At a glance
| Document type | HR policy template |
|---|---|
| Issued by | Employer |
| Templates included | 3 ready to use versions |
| Download format | Word (.docx) |
| Statutory reference | None cited on this page |
| Last reviewed | 26 August 2026 |
| Maintained by | Engage HR editorial team |
Code of conduct, employee handbook and disciplinary procedure
Three documents that overlap and are often combined into one. Each answers a different question, and a single merged document tends to answer none of them clearly.
| Code of conduct | Employee handbook | Disciplinary procedure | |
|---|---|---|---|
| Question it answers | What behaviour is required, and what is not acceptable. | How the organisation works: leave, pay cycles, benefits, who to ask. | How a suspected breach is investigated and decided. |
| Who relies on it | Managers making a judgement, and the inquiry that follows. | Employees looking something up. | HR and the inquiry officer running a case. |
| Tone | Prescriptive. Rules a person either met or did not. | Explanatory. Written to be read once and referred back to. | Procedural. Steps, timelines and who decides. |
| How often it changes | Rarely. Changes to the standard need announcing and re-acknowledging. | Often, as processes and benefits change. | Rarely, and changes mid-case are difficult to defend. |
| Failure mode | Written as values, so nothing can be found to have breached it. | Grown past the length anyone reads. | Skipped, which undoes whatever the code said. |
How a code of conduct is structured
A workable code has nine parts. The order matters, because the sections most often needed in a hurry should be the easiest to find.
- Control block. Owner, approving authority, version, effective date, what it supersedes and the next review date.
- Purpose and scope. Who it binds. Employees, and usually also contractors, consultants, interns and anyone acting for the organisation. Say which.
- Standards of behaviour. The core. Conduct at work, conduct towards colleagues, conduct towards customers and suppliers, and conduct outside work where it affects the organisation.
- Conflicts of interest. What must be declared, to whom, and by when. Outside employment, directorships, family relationships in the supply chain, personal investments in competitors.
- Gifts, hospitality and improper payments. What may be accepted, what must be declared, and what is prohibited outright.
- Information, systems and assets. Confidentiality, personal data, use of company systems, and what happens to information on exit.
- Categories of breach. Graded, with examples. This is the section that makes the code usable.
- Reporting a concern. How to raise something, what protection the person raising it has, and where the separate channels are for harassment and for whistleblowing.
- Acknowledgement. How assent is recorded, at joining and on each material change.
Keep the disciplinary procedure in its own document and cross-refer to it. A code that also contains the procedure has to be reissued whenever the procedure changes, which means the standard gets reopened every time a process detail moves.
3 policy templates
Code of Conduct for full code of conduct template
The complete structure with the drafting notes in brackets. Written for an organisation large enough to have separate functions owning parts of it.
[Company Name] CODE OF CONDUCT Policy owner: [Owner Designation] Approved by: [Approving Authority] Version: [Version Number] Effective from: [Effective Date] Supersedes: [Previous Version and Date, or "None"] Next review: [Review Date] 1. PURPOSE This Code sets out the standards of behaviour [Company Name] requires of everyone who works for it or acts on its behalf. It states what is expected, what is not acceptable, and what follows when the standard is not met. 2. SCOPE 2.1 This Code applies to all employees of [Company Name] at all locations, and to trainees and interns. 2.2 It also applies to [Categories, for example consultants, contract staff and agency personnel] while engaged on [Company Name] work or present at [Company Name] premises. 2.3 Where a person is covered by certified standing orders applicable to the establishment, those prevail over this Code to the extent of any inconsistency. 3. STANDARDS OF BEHAVIOUR 3.1 At work. You will perform the duties assigned to you honestly and to the standard the role requires, follow lawful instructions from those authorised to give them, and be present and available during your working hours. 3.2 Towards colleagues. You will treat colleagues with respect. Abuse, intimidation, threats, physical violence and persistent behaviour that a reasonable person would find humiliating are prohibited. Complaints of sexual harassment are dealt with under [Policy Name] and not under this Code. 3.3 Towards customers, suppliers and the public. You will deal with them honestly, will not make commitments outside your authority, and will not make statements on behalf of [Company Name] unless authorised to do so. 3.4 Substances. Attending work under the influence of alcohol or a controlled substance is prohibited. [Where applicable: consumption on [Company Name] premises is prohibited except at events authorised in writing by [Approving Role].] 