Code of Conduct

A code of conduct gives you and your employees a shared standard for responsible behaviour at work. It explains what your organisation expects, which actions are unacceptable and where someone can go for guidance or support. In other words, it turns broad values such as integrity, respect and accountability into practical rules that you can use in everyday situations.

That makes the document far more than an administrative formality. When you write it clearly, communicate it well and apply it consistently, your code can strengthen trust, guide difficult decisions and reduce legal, ethical and reputational risks. It can also help you create a workplace in which employees know that the same standards apply to everyone, regardless of role, location or seniority.

In this guide, you will learn what a code of conduct means, why you need one and which subjects it should cover. You will also discover how you can develop, implement and maintain a code that works in practice, including across remote teams and international workplaces.

What is a code of conduct?

A code of conduct is a formal document that defines the behaviour you expect from people who work for or represent your organisation. It usually applies to employees and managers, but you can also extend it to directors, temporary workers, contractors, interns, volunteers, suppliers and other business partners.

Your code translates your mission and values into specific guidance. A commitment to respect, for example, becomes a rule against harassment, discrimination and intimidation. A commitment to integrity may lead to requirements concerning accurate records, conflicts of interest, gifts, bribery and the use of company resources. A commitment to confidentiality becomes practical instructions for protecting personal, commercial and payroll data.

The code should help someone answer a simple question: “What should you do in this situation?” It therefore needs more substance than a list of inspiring words. You should describe expected conduct, prohibited conduct, reporting routes and possible consequences. You should also explain where the rules apply. Modern work does not stop at the office door, so your scope may include remote work, business travel, company events, messaging platforms, social media and contact with customers or suppliers.

You will often include the code in your employee handbook or policy portal. However, the format matters less than accessibility. Employees need to be able to find, understand and use it when a real issue arises.

Why is a code of conduct important?

Without written standards, employees have to interpret unwritten rules. One manager may accept behaviour that another manager challenges. A new employee may not know how you expect them to handle a supplier’s gift, a colleague’s confidential information or an offensive comment in a group chat. That uncertainty can damage trust and produce inconsistent decisions.

A strong code gives you a common reference point. It can help you:

• make acceptable and unacceptable behaviour clear;
• connect everyday decisions to your values and culture;
• promote a safe, respectful and inclusive workplace;
• support compliance with relevant laws and industry rules;
• prevent conflicts of interest, fraud, bribery and misuse of information;
• give employees safe routes for asking questions and reporting concerns;
• respond to comparable cases in a more consistent way;
• protect relationships with customers, suppliers and other stakeholders; and
• show candidates and employees what your organisation stands for.

The code also supports better decision-making. You cannot predict every ethical dilemma, but you can give employees principles, examples and questions that help them pause before acting. If an employee is unsure whether a personal relationship creates a conflict, for instance, your code can tell them to disclose the situation rather than hide it. If someone receives confidential payroll information by mistake, the code can direct them to report the incident and avoid sharing the data.

Do not assume that the document itself will change behaviour. Its credibility comes from what you do with it. If leaders ignore the rules, employees will notice. If reports disappear into a black box or high performers receive special treatment, your written promises will quickly lose their value. Your actions must support your words.

Code of conduct versus code of ethics

You may see “code of conduct” and “code of ethics” used as if they mean the same thing. The two concepts overlap, but they usually serve different purposes.

A code of ethics describes the principles that should guide judgement. It explains why values such as honesty, fairness, independence or respect matter. A code of conduct is more specific. It explains how you expect someone to behave and which actions cross the line.

You can think of ethics as the direction and conduct as the route. “You should act with integrity” is an ethical principle. “You must disclose a financial interest in a supplier before taking part in a purchasing decision” is a conduct rule. The first shapes judgement; the second gives an observable instruction.

You do not always need two separate documents. You can combine principles and rules in one code, provided you make the relationship clear. Start with the value, explain why it matters and then show what it requires in practice. This structure keeps your code meaningful without leaving employees to guess how abstract ideals apply to their work.

What should you include in a code of conduct?

