Code of Conduct

The same rules must apply at every level — this is where many organisations fail. If senior leaders are seen to be above the Code, it destroys its credibility entirely. A robust process means any complaint is handled independently of seniority, and outcomes are communicated (within appropriate limits) to maintain trust.

Review it at least every two years, and immediately after major events like a merger, regulatory change, or high-profile misconduct case. An outdated Code that doesn't reflect current laws or company realities can actually create more legal risk than having no code at all.

A Code of Ethics is broad and values-based — it outlines the principles your organisation believes in (like honesty and respect). A Code of Conduct is more practical — it spells out the specific behaviours and actions expected in day-to-day situations. Many organisations have both, or combine them.

A Code of Conduct is a written document that sets out the standards of behaviour expected from everyone in your organisation. It gives employees a clear reference for what's acceptable, protects the company legally, and signals to clients and partners that you operate with integrity.

At minimum, it should cover: workplace behaviour and respect, conflicts of interest, data and confidentiality, gifts and hospitality, anti-bribery and corruption, use of company resources, social media conduct, health and safety, how to raise concerns, and the consequences of violations.

On its own, no. A Code of Conduct is a tool — culture is shaped by what leaders model, what gets rewarded, and what gets tolerated. But a clear, well-communicated Code, consistently enforced, is an important foundation. It sets expectations, provides accountability, and gives people the language to call out behaviour that falls short.

Track metrics like: number of concerns raised (a healthy figure, not necessarily a bad sign), time to resolution, employee survey scores on trust and safety, repeat violations, and exit interview themes. An absence of reported concerns often means people don't feel safe raising them — not that everything is fine.

Increasingly, yes. A modern Code of Conduct recognises that respectful behaviour includes not creating toxic working conditions, excessive pressure, or bullying — even subtle forms. Including wellbeing expectations signals that the organisation takes psychological safety as seriously as physical safety

It should clarify the difference between personal and professional social media use, prohibit sharing confidential information, address how to handle negative comments about the company or colleagues online, and remind employees that what they post publicly can reflect on the organisation — even outside working hours.

Yes — third parties acting on your behalf can create reputational and legal risk. Your supplier or vendor Code of Conduct should set out minimum standards on labour practices, anti-corruption, environmental conduct, and data handling. Include compliance requirements in all contracts.

Require employees to disclose situations where their personal interests could influence their professional decisions — such as a supplier relationship with a family member, or investing in a competitor. The Code should explain what to disclose, who to tell, and how the conflict will be managed.

Start with core universal principles (respect, honesty, compliance with law), then add region-specific guidance where local laws or customs differ — for example, gift-giving norms vary widely. Translate it into local languages, and consult local teams to ensure it feels relevant rather than imposed from headquarters.

Follow a clear, documented process: receive the complaint, acknowledge it promptly, assign an impartial investigator, gather evidence from all sides, make a finding, communicate the outcome, and document everything. Both the person raising concerns and the person accused deserve to be treated fairly throughout.

The response depends on the severity. Minor breaches may result in a warning or additional training. Serious violations — like fraud, harassment, or discrimination — typically lead to formal disciplinary action and potentially dismissal. The key is that consequences must be consistent and clearly communicated in advance.

Make training mandatory and engaging — not just a PDF to sign. Use real-life scenarios, interactive e-learning, and regular refreshers. Ensure managers model the expected behaviours, and create a culture where raising concerns is genuinely welcomed and safe.