3.5 Outside work. [Company Name] does not regulate your private life. Conduct outside work is within this Code only where it is unlawful and relevant to your role, damages [Company Name] in a way that can be identified, or involves a colleague, customer or supplier in a way that affects the workplace. 3.6 Public statements and social media. You will not present a personal view as [Company Name]'s, will not disclose [Company Name] information, and will not identify a customer without written permission from [Approving Role]. 4. CONFLICTS OF INTEREST 4.1 You must declare to [Declaration Recipient], in writing and within [Declaration Period] of it arising: any outside employment or engagement; any directorship or partnership; any financial interest in a competitor, customer or supplier beyond [Threshold Description]; and any close personal or family relationship with a person at a competitor, customer or supplier, or with a person you supervise or whose work you assess. 4.2 A declared conflict is not by itself a breach. Failing to declare one is. 4.3 [Declaration Recipient] records declarations in the conflicts register and decides what safeguard applies, which may include removing you from a decision, reassigning an account, or changing a reporting line. 5. GIFTS, HOSPITALITY AND IMPROPER PAYMENTS 5.1 You may not offer, give, request or accept any payment or benefit intended to improperly influence a decision, whether in [Company Name]'s favour or against it. This applies without exception and regardless of local practice. 5.2 Gifts of nominal value and ordinary business hospitality may be accepted, up to the limits set out in Annexure [Reference], and must be recorded in the gifts register where they exceed [Threshold Description]. 5.3 Cash, cash equivalents and gifts to family members may not be accepted at any value. 5.4 Anything offered during a live tender, negotiation or evaluation must be declined and reported to [Declaration Recipient] on the same day. 6. INFORMATION, SYSTEMS AND ASSETS 6.1 Confidentiality. You will not disclose [Company Name] or customer information to anyone who does not need it for [Company Name] work, during or after your employment. 6.2 Personal data. You will access personal data only where your role requires it, use it only for the purpose it was collected for, and follow [Data Policy Name]. 6.3 Systems. [Company Name] systems are provided for work. Incidental personal use is permitted where it does not interfere with your duties or breach any other clause. Sharing credentials, bypassing controls and installing unapproved software are prohibited. 6.4 On exit. All [Company Name] information, equipment and records are to be returned. Retaining copies in personal storage or personal accounts is a breach and remains one after employment ends. 7. CATEGORIES OF BREACH 7.1 Minor breach. Addressed by the reporting manager through counselling and, where it recurs, a written warning. Examples: [Example], [Example]. 7.2 Serious breach. Addressed under [Disciplinary Procedure Name] and may result in a written warning, withholding of increment or promotion, transfer or suspension. Examples: [Example], [Example]. 7.3 Gross breach. Addressed under [Disciplinary Procedure Name] and may result in the ending of employment. Examples: theft or misappropriation; falsification of records, claims or credentials; disclosure of confidential information; accepting an improper payment; physical violence; and wilful damage to [Company Name] property. 7.4 The examples above are illustrative and not exhaustive. The category applied depends on the facts, and is decided under [Disciplinary Procedure Name] rather than under this Code. 8. REPORTING A CONCERN 8.1 A concern about conduct under this Code may be raised with your reporting manager, with [Declaration Recipient], or through [Reporting Channel]. 8.2 Complaints of sexual harassment go to [ICC Contact] under [POSH Policy Name]. Concerns about financial impropriety or wrongdoing may be raised under [Whistleblower Policy Name], which carries its own protections. 8.3 [Company Name] will not permit retaliation against anyone who raises a concern in good faith. Retaliation is itself a serious breach of this Code. 9. ACKNOWLEDGEMENT 9.1 Every person within scope acknowledges this Code on joining and on each material revision. 9.2 [Owner Designation] maintains the record of acknowledgements and the register of material revisions. 10. REVIEW This Code is reviewed by [Owner Designation] on or before [Review Date], and earlier if a change in law or in the organisation requires it.
Code of Conduct for short code for a small company
Under roughly fifty people, the full structure is more document than the organisation can maintain. This version keeps the enforceable parts and drops the machinery.
