Skip to main content
Governance Authority
Category: Ethics and Conduct

Codes of Business Conduct

Also known as: Code of Business Conduct and Ethics, Code of Conduct, Code of Ethics and Business Conduct, Code of Conduct and Business Ethics
Simply put

A code of business conduct is a document in which an organization sets out the standards and principles it expects people to follow in how they behave and do business. It typically aims to promote honest and ethical conduct and to discourage wrongdoing. Such codes generally apply broadly across an organization, often covering employees, officers, directors, and sometimes contractors and business partners.

Formal definition

A code of business conduct is a formal statement of the behavioral standards, principles, and expectations that govern an organization's conduct and articulate its commitment to responsible practice. Codes typically state purposes such as deterring wrongdoing and promoting honest and ethical conduct, and they generally define a scope of covered persons that may include directors, officers, employees, contract workers, agents, and business partners. The specific content, scope, and whether a code is legally required versus adopted voluntarily vary by jurisdiction, sector, and entity type; for many listed companies certain listing or regulatory regimes call for adoption of such a code, but the evidence here does not establish those particular requirements. A code of conduct is generally a governance and compliance instrument owned and adopted at the organizational level (often approved by the board), while day-to-day implementation, monitoring, and enforcement typically sit with management and compliance functions. This entry is educational and not legal, audit, or compliance advice.

Why it matters

A code of business conduct sets the tone for how an organization expects people to behave, translating broad commitments to honest and ethical conduct into a documented standard that covered persons can reference. By articulating the standards that govern an organization's conduct and conveying its commitment to responsible practice, a code helps deter wrongdoing and gives employees, officers, directors, and often contractors and business partners a shared understanding of what is and is not acceptable. Without such a document, expectations may remain implicit and inconsistently understood across the organization.

Codes also serve a governance function: they are typically adopted at the organizational level, often with board approval, and signal to internal and external stakeholders that the organization has articulated behavioral expectations formally rather than leaving them to individual judgment. The scope of who is covered varies, some codes explicitly extend to directors, officers, employees, contract workers, agents, and business partners, so the breadth of a code shapes how far its standards reach into an organization's operations and relationships.

It is important to note that a code is a statement of standards, not a guarantee of behavior. Whether a code is legally required or voluntarily adopted, and what specific content it must contain, varies by jurisdiction, sector, and entity type. The existence of a code does not, on its own, establish that it is effectively implemented, monitored, or enforced; those are separate matters that depend on management and compliance execution.

Who it's relevant to

Boards and Directors
Boards are frequently responsible for adopting a code of business conduct and for overseeing its role within the organization's governance framework. In many organizations, directors are themselves covered by the code's standards. The board's function is generally oversight and approval rather than day-to-day enforcement.
Chief Compliance and Ethics Officers
Compliance functions typically own the practical implementation of a code, including communication, monitoring, and enforcement of its standards. They translate the code's principles into operational practice and address potential violations.
Management and Employees
Codes generally set standards for the business behavior of all employees and officers, with some codes stating that everyone in the organization is expected to follow their principles. Management is typically responsible for applying the code in daily operations and modeling the expected conduct.
Contractors, Agents, and Business Partners
Some codes explicitly extend their scope to contract workers, agents, and business partners, meaning the organization's behavioral standards may reach beyond its direct workforce. The extent of this coverage varies by organization and by the terms of the code itself.
General Counsel and Legal Teams
Legal teams are often involved in drafting and reviewing codes to align them with the organization's obligations and stated commitments. Whether a code is legally required or voluntarily adopted varies by jurisdiction, sector, and entity type, and legal input helps clarify that distinction.

Inside Codes of Business Conduct

Core Values and Guiding Principles
A statement of the organization's ethical values and expected standards of behavior that set the tone for how the entity conducts business. This section is generally aspirational and principles-based rather than a set of enforceable legal rules, though it often anchors the more specific provisions that follow.
Conflicts of Interest Provisions
Guidance on identifying, disclosing, and managing situations where personal interests may compromise judgment or duties owed to the organization. The scope of what must be disclosed and to whom typically varies by entity type, sector, and jurisdiction.
Anti-Corruption and Gifts/Hospitality Standards
Expectations regarding bribery, facilitation payments, and the giving or receiving of gifts and entertainment. Where these overlap with binding anti-bribery statutes, the code generally operationalizes legal requirements, but specific thresholds and prohibitions depend on applicable law in each jurisdiction.
Compliance with Laws and Regulations
A general commitment to observe applicable legal and regulatory requirements. The code typically signals which behaviors are legally mandated versus which reflect voluntary standards the organization has chosen to adopt.
Handling of Confidential Information and Assets
Provisions on protecting proprietary, personal, and third-party data, and on the proper use of company property and resources. The applicable data protection obligations depend on the relevant regime and the nature of the information involved.
Reporting Mechanisms and Non-Retaliation
Description of channels for raising concerns, such as speak-up or whistleblowing lines, and a commitment against retaliation. Whether particular reporting protections are legally required generally depends on jurisdiction, sector, and entity type.
Consequences and Accountability
A statement that violations may result in disciplinary action, clarifying that the code applies to defined populations such as employees, officers, and in some cases third parties. Enforcement of the code is typically a management responsibility, with the board or a committee providing oversight.

