Learn how to create a code of conduct* that reduces risk by helping your people make better decisions.
When the writing is dry enough to eat and the content feels disconnected to real-life decisions, a code of conduct is doomed to irrelevance. But do it right and your code will be hard to ignore.
When well-designed, a code of conduct should influence everyday actions, shape organisational culture, build trust, and make sure everyone across the organisation is on the same page to reduce risk. So what exactly needs to be included? And how do you create one that people actually use – and remember?
*You don’t have to call it that! This is a document that should motivate people in their work. Use the title as an opportunity to link to the vision and aspiration of your organisation.
What is a code of conduct?
At its core, a code of conduct is a document that outlines an organisation’s values, behavioural expectations, policies and reporting procedures. It helps employees understand how to act in different situations and encourages consistent, ethical behaviour at work. It should go further than simply instructing employees to declare a conflict of interest but teaching them how to recognise one and helping them understand what to do next.
Most people want to do the right thing – an effective code of conduct helps them do it.
What should a code of conduct include?
Every code of conduct will be slightly different, but there are risk areas that will likely always be covered, regardless of the type of organisation.
- Company principles: the key values of your organisation
- Behavioural expectations and guidelines: the basic standards you expect from your employees with regards to their colleagues and customers
- Policies around remote working, data protection, conflict of interest and anti-discrimination: all the critical policies you need to support the reputational and legal protection of the business, explained in a way that is easy for everyone to understand
- Speaking-up and reporting procedures: detailing the process for reporting and dealing with issues at work
- Consequences: explaining what happens if behavioural breaches occur
But it’s not just about what content you put in. It needs to be written in a way that makes sense to employees, easy to use, with examples they recognise, and principles that can be put into action.
The process for making (or updating) a code of conduct
- Involve the right people
Who needs to be in the room when you’re making decisions about the code of conduct? Make sure you’ve gathered all the people who will sign-off on it early on, to avoid hiccups down the line. Leadership buy-in will help you progress smoothly, and help you later on with the launch. - Define what matters most – then turn those principles into practical guidance
What behaviours create the biggest risk for your organisation? What values do you want people to demonstrate every day? When you lay out the guidelines, show employees what good practice looks like.
Are there simple but powerful ‘hero’ behaviours that will make a big difference? For example, the simple act of ‘pause and think’ applies in most workplace scenarios and can unlock a whole range of other risk-reducing actions.
Give examples and real-life scenarios that reflect different roles, locations and working environments. The goal is not simply to tell people what the rules are, but to help them recognise situations where those rules apply. -
Make it easy to access and understand
Clarity matters. By making your code of conduct as easy as possible to understand, you make it more likely that behaviour will change. This means it should be searchable too, so someone can find exactly what they’re looking for without scrolling through the document. Make it into a practical, interactive tool. You might do this through an accessible SharePoint tool or an AI chatbot to signpost relevant policies.
If your employee is facing uncertainty or a difficult decision, you want them to be able to easily locate the code of conduct and find useful, practical guidance. Fast. A reader of your code of conduct should find relevant guidance in less than a minute.
- Use your voice
A code of conduct should have your organisation’s tone of voice. It doesn’t need to sound like a lawyer wrote it up for you. So long as clarity is at the heart of the code of conduct, you can be playful and inventive in the way you put the information across.
- Make it hyper-relevant
The guidance in the code should reflect real life. That can be tricky when everyone’s workdays are different. But make your code specific, and you will be more likely to see a difference in behaviour. This might look like having different sections or even different codes for different jobs.
If you’re making front of house staff do a whole section on tax evasion, you’re probably not using their time well. Having specific guidance for specific roles and specific situations will show your people that you understand the decisions they have to make in their everyday lives, and help them make better choices. - Interaction shouldn’t be a one-off
You want to keep a code of conduct top of mind. By embedding relevant aspects of it into regular internal communication for specific roles, such as prompts, questions, scenarios and case studies – and making the key messages part of the fabric of work – you put your code of conduct within easy reach.
When should you update a code of conduct?
As a general rule, a code of conduct should be revisited every year. Additional updates might be required after changes in legislation, emerging risks, organisational restructuring, employee feedback, or changes to ways of working such as hybrid or remote arrangements. Or you might just feel it’s not up to scratch.
Rather than asking “is the wording up to date?” a more useful question to ask is: can employees use the code of conduct to make a better decision when it matters?
Listen to the podcast: Associate General Counsel of Ethics, Governance and Compliance at Wellcome Trust
shares how they use ethics and compliance to help colleagues confidently manage risk.
How do you measure whether a code of conduct is working?
A measure of success isn’t whether employees have received a code of conduct, or even whether they’ve read it. It’s a question of whether it has influenced their behaviour and altered their actions.
As a first port of call, you could use analytics to see how much the code of conduct is being interacted with. But behavioural change is a more meaningful indicator of success. This could look like seeing an increase in declarations of gifts or an increase in calls to the team.
Here's how Channel 4 reduced Health & Safety accidents by 24%.
Is your code good enough? Five questions to test its strengths (and identify its weaknesses)
- Which moments of choice create the greatest risk for each role? Focus on the situations where people face pressure, uncertainty or competing priorities, and ensure the code of conduct offers practical guidance for those moments.
- Can people find relevant guidance in less than two minutes? Test this on mobile devices and with frontline, remote and non-desk employees.
- Do examples reflect the situations people actually face? Use interviews, site visits, employee questions, case data and risk assessments to find out.
- Are managers equipped to act? Give them prompts, boundaries, escalation routes and opportunities to practise difficult conversations.
- What happens after annual training? Plan communications and learning around risk areas throughout the employee lifecycle.
A code of conduct should be more than a compliance document. At it’s best, it helps people make better decisions when the answer is not obvious. When it’s practical, accessible and reinforced through everyday conversations, it becomes a tool that strengthens culture, reduces organisational risk and helps employees do the right thing when it matters most.