[Company Name] CODE OF CONDUCT Owner: [Owner Designation] | Approved by: [Approving Authority] Version: [Version Number] | Effective from: [Effective Date] | Next review: [Review Date] 1. WHO THIS APPLIES TO Everyone who works at [Company Name], including employees, interns and anyone engaged on a contract while doing [Company Name] work. 2. WHAT WE EXPECT 2.1 Do the work assigned to you honestly and to the standard your role requires. 2.2 Treat colleagues with respect. Abuse, threats, intimidation and violence are not tolerated, at any level and in any direction. 2.3 Be honest in what you record. Timesheets, expense claims, customer records, test results and credentials are relied on by other people. 2.4 Do not commit [Company Name] to anything outside your authority, and do not speak for [Company Name] publicly unless [Approving Role] has asked you to. 2.5 Do not attend work under the influence of alcohol or a controlled substance. 3. CONFLICTS OF INTEREST 3.1 Tell [Declaration Recipient] in writing, within [Declaration Period], if you take outside work, hold a directorship, have a financial interest in a competitor, customer or supplier, or have a close personal relationship with someone at one of them, with someone you supervise, or with someone whose work you assess. 3.2 Having a conflict is not a problem in itself. Not telling us is. 4. GIFTS AND PAYMENTS 4.1 Never offer or accept anything intended to influence a decision improperly. 4.2 Ordinary business hospitality is fine. Anything beyond [Threshold Description] should be mentioned to [Declaration Recipient]. Cash is never acceptable. 4.3 Anything offered while a deal, tender or evaluation is live must be declined and reported the same day. 5. INFORMATION AND SYSTEMS 5.1 [Company Name] and customer information stays confidential, during your employment and after it. 5.2 Access personal data only where your job needs it, and only for the purpose it was collected for. 5.3 Do not share your login, work around security controls, or install unapproved software. 5.4 When you leave, return everything and keep no copies in personal storage or personal accounts. 6. IF SOMETHING GOES WRONG 6.1 Most issues are dealt with by a conversation with your manager. Where that is not appropriate, speak to [Declaration Recipient]. 6.2 Serious matters, including dishonesty, falsification, disclosure of confidential information, accepting an improper payment and violence, are dealt with under [Disciplinary Procedure Name] and can lead to the ending of employment. 6.3 Complaints of sexual harassment go to [ICC Contact] under [POSH Policy Name], not through this Code. 6.4 Nobody will be penalised for raising a concern honestly. Retaliating against someone who does is itself a serious breach. 7. ACKNOWLEDGEMENT You confirm that you have read this Code and agree to follow it. Name: [Employee Name] | Employee code: [Employee Code] Signature: ____________________ | Date: [Date]
Code of Conduct for annual acknowledgement and conflicts declaration
The form that keeps the code alive. Run it yearly, and treat a nil declaration as a positive statement rather than as silence.
[Company Name] ANNUAL CODE OF CONDUCT ACKNOWLEDGEMENT AND CONFLICTS DECLARATION Declaration period: [Period Covered] Return by: [Return Deadline] Return to: [Declaration Recipient], [Contact Details] PART A: EMPLOYEE DETAILS Name: [Employee Name] Employee code: [Employee Code] Designation: [Designation] Department: [Department] Location: [Location] Reporting manager: [Manager Name] PART B: ACKNOWLEDGEMENT I confirm that: 1. I have read the [Company Name] Code of Conduct, version [Version Number], effective [Effective Date]. 2. I understand the standards it sets and that a breach may be dealt with under [Disciplinary Procedure Name]. 3. I have complied with it during [Period Covered], except as disclosed in Part C or Part D below. 4. I am not aware of any breach by another person that I have not reported. PART C: CONFLICTS OF INTEREST Do you have any of the following? Mark each line. 1. Outside employment, consultancy or business activity: [Yes / No] 2. A directorship, partnership or proprietorship: [Yes / No] 3. A financial interest in a competitor, customer or supplier beyond [Threshold Description]: [Yes / No] 4. A close personal or family relationship with a person employed by a competitor, customer or supplier: [Yes / No] 5. A close personal or family relationship with a person you supervise, whose work you assess, or who assesses yours: [Yes / No] 6. Any other circumstance in which your personal interest could conflict with your duties: [Yes / No] For each Yes, give details: Item number: [Item Number] Nature of the interest: [Description] Parties involved: [Names and Entities] When it arose: [Period] Whether previously declared, and to whom: [Previous Declaration Details] PART D: GIFTS AND HOSPITALITY RECEIVED List anything received during [Period Covered] above [Threshold Description]. From: [Giver and Entity] | What: [Description] | Approximate value: [Value Description] | Date: [Date] | Declared at the time: [Yes / No] If nothing is to be declared, state: NIL PART E: DECLARATION The information I have given is complete and accurate. I understand that an incomplete or inaccurate declaration is itself a breach of the Code. Signature: ____________________ | Date: [Date] PART F: FOR COMPLETION BY [DECLARATION RECIPIENT] Received on: [Date] Entries added to the conflicts register: [Yes / No / Not applicable] Safeguard applied, if any: [Description of Safeguard] Referred to [Approving Authority]: [Yes / No] Decided by: [Name and Designation] | Date: [Date]
