Plenty of businesses have a code of conduct somewhere. It arrived inside a policy pack years ago, nobody has read it since onboarding, and if you asked three managers what it actually requires, you would get three answers. That is a normal state of affairs in small business, and it is worth fixing, because a workplace code of conduct has quietly become one of the more legally useful documents an employer can hold.
This guide explains what a code of conduct is, why it matters more than it used to, what to include, and how to write and enforce one that holds up when it is tested. No rates, no thresholds: this is about behaviour, expectations and the document that connects them.
What a code of conduct is, and is not
A code of conduct is the document that sets the standard of behaviour expected of everyone in the business: how people treat each other, clients and the organisation's resources and reputation. It states principles and boundaries. It is deliberately broader than any single rule, and it applies to everyone, from the newest casual to the owner.
Code, policies and contracts do different jobs
The code sits at the top of a small hierarchy, and confusion between the layers is where enforcement problems start:
- The code of conduct states the behavioural standard: respect, honesty, integrity, professionalism, safety.
- Specific policies operationalise it: a social media policy, a drug and alcohol policy, a conflict of interest procedure, an acceptable use policy for technology.
- The employment contract creates the legal relationship and typically requires compliance with policies as lawful and reasonable directions, without incorporating them as contractual terms.
A code that tries to be all three at once becomes unenforceable in practice: too vague to discipline against, too rigid to survive its first unusual case. Keep the code principled and short, and let the policies carry the detail.
Why it matters legally
A code of conduct is not itself required by legislation. What the law increasingly requires is what a good code delivers: documented behavioural standards, communicated to employees, applied consistently. Three legal doors connect to it.
The dismissal connection
When an employer dismisses an employee for misconduct, the Fair Work Commission asks whether there was a valid reason and whether the process was fair. A clear, communicated code of conduct does real work here: it establishes that the employee knew the standard, that the standard was reasonable, and that breaching it has consequences. The reverse is also true. A code nobody was shown, or one enforced against one employee and ignored for another, undermines the dismissal it was supposed to support. Consistency is not a nicety, it is the evidentiary point.
The positive duty connection
Since December 2023, the Australian Human Rights Commission has held enforcement powers over the positive duty under section 47C of the Sex Discrimination Act: employers must take reasonable and proportionate measures to eliminate sexual harassment, sex-based harassment, sex discrimination and hostile workplace environments, as far as possible. The AHRC's compliance guidance is built around seven standards, and one of them, Knowledge, expressly expects a documented policy addressing respectful behaviour and unlawful conduct, communicated and trained. A code of conduct is the natural home of that standard. The full framework is covered in the positive duty explained in full.
The same logic runs through work health and safety law: behavioural standards, and the willingness to enforce them, are part of managing psychosocial hazards in the workplace, because bullying, harassment and poor behavioural norms are recognised hazards, not HR-only problems.
What to include
The strongest codes are short, specific to the business, and written in plain language. The core content:
Behaviour and respect
The standard of conduct expected towards colleagues, clients and the public: courtesy, professionalism and the explicit statement that bullying, harassment, sexual harassment, discrimination and victimisation are unacceptable. Name the behaviours. A code that says "treat everyone with respect" and stops there gives a manager nothing to point to when a specific behaviour needs to be addressed.
Conflicts of interest
What a conflict of interest looks like in your business, and the rule: disclose it. Secondary employment, supplier relationships, family members in the hiring process, gifts and hospitality above a stated threshold. The obligation is disclosure and management, not the pretence that conflicts never arise.
Confidentiality and company resources
The handling of confidential and sensitive information, both the business's and clients', and the acceptable use of company resources: systems, vehicles, cards, accounts. This is also where the interaction with privacy obligations lives, stated at the level of principle with the detail in policy.
Conduct outside work hours
The hardest boundary to draft and the one disputes test hardest. Out-of-hours conduct is the employee's own business unless it has a real connection to employment: conduct at work functions, conduct towards colleagues on social media, public statements that identify the employer, criminal conduct incompatible with the role. State the connection test rather than claiming blanket coverage, because a code that overreaches into private life reads as unreasonable, and unreasonable standards are hard to enforce.
Compliance with laws and policies
A general obligation to comply with applicable laws and regulations and with the business's specific policies, which keeps the code aligned with the policy layer beneath it.
Who the code applies to
State the coverage explicitly: employees of every type including casuals, and, where practical, contractors, labour hire workers and volunteers working under the business's direction. A behavioural standard that evaporates at the boundary of the employment contract does not manage the risk, because a client does not distinguish between the employee and the contractor who behaved badly under your brand. For non-employees the enforcement mechanism is the commercial arrangement rather than discipline, but the standard itself should be the same, and the code should say so.
Writing it so it holds up
Two drafting rules separate codes that work from codes that decorate a drive. First, write for the reader, not the lawyer: short sentences, concrete examples, the business's own core values in its own words. An employee code of conduct that people can actually remember is enforceable in a way a ten-page legal document is not. Second, make the consequences clause honest and flexible: breaches may result in disciplinary action up to and including dismissal, with serious misconduct handled under its own procedure. Avoid rigid tariff lists that promise a first written warning for everything, because the one case where you need to move straight to dismissal will be the case where your own code says you cannot.
Tailor it. A hospitality venue's code deals with alcohol, cash handling and customer conduct. A professional services firm's code deals with client confidentiality and conflicts. A template code written for nobody protects nobody, and it signals to a tribunal exactly how much thought went into the standard being enforced.
Enforcing it consistently
A code of conduct earns its keep at enforcement time, and enforcement is where many businesses let it down. The pattern that works:
- Communicate it: at onboarding, with acknowledgement recorded, and again whenever it changes.
- Train managers on it, because they apply the standard daily, informally, long before HR ever hears about a problem.
- Apply it consistently, including to senior people and strong performers. Selective enforcement is the fastest way to lose both the culture argument and the legal one.
- Follow the process when a breach arises: put the specific conduct and the specific code provision to the employee, hear their response, and decide on the evidence.
When a breach becomes a disciplinary matter, the code is evidence, not a verdict. The question is always whether this conduct, by this employee, in these circumstances, justified this response. If your business is heading into that territory and the documentation is thin, getting the framework right first matters: a documented policy framework built for your business is a faster and cheaper fix than defending an unfair dismissal claim with a code nobody signed.
Keeping it alive
A code of conduct is a living document. Review it on a fixed cycle, and additionally whenever the law moves or the business changes shape: new obligations like the positive duty, new risks like generative AI use, new work patterns like remote teams all belong in the next revision. Reissue it, capture fresh acknowledgements, and retire the old version so only one standard exists at a time. A dated code quietly stops being evidence of a maintained standard and starts being evidence of neglect.
The businesses that get value from a code treat it as part of the work culture rather than a compliance artefact: leaders model it, managers reference it in ordinary conversations, and it gets used long before anything becomes formal. That is what "reasonable and proportionate measures" look like in practice, and it is also, not coincidentally, what good workplaces look like.
