# Code of Business Conduct: [Organization name]

> A code of business conduct sets out the ethical standards that every
> director, employee and representative of an organisation must follow,
> how to make decisions when the rules are unclear, and how to raise a
> concern without fear of retaliation. Its structure is aligned with
> ISO 37301:2021 (compliance management systems, with Amd 1:2024),
> clause 5.2 on the compliance policy, and links to the anti-bribery
> policy required by ISO 37001:2025 clause 5.2. It also covers the
> elements of a code of ethics listed in US SEC Regulation S-K Item 406.
> It is a corporate ethics code: for an open-source or event community
> code of conduct, use `dev/code-of-conduct`. Replace every
> `[bracketed]` value and every row marked *Example*. This is a
> documentation format, not legal advice: check the current official
> text and ask a qualified professional.

<!--
Guidance: How to use this template
- Write the code for the reader who has a decision to make today. Use
  plain language, short sections and real situations from your
  business; link to the detailed policies instead of repeating them.
- Keep the code short enough to read in 20 minutes. The detail belongs
  in the policies it points to: anti-bribery (`compliance/iso-37001-anti-bribery`),
  whistleblowing (`compliance/whistleblowing-policy`), conflicts of
  interest (`compliance/conflicts-of-interest-register`), sanctions
  (`compliance/sanctions-compliance-procedure`), acceptable use
  (`compliance/acceptable-use-policy`), information security
  (`compliance/information-security-policy`), privacy notice
  (`legal-lite/privacy-policy`) and the wider compliance management
  system (`compliance/compliance-management-system`).
- Top management must approve the code and visibly support it. Test
  each section with a few employees before publication.
- The worked example uses Brackenfold Engineering plc, a fictional
  listed engineering group with 1,240 staff.
- Sections 8 and 10 contain legal points that depend on jurisdiction
  and listing status; take advice before publication.
-->

## Contents

1. A message from leadership
2. Who this code applies to and how to use it
3. Speaking up
4. Respect for people
5. Integrity in business
6. Information and assets
7. Communities and the wider world
8. Breaches, waivers and discipline
9. Governance, training and attestation
10. Legal context examples
11. References

## Document control

<!-- Guidance: The code is controlled documented information. Board approval and the date of the last review are often asked for by customers, auditors and regulators. -->

| Field | Value |
|---|---|
| Document ID | [POL-ETH-001] |
| Version | [1.0] |
| Status | [Draft / In review / Approved] |
| Owner | [Chief compliance officer, @name] |
| Approved by | [Board of directors, YYYY-MM-DD] |
| Approvers/reviewers | [Legal, HR, internal audit] |
| Effective date | YYYY-MM-DD |
| Last updated | YYYY-MM-DD |
| Next review | YYYY-MM-DD (at least every [two] years) |
| Classification | [Public] |
| Languages | [List; the [English] version prevails] |

### Approvals

| Role | Name | Decision | Date |
|---|---|---|---|
| Board of directors | [@chair] | [Approved] | YYYY-MM-DD |
| Chief compliance officer | [@name] | [Recommended] | YYYY-MM-DD |

### Revision history

| Version | Date | Author | Change summary |
|---|---|---|---|
| 0.1 | YYYY-MM-DD | [@name] | First draft after employee focus groups |
| 1.0 | YYYY-MM-DD | [@name] | *Example:* Approved by the board, fraud prevention section added |

## 1. A message from leadership

<!-- Guidance: A short, signed statement by the chief executive or chair. Say why ethics matters to your business in concrete terms, commit to non-retaliation, and ask people to speak up. Pitfall: a generic letter that could belong to any company. -->

[Two or three paragraphs signed by the chief executive or chair.]

*Example:* "Our customers trust our bridges, pumps and turbines with
their safety. That trust depends on every test report being honest and
every contract being won fairly. If something feels wrong, tell us. You
will never be penalised for raising a concern in good faith."

## 2. Who this code applies to and how to use it

<!-- Guidance: Name every group covered and how the code reaches third parties. Give a short decision test people can apply on their own. -->

This code applies to [all directors, officers, employees, temporary
staff and contractors of the group]. We expect [agents, distributors,
joint venture partners and suppliers] to follow equivalent standards,
set in the supplier code and contracts.

