Writing a code of conduct people actually read (and use)
Most codes of conduct are lawyer-written, employee-ignored, and never referenced when it matters. Here's the structure that works — principles, examples, and…
- Principles + concrete examples + clear paths. If any one is missing, the document is decoration.
- Annual acknowledgement is a SOC 2 control AND a culture moment. Don't waste it on a click-through.
- Reporting paths must offer at least three options: manager, HR, anonymous/external. Equal-status.
- Live the document: cite it in decisions, reference it in onboarding, refresh it annually.
A code of conduct is only useful when an employee uses it as a reference under stress. That means it has to be readable, specific, and structurally available — three reporting paths, at least one of which doesn't go through their manager.
The structure
- Why we have this (½ page).
- 5-7 principles, each one sentence.
- For each principle: 2-3 'looks like' examples and 1-2 'doesn't look like' examples.
- What to do if you see a violation (3 paths).
- Consequences spectrum (coaching → formal → termination).
- Acknowledgement + annual refresh.
Examples beat principles alone
- Disagreeing in the meeting and aligning after
- Naming harm without labelling the person
- Apologising specifically when wrong
- Eye-rolls and side conversations in meetings
- Public criticism of named individuals
- 'I was just joking' as a defence
Reporting paths
- Manager (default, fastest, but conflicted when manager is involved).
- HRBP / People (named individual; not a generic inbox).
- Anonymous / external (third-party ethics hotline or ombudsperson).
- Each path describes: who sees it, response SLA, what happens next, retaliation protection.
Keeping it alive
If your last update was 3+ years ago, nobody trusts it. Annual refresh: review what enforcement actions you took, add examples from real cases (anonymised), update where the world changed (remote work, AI tools, social media). Publish the changelog.
Read next
All playbooksA whistleblower program is judged the day after the first hard report. Design for that day — multi-channel intake, named protections, independent…
An anti-harassment program is five linked components, not a single training. Here's the end-to-end design, with specifics on bystander training, the named…
Most internal comms is reactive — fires, leaks, surprises. A working model has four channels with different cadences, audiences, and owners.