A complete code of conduct to copy and adapt: how we act, how we treat each other, what we protect, how to speak up and what happens when the code is broken. Written to the law of Great Britain, with the Item 406 and NYSE elements a US-listed group needs, and every report-it line pointing to one route.
“The global leaders in whistleblowing software”
As seen in:
Fulham F.C.
A typical code says raise it with your manager or compliance six times and never says where. Section 6 of this one names the reporting system, the designated person and an alternate, and every other section sends the reader there.
Honest conduct and conflicts, accurate disclosure, compliance with law, prompt internal reporting and accountability, plus the NYSE 303A.10 list from corporate opportunities to waivers, so a US-listed group or its UK subsidiary can adopt it without a second document.
Section 7 sets out the investigation, the consequences up to dismissal or the end of a contract, and that a waiver for a director or officer comes only from the board. A code without consequences is a poster.
How we work matters as much as what we deliver. This code sets out the standards every one of us at [Organization] is held to, including me. It is short because the standards are simple: act honestly, treat people with respect, protect what belongs to the organization and its customers, and speak up when something is wrong. If you are unsure what the code requires, ask. If you see it broken, say so, and you will be supported for doing it.
[Name], [Chief Executive]
This code describes how [Organization] does business and what we expect of everyone who works for it or on its behalf: directors, officers, employees, contractors, agency staff and [third parties acting in our name]. It applies in every country we operate in. Where local law sets a higher standard, follow the law; where this code does, follow the code.
Our values are [value one], [value two] and [value three]. The code turns them into behavior. It sits above our other policies, each referred to where it applies, and is approved by [the board].
We comply with every law and regulation that applies to our work. Compliance is the floor, not the ceiling: where the code asks more than the law, we do more.
Conflicts of interest. A conflict arises when your personal interests, or those of a family member or close associate, could affect, or appear to affect, a decision you make for [Organization]. Outside work, shareholdings, a relative at a supplier or customer, a relationship with someone you manage: declare it in writing to [the Compliance Lead] as soon as it arises and before any decision is made, then follow the instruction you are given. Directors must avoid situations where their interests may conflict with the company's, unless the conflict is authorized by the board, and must declare the nature and extent of any interest in a proposed transaction to the other directors, as the Companies Act 2006 requires. Do not take for yourself an opportunity you learned of through your work here.
Gifts and hospitality. Reasonable and proportionate hospitality is a normal part of doing business. Never offer or accept cash or anything equivalent to cash. Any gift or hospitality worth more than [£ threshold], or of any value involving a public official, is declared in the register and approved by [your manager] before it is given or accepted. Anything that could reasonably be seen to influence a decision is refused whatever its value.
Bribery and corruption. We do not pay or accept bribes, directly or through anyone else. Under the Bribery Act 2010 it is an offence to offer, promise or give a financial or other advantage to get someone to do their job improperly or to reward them for doing so (section 1), to request or accept such an advantage (section 2), or to bribe a foreign public official to win or keep business (section 6). [Organization] itself commits an offence if anyone associated with it bribes another person, unless it had adequate procedures to prevent it (section 7), which is why this section exists. Small payments to officials to speed up routine tasks are bribes. [US: the Foreign Corrupt Practices Act prohibits payments to foreign officials to obtain or retain business and requires accurate books and records; it applies to [Organization] as [a US issuer / a domestic concern], and can reach its subsidiaries through the parent's liability and its books and records.]
Respect and equal treatment. We treat every colleague, customer, supplier and member of the public with respect. Decisions about hiring, pay, promotion and work are made on merit, never on a protected characteristic.
Harassment and bullying. Harassment is unwanted conduct related to a protected characteristic (age, disability, gender reassignment, race, religion or belief, sex or sexual orientation) that has the purpose or effect of violating someone's dignity or creating an intimidating, hostile, degrading, humiliating or offensive environment for them. That is the definition in section 26 of the Equality Act 2010, and it includes unwanted conduct of a sexual nature. Whether conduct has that effect takes account of how the person perceived it, the circumstances and whether it is reasonable for it to have had that effect. Bullying is offensive, intimidating or insulting behavior that undermines or humiliates someone, whether or not a protected characteristic is involved. Neither is tolerated from anyone, in the office, on site, online or at a work event. [Organization], as the employer, has a legal duty under the Equality Act 2010 to take all reasonable steps to prevent sexual harassment of its employees, including by customers and other third parties. Managers are responsible for putting that into practice in their teams. [Northern Ireland: the Equality Act 2010 does not apply; check the equivalent local legislation.]
