Code of Conduct

A code of conduct is the document that tells everyone at a company what behavior is expected and where the line sits. Most cover conflicts of interest, gifts, harassment, confidentiality, use of company assets, and how to raise a concern. No general US law requires one, though NYSE and Nasdaq listed companies must adopt one, and so must federal contractors above the FAR threshold.

What goes in a code of conduct?

Most codes cover the same territory, because the territory is set by where employees actually get into trouble. A working code addresses conflicts of interest, gifts and entertainment, anti-bribery, confidential information, insider trading, use of company assets and systems, harassment and discrimination, health and safety, accurate books and records, and the reporting channels available when something looks wrong.

The sections that matter most are the ones people read under pressure. An employee who just got offered World Series tickets by a vendor doesn't read the whole code. They search for "gifts," find a number, and decide. That argues for short, searchable sections with concrete examples.

Two structural choices separate a useful code from a decorative one. A conflicts section that names the disclosure form and the reviewer beats one that tells employees to avoid conflicts, and a code that goes quiet on consequences signals there aren't any.

Who's legally required to have one?

Three of them you can check yourself, against the text that creates them.

1. Nasdaq listed companies. Listing Rule 5610 requires each company to adopt a code of conduct applicable to all directors, officers, and employees, and to make it publicly available. A September 2023 rule change lets the board or a committee of the board grant a waiver, and requires foreign private issuers to disclose a waiver within four business days. (SR-NASDAQ-2023-031, 88 Fed. Reg. 62368, September 11, 2023.)
2. Federal contractors. FAR 52.203-13 requires a written code of business ethics and conduct within 30 days after contract award, unless the contracting officer sets a longer period. FAR 3.1004(a) inserts the clause when the contract value is expected to exceed $7.5 million and the performance period is 120 days or more.
3. Everyone else. No general US statute requires a code.

Sarbanes-Oxley is where this gets misreported. Section 406 does not require a company to have a code of ethics. It requires disclosure of whether the company has adopted one for its senior financial officers, and if not, why not. The implementing rule is Item 406 of Regulation S-K, which reaches the principal executive officer along with the principal financial and accounting officers. Any source that says SOX requires a code of ethics has the obligation backwards.

A code is one piece of a larger program, and usually the piece the rest of it hangs off. See the seven elements of an effective compliance program for where it sits.

What is a gifts and entertainment policy?

A gifts and entertainment policy sets out what employees can accept and give, from whom, and at what point they have to disclose it or get approval. Most set a dollar threshold, ban cash and gift cards (“cash equivalents”) outright, and treat anything involving a government official as a separate, stricter category. The FCPA has no de minimis threshold, so the number in your policy is a control you chose, not a line the law drew. Gifts and entertainment policies are sometimes standalone and sometimes part of a company’s Anti-Bribery and Anti-Corruption (“ABAC”) policy. They can also be embedded within a Code of Conduct.

Two points are worth making explicit to employees. The FCPA reaches the corrupt offer, promise, or giving of "anything of value" to a foreign official, at 15 U.S.C. 78dd-1(a), and the DOJ and SEC’s FCPA Resource Guide, Second Edition, reads that phrase to cover meals, travel, entertainment, charitable donations, internships, and jobs for relatives. And the provision covering reasonable and bona fide expenditures such as travel and lodging, at 15 U.S.C. 78dd-1(c)(2), sits in a subsection the statute titles “Affirmative defenses.”

Code of conduct vs. employee handbook vs. policy

The code is the umbrella. Individual policies sit underneath it and carry the operational detail the code only gestures at. The handbook overlaps at the edges, which is why the two contradict each other at a surprising number of companies. Check them against each other whenever either one changes.

What makes a code work, and what makes it shelfware?

Shelfware has a recognizable shape: it opens with a letter from the CEO, runs to abstract values, and gets attested once at hire and never again. Employees can't answer questions with it, so they stop opening it. Codes that work share four traits. They use scenarios drawn from the company's own risk profile rather than generic hypotheticals. They name a specific owner or channel for every escalation path instead of pointing at "management." They get re-attested on a schedule. And leadership references the code in real decisions, which is the only durable proof that tone at the top matches the text.

The attestation record is the part regulators and plaintiffs ask about first, because a code nobody acknowledged is hard to enforce against anyone. See policy attestation for what a defensible record looks like.

How do companies keep a code current?

Put the code on an annual review cycle with a named owner, and trigger an off-cycle review whenever the business changes shape: a new country, a new regulated product, an acquisition, a new category of third-party relationship. Log every change so you can show which version applied on any given date. The most common gap isn't a stale code. It's a code that changed while the training, the attestation form, and the intranet copy did not. Treat those four as one release.

FAQ

Does a small private company need a code of conduct?

No law requires it unless the company holds a federal contract above the FAR 52.203-13 threshold. Most adopt one anyway, because it is the document that makes discipline consistent and defensible.

What's the difference between a code of conduct and a code of ethics?

Most companies use the terms interchangeably. Where they do distinguish, the code of ethics states principles and the code of conduct states rules. SOX section 406 and Item 406 of Regulation S-K both say "code of ethics," which is why the phrase persists in securities filings.