Category: Ethics and Conduct

Conduct Standards

Also known as: Standards of Conduct, Code of Conduct, Standards of Ethical Conduct

Simply put

Conduct standards are the behavioral and ethical expectations an organization sets for the people who work within it, describing how they should act when carrying out their duties. They are typically expressed through a code of conduct or similar document that conveys the organization's commitment to responsible practice and guides day-to-day decision-making. They serve as a reference point for what the organization considers acceptable behavior.

Formal definition

Conduct standards are articulated principles and rules of expected behavior that govern the conduct of individuals associated with an organization, commonly set out in a code of conduct or a set of ethical standards. In the corporate context they typically communicate an entity's commitment to responsible and ethical practice and provide a framework to guide decision-making by employees, officers, and other covered persons. Their content, binding force, and enforcement mechanisms vary by sector, jurisdiction, and entity type: some are voluntary internal standards adopted by an organization, while others, such as government ethics standards for public officials, may be grounded in law or regulation. As a governance and compliance instrument, conduct standards generally sit within management's responsibility to establish and communicate, with board or committee oversight of the broader ethics and compliance program; this entry does not address the specific legal requirements applicable to any particular regime.

Why it matters

Conduct standards translate an organization's stated values into concrete behavioral expectations, giving employees, officers, and other covered persons a reference point for how to act when carrying out their duties. Without a clearly articulated code, expectations can remain implicit and inconsistent, leaving individuals to interpret acceptable behavior on their own and making it harder for an organization to demonstrate a genuine commitment to responsible practice. A well-communicated set of standards helps align day-to-day decision-making with the organization's ethical posture and provides a shared basis for evaluating conduct.

The significance of conduct standards depends heavily on their binding force, which varies by sector, jurisdiction, and entity type. Some standards are voluntary internal instruments an organization chooses to adopt, while others, such as ethics standards for government officials, may be grounded in law or regulation and carry consequences for non-compliance. Understanding whether a given set of standards is a voluntary commitment or a legal requirement is essential before drawing conclusions about enforceability or exposure.

As a governance and compliance instrument, conduct standards sit within a broader ethics and compliance program. Their value is realized less through the document itself than through how it is communicated, reinforced, and applied. Because this entry is educational and general, the specific obligations, enforcement mechanisms, and consequences applicable to any particular regime should be assessed against the relevant law, regulation, and the organization's own facts.

Who it's relevant to

Boards and Board Committees

Boards and their designated committees generally hold oversight responsibility for the broader ethics and compliance program within which conduct standards sit. Their role is typically to satisfy themselves that appropriate standards exist and are being maintained, rather than to draft or administer them directly.

Chief Compliance and Ethics Officers

Compliance and ethics leaders are commonly involved in developing, communicating, and reinforcing conduct standards as part of management's responsibility to establish them. They help ensure the code guides day-to-day decision-making and functions as an effective component of the wider compliance program.

Management and Employees

Management typically owns the operational work of establishing and communicating conduct standards, while employees, officers, and other covered persons are the audience whose behavior the standards are intended to guide. The code serves as their reference point for what the organization considers acceptable conduct.

Public Officials and Regulated Professionals

In some contexts, conduct standards are grounded in law or regulation rather than adopted voluntarily. Government officials subject to ethics standards, and professionals subject to standards set by professional bodies, may face conduct expectations with binding force; the specific requirements depend on the applicable regime.

Inside Conduct Standards

Code of Conduct

A foundational document that articulates the behavioral expectations, ethical principles, and values an organization expects of its directors, officers, and employees. It is typically a management-owned instrument approved or endorsed by the board, and while listing rules in many jurisdictions expect listed entities to maintain one, its specific content is generally shaped by the organization rather than prescribed in detail.

Policies and Procedures

The operational documents that translate high-level conduct principles into concrete requirements, such as anti-bribery, conflicts of interest, gifts and hospitality, and confidentiality policies. Ownership generally sits with management and relevant control functions, which are responsible for design and day-to-day implementation.

Regulatory Conduct Expectations

Standards imposed by law, regulation, or listing rules governing how a firm and its personnel must behave, which vary by jurisdiction, sector, and entity type. In certain regimes, conduct requirements are set out in binding rulebooks; in others, expectations are expressed through principles-based guidance rather than detailed prescription.

Ethical Values and Culture

The shared norms and tone that shape decision-making beyond the letter of any rule. Culture is generally regarded as a matter of board oversight and management stewardship; the board typically sets and monitors tone at the top while management embeds it operationally.

Monitoring and Enforcement Mechanisms

Processes for detecting, escalating, investigating, and remediating conduct breaches, including speak-up channels, disciplinary frameworks, and reporting lines. Compliance monitoring of adherence is typically a compliance-function activity, while independent assurance over the design and operating effectiveness of these mechanisms generally falls to internal audit.

Accountability and Reporting

The allocation of responsibility for conduct outcomes across the organization and the flow of information to senior management and the board. This clarifies where operational ownership sits with management and where oversight responsibility sits with the board or a designated committee.

