Code of Conduct: Who Must Adopt One and Required Topics

A code of conduct carries legal requirements for three main groups: companies that file periodic reports with the SEC, companies listed on Nasdaq or the NYSE, and businesses that hold federal contracts. Everyone else adopts one by choice, but the choice is heavily incentivized. Federal sentencing rules, Department of Justice charging policy, and employment-discrimination law all treat an effective code and compliance program as a factor that can dramatically lower penalties and, in some cases, block liability altogether.

Who Is Legally Required to Adopt a Code

SEC-Reporting Companies Under Sarbanes-Oxley

Every company that files periodic reports with the SEC must disclose whether it has adopted a code of ethics covering its principal financial officer and principal accounting officer. A company without one has to explain why. Any change to the code, or any waiver granted under it, must be disclosed immediately through a public filing or on the company’s website.¹

The statute defines “code of ethics” as standards reasonably necessary to promote honest and ethical conduct, full and fair disclosure in financial reports, and compliance with applicable laws and regulations.¹

Nasdaq and NYSE Listed Companies

The exchanges go further than Sarbanes-Oxley. Nasdaq Listing Rule 5610 requires every listed company to adopt a code of conduct that applies to all directors, officers, and employees, make it publicly available, and include an enforcement mechanism. Any waiver for a director or executive officer must be approved by the board or a board committee and disclosed within four business days.²

The NYSE imposes a nearly identical obligation through its Listed Company Manual, requiring adoption and public disclosure of a code of business conduct and ethics for directors, officers, and employees, along with prompt disclosure of waivers granted to directors or executive officers.

Federal Contractors

Government contractors operating under the Federal Acquisition Regulation must maintain a written code of business ethics and conduct. The FAR defines “agent” broadly, reaching any individual authorized to act on the organization’s behalf, whether a director, officer, employee, or independent contractor.³

Why Private Companies Adopt One Anyway

Three federal frameworks reward organizations that took compliance seriously before a problem surfaced.

Federal Sentencing Guidelines Credit

An organization convicted of a federal crime receives a “culpability score” that determines its fine range. If it had an effective compliance and ethics program in place at the time of the offense, the court can subtract three points from that score, potentially cutting the fine by millions of dollars.⁴

To qualify, the program must include written standards designed to prevent and detect criminal conduct, high-level oversight paired with a specific individual running day-to-day operations, screening of personnel for past illegal conduct, periodic training tailored to different roles, monitoring and auditing, a reporting system that allows anonymity, and consistent discipline for violations.⁵

The reduction disappears if the organization unreasonably delayed reporting the offense to authorities or if senior leadership participated in or was willfully ignorant of the misconduct.⁵

DOJ Charging Decisions

When deciding whether to bring criminal charges against a company, federal prosecutors evaluate the compliance program by asking three questions: Is it well designed? Is it adequately resourced and applied in good faith? Does it work in practice? The evaluation is individualized to the company’s size, industry, geographic reach, and regulatory environment.⁶

Prosecutors look at whether the company conducted a meaningful risk assessment, tailored its code to those risks, and actually enforced it. A code that sits on a shelf impresses no one. The DOJ wants evidence that the program detected problems, that employees used the reporting channels, and that the company responded appropriately when issues surfaced.⁶

Harassment Defense

A written anti-harassment policy with a complaint procedure can supply an affirmative defense when an employee sues over supervisor harassment. Failing to develop and implement such a policy may prevent an employer from raising that defense at all. The EEOC has identified the absence of an adequate policy and complaint procedure as a factor that increases liability risk.⁷

Who the Code Has to Cover

The code should define exactly who is bound by it, and that group is almost always broader than “full-time employees.” Part-time staff, temporary workers, interns, and independent contractors act on behalf of the organization and can create legal exposure if they violate anti-corruption, anti-discrimination, or data-privacy rules. Extending coverage to board members, vendors, and suppliers is standard.

Broad applicability matters most in anti-corruption contexts. The Foreign Corrupt Practices Act reaches officers, directors, employees, agents, and stockholders acting on behalf of the company.⁸ If a third-party distributor or local consultant bribes a foreign official to win business for your company, the company faces liability whether or not the code explicitly covered that person.

Topics the Law Effectively Requires You to Address

Anti-Discrimination and Anti-Harassment

Federal law prohibits workplace discrimination based on race, color, religion, national origin, sex (including pregnancy, sexual orientation, and transgender status), age (40 and older), disability, and genetic information. The prohibition covers every aspect of employment, from hiring and pay to job assignments and termination.⁹ A code should translate these requirements into plain rules employees can follow, describe what harassment looks like in practice, and explain how to report it.

Conflicts of Interest

Conflict-of-interest provisions require employees to disclose situations where personal financial interests, outside employment, or family relationships could influence their business decisions. Most codes require advance disclosure along with a review process for determining whether the conflict can be managed or must be eliminated.

Anti-Corruption

Any organization with an international footprint needs anti-corruption provisions. The FCPA makes it illegal for a company or anyone acting on its behalf to pay or offer anything of value to a foreign official to influence an official act, secure an improper advantage, or win or keep business.⁸ The law reaches direct payments and payments funneled through intermediaries when the company knows the money will reach a foreign official.

A code should spell out rules for gifts, meals, travel expenses, and charitable donations in the context of government dealings. The DOJ’s FCPA Resource Guide emphasizes that companies need to assess corruption risk based on the countries where they operate, the use of third-party agents, and interactions with government-owned enterprises.¹⁰

Data and Confidentiality

A code should set out rules for handling sensitive information, including customer data, employee records, proprietary information, and trade secrets. These provisions typically cover who can access different categories of data, how data must be stored and transmitted, what to do if a breach occurs, and restrictions on sharing confidential information after leaving the organization.

