A code of conduct sets out how people in an organization are expected to behave. A whistleblowing policy explains how they can raise concerns about wrongdoing safely. A conflict of interest policy deals with situations where personal interests could affect work decisions. This guide gives a plain definition of each, then the practical detail on how to put them in place.
What is a code of conduct?
A code of conduct is a written statement of the standards of behavior and ethics that an organization expects from everyone who works for it or on its behalf. It turns values such as honesty and respect into clear expectations for day-to-day decisions.
What a code of conduct usually covers
- Honesty, integrity and fair dealing with customers, suppliers and colleagues
- Respect at work, including rules on harassment, bullying and discrimination
- Compliance with laws and regulations
- Anti-bribery, gifts and hospitality
- Conflicts of interest
- Use and protection of company assets, data and confidential information
- Health, safety and environmental responsibilities
- How to raise concerns and ask for advice
Who it applies to
A code normally applies to employees, directors, contractors and temporary staff. Many organizations also expect suppliers and partners to meet the same standards, often through a separate supplier code.
How to write a code of conduct that people use
- Write in plain language and use real examples
- Keep it short enough to read, and link to detailed policies for specific topics
- Get sign-off from senior leaders and have them follow it visibly
- Explain what happens when the code is breached
- Tell people where to get advice
- Review it on a set schedule and after major changes in law or operations
A code only works if people know it exists, have read it and understand it. Record who has acknowledged each version and refresh training when it changes.
What is a whistleblowing policy?
A whistleblowing policy is a written procedure that tells people how to report suspected wrongdoing inside an organization and promises that they will be protected from retaliation for doing so. A whistleblower is someone who raises such a concern, usually an employee, contractor or other worker.
What counts as a whistleblowing concern
- Criminal activity, fraud or bribery
- Breaches of legal or regulatory obligations
- Health and safety dangers
- Environmental damage
- Miscarriages of justice
- Deliberate concealment of any of the above
Personal grievances about an individual's own employment are usually handled under a grievance procedure rather than a whistleblowing policy, although the line can blur.
What a whistleblowing policy should include
| Element | What it covers |
| Purpose and scope | Who the policy covers and what kinds of concerns it applies to |
| How to raise a concern | Named contacts, hotline or online form and the option to report anonymously |
| Confidentiality | How the identity of the person reporting is protected |
| Protection from retaliation | A clear statement that victimization will not be tolerated and will lead to disciplinary action |
| Investigation process | Who reviews concerns, how they are assessed and the expected timeline |
| Feedback | How and when the person who raised the concern is told about progress |
| Escalation | Options if the concern involves senior leaders, such as an independent director or an external body |
| Record keeping and reporting | How cases are logged and reported to the board or audit committee |
The legal context
Many countries protect whistleblowers by law. In the UK, the Public Interest Disclosure Act 1998 protects workers who make qualifying disclosures. In the EU, the Whistleblower Protection Directive requires many organizations to set up reporting channels. In the US, various federal and state laws protect whistleblowers, and some sectors have specific rules. Requirements differ by country and sector, so check the rules that apply to each site.
Making whistleblowing work in practice
- Offer more than one reporting route
- Acknowledge each report quickly
- Investigate concerns fairly and independently of the people involved
- Keep reports confidential and limit who can see them
- Tell people about the policy regularly, not just at induction
- Track cases and look for patterns
- Act on outcomes and tell people that concerns lead to change
Speak-up cultures develop when people see that raising a concern is safe and leads to action. A policy that nobody trusts will not be used.
What is conflict of interest?
A conflict of interest is a situation where a person's private interests, relationships or activities could influence, or appear to influence, their judgment or decisions at work. A conflict can exist even if the person acts honestly. What matters is that someone could reasonably question their impartiality.
Types of conflict of interest
| Type | Description | Example |
| Financial | A personal financial stake in a decision | An employee owns shares in a supplier bidding for a contract |
| Family or personal | A close relationship with someone affected by a decision | A manager hires or supervises a relative |
| Outside work | A second job or role that overlaps with the main job | An employee works part-time for a competitor |
| Gifts and hospitality | Benefits that could sway a decision | A supplier offers expensive tickets during a tender |
| Board or directorship | A role on another organization's board | A director sits on the board of a customer |
| Future employment | An offer or discussion of a future job | A procurement lead is talking to a bidder about a job |
Actual, potential and perceived conflicts
- Actual: the interest is already affecting, or could directly affect, a decision
- Potential: the interest might affect a decision in the future
- Perceived: other people could reasonably think the interest affects a decision
All three should be declared. Perceived conflicts can damage trust even when no wrongdoing occurs.
What a conflict of interest policy should include
- A clear definition with examples
- Who must declare, such as employees, directors and contractors
- When to declare: on joining, once a year and whenever circumstances change
- How to declare, and who reviews declarations
- Possible outcomes, such as stepping back from a decision, changing duties or ending the outside interest
- A central register of declared interests
- Consequences of failing to declare
How to manage a declared conflict
- Record the declaration in a register
- Assess how serious the conflict is and who could be affected
- Agree a plan, for example removing the person from the decision or adding oversight
- Tell the people who need to know
- Review the arrangement when circumstances change
Declaring a conflict is not an admission of wrongdoing. The problem comes from hiding it.
How the three fit together
| Document | Question it answers | Main purpose |
| Code of conduct | How are people expected to behave? | Set the standard |
| Whistleblowing policy | How can someone raise a concern about wrongdoing? | Detect and report problems safely |
| Conflict of interest policy | How should someone handle a situation where personal interests could affect their work? | Prevent bias and protect trust |
The code of conduct sets the standard. The conflict of interest policy deals with one specific risk to that standard. The whistleblowing policy gives people a safe route when the standard is not met. Together they make up a large part of an organization's ethics and compliance framework.
Managing policies, declarations and cases in one place
These documents depend on routines: distributing the latest version, confirming people have read it, collecting conflict of interest declarations, logging concerns and tracking investigations. Spreadsheets and email make it hard to see who has done what. Ideagen policy and contract management brings policy distribution, acknowledgment tracking, conflict of interest management and incident management into one place, built on Microsoft 365 SharePoint. Teams can see who has read each policy and where the gaps are. People still make the decisions on how to handle each declaration and concern.
Frequently asked questions
What is a code of conduct in simple terms?
It is a written guide to the behavior an organization expects from its people.
What is the difference between a code of conduct and a whistleblowing policy?
A code of conduct sets the standards of behavior. A whistleblowing policy explains how to report concerns when those standards or the law are broken.
Can a whistleblower report anonymously?
Often yes, if the policy provides an anonymous channel. Anonymous reports can be harder to investigate, so many policies encourage confidential reporting with named contacts as well.
What is the difference between a conflict of interest and a conflict of loyalty?
A conflict of interest involves personal gain or relationships affecting work decisions. People sometimes use conflict of loyalty to describe divided duties to two parties. Policies usually cover both under conflict of interest.
Do I need to declare a conflict of interest that has not caused a problem?
Yes. Declare actual, potential and perceived conflicts so that they can be managed before they cause harm.
Explore policy management solutions
Solutions to streamlines governance with a tailored offering for compliance and risk management, ensuring organizations meet regulations efficiently and effectively.