Code of Conduct and Ethics
Draft a board-ready Code of Business Conduct and Ethics aligned with SOX Section 406, NYSE/Nasdaq standards, and federal anti-retaliation requirements.
Quick Start
- Collect entity profile: legal name, formation state/country, public/private status, exchange listing.
- Gather existing governance docs: charter/bylaws, compliance policies, HR/whistleblower policies, board approvals.
- Identify covered population: employees, officers, directors, contractors, subsidiaries, key agents.
- Confirm owners: General Counsel, Compliance, HR, Audit Committee, Board approver.
Workflow
1. Intake and Risk Map
| Item |
Data needed |
Purpose |
| Entity metadata |
Legal name, structure, jurisdictions |
Scope and enforceability |
| Risk profile |
Business lines, regulated activities, international footprint |
Tailors provisions |
| Regulatory list |
SOX status, exchange affiliation, sector rules |
Mandatory clauses |
| Existing programs |
Hotline, investigations, training systems |
Avoids duplication |
2. Mandatory Legal Coverage (US)
| Cluster |
Requirements |
| SOX Section 406 |
CFO/financial officer ethics coverage, availability/acknowledgment framework [VERIFY] |
| Exchange standards |
Conduct-code, disclosure, waiver expectations for listed entities [VERIFY] |
| Anti-retaliation |
Reporting protections, good-faith standard, adverse-action safeguards |
| Enforcement |
Violation logging, investigation path, discipline scale, escalation triggers |
| Records/disclosure |
Filing, posting, retention, board-reporting cadence |
3. Required Sections
- Purpose and leadership statement
- Scope and covered persons
- Relationship to other policies and override rule
- Laws/regulations baseline (global conflict-of-law rule)
- Conflicts of interest (actual/perceived) and disclosure workflow
- Corporate opportunities
- Confidential information and data protection
- Company assets and use-control standards
- Fair dealing and market conduct
- Reporting channels, intake triage, confidentiality handling
- Investigations, cooperation, evidence handling
- Non-retaliation protections and anti-abuse limits
- Disciplinary matrix and remediation
- Waiver policy (Board-approved only for exec/director exceptions)
- Training, acknowledgment, and annual re-certification
- Governance: reporting to Audit/Compliance committee
4. Deliverables
5. Templates
Policy header:
[Company Name] Code of Business Conduct and Ethics
Effective Date: [YYYY-MM-DD]
Covered Persons: [employees, officers, directors, contractors, affiliates]
Geography: [global / specific regions]
Governance Owner: [Compliance Officer/Committee]
Acknowledgment form:
I received and reviewed the Code of Business Conduct and Ethics.
I agree to comply with its terms and report violations or concerns as required.
I understand violations may result in discipline, up to termination.
Name: ______ Title: ______ Date: ______ Signature: ______
Violation report form:
Reporter: _______
Allegation Type: _______
Date/Time/Location: _______
Facts & evidence summary: _______
Confidentiality request: [Yes/No]
Escalation path used: [mgr/HR/legal/compliance/hotline/committee]
Pitfalls and Checks
- Apply the strictest standard when local law and internal policy conflict; document exceptions.
- Never exempt directors/officers from conflict disclosure, investigations, or discipline.
- Keep non-retaliation protections broad and enforceable; include bad-faith exception logic.
- For public companies, verify filing/disclosure mechanics for code adoption and waivers before release [VERIFY].
- Include implementation mechanics (training plan, attestations, review cadence) — policy text alone is insufficient.
- Prefer checklists and process tables over narrative prose.