When a situation is not covered, ask:

| Question | If the answer is no or unsure |
|---|---|
| Is it legal and consistent with our policies? | Stop and ask [compliance] |
| Would I be comfortable if it were reported in the news? | Stop and ask |
| Would it hold up if my manager or a regulator reviewed it? | Stop and ask |
| Is it fair to customers, colleagues and the public? | Stop and ask |

## 3. Speaking up

<!-- Guidance: List every channel, including an anonymous one where the law allows it, and state non-retaliation clearly. Point to the whistleblowing policy for the procedure. ISO 37301 also covers raising concerns and investigations in its operation clause; confirm numbering in your licensed copy. -->

| Channel | Details |
|---|---|
| Your manager or HR | [Contacts] |
| Compliance team | [Email, phone] |
| Independent hotline (anonymous option) | [Phone, web address, languages] |
| External authority | [Where law provides, for example under the EU Whistleblowing Directive (EU) 2019/1937] |

We do not tolerate retaliation against anyone who raises a concern in
good faith or helps an investigation. Retaliation is itself a breach of
this code. Details: `compliance/whistleblowing-policy`.

## 4. Respect for people

<!-- Guidance: Cover equal treatment, harassment, health and safety, and human rights at work. Keep each rule to a few sentences with a link. -->

| Topic | Our standard | Policy |
|---|---|---|
| Equal treatment | We hire, pay and promote on merit, without discrimination | [HR-POL-nn] |
| Harassment and bullying | We do not accept harassment of any kind, online or offline | [HR-POL-nn] |
| Health and safety | Anyone may stop work they believe is unsafe | [HSE-POL-nn] |
| Human rights and fair labour | No forced or child labour in our operations or supply chain | [Supplier code] |

## 5. Integrity in business

<!-- Guidance: This is the core of the code. Set clear rules for bribery, gifts, conflicts, competition, trade controls, fraud and money laundering, each with a link. Thresholds belong in the detailed policy; repeat them here only if they are simple. Pitfall: thresholds without a register, so nobody can check them. -->

### 5.1 Bribery and corruption

We do not offer, give, request or accept bribes, including facilitation
payments, directly or through anyone acting for us. Full rules, due
diligence and red flags: `compliance/iso-37001-anti-bribery`.

### 5.2 Gifts and hospitality

| Rule | Value |
|---|---|
| Never acceptable | Cash or cash equivalents, anything during a tender, anything to a public official without approval |
| Allowed without approval | *Example:* Modest items up to [EUR 50] per occasion |
| Needs approval and registration | *Example:* Above [EUR 50] per occasion or [EUR 150] per counterparty per year |
| Register | [Link to gifts and hospitality register] |

### 5.3 Conflicts of interest

Declare any personal, financial or family interest that could influence
or appear to influence your work, when it arises and at the yearly
attestation. Register: `compliance/conflicts-of-interest-register`.

### 5.4 Fair competition

We compete on merit. We do not agree prices, bids, markets or customers
with competitors, and we leave any meeting where such topics come up.

### 5.5 Trade controls and sanctions

We screen customers, suppliers and shipments and follow the export
control and sanctions laws that apply. Procedure:
`compliance/sanctions-compliance-procedure`.

### 5.6 Fraud and money laundering

We do not falsify records, misstate results or help anyone commit
fraud or launder money. Report suspicions through the channels in
section 3.

## 6. Information and assets

<!-- Guidance: Cover confidential information, personal data, accurate records, inside information and use of company assets and AI tools. -->

| Topic | Our standard | Policy |
|---|---|---|
| Accurate records and reporting | Books, test reports and disclosures are complete, accurate and timely | [FIN-POL-nn] |
| Confidential information | Use it only for its purpose and protect it after you leave | `compliance/information-security-policy` |
| Personal data | Collect and use it only as our privacy policies allow | `legal-lite/privacy-policy` |
| Inside information | Do not trade on or pass on inside information about us or others | [Insider dealing policy] |
| Company assets and AI tools | Use them for legitimate business; follow the acceptable use rules | `compliance/acceptable-use-policy` |