Common questions

Answers to the questions practitioners most commonly ask about Codes of Business Conduct.

Is a code of business conduct a legally binding document that itself imposes obligations under law?
Not typically. A code of business conduct is generally an internal governance instrument adopted voluntarily by an organization, rather than a source of binding law in its own right. That said, its status can vary by jurisdiction, sector, and entity type. In some settings, listing rules or regulations require certain issuers to adopt a code or to disclose whether they have one, and a code may reference underlying legal duties. Provisions of a code can also acquire legal significance through employment terms, contractual incorporation, or as evidence of an organization's standards. Whether any particular obligation is enforceable depends on the facts and applicable law, and this entry is educational rather than legal advice.
Does adopting a code of business conduct mean compliance is now handled and the board can consider the matter closed?
No. Adopting a code is generally a starting point rather than a conclusion. A code sets out expected standards, but it does not by itself establish that controls are designed appropriately or operating effectively, nor does it substitute for training, monitoring, reporting channels, investigation processes, and periodic review. Under many governance frameworks, the board or a relevant committee retains oversight responsibility for the ethical tone and the effectiveness of the compliance program, while management typically owns the operational task of implementing, communicating, and enforcing the code. Treating adoption as the end of the process conflates having a policy with achieving its objectives.
Who within an organization typically owns the code of business conduct?
Ownership is generally split by function. Under many governance arrangements, the board or a designated committee provides oversight of the code and the ethical culture it reflects, while management is typically accountable for drafting, maintaining, communicating, and enforcing it day to day. The compliance function often serves as the operational custodian, coordinating updates, training, and monitoring, though specific allocations vary by organization size, sector, and structure. Assurance functions such as internal audit generally evaluate the effectiveness of the arrangements rather than owning the code themselves. Clarifying these distinct roles helps avoid attributing operational duties to the board or oversight duties to management.
How often should a code of business conduct be reviewed and updated?
There is no single universally mandated frequency; the appropriate cadence depends on the organization, its risk profile, and applicable requirements or framework expectations. In practice, many organizations review their code periodically and also on a triggered basis, for example following significant regulatory change, a merger or restructuring, entry into a new market, or lessons learned from an incident or investigation. Assigning clear responsibility for scheduling and documenting reviews helps ensure the code remains current. Organizations subject to specific rules should confirm any review or disclosure expectations that apply to them.
How can an organization assess whether its code is operating effectively rather than merely existing on paper?
Effectiveness is generally evaluated by looking beyond the document to how it functions in practice. This often draws on the distinction between control design and operating effectiveness: whether the code and supporting processes are designed to address relevant risks, and whether they actually work as intended over time. Indicators organizations commonly consider include awareness and training completion, use of reporting or whistleblowing channels, the handling and outcomes of reported concerns, and management and board reporting. Assurance activity, such as review by internal audit, can provide independent evaluation. What constitutes sufficient evidence depends on the organization's circumstances and professional judgment.
How should a code of business conduct relate to an organization's other policies and frameworks?
A code typically functions as a high-level statement of expected conduct and values, with more detailed policies and procedures sitting beneath it to address specific topics. Organizations generally aim for consistency so that the code and subordinate policies do not conflict, and clear cross-references can help users navigate from principle to procedure. Some organizations map their code to relevant governance or risk frameworks they have chosen to apply, but such frameworks are not universally mandatory and their use should be described accurately. Integrating the code coherently with the broader control environment supports its practical application, while the specific structure remains a matter of organizational design and judgment.

Common misconceptions

A code of business conduct is itself legally binding law.
A code is generally an internal, entity-adopted standard rather than a statute, regulation, or listing rule. While a code may incorporate or reference binding legal obligations, and while certain regimes may require regulated entities to maintain a code, the document itself is typically a voluntary governance instrument whose specific requirements vary by jurisdiction, sector, and entity type. Entries here are educational and not legal advice.
Having a well-written code demonstrates that the compliance program is effective.
The existence of a code speaks to control design, not operating effectiveness. A code that is not communicated, trained on, monitored, and enforced may function poorly in practice. Assurance over whether the code operates as intended is generally distinct from the act of drafting or adopting it.
The board is responsible for administering and enforcing the code day to day.
Administering, training on, and enforcing the code is typically a management responsibility. The board, often through a designated committee, generally exercises oversight of the code and the tone at the top rather than performing operational enforcement itself.

Best practices

Clearly distinguish within the code which provisions restate binding legal obligations and which reflect the organization's voluntary ethical standards, and note that specific requirements may differ by jurisdiction, sector, and entity type.
Assign ownership explicitly: designate management functions responsible for administering, training on, and enforcing the code, while reserving oversight of the code to the board or an appropriate committee.
Support the code with accessible reporting channels and a clearly stated non-retaliation commitment so that concerns can be raised and addressed.
Move beyond design to operating effectiveness by communicating the code to all covered populations, delivering periodic training, and monitoring adherence rather than relying on the document alone.
Review and refresh the code on a regular cadence and in response to significant changes in the organization's operations, risk profile, or applicable legal and regulatory environment.
Where the code addresses areas such as conflicts of interest, gifts and hospitality, or anti-corruption, align its provisions with applicable law and seek qualified legal or compliance input rather than treating the code as a substitute for professional advice.