The gift basket in December
A new accounts payable clerk finds a gift basket on her desk in the second week of December. It comes from a freight carrier whose invoices she processes, with a card offering two tickets to a playoff game. She opens the code of conduct, a 46-page PDF she signed on her first day, and searches for "gift". The search fails, because the PDF is a scanned image. She scrolls to a section called "Business courtesies", which says gifts must be "of nominal value" and "consistent with local custom", and that questions should go to "the appropriate function".
She asks the person at the next desk, who says everybody keeps those. The example is illustrative, and the failure is a familiar one: the code exists, it was signed, and it did not help with the one decision it was needed for.
A code of ethics that people actually read is less a document than a set of answers. The work is to find the decisions employees face, answer each in plain language, give the limits as numbers, and name a person to ask.
Prosecutors ask whether people use it
The DOJ's Evaluation of Corporate Compliance Programs, updated in September 2024 and still the latest version on the Criminal Division's compliance page as of November 2026, treats the code as a threshold question. It asks whether the company has a code of conduct that is "accessible and applicable to all company employees".
The questions on accessibility are specific. Prosecutors are told to ask how policies have been communicated to employees and relevant third parties, whether there are language barriers for staff abroad, and whether policies have been "published in a searchable format for easy reference". They also ask how the company confirms that employees know how to access policies, and whether it tracks access to see which policies attract the most attention.
The same document asks what guidance resources employees have, and how the company has assessed whether employees know when to seek advice and whether they would be willing to do so. A scanned PDF with a generic mailbox fails most of those questions before anyone reads a word.
Culture is now in the standard
ISO 37001, the international standard for anti-bribery management systems, was revised in February 2025. According to the certification bodies DNV and DQS, the 2025 edition formally introduces the concept of anti-bribery culture, gives it its own clause (5.1.3), and adds a more complete treatment of conflicts of interest, including procedures for reporting potential and actual conflicts. DQS notes that certified organizations must move to the new version by 28 February 2027.
Even if you never seek certification, the direction is useful. A standard that writes culture into its requirements is asking whether the program changes behavior, not whether the binder exists. A code built around decisions gives you something to measure.
Write it as decisions
Four rules make the difference between a code people sign and a code people use:
- Organize by situation, not by statute. "Someone offers you a gift" is a better heading than "Anti-corruption". People search for what is in front of them.
- Open each section with the decision. Then answer it in steps. The explanation of why comes after, for those who want it.
- Use numbers. Set a gift limit, a disclosure deadline, an approval threshold. A reader cannot apply "reasonable".
- Name the person. A role and a direct contact, plus the speak-up channel for anything they would rather not raise with a manager.
Keep the policy rationale and legal references in a short appendix, and keep the decision pages on the company intranet as searchable web pages rather than a PDF.
Three decision trees to copy
Adjust the limits to your own policies. The structure is the point.
Someone outside the company offers you something
- Is it cash, a gift card, a loan or a payment of your personal expenses? Decline. No exceptions.
- Are you involved in a live decision that affects them, such as a bid, renewal, invoice dispute or audit? Decline, and tell your manager it was offered.
- Is it worth more than $100, or is it travel or tickets? Ask the compliance contact before accepting. Approval is recorded.
- Would you be comfortable if it appeared in the vendor file your auditors read? If not, decline.
- Otherwise, accept it and record it in the gifts log within five business days.
You have an interest that touches your work
- Does it involve a vendor, customer, competitor or colleague you deal with? This includes a relative who works there, an investment, a side business or a board seat.
- If yes, disclose it on the conflicts form before your next decision involving them, and at each annual certification.
- Are you the person who approves, pays or evaluates them? Step aside. Your manager reassigns the decision and records it.
- Are you unsure whether it counts? Disclose anyway. A disclosure is not an admission, and a conflict the company knows about can usually be managed.
If the conflict involves a director or officer, the related-party process applies as well; see related-party transactions: policy, approval and disclosure.
You want to use an AI tool for work
- Is the tool on the approved list? If not, do not use it for company work. Ask for it to be reviewed.
- Will you enter confidential information, such as customer data, employee data, bank details or unreleased results? Only in tools approved for that tier of data.
- Will the output go to a customer, a regulator, an auditor or the ledger? You are responsible for it. Check it against the source, and say where AI was used if the policy for that output requires it.
- Are you asking it to create or alter a record of fact, such as a receipt, invoice, approval or signature? Never. That is falsifying a record, whatever tool does it.
- Did something go wrong, such as confidential data entered by mistake or a wrong output that was used? Report it the same day. Early reports are treated as reports, not misconduct.
The AI section needs its own page
The September 2024 DOJ guidance asks whether controls ensure AI is used only for its intended purposes, how accountability for AI use is monitored and enforced, and how employees are trained on emerging technologies such as AI. A code is where employees first meet those expectations.
Keep the AI page short. State the principle (people remain responsible for their work), link to the approved tools list rather than naming tools in the code, and include the decision tree above. Update the list monthly, the code itself yearly.
The conflicts section needs examples
Conflicts are where generic language fails worst, because people rarely see their own situation in a definition. Give six to ten short examples drawn from your own business: the buyer whose brother-in-law owns a supplier, the controller with shares in a customer, the engineer who consults for a competitor at weekends. Say for each whether it must be disclosed and what usually happens next.
Check that it is used
Once the decision pages are live, you can measure them. Track page views and on-site search terms; the DOJ asks about tracking access to policies. Count questions to the compliance contact by topic. Add two or three scenario questions to the annual certification and see where answers diverge. If the gifts page gets no views in December, the code is not being read.
Where to start
Pick the three decisions employees ask about most, usually gifts, conflicts and AI use, and rewrite only those sections first as searchable pages with numbers and a named contact. Then make sure the speak-up route is just as easy to find; our guide to whistleblower hotline setup for smaller companies covers that half. For a full redesign of the code and the reporting channel together, see Code of Conduct & Speak-Up Programs.