What it has to contain
| Element | Why it matters |
|---|---|
| A scope clause naming every category it binds | Contractors, consultants, interns and agency staff sit outside the employment relationship, so a code that says it applies to employees does not reach them. The organisations most exposed to conduct risk from third parties are usually the ones whose code never mentioned them. |
| Graded categories of breach with examples | Without grading, every breach looks like a dismissal case, so managers avoid raising anything until it is unavoidable. Naming minor, serious and gross categories with examples is what makes the code something a manager will actually use on a Tuesday. |
| A conflicts of interest clause with a named recipient and a deadline | A duty to declare needs a named recipient, or it goes undischarged and nobody notices. Naming the person, the form and the period converts an aspiration into something whose breach is a fact rather than a judgement. |
| A cross-reference to the disciplinary procedure | The code sets the standard, the procedure decides the case. Keeping them separate lets the procedure be revised without reopening the standard, and stops the code from implying that a breach leads automatically to a particular outcome. |
| Signposting to the separate harassment and whistleblowing channels | Complaints of sexual harassment and disclosures about wrongdoing have their own routes and their own protections. A code that absorbs them into a general conduct process sends complainants to the wrong place and strips them of protections that were meant to attach. |
| A non-retaliation clause that is itself enforceable | A promise not to retaliate means little unless retaliation is a breach with a consequence. Stating it as a serious breach of the code is what gives the promise something behind it. |
| A recorded acknowledgement, refreshed on material change | The most common defence to a conduct case is that the person did not know the rule. A dated acknowledgement against a named version answers that, and an acknowledgement taken once at joining does not answer it for a clause added three years later. |
How to write one
- Establish what already binds the organisation. Certified standing orders where the establishment is covered, any settlement or service rules, and the terms of the appointment letter all sit around the code. Draft after reading them, because a code that contradicts one of them creates a conflict the employer does not win.
- Start from the cases you have actually had. Go through the conduct issues of the past two or three years and check whether the draft code would have covered each one clearly. This produces a shorter and far more useful document than starting from a generic template, and it surfaces the gaps that matter to this organisation.
- Write every clause so a manager can apply it. Take each sentence and ask whether a reporting manager could decide, from the text alone, whether something breached it. Anything that requires interpretation of a value rather than assessment of a fact is not yet a rule.
- Grade the breaches and give examples. Sort the conduct into minor, serious and gross, and give two or three examples in each. Say expressly that the examples are illustrative and that the category applied depends on the facts, so the grading guides without binding the inquiry.
- Get it approved at the right level. A code is the reference an inquiry relies on, so it should be approved by the board or the senior body rather than issued by a function. Approval at the wrong level is the first thing challenged when the code is relied on in a difficult case.
- Roll it out with a briefing, not an email. Walk managers through the grading and the reporting routes, because they are the people who will apply it. Send the document to everyone with the acknowledgement, and keep the record of who acknowledged which version.
- Run the annual declaration. Once a year, ask everyone to reaffirm and to declare conflicts, gifts and outside interests. This is what keeps the conflicts register accurate and what turns the code from a joining formality into something the organisation is actively maintaining.
The difference between a rule and a value
Most codes of conduct fail at the same point, and it is visible in the first page. They describe the kind of organisation the employer wants to be rather than the conduct it requires.
