Your Code of Conduct Is a 40-Page PDF Nobody Reads. Here's How to Fix That.

The acknowledgement was never the point. The behaviour was. And there is a wide, well-documented gap between the two that most Indian organisations have quietly decided to live with.

This matters more than it used to. For listed companies, a code of conduct for the board and senior management is a regulatory requirement under SEBI's Listing Obligations and Disclosure Requirements, with an annual affirmation of compliance disclosed in the corporate governance report. Directors' duties under Section 166 of the Companies Act, 2013 set a statutory baseline for conflicts and good faith. And in any inquiry — a POSH complaint, a fraud investigation, a bribery allegation — one of the first questions asked is: what did the company do to make its standards known? "We emailed a PDF" is an answer. It is not a good one.

Why don't employees read the code of conduct?

Because it is written to protect the company rather than guide the employee, it appears only at onboarding and annual sign-off, and one generic version speaks to nobody's actual job.

The typical Indian corporate code of conduct is written by lawyers, for regulators, in the language of both. It is comprehensive, defensible, and almost perfectly designed not to be read. Three structural problems do most of the damage.

1. It is written to protect the company, not to guide the employee

A code drafted primarily as a legal shield reads like one: definitions, cross-references to policies, and clauses that begin with "employees shall not." It answers the question "what can we point to in a dispute?" rather than the question employees actually have, which is "what do I do in this situation?" The result is a document that is legally complete and behaviourally empty.

2. It arrives without context and disappears without reinforcement

Most employees meet the code exactly twice: once during onboarding, buried in a stack of joining formalities, and once a year at acknowledgement time. Nothing about that schedule matches how ethical decisions actually occur — in the middle of a deal negotiation, a Diwali gifting season, a hiring conversation, a procurement approval. The code is absent at every moment it is needed.

3. One document, every role, no relevance

A sales manager negotiating with government buyers, a procurement executive shortlisting vendors, and a software engineer with access to production data face completely different conduct risks. A single generic document treats them identically, which means it speaks specifically to none of them. Employees learn early that the code is not about their job — and they stop looking to it for answers.

"In almost every internal investigation, the misconduct was preceded by a moment of genuine uncertainty — a point where the employee did not know the rule, did not know who to ask, and made a guess. The code existed. It just wasn't in the room."

Is a signed code of conduct acknowledgement enough?

No. A signature shows the code was sent, not that it was understood, and inquiries look for evidence of a genuine effort to ensure understanding.

There is a persistent belief that a signed acknowledgement transfers responsibility to the employee: they signed, so they knew. Inquiry committees, courts, and regulators are increasingly unimpressed by this logic. What they look for instead is whether the organisation made a genuine effort to ensure understanding — the same standard Indian jurisprudence applies to POSH Act awareness obligations and that global regulators like the US Department of Justice apply when evaluating compliance programmes: is it a paper programme, or is it real?

The practical test is simple. If your programme's only measurable output is a completion percentage, it is a paper programme. A real programme can show what employees were taught, in what form, how their understanding was assessed, how often it was refreshed, and how the content differed by role and risk. That evidence is what stands up in front of an audit committee, a SEBI inquiry, or an opposing counsel — and, more importantly, it is what actually changes decisions on the ground.

What does an effective code of conduct programme look like?

The fix is not a shorter PDF (although that helps). It is treating the code as a curriculum rather than a document — something employees practise, not something they acknowledge. The organisations that get this right build their programmes around five design principles.

1. Lead with dilemmas, not clauses. Adults learn conduct from situations, not statements. "A vendor you shortlisted invites you to his daughter's wedding — do you attend?" teaches more about gifts, hospitality and conflicts in thirty seconds than three pages of policy text. Every module should be built around decision points where the right answer is genuinely unclear until the principle is understood.
2. Make it role-relevant. Procurement gets vendor-integrity and kickback scenarios. Sales gets gifts, entertainment and government-interface situations. Managers get a track of their own — because they are the ones employees actually ask, and an untrained manager's wrong answer becomes the de facto policy for their whole team.
3. Use real (anonymised) cases. Nothing lands like "this happened here" or "this happened at a company like ours." A conduct programme that draws on genuine Indian cases — the ghost-vendor scheme, the undisclosed relative on the supplier list, the Diwali hamper that crossed a line — signals that the code describes reality, not theory.
4. Refresh in moments that matter, not on anniversaries. Short, targeted refreshers timed to risk — a gifts-and-hospitality nudge before the festive season, a conflicts refresher before annual declarations, a data-handling reminder when someone changes role — outperform any annual campaign. Frequency beats duration.
5. Assess understanding and keep the records. Scenario-based assessments, not recall quizzes. Track scores, completion and refresher history by role. This is the audit trail that converts your training from an HR activity into demonstrable evidence of a functioning programme.

Why do managers matter most in a code of conduct programme?

When an employee faces a grey area, they do not open the PDF. They ask their manager — usually informally, usually in a corridor or a chat message. Whatever the manager says in that moment is the code of conduct, as far as that employee is concerned. This is the single most under-invested layer in Indian conduct programmes.

Managers need training the general population does not: how to respond when someone discloses a potential conflict, how to escalate without punishing the question, how to avoid the reflexive "don't worry about it" that quietly authorises misconduct. They also need to understand the areas where employee questions cluster most — gifts and entertainment, moonlighting and side businesses, relatives in the value chain, use of company information. Many of these are conflict-of-interest questions at heart; our guide to the eight conflict of interest questions employees are afraid to ask covers the exact scenarios managers are most likely to face.

How do you fix a code of conduct programme in 90 days?

Diagnose in the first 30 days, rebuild the content in the next 30, then launch with assessment and risk-timed refreshers built in.

Days 1–30: Diagnose. Run a short, anonymous scenario quiz across a sample of employees — five realistic dilemmas, role-relevant, no policy language. The gap between your acknowledgement rate and your correct-answer rate is your true exposure, and it will tell you which risk areas and which populations to prioritise.

Days 31–60: Rebuild the content. Distil the code into a short, plain-language principles document (the 40-page version can remain as the legal reference). Build role-based scenario modules for your three highest-risk populations first — typically procurement, sales and people managers. Anchor every module in decisions, not definitions.

Days 61–90: Launch and instrument. Roll out with assessment built in, schedule risk-timed refreshers for the year ahead, and set up the reporting your audit committee should actually see: understanding scores by role and risk area, not completion percentages.

Our Code of Conduct training course is built on exactly this model — scenario-driven, role-aware, and fully tracked for audit evidence. Because conflicts of interest are the single largest source of grey-area questions, most organisations pair it with our Conflict of Interest course so that declarations season becomes an informed exercise rather than a guessing game. For formats and rollout options, see our code of conduct training hub.

A code of conduct that nobody reads is not a compliance asset. It is a liability with a table of contents. The organisations that treat conduct as a taught, practised, measured capability are the ones whose employees make the right call when nobody is watching — which is the only moment that ever mattered.