A board member code of conduct is a written policy that turns broad fiduciary duties into specific, enforceable rules covering how directors behave, vote, disclose conflicts, and handle sensitive information. It typically addresses conflicts of interest, confidentiality, use of organizational assets, gifts, attendance, reporting of violations, and sanctions up to removal. For nonprofits, the document also carries tax significance: IRS Form 990 asks directly whether the organization maintains a written conflict-of-interest policy, a whistleblower policy, and a document retention policy.1Internal Revenue Service. Exempt Organizations Annual Reporting Requirements – Governance (Form 990, Part VI)
The Fiduciary Duties the Code Enforces
Every code of conduct rests on three duties that courts and state statutes impose on directors of both for-profit and nonprofit organizations. A director who ignores them can face personal liability for the organization’s losses and, in some cases, court-ordered removal.
- Duty of care. Be reasonably informed before voting. Read the financial statements, ask questions when something doesn’t add up, attend meetings. The standard most states apply is the care a person in a similar position would exercise under similar circumstances.
- Duty of loyalty. The organization’s interests come before yours. When personal benefit and organizational benefit conflict, the organization wins. This is why conflict-of-interest rules exist.
- Duty of obedience. Keep the organization within its stated mission and applicable law. Steering a children’s charity into unrelated commercial ventures can breach this duty even if the venture is profitable.
The consequences are real. Under federal law governing employee benefit plans, a fiduciary who breaches an imposed duty is personally liable for resulting losses and must return any profits gained through misuse of plan assets, and courts can order removal.2Office of the Law Revision Counsel. 29 US Code 1109 – Liability for Breach of Fiduciary Duty State laws governing corporate and nonprofit directors follow a similar pattern.
Directors who do follow good process are not left exposed by every bad outcome. The business judgment rule, recognized across most states, protects a director whose decision turns out badly if the process was sound: relevant information reviewed, no undisclosed personal stake, and a genuine belief the decision served the organization. A code of conduct essentially maps that process onto daily practice, so a director who follows the code is also building the record the rule requires.
What the Code Should Cover
The details vary by organization, but most effective codes share a common set of provisions.
Conflicts of Interest and Recusal
This section is the backbone. It requires directors to disclose any financial interest, family relationship, or outside role that could influence their judgment on a matter before the board. Disclosure alone isn’t enough. The standard practice is for a conflicted director to leave the room during discussion and abstain from the vote, with the minutes recording the disclosure, the absence during deliberation, and the abstention. That documentation is what stands up if the decision is later challenged.
The IRS expects nonprofits applying for tax-exempt status to have a conflict-of-interest policy in place, and explains that its purpose is to ensure the organization has a process for handling conflicts when they arise.3Internal Revenue Service. Form 1023 Purpose of Conflict of Interest Policy A code without this section is missing its most critical component.
Confidentiality
Board members routinely see financial projections, litigation strategy, personnel decisions, donor records, and executive-session discussions. The confidentiality provision prohibits disclosing that information to anyone outside the board, including family, business associates, and the media, and the obligation typically continues after the director’s term ends. A premature leak about a pending merger or a personnel investigation can expose the organization to lawsuits and destroy trust with donors and staff.
Use of Organizational Assets
The code should explicitly prohibit using the organization’s property, funds, staff time, or intellectual property for personal benefit. That covers using a nonprofit’s mailing list for a personal business, directing organizational contracts to a company the director owns, and charging personal expenses to an organizational account. Even small-scale misuse can trigger a breach-of-loyalty claim.
Gifts
Most codes set a dollar threshold for gifts a director can accept from vendors, contractors, or anyone doing business with the organization. Gifts above that amount must be declined or disclosed to the full board. The point isn’t to police every cup of coffee; it’s to prevent expensive gifts from creating an appearance of influence over a vote or recommendation.
Attendance, Preparation, and Unified Voice
Set clear expectations for meeting attendance and require directors to review materials before arriving. Some organizations define a specific number of unexcused absences that triggers automatic review or removal. A related provision, sometimes called a “unified voice” or “one voice” policy, requires directors to publicly support board decisions once made, even if they voted against the measure in deliberation. Disagreement during the meeting is expected and healthy. Publicly undermining the decision afterward is not. Directors can still raise concerns through proper channels; the organization simply speaks with one voice to employees, donors, and the public.