Consider two versions of the same clause. The first says that employees are expected to act with the highest standards of professional integrity. The second says that employees will not falsify a record, a claim, a test result or a credential, and that doing so is a gross breach of the code. Only the second can be applied. A manager reading the first has to decide what integrity means, and an inquiry relying on it has to persuade someone that a particular act fell below an undefined standard. A manager reading the second has to establish a fact.
The test to apply to a draft is narrow. For each sentence, ask whether a reporting manager with no legal training could decide, from that sentence alone, whether a described incident breached it. Sentences that pass are rules. Sentences that fail are values, and values belong in a short preamble rather than in the operative body of the code.
None of this means the values are worthless. A statement of what the organisation cares about does real work in setting tone and in recruiting. It just cannot carry the weight of a disciplinary case, and codes that ask it to are the ones that collapse when tested.
Grading breaches, and why it matters more than the list
The section employers spend least time on is usually the one that decides whether the code gets used at all.
A code that lists prohibited conduct without grading it puts every breach on the same footing. In practice, that means a manager who notices something small has two options: ignore it, or begin a formal process that feels disproportionate. Almost every manager chooses the first. Conduct then builds up unaddressed until it becomes serious enough that action is unavoidable. At that point the record shows years of tolerance followed by a sudden escalation, which is a poor position for the employer and an unfair one for the employee.
Three categories are usually enough. Minor breaches, dealt with by the manager through a conversation and, on recurrence, a written warning. Serious breaches, dealt with formally, with outcomes short of the ending of employment. Gross breaches, where the ending of employment is a possible outcome. Two or three examples in each category tell a manager where a new situation sits.
Two drafting cautions. Say expressly that the examples are illustrative and not exhaustive, or the code becomes an argument about whether a particular act appears on a list. And say that the category applied is decided under the disciplinary procedure on the facts, so the grading guides the manager without pre-deciding the outcome of an inquiry that has not happened yet.
Conflicts of interest and the unkept register
A working conflicts clause has four components. A list of what must be declared, specific enough to be useful. A named recipient. A period running from when the circumstance arises. And a statement that declaring is not a breach, but failing to declare is. Behind it there has to be a register someone reads.
Conflict of interest clauses are close to universal and are among the least effective provisions in most codes, because they impose a duty without building the mechanism the duty needs.
The typical clause tells employees to avoid conflicts of interest and to declare them. It does not say to whom, in what form, within what period, or what happens next. The predictable result is that nothing is declared. The employer then discovers a conflict from another direction and finds it difficult to say what obligation was breached, because the obligation was never made specific enough to breach.
A working clause has four components. A list of what must be declared, specific enough to answer the question people actually have. That means outside work, directorships, financial interests above a stated threshold, family relationships in the supply chain, and relationships with someone the person supervises or assesses. A named recipient. A period, running from when the circumstance arises. And a statement that declaring is not itself a breach, but failing to declare is.
Behind the clause there has to be a register and someone who reads it. The point of a declaration is to allow a safeguard: removing someone from a decision, reassigning an account, changing a reporting line. A declaration filed and never acted on gives the employer notice without giving it protection, which is arguably a worse position than not asking.
The annual reaffirmation is what keeps this alive. Circumstances change, and a declaration made at joining is stale within a year. Asking once a year, and treating a nil return as a positive statement rather than as silence, is the difference between a register that reflects the organisation and one that reflects who joined recently.
Conduct outside work
The clause that causes the most argument, and the one most often drafted too widely.
The temptation is to write something broad: conduct that brings the organisation into disrepute. Applied literally, that reaches an employee's political opinions, their private relationships and their weekend. Employers rarely intend that reach and generally cannot sustain it, but a clause drafted that widely invites a challenge on exactly those grounds the first time it is used, even where the actual conduct in question was serious.
A narrower formulation holds up better. Private life is outside the employer's concern. Conduct outside work comes within the code in three defined situations: where it is unlawful and relevant to the person's role, where it causes identifiable damage to the organisation, and where it involves a colleague, customer or supplier in a way that affects the workplace. Each of those requires the employer to show something specific, which is the discipline a wide clause lacks.
Social media sits inside this and deserves its own short clause, because the failure mode is different. The risk is rarely an opinion. It is a personal view being read as the organisation's, an unreleased product or a customer being named, or internal information appearing where competitors read it. Writing the clause around those three things is more useful than a general instruction to be careful online, and it is far easier for an employee to comply with.