Insider Trading

Publicly traded companies need insider-trading provisions. Federal securities law prohibits trading on material nonpublic information, and the SEC’s amended Rule 10b5-1 tightened the rules for prearranged trading plans. Directors and officers who adopt such plans must certify in writing that they are not aware of material nonpublic information and are acting in good faith, and the plans must include cooling-off periods before any trades can begin.¹¹

Social Media, With Limits

Social media policies bump into the National Labor Relations Act. Employees have the right to discuss working conditions, pay, and benefits with coworkers, including on social media, whether or not the workforce is unionized. A policy that broadly prohibits negative comments about the company risks violating federal labor law. The protection has limits: individual griping unrelated to group action is not protected, and employees lose protection if their posts are egregiously offensive, knowingly false, or publicly disparage the employer’s products without connecting the criticism to a labor dispute.¹²

Reporting Channels and Whistleblower Protections

Provide more than one reporting channel so an employee who is uncomfortable going to a direct supervisor has alternatives. Common options include a dedicated compliance officer, an HR representative, and an anonymous hotline or web-based reporting tool. Third-party hotline services are available for organizations that want to outsource intake.

Whistleblower retaliation protections are not optional. More than twenty federal statutes prohibit employers from retaliating against workers who report safety hazards, fraud, securities violations, environmental problems, and other protected concerns.¹³ Retaliation can include termination, demotion, reduced hours, reassignment to undesirable work, intimidation, and blacklisting.¹⁴

For public companies, Sarbanes-Oxley separately protects employees who report conduct they reasonably believe constitutes securities fraud, wire fraud, bank fraud, or a violation of SEC rules. Protected reports can go to a federal agency, a member of Congress, or a supervisor with authority to investigate. An employee who prevails in a retaliation claim is entitled to reinstatement, back pay with interest, and compensation for litigation costs and attorney fees.¹⁵

State these protections plainly in the code. Employees who fear retaliation do not report, and unreported problems tend to grow.

Training, Acknowledgment, and Enforcement

Writing the code is only the start. Effective training programs are role-specific: someone in procurement faces different corruption risks than someone in HR, and the scenarios should reflect that. The Federal Sentencing Guidelines require organizations to communicate their standards “periodically and in a practical manner” appropriate to each individual’s role and responsibilities.⁵ Annual refresher training is the most common cadence; high-risk functions may warrant more.

Every employee should sign an acknowledgment confirming they received, read, and understood the code. Electronic signatures are widely accepted and easier to track at scale. If an employee later claims they never knew about a policy, the signed acknowledgment undercuts that argument. Courts have accepted electronic click-to-acknowledge logs as proof of notice.

When a report comes in, investigate promptly and impartially. The investigation should be handled by someone without a stake in the outcome, and the findings should be documented in writing. Discipline should be proportionate and consistent across the organization. If an executive gets a quiet conversation while a line employee is fired for the same behavior, the code loses credibility with the workforce, and prosecutors evaluating the compliance program notice the same thing. The Guidelines require an effective program to include “appropriate incentives” and “appropriate disciplinary measures” for engaging in criminal conduct or failing to prevent or detect it.⁵

Records to Keep

Investigation files, signed acknowledgments, training records, and disciplinary documentation all need to be preserved. Under EEOC rules, private employers must retain personnel and employment records for at least one year from the date the record was created or the personnel action occurred, whichever is later. When an employee is involuntarily terminated, records related to that person must be kept for one year from the termination date. If a charge of discrimination has been filed, the employer must retain all records related to the charge until final disposition.¹⁶

Other rules impose longer periods. HIPAA-regulated entities must keep compliance documentation for six years, and industry-specific rules for financial services, government contracting, and healthcare may require even longer retention. The safest approach is to identify every retention requirement that applies to your organization and follow the longest one. Destroying investigation files prematurely can create the appearance of a cover-up and may violate document-preservation obligations if litigation is anticipated.

1
Office of the Law Revision Counsel. United States Code Title 15 Section 7264 – Code of Ethics for Senior Financial Officers
2
Nasdaq Listing Center. Nasdaq 5600 Series – Code of Conduct
3
Acquisition.GOV. 48 CFR 52.203-13 – Contractor Code of Business Ethics and Conduct
4
United States Sentencing Commission. Determining the Appropriate Fine Under the Organizational Guidelines
5
United States Sentencing Commission. 2018 Chapter 8 – Effective Compliance and Ethics Program
6
U.S. Department of Justice. Evaluation of Corporate Compliance Programs
7
U.S. Equal Employment Opportunity Commission. Promising Practices for Preventing Harassment
8
Office of the Law Revision Counsel. 15 U.S. Code 78dd-1 – Prohibited Foreign Trade Practices by Issuers
9
U.S. Equal Employment Opportunity Commission. Know Your Rights: Workplace Discrimination is Illegal
10
Department of Justice. FCPA Resource Guide
11
U.S. Securities and Exchange Commission. SEC Adopts Amendments to Modernize Rule 10b5-1 Insider Trading Plans
12
National Labor Relations Board. Social Media
13
Occupational Safety and Health Administration. OSHA’s Whistleblower Protection Program
14
U.S. Department of Labor. Whistleblower Protections
15
Office of the Law Revision Counsel. United States Code Title 18 Section 1514A – Civil Action to Protect Against Retaliation in Fraud Cases
16
U.S. Equal Employment Opportunity Commission. Summary of Selected Recordkeeping Obligations in 29 CFR Part 1602