Your content should reflect your workforce, industry, locations and risk profile. A small professional services firm will not need exactly the same rules as an international manufacturer, healthcare provider or payroll processor. Even so, most effective codes cover the following subjects.

Purpose, scope and responsibilities

Begin by explaining why the code exists and who must follow it. State whether it applies during working hours only or in every work-related setting, including digital communication and external events. Make clear that managers and senior leaders are covered too. You can then describe the additional responsibility managers have to model the standards, respond to concerns and seek help instead of improvising an investigation.

Values and professional behaviour

Connect the code to your mission and core values, but use concrete language. Explain what professionalism, honesty and accountability look like in your organisation. You might expect employees to communicate respectfully, keep commitments, record information accurately, take responsibility for mistakes and cooperate with legitimate reviews or audits.

Respect, equality and inclusion

State that you do not accept discrimination, harassment, bullying, sexual harassment, victimisation or retaliation. Give accessible examples without suggesting that your list is exhaustive. Cover behaviour in person and through email, chat, video calls, social media or other digital channels. Employees should know that an informal setting or an attempted joke does not automatically make harmful conduct acceptable.

Health, safety and wellbeing

Explain each person’s responsibility for a safe workplace. Depending on your activities, this may include reporting hazards, following equipment procedures, avoiding violence and threats, and complying with rules on alcohol or drugs. You should also tell employees what to do when there is an immediate danger and where they can find the detailed safety policy.

Conflicts of interest, gifts and anti-bribery

Define a conflict of interest and require disclosure when personal interests could influence, or appear to influence, a business decision. Address outside employment, family relationships, investments, gifts, hospitality and dealings with public officials where relevant. Practical thresholds and approval routes are more useful than a vague instruction to “use common sense”.

Confidentiality, privacy and data protection

Tell employees how you expect them to protect personal and business information. This is especially important when you process HR and payroll data, because salary details, bank information, tax identifiers, absence records and other personal data can be highly sensitive. Cover access controls, secure sharing, clean-desk practices, phishing, personal devices and the reporting of suspected data incidents. Link to your detailed privacy and security policies rather than trying to reproduce every technical requirement in the code.

Company assets and accurate records

Explain how employees may use equipment, systems, funds, intellectual property and working time. Set expectations for expense claims, financial records, payroll changes and other transactions. Accuracy matters. Your code should prohibit theft, falsification, deliberate misclassification and the unauthorised use or removal of company assets.

Communication, social media and artificial intelligence

Your standards should apply to public statements and online behaviour where there is a genuine connection to work. Explain who may speak on behalf of your organisation and how employees should protect confidential information online. If employees use generative AI, define permitted tools and tasks, human-review requirements and rules for personal or confidential data. You should also address accuracy, intellectual property, bias and transparency. A blanket sentence about “responsible AI” will rarely give employees enough direction.

Customers, suppliers and communities

Describe how you expect employees to deal with people outside your organisation. You may cover fair competition, honest marketing, service standards, supplier due diligence, human rights, environmental commitments and responsible sourcing. If third parties must meet equivalent standards, explain how you select, contract with and monitor them.

Speaking up, non-retaliation and consequences

Employees need to know how they can ask a question or report a suspected breach. Offer more than one channel where possible, particularly when a concern involves someone’s direct manager. Explain the options for confidential or anonymous reporting, together with any practical limits. State clearly that you prohibit retaliation against someone who raises a concern in good faith or participates in an investigation.

Finally, describe the consequences of a substantiated violation. These may range from coaching or a warning to suspension, dismissal or termination of a commercial relationship, depending on the facts and applicable law. Avoid promising an automatic outcome before you have investigated the case fairly.

Practical code of conduct examples

Rules become easier to understand when you add short, realistic scenarios. Imagine that a supplier offers you an expensive weekend trip shortly before a contract decision. Your code should tell you not to accept it secretly; you should disclose the offer and follow the approval process. The concern is not limited to proven bribery. The appearance that a benefit could influence your judgement can also undermine trust.

Now imagine that you accidentally receive a spreadsheet containing salaries for employees outside your team. You should not browse the file or forward it to a colleague. You should close it, report the access error through the designated channel and follow any instructions for secure deletion. This example turns a general promise of confidentiality into a clear response.

