An organization should adopt and maintain a code (or codes) of conduct tailored to its particular business needs and culture. A code of conduct may be a summary of current policies and procedures that affect all employees or it may be a separately-created official policy of the organization. It may also be referred to as a code of ethics or a code of business conduct. Although the terms are different, the content and purpose of these instruments are sufficiently similar – they act as a set of principles to guide individual conduct. A code is particularly powerful when internal controls are weak, incomplete or nonexistent – and for the countless occasions when individuals encounter the unexpected or undefined risk.

When preparing a code of conduct, an organization must be mindful of legal mandates and the voluntary policies it wishes to establish and enforce. Established values should be clearly articulated in the code of conduct. A very small organization may use a mission, vision and values statement as the primary content of the code of conduct, while large entities may include detailed policy on a wide variety of compliance and ethics issues. An organization must do more than issue a written code of conduct that sits on a shelf. The code, and compliance with its terms, must be managed and monitored to ensure the principles and practices established by the code are honored and observed within the organization. The organization must demonstrate enforcement of the code.

Principles
> Participation from multiple stakeholders
> Participation from multiple levels of the organization
> Understandable
> Addresses all legal mandates and requirements
> Addresses voluntary policies and values