Federal Rules That Reach Every Board
Two provisions of the Sarbanes-Oxley Act apply broadly enough to reach nonprofits and private organizations, not just public companies. Reference both in the code because violations carry criminal penalties.
Whistleblower Retaliation
Federal law makes it a crime to retaliate against anyone who provides truthful information to law enforcement about possible federal offenses. The penalty is a fine, up to 10 years in prison, or both.4Office of the Law Revision Counsel. 18 USC 1513 – Retaliating Against a Witness, Victim, or an Informant This is not limited to publicly traded companies. Your code should protect whistleblowers and make clear that retaliation, including firing a staff member who reports financial misconduct or pushing out a director who raises concerns, will not be tolerated and may itself be a federal felony.
Document Destruction
Destroying, altering, or falsifying records with the intent to obstruct a federal investigation is punishable by up to 20 years in prison.5Office of the Law Revision Counsel. 18 USC 1519 – Destruction, Alteration, or Falsification of Records in Federal Investigations and Bankruptcy Like the whistleblower provision, this applies to all organizations. The code should include or cross-reference a document retention policy stating which records to keep, for how long, and what triggers a litigation hold that freezes scheduled destruction.
What the IRS Asks Nonprofits
Nonprofits filing Form 990 must answer yes-or-no questions about governance. Part VI asks whether the organization maintains a written conflict-of-interest policy (Line 12a), a whistleblower policy (Line 13), and a document retention and destruction policy (Line 14).1Internal Revenue Service. Exempt Organizations Annual Reporting Requirements – Governance (Form 990, Part VI) Answering “no” doesn’t automatically trigger penalties, but it signals to the IRS, donors, and grantmakers that basic governance infrastructure may be missing. A well-drafted code addresses all three areas in one document or in companion policies that are cross-referenced, so the person signing the return can answer “yes” without scrambling at filing time.
How to Adopt and Enforce the Code
Draft It Against Your Existing Documents
Start with the articles of incorporation, bylaws, and any standalone policies already in effect. The code should align with those documents, not contradict them. If the bylaws already define a removal process, the code’s enforcement section should reference that process rather than create a competing one. Decide early who the code covers: voting directors are the obvious audience, but many organizations extend it to non-voting advisory members, non-board committee members, and senior staff who attend meetings ex officio. State the scope in the document’s opening paragraph.
Formal Adoption and Signed Acknowledgments
The board adopts the code by majority vote at a regular or special meeting, and the motion and vote appear in the minutes. Every current director then signs an acknowledgment confirming they’ve read and agree to follow the policy. That signature is evidence of notice if a violation occurs later and the director claims not to have known the rule. Require re-signing annually so new members are formally onboarded and returning members are reminded of their obligations.
Reporting and Investigating Violations
Designate who receives reports of suspected violations. This is usually the board chair or the chair of a governance committee. If the allegation involves the board chair, name an alternate, such as the vice chair or the chair of the audit committee. Without a clear reporting path, people who spot problems have nowhere to go. Once a report is received, the code should outline the investigation process: who conducts the preliminary review, the timeline, and what happens if the allegation is substantiated. Short timelines matter; delay erodes the whistleblower protections the code is supposed to provide.
Sanctions and Removal
Consequences should be proportional and defined in advance. Minor infractions like missing meetings without notice may warrant a private conversation with the chair. Serious violations, such as undisclosed conflicts or breaches of confidentiality, may justify suspension from committees, loss of voting privileges, or removal from the board. Most bylaws require a supermajority vote, commonly two-thirds of directors, to remove a member for cause, along with advance written notice and an opportunity for the accused director to respond before the vote. If your bylaws are silent on removal, fix that before adopting the code. A code without an enforcement mechanism is just a suggestion.
D&O Insurance Sits Alongside the Code
Even boards with strong codes get sued. Directors and officers (D&O) liability insurance covers legal defense costs and damages when a board member is sued over decisions made in an official capacity, and experienced prospective directors will often ask whether coverage is in place before agreeing to serve. Insurance doesn’t replace the code, and the code doesn’t replace insurance. Following the code strengthens a director’s defense if a claim is filed, because it produces the record of good-faith process courts look for when applying the business judgment rule.