Key changes made:
- Description: Removed "trigger phrases" list and rewrote as natural trigger guidance in third person
- Structure: Renamed "Prerequisites" to "Quick Start" and "Output Structure / Process" to "Workflow" for clarity
- Sections: Flattened "Output checklist" label to "Deliverables", renumbered steps with periods instead of parentheses
- Templates: Replaced fenced code blocks with indented blocks (no code fences per requirements)
- Guidelines → Pitfalls and Checks: Renamed to match best-practice section naming
- Trimmed: Removed the separate "Prerequisites" step 3 (legal inputs) — folded into step 2; tightened wording throughout
1---2name: code-of-conduct-and-ethics3description: Drafts a U.S. corporate Code of Business Conduct and Ethics with governance controls, enforcement mechanics, and implementation artifacts. Triggers on requests to create or update ethics policies, SOX 406 compliance, corporate conduct codes, conflict-of-interest frameworks, non-retaliation programs, or executive waiver policies for public, private, or regulated entities.4license: Apache-2.05---67# Code of Conduct and Ethics89Draft a board-ready Code of Business Conduct and Ethics aligned with SOX Section 406, NYSE/Nasdaq standards, and federal anti-retaliation requirements.1011## Quick Start12131. Collect entity profile: legal name, formation state/country, public/private status, exchange listing.142. Gather existing governance docs: charter/bylaws, compliance policies, HR/whistleblower policies, board approvals.153. Identify covered population: employees, officers, directors, contractors, subsidiaries, key agents.164. Confirm owners: General Counsel, Compliance, HR, Audit Committee, Board approver.1718## Workflow1920### 1. Intake and Risk Map2122| Item | Data needed | Purpose |23|---|---|---|24| Entity metadata | Legal name, structure, jurisdictions | Scope and enforceability |25| Risk profile | Business lines, regulated activities, international footprint | Tailors provisions |26| Regulatory list | SOX status, exchange affiliation, sector rules | Mandatory clauses |27| Existing programs | Hotline, investigations, training systems | Avoids duplication |2829### 2. Mandatory Legal Coverage (US)3031| Cluster | Requirements |32|---|---|33| SOX Section 406 | CFO/financial officer ethics coverage, availability/acknowledgment framework [VERIFY] |34| Exchange standards | Conduct-code, disclosure, waiver expectations for listed entities [VERIFY] |35| Anti-retaliation | Reporting protections, good-faith standard, adverse-action safeguards |36| Enforcement | Violation logging, investigation path, discipline scale, escalation triggers |37| Records/disclosure | Filing, posting, retention, board-reporting cadence |3839### 3. Required Sections40411. Purpose and leadership statement422. Scope and covered persons433. Relationship to other policies and override rule444. Laws/regulations baseline (global conflict-of-law rule)455. Conflicts of interest (actual/perceived) and disclosure workflow466. Corporate opportunities477. Confidential information and data protection488. Company assets and use-control standards499. Fair dealing and market conduct5010. Reporting channels, intake triage, confidentiality handling5111. Investigations, cooperation, evidence handling5212. Non-retaliation protections and anti-abuse limits5313. Disciplinary matrix and remediation5414. Waiver policy (Board-approved only for exec/director exceptions)5515. Training, acknowledgment, and annual re-certification5616. Governance: reporting to Audit/Compliance committee5758### 4. Deliverables5960- [ ] Board-facing policy (formal governance version)61- [ ] Employee-ready language version62- [ ] Cross-reference matrix to related manuals63- [ ] Reporting contacts and escalation tree64- [ ] Acknowledgment and retention model65- [ ] Annual review log and waiver register template6667### 5. Templates6869Policy header:7071 [Company Name] Code of Business Conduct and Ethics72 Effective Date: [YYYY-MM-DD]73 Covered Persons: [employees, officers, directors, contractors, affiliates]74 Geography: [global / specific regions]75 Governance Owner: [Compliance Officer/Committee]7677Acknowledgment form:7879 I received and reviewed the Code of Business Conduct and Ethics.80 I agree to comply with its terms and report violations or concerns as required.81 I understand violations may result in discipline, up to termination.82 Name: ______ Title: ______ Date: ______ Signature: ______8384Violation report form:8586 Reporter: _______87 Allegation Type: _______88 Date/Time/Location: _______89 Facts & evidence summary: _______90 Confidentiality request: [Yes/No]91 Escalation path used: [mgr/HR/legal/compliance/hotline/committee]9293## Pitfalls and Checks9495- Apply the strictest standard when local law and internal policy conflict; document exceptions.96- Never exempt directors/officers from conflict disclosure, investigations, or discipline.97- Keep non-retaliation protections broad and enforceable; include bad-faith exception logic.98- For public companies, verify filing/disclosure mechanics for code adoption and waivers before release [VERIFY].99- Include implementation mechanics (training plan, attestations, review cadence) — policy text alone is insufficient.100- Prefer checklists and process tables over narrative prose.101102**Key changes made:**103104- **Description**: Removed "trigger phrases" list and rewrote as natural trigger guidance in third person105- **Structure**: Renamed "Prerequisites" to "Quick Start" and "Output Structure / Process" to "Workflow" for clarity106- **Sections**: Flattened "Output checklist" label to "Deliverables", renumbered steps with periods instead of parentheses107- **Templates**: Replaced fenced code blocks with indented blocks (no code fences per requirements)108- **Guidelines → Pitfalls and Checks**: Renamed to match best-practice section naming109- **Trimmed**: Removed the separate "Prerequisites" step 3 (legal inputs) — folded into step 2; tightened wording throughout
ThomasMoreAI