## 7. Communities and the wider world

<!-- Guidance: State your position on political activity, donations and sponsorships, the environment, and public communication. -->

| Topic | Our standard |
|---|---|
| Political activity | No company political donations [unless approved by the board and lawful]; personal activity in your own time and name |
| Charitable donations and sponsorship | Approved, recorded and never linked to a business decision |
| Environment | We meet our environmental permits and report honestly on our impact |
| Media and social media | Only authorised spokespeople speak for the company |

## 8. Breaches, waivers and discipline

<!-- Guidance: State consequences, investigation principles and who may grant waivers. US listed companies must publicly disclose waivers of the code for certain officers; check the rules of your listing venue. -->

Breaches can lead to disciplinary action up to dismissal and may be
reported to authorities. Investigations are fair, confidential and
proportionate. Only [the board or its audit committee] may grant a
waiver for a director or executive officer; waivers are recorded and
disclosed where law or listing rules require.

## 9. Governance, training and attestation

<!-- Guidance: Name owners and the training cycle, and track completion. ISO 37301 expects the compliance function to have authority and access to the governing body. -->

| Role | Responsibility |
|---|---|
| Board or audit committee | Approves the code, oversees compliance, receives reports |
| Chief compliance officer | Owns the code, advice, training, reporting |
| Managers | Lead by example, respond to concerns, prevent retaliation |
| Everyone | Read, follow, complete training, attest yearly, speak up |

| Metric | Value |
|---|---|
| Staff in scope *(Example)* | 1,240 |
| Training and attestation complete *(Example)* | 1,178 (95.0%) |
| Outstanding, escalated to managers *(Example)* | 62 |

## 10. Legal context examples

<!-- Guidance: Dated examples, not a full list. A code does not prove compliance with any law. -->

As of October 2026 (not legal advice; check the current official text):

| Jurisdiction | Point | Official source |
|---|---|---|
| EU | Directive (EU) 2019/1937 protects people who report breaches of EU law and requires internal reporting channels for many employers | https://eur-lex.europa.eu/eli/dir/2019/1937/oj |
| UK | Bribery Act 2010 section 7 (failure to prevent bribery, adequate procedures defence). The failure to prevent fraud offence in the Economic Crime and Corporate Transparency Act 2023 applies to large organisations from 1 September 2025, with a reasonable procedures defence | https://www.gov.uk/government/publications/offence-of-failure-to-prevent-fraud-introduced-by-eccta |
| US | SEC Regulation S-K Item 406 (17 CFR 229.406) asks registrants to disclose whether they have a code of ethics for senior executive and financial officers. The DOJ Evaluation of Corporate Compliance Programs (updated September 2024) asks how the code is communicated and enforced | https://www.justice.gov/criminal/criminal-fraud/page/file/937501/dl |

## 11. References

| Reference | Edition | Use |
|---|---|---|
| ISO 37301, Compliance management systems, Requirements with guidance for use | 2021, with Amd 1:2024 | Clause 5.2 compliance policy, culture and governance |
| ISO 37001, Anti-bribery management systems, Requirements with guidance for use | 2025 (second edition) | Clause 5.2 anti-bribery policy |
| ISO 37002, Whistleblowing management systems | 2021 | Speaking up section |
| SEC Regulation S-K Item 406 | Current eCFR | Code of ethics elements |
| DOJ Evaluation of Corporate Compliance Programs | September 2024 | Effectiveness questions |

## Standard and licence note

Structure aligned with ISO 37301:2021, *Compliance management systems,
Requirements with guidance for use* (with Amd 1:2024), and ISO
37001:2025, *Anti-bribery management systems, Requirements with
guidance for use*. Only names, editions and clause numbers are cited;
the code text, decision test, tables and guidance are original text
written for this collection and reproduce no wording from the
standards. The legal examples are dated summaries and the worked
example is fictional. Check the current editions and laws before use.
This is a documentation format, not legal advice.

Official text: ISO, purchase or licensed access:
https://www.iso.org/standard/75080.html (ISO 37301) and
https://www.iso.org/standard/85816.html (ISO 37001), also available
from national standards bodies.

Template licence: MIT.