Health and safety. Everyone is responsible for their own safety and the safety of people around them. Follow the safety rules for your work, do not start a task you are not trained for, and report every injury, near miss and unsafe condition on the day through [the incident report form].
Confidential information. Information about our business, customers, suppliers and colleagues that is not public stays inside [Organization] and is used only for its work. That obligation continues after you leave. Nothing in this code stops you making a protected disclosure to a regulator or using the route in section 6.
Personal data. Collect only the personal data a task needs, use it only for that purpose, keep it secure and report any loss or breach to [the Data Protection Lead] the same day, so that the organization can meet its own reporting deadlines.
Company assets. Equipment, systems, money, time and the organization's name are for its work. Protect them from loss, theft and misuse, and do not use them for personal benefit beyond what [the acceptable use policy] allows.
[Listed companies: you must not deal in [Organization]'s shares, or those of any other company, while holding inside information about it, or pass that information to anyone else. See [the share dealing code].]
Accurate records. Every record we make, from expense claims and timesheets to accounts, contracts and reports to regulators, is complete, accurate and honest. Never make a false or misleading entry, never describe a payment as something it is not, and never destroy a record that is subject to a legal hold or an investigation.
Fair dealing. We compete on the merits of what we offer. Deal honestly with customers, suppliers and competitors; do not misrepresent facts, misuse confidential information or take unfair advantage of anyone through manipulation or concealment.
If you see or suspect a breach of this code, the law or any policy, report it. Tell your manager or [the Compliance Lead], or use the reporting system at [portal link], by web form, voice message, the QR code on [noticeboards] or email to [reporting address]. If the concern involves [the Compliance Lead], it goes to [the Chair of the Audit Committee]. You can report openly, confidentially or anonymously, and an anonymous report is assessed in the same way as a named one.
Every report is acknowledged within [seven days], handled by someone outside the reporting line of anyone named, and answered within [three months]. Nobody who raises a concern honestly will suffer for it. Retaliation against a reporter is itself a breach of this code and is treated as gross misconduct; if you think it is happening to you, report it through the same route. Full details are in [the whistleblowing policy], which also explains your legal protection under the Employment Rights Act 1996 [EU: and Directive 2019/1937] [US: and the federal statute that applies to your work].
A suspected breach is looked into promptly and fairly under [the disciplinary procedure] or, for contractors, the terms of their contract. The person concerned is told what is alleged and has the chance to respond before any decision is made.
A breach may lead to disciplinary action up to dismissal, or to the end of a contract, and is reported to the police or a regulator where the law requires it. Fraud, bribery, violence, harassment, gross negligence and retaliation against a reporter are gross misconduct and may lead to dismissal for a first offence. A manager who knew of a breach and did not act may face disciplinary action of their own, judged on their own conduct and the circumstances.
A waiver of any part of this code for a director or officer may be granted only by [the board or its designated committee], is recorded, and is disclosed promptly where listing rules require it. No one else may waive the code for anyone.
I have read and understood the [Organization] code of conduct. I will comply with it, and I know where to report a concern.
A starting point to adapt to your organization, not legal advice.
A code that is signed once and filed changes nothing. These six steps make it the document people reach for when they are unsure what to do.
Book a demoSection 1 is signed by the chief executive, not by the leadership team. A named person saying the code applies to them is the first signal that it applies to everyone else, and the first thing a reader checks.
The gift threshold, the names in section 6, the committee that grants waivers and the three values are decisions, and a bracket left in the published code is a rule nobody can follow. Decide each one before the code goes out, and keep the thresholds in the gifts and hospitality policy in step with it.
Section 6 promises a web form, a voice message, a QR code and an email address, an acknowledgment within seven days and an answer within three months. Set each one up and test it from a phone before anyone reads the promise. Confide takes reports by all four routes. A user named in a report loses access to that case automatically, and every access is recorded in an audit trail that cannot be changed.
A supplier sends a case of wine. A colleague's sister applies for a role on their team. A manager's joke lands badly in the group chat. Walk each one through the code with the people it applies to, and ask what they would do and where they would report it. The answers tell you which sections are understood.
Section 8 is signed on joining and after each annual review, and the signed page is filed. When a breach is investigated, the acknowledgment is the evidence that the standard was known, so a missing signature is a gap in the file, not a formality.
The UK Corporate Governance Code 2024 asks the board to assess and monitor culture and to seek assurance where behavior is not aligned with the company's values. Give it the numbers: reports received, breaches found, action taken and every waiver granted. Review the code on the same date each year, and sooner when the law moves.