Common questions

Answers to the questions practitioners most commonly ask about Conduct Standards.

Are conduct standards the same thing as a code of conduct?

Not exactly. A code of conduct is typically a formal document that articulates expected behaviors, while conduct standards is the broader concept encompassing the norms, expectations, and behavioral principles an organization sets for how people act. A code is one common way of expressing conduct standards, but the standards themselves may also be reflected in policies, values statements, and supervisory expectations. The relationship and terminology can vary by organization, so it is worth confirming how a given entity defines each term.

Does having conduct standards mean compliance owns responsibility for how employees actually behave?

No. Accountability for conduct generally sits with management and, ultimately, individual employees who carry out day-to-day activities, with board-level oversight of culture and tone. Compliance and other assurance functions typically help design, communicate, monitor, and report on conduct standards, but ownership of behavior itself is not the same as ownership of the monitoring function. Conflating the two blurs the distinction between operational responsibility held by the business and oversight or assurance responsibilities held elsewhere. The precise allocation depends on the organization's structure and its approach to the lines of defense.

Who should be involved in setting and approving conduct standards?

In many organizations, management develops conduct standards while the board or a relevant committee provides oversight and, where appropriate, approval, particularly for standards tied to culture and tone at the top. Legal, compliance, human resources, and risk functions often contribute to drafting and reviewing standards. The specific approval path depends on the entity type, governance framework, and any applicable requirements, so organizations generally document who holds drafting, review, approval, and oversight roles.

How can conduct standards be communicated effectively across an organization?

Effective communication generally combines clear documentation with reinforcement through training, leadership messaging, and integration into everyday processes such as onboarding and performance management. Making standards accessible, using concrete examples, and providing channels to raise questions or concerns are commonly cited practices. The appropriate approach depends on organizational size, workforce composition, and jurisdictional considerations, and organizations typically tailor communication accordingly. This is a general description of practice rather than a prescriptive requirement.

How is adherence to conduct standards typically monitored?

Monitoring often involves a combination of methods, which may include supervisory review, metrics, surveys, reporting channels, and periodic assessment by assurance functions. It is useful to distinguish the design of monitoring activities from their operating effectiveness, since standards that look robust on paper may not function as intended in practice. Ownership of routine monitoring generally sits within the business and compliance function, while independent assurance may provide additional review. The mix of methods depends on the organization's risk profile and resources, and this entry does not prescribe a specific monitoring model.

What role do conduct standards play when a potential breach occurs?

Conduct standards generally provide a reference point against which reported or observed behavior can be assessed, supporting consistent handling of concerns. Organizations typically pair standards with defined processes for reporting, investigating, and responding to potential breaches, often involving human resources, legal, and compliance functions as appropriate. How a specific matter is handled depends on the facts, applicable law, internal policies, and professional judgment. This entry is educational and does not constitute legal, audit, or compliance advice on any particular situation.

Common misconceptions

A code of conduct is a legally mandatory document that every organization must adopt in the same form.

Whether an organization must maintain conduct standards, and in what form, generally depends on jurisdiction, sector, and entity type. In many jurisdictions listing rules expect listed companies to have a code, but content is largely a matter for the organization, and non-listed or smaller entities may face different or no formal requirements. Some elements are binding law while others reflect voluntary best practice.

The board is responsible for implementing and enforcing conduct standards day to day.

The board typically holds an oversight role, setting tone at the top and monitoring culture and conduct outcomes, while management generally owns the design, implementation, and enforcement of policies and procedures. Attributing operational execution to the board, or oversight duties to management, misstates where accountability sits.

If conduct policies are well drafted, the organization has effective conduct standards.

A well-designed policy addresses only control design; it does not demonstrate operating effectiveness. Standards may exist on paper yet fail in practice if they are not embedded, monitored, and enforced. Assessing whether controls actually operate as intended is a separate exercise, generally within the remit of assurance functions.

Best practices

Clearly delineate ownership so that management is accountable for designing and implementing conduct policies, while the board or a designated committee retains oversight of culture, tone at the top, and conduct outcomes.

Map conduct requirements against the applicable legal, regulatory, and listing-rule obligations for your jurisdiction, sector, and entity type, and distinguish binding requirements from voluntary codes and frameworks you choose to adopt.

Translate high-level conduct principles into specific, operational policies and procedures, and periodically test both control design and operating effectiveness rather than assuming that documented standards are functioning.

Maintain accessible speak-up and escalation channels together with a consistent, proportionate disciplinary framework, so that breaches are detected, investigated, and remediated in a documented manner.

Establish reporting that gives senior management and the board timely, meaningful information on conduct indicators, breaches, and remediation, keeping management's monitoring role distinct from independent assurance provided by internal audit.

Review conduct standards on a defined cycle and following significant regulatory, business, or cultural changes, treating outputs as educational inputs to be validated against professional judgment and, where appropriate, legal or compliance advice.