Common mistakes
| Mistake | Why it causes trouble | What to do instead |
|---|---|---|
| Writing values instead of rules | "We act with integrity and treat one another with respect" cannot be breached in any way anyone can demonstrate. When a case arises, the inquiry has nothing to test the conduct against, and the outcome rests on whoever argues more persuasively. | Keep a short values statement if the organisation wants one, and follow it with rules that describe conduct in terms of facts a manager can establish. |
| One category of breach | Every breach is potentially dismissible, so managers do not raise small things, and the first time anything is formally recorded the conduct has been running for a year. The record then shows tolerance followed by a sudden escalation. | Grade the breaches with examples, and make it explicit that minor matters are dealt with by the manager without a formal process. |
| Merging the code and the disciplinary procedure | Any change to the process reopens the standard, and the combined document implies that a particular breach leads automatically to a particular outcome, which is not how an inquiry works. | Keep them as separate documents with a cross-reference in each. Version and approve them independently. |
| Absorbing harassment complaints into the code | Complaints that should go to the internal committee under the organisation's harassment policy are routed to a line manager under a general conduct process, and the complainant loses the protections and the procedure that were meant to apply. | State in the code that harassment complaints go to the named committee under the named policy, and repeat the signpost wherever conduct towards colleagues is described. |
| A conflicts clause with nowhere to declare | Employees are told to avoid conflicts of interest with no named recipient, no form and no deadline. Nothing is ever declared, and when a conflict surfaces the employer cannot show the person failed to do anything specific. | Name the recipient, set a period, provide the form, and keep a register. Then run the declaration annually so the register stays current. |
| Acknowledgement taken once, at joining | The code is revised twice over five years. An employee is charged under a clause added after they joined and says they never saw it. The acknowledgement on file is against a version that did not contain the clause. | Record acknowledgement against a version number and date, and take a fresh acknowledgement on every material revision. |
Frequently asked questions
What should a code of conduct for employees include?
A control block with owner and version, and a scope clause naming every category it binds. Standards of behaviour at work and towards colleagues and customers, conflicts of interest with a named recipient and deadline, gifts and improper payments, and information and systems use. Then graded categories of breach with examples, reporting routes including the separate harassment and whistleblowing channels, and an acknowledgement.
Is a code of conduct legally required in India?
No general statute requires a private employer to publish one. Its value is that it is the standard a disciplinary process points back to. Separately, an establishment covered by certified standing orders is bound by those, and they sit above anything the code says.
What is the difference between a code of conduct and an employee handbook?
The code states the behaviour required and what happens when it is not met. The handbook explains how the organisation works: leave, pay cycles, benefits and who to ask. The code is prescriptive and changes rarely; the handbook is explanatory and changes often, which is why they are better kept apart.
Should the disciplinary procedure be part of the code of conduct?
Better not. Keeping them separate lets the procedure be revised without reopening the standard, and stops the code from implying that a given breach leads automatically to a given outcome. Cross-refer from each document to the other.
Does a code of conduct apply to contractors and interns?
Only if it says so. Contractors, consultants, interns and agency staff sit outside the employment relationship, so a code stated to apply to employees does not reach them. Name each category in the scope clause and make acknowledgement part of onboarding for all of them.
How often should a code of conduct be reviewed?
Annually is common, and a review date should be in the control block. What matters more than the calendar is re-acknowledgement: every material revision needs a fresh, dated acknowledgement against the new version number, or an employee can say they never saw the clause being applied to them.
Can an employee be dismissed for breaching the code of conduct?
The code identifies which breaches may lead to that outcome. Whether it follows in a given case is decided under the disciplinary procedure, on the facts, after the employee has had an opportunity to answer the allegation. The code does not by itself determine the outcome of an inquiry.
How should a code of conduct deal with sexual harassment complaints?
By signposting rather than absorbing them. Complaints of sexual harassment go to the internal committee under the organisation's harassment policy, which carries its own procedure and protections. Routing them through a general conduct process sends the complainant to the wrong place and removes safeguards that were meant to apply.
Keeping the code acknowledged in Engage
Engage records acknowledgement against a version number and date, so when a clause is added the system knows who has accepted the new version and who has not, and the reminder goes only to the second group. Conflicts declarations run off the same record, which keeps the register something you can read rather than a folder of returned forms.
Book a demo