Policy required document Workplace
Code of Conduct and Business Ethics Policy
A code of conduct states the standards the company expects of everyone who works for it: honesty in records and dealings, how conflicts of interest are handled, gifts and payments, confidentiality, fair treatment, compliance with law, and how to raise a concern. Three regimes name the document.
Public companies must disclose whether they have adopted a code of ethics for the principal executive, financial and accounting officers, and explain why if not (Regulation S-K, Item 406); the exchanges go further and require a code for all directors, officers and employees.
Federal contractors with a contract expected to exceed $7.5 million and a performance period of 120 days or more must have a written code of business ethics and conduct within 30 days of award and give a copy to each employee working on the contract (FAR 52.203-13).
And the federal Sentencing Guidelines make an effective compliance and ethics program, of which written standards of conduct are the first element, a factor that reduces an organization's fine if it is ever prosecuted (USSG 8B2.1).
For everyone else the code is the parent document that the more specific policies hang from. A harassment policy, a confidentiality policy and a whistleblower policy each cover one topic; the code is where the company says, once, what it stands for and what happens when someone falls short.
It matters in litigation because it is the standard the company is held to: an employee fired for an ethics breach the code named is an easy case, and one fired for conduct the code never mentioned is a harder one. It also matters to customers, investors and acquirers, who now ask for it as routinely as they ask for financial statements.
Obligation ledger
Who requires it, and what each one says.
| Source | Applies when | What it requires | Status |
|---|---|---|---|
| SEC Regulation S-K, Item 406, code of ethics 17 CFR 229.406 | Companies filing annual reports with the SEC | Disclose whether the company has adopted a code of ethics applying to its principal executive officer, principal financial officer, principal accounting officer or controller, and if not, why not; the code must be written standards reasonably designed to deter wrongdoing and promote honest and ethical conduct, full and fair disclosure, compliance with law, prompt internal reporting of violations and accountability; file it, post it, or provide it on request. Legally required. | Mandatory |
| FAR, Contractor Code of Business Ethics and Conduct 48 CFR 52.203-13; FAR 3.1004 | Federal contracts expected to exceed $7.5 million with a performance period of 120 days or more, and subcontracts at the same threshold | Within 30 days of award, a written code of business ethics and conduct, a copy available to each employee engaged in the contract, due diligence to prevent and detect criminal conduct, a culture that encourages ethical conduct, timely written disclosure to the agency Inspector General of credible evidence of certain violations, and, other than for small businesses and commercial products, an ongoing awareness program and internal control system. Legally required. | Mandatory |
| U.S. Sentencing Guidelines, effective compliance and ethics program USSG 8B2.1 | Any organization sentenced in federal court | Standards and procedures to prevent and detect criminal conduct, oversight by the governing authority, specific high-level responsibility, reasonable efforts not to place people with a history of misconduct in positions of authority, communication and training, monitoring and auditing with a reporting system, consistent enforcement, and response to detected conduct. An effective program reduces the culpability score and the fine. | Implied |
Required sections
- A statement of the company's values and the expectation that everyone follows the law and the code
- Conflicts of interest: what they are, the duty to disclose, and who decides (cross-referenced to the conflict of interest policy)
- Gifts, entertainment, payments and anti-bribery, with limits and approval routes, and the FCPA rule where the company does business abroad
- Accurate books and records, and the prohibition on falsifying any record
- Confidential information and trade secrets, cross-referenced to that policy
- Fair treatment, equal opportunity and anti-harassment, cross-referenced
- Protecting company assets and acceptable use of systems, cross-referenced
- Dealing with customers, suppliers, competitors and government officials, including antitrust basics
- How to report a concern, the routes available, and the promise of no retaliation, cross-referenced to the whistleblower policy
- How violations are investigated and the consequences, and who may grant a waiver (for public companies, waivers for senior officers must be disclosed)
- Acknowledgment on hiring and annually
What the examiner asks for
What changed
Change log.
Frameworks
Where this document is required.
Need a hand implementing it?
Find a Consultant for Code of Conduct and Business Ethics Policy
Tell us what you need done and we will point you to firms that do this work. Your details go to a firm only when you choose it.
From the publisher
Manage This Document in AllyMatter
Route it for approval, keep every version, and record a named acknowledgment from everyone who has to read it.
Questions
What people ask.
Is a code of conduct legally required for a private company?
Not by statute, unless you hold a federal contract above the threshold. What requires it is the way discipline, investigations and due diligence work: the code is the standard you point to. And if the company is ever investigated, the Sentencing Guidelines treat written standards as the first element of a program that reduces the penalty.
How is this different from the employee handbook?
The handbook is the collection of workplace rules and benefits. The code is shorter and about conduct and integrity, and it applies to directors and officers as well as staff, which the handbook usually does not. Many small companies fold the code into the handbook; the risk is that the parts directors and officers must sign get lost.
What is the waiver rule?
Public companies must disclose promptly any waiver of the code granted to a senior officer. The practical consequence is that the code should say who may grant a waiver and that waivers are recorded, so the company knows when it has granted one.
Do we need a hotline?
Public companies need an anonymous channel for accounting concerns under Sarbanes-Oxley, and contractors above the FAR threshold need a hotline poster and reporting mechanism. For others it is a choice, but the Sentencing Guidelines credit a system that allows anonymous reporting, and most vendors offer one cheaply.