In another situation, a colleague repeatedly comments on someone’s accent during video calls after being asked to stop. The fact that the team works remotely does not place the conduct outside your rules. You should document and report the concern using an available channel. Your organisation should assess it promptly, protect the people involved and prevent retaliation.

Examples should illuminate the rule, not replace it. Include enough variety to reflect the decisions employees genuinely face, and make clear that materially similar conduct is covered even when the exact scenario does not appear in the document.

How do you create an effective code of conduct?

You can use the following process to turn a generic policy into a practical workplace tool.

1. Identify your risks and requirements

Review past incidents, grievances, audit findings, employee feedback and sector-specific obligations. Consider how your business model, locations, systems and working arrangements create risk. If you process payroll across borders, for example, data access, confidentiality, local employment rules and secure transfers deserve particular attention.

2. Involve the right people

HR may coordinate the work, but you should involve leadership, legal or compliance specialists, information security, employee representatives and people from different functions and locations. Their input helps you spot gaps and write examples that make sense in daily work. Legal advice is particularly important when rules or sanctions may affect employment rights.

3. Define your principles and observable standards

Choose the values that genuinely guide your organisation. For each value, ask what employees should do, what they must not do and when they should seek advice. Use specific verbs. “Disclose,” “protect,” “report” and “obtain approval” provide more direction than “be good” or “act appropriately”.

4. Write in plain, inclusive language

Keep sentences direct and explain technical terms. Avoid legalistic wording where ordinary language is accurate. Employees should be able to understand the code without specialist knowledge. You should also make the document usable for people with disabilities and provide reliable translations for employees who do not work comfortably in the source language.

5. Add examples and decision support

Use scenarios drawn from your real risk areas. You can also give employees a short decision test: Is the action legal? Does it fit your values? Would you be comfortable if it became public? Could it harm an employee, customer or partner? Do you need approval or expert advice? A test cannot replace a clear rule, but it can help when the code does not address every detail.

6. Design a fair reporting and response process

Define who receives reports, how you triage urgent safety risks, who investigates and how you manage conflicts of interest. Explain confidentiality carefully; promise discretion to the extent possible, not absolute secrecy that you may be unable to maintain. Build in non-retaliation measures, documentation standards and an escalation route.

7. Check consistency with contracts and policies

Your code should work alongside employment contracts, collective agreements, disciplinary procedures, whistleblowing arrangements, privacy notices and local policies. Contradictions create confusion and legal risk. Make it clear which document provides detailed procedures and what happens if local law requires a different approach.

8. Obtain visible leadership approval

Leadership endorsement should mean more than a signature on the first page. Leaders need to discuss the code, follow it themselves and accept scrutiny when a concern involves them. If employees see exceptions for senior or commercially valuable people, they will conclude that your standards are optional.

9. Test the draft before launch

Ask a representative group to find information and interpret several scenarios. Can they identify the correct reporting channel? Do translations preserve the intended meaning? Are the examples culturally clear? Testing reveals ambiguity that the drafting team may no longer see.

10. Publish, train and record acknowledgement

Make the current version easy to find in your HR system, intranet or policy portal. Introduce it during onboarding and use scenario-based training for higher-risk topics. You may ask employees to acknowledge receipt, but a recorded click does not prove understanding. Combine acknowledgement with opportunities to ask questions and with periodic refreshers.

How do you implement the code in everyday work?

Implementation begins after publication. Refer to the code in team discussions, manager training, performance expectations and relevant business decisions. Give managers practical guidance on how to receive a report without judging it prematurely or promising an outcome. Employees should see the code as a resource they can use before a problem escalates, not only as a disciplinary document.

Your systems can support this work. You can use an HR platform to publish the current version, assign training and maintain version-controlled acknowledgement records. You can also track cases and deadlines with appropriately restricted access. Be careful, though. Sensitive reports should not become an unrestricted dashboard, and access should follow a genuine need-to-know principle.

For an international workforce, keep a global core while adapting procedures to local law. Your central values may stay consistent, but reporting routes, investigation rights, employee representation, privacy requirements and disciplinary steps can differ by country. Use qualified local advice and professional translation. A literal translation may fail to convey the practical meaning of retaliation, harassment or a conflict of interest.

What happens when someone breaches the code of conduct?

When you receive a report, first consider immediate safety, wellbeing and the risk that evidence could disappear. You may need temporary protective measures, but you should avoid treating those measures as proof of wrongdoing. Decide who can handle the matter impartially and tell the relevant people what they can expect from the process.

You should then gather and assess evidence fairly. That may include interviews, documents, system records or messages, subject to privacy and employment rules. Give the person accused enough information and a reasonable opportunity to respond. Keep records, limit disclosure and watch for retaliation or attempts to influence witnesses.

If the evidence establishes a breach, choose a proportionate response under your policies and applicable law. Consider the seriousness of the conduct, actual or potential harm, intent, previous incidents, consistency with comparable cases and any mitigating or aggravating circumstances. A minor first-time lapse may call for coaching or a warning. Fraud, violence or serious harassment may justify much stronger action, potentially including dismissal. You should not use seniority, revenue or reputation as a reason to overlook misconduct.

If a report is not substantiated, that does not necessarily mean it was false or malicious. It may mean that the available evidence does not support a finding. Protect employees who raise genuine concerns, communicate the outcome as far as confidentiality allows and look for broader lessons. A case can reveal unclear wording, weak controls or a need for better training even when you do not find an individual breach.

Is a code of conduct legally binding?

The answer depends on your wording, how you introduce the code, its relationship with employment terms and the law in each relevant jurisdiction. A code may create contractual obligations in some circumstances, while in others it operates primarily as an internal policy. Certain subjects within it may also reflect legal duties that apply independently of the code.

Do not present the document as a substitute for legal advice or due process. You should have the code reviewed for the countries in which you use it, especially if you link breaches to disciplinary action. Follow applicable consultation, employee-representation, privacy and notification requirements. Most importantly, apply your procedure fairly and consistently. A written rule does not give you unlimited discretion.

How often should you review your code of conduct?

Treat your code as a living document. Review it on a regular schedule, often annually, and whenever a material change affects your risks. A legal development, acquisition, new country, new technology, serious incident or change in working arrangements may justify an earlier review.

Look beyond the number of reports. A very low figure could indicate a healthy culture, but it could also mean that employees do not trust the process. Use several indicators, such as training completion, employee awareness, confidence in speaking up, response times, repeat issues and patterns by topic or location. Analyse trends without exposing individuals or encouraging managers to suppress reports.

After you update the code, show employees what changed and why. Replace outdated versions, refresh training where necessary and request a new acknowledgement when appropriate. This keeps the document visible and prevents different teams from relying on conflicting rules.

Common mistakes to avoid

Your code will struggle to influence behaviour if it is copied from another organisation, overloaded with legal jargon or disconnected from your actual culture. Other common mistakes include offering only one reporting route, failing to protect reporters from retaliation, using vague rules without examples and allowing leaders to avoid consequences.

You should also avoid treating every concern as a disciplinary matter. Employees need room to ask honest questions, admit mistakes and seek advice. At the same time, an overly aspirational code without enforcement can become empty branding. The balance is clear standards, accessible support, impartial investigation and proportionate action.

Finally, do not confuse completion metrics with effectiveness. A 100% acknowledgement rate tells you that employees clicked or signed. It does not tell you whether they understand the rules, trust the reporting process or believe leaders will act consistently. Ask better questions and examine real outcomes.

A clear standard supported by consistent action

A code of conduct helps you turn organisational values into visible, practical behaviour. It gives employees direction, supports managers when difficult situations arise and shows customers and partners that integrity matters to you. Yet the value of the code does not come from its length or polished design.

You make it credible when you involve the right people, use plain language, provide realistic examples and build a fair process around it. Keep the code accessible. Train employees, protect people who speak up, investigate impartially and hold leaders to the same standards as everyone else. When you do that consistently, your code of conduct becomes more than a rulebook. It becomes part of how you earn trust and how you work.