Code of Conduct Training: What to Include and How to Do It
What is code of conduct training? 6 topics to cover, how to create a program, delivery methods, and how to make it effective at a growing business.
Code of Conduct Training
What to cover, how to deliver it, and why it matters at every company size
At a previous company, we had a code of conduct. It was a 14-page document that every employee signed during their first week. Nobody read it. I know because when a conflict-of-interest issue surfaced eight months later, the employee involved said: "I did not know that was against policy." He had signed the acknowledgment. He had not understood what he signed.
That is the difference between having a code of conduct and having code of conduct training. The document defines the rules. The training ensures people understand them, can apply them to real situations, and know what to do when they see violations. This guide covers what code of conduct training should include, the six topics every program needs, how to create and deliver training that actually changes behavior, and how often to repeat it. I built training modules and document management into FirstHR because code of conduct training requires both delivering content and collecting signed acknowledgments, and most growing businesses need a single system that handles both.
What Is Code of Conduct Training?
Code of conduct training is structured employee education that covers the behavioral, ethical, and legal standards employees are expected to follow. It goes beyond handing someone a document: it explains what the rules mean, shows how they apply to real workplace situations, and ensures employees know how to report violations.
This guide covers how to train employees on the code of conduct effectively.
Workplace Behavior Training and Ethics Training
Two other names cover most of the same ground. Workplace behavior training is the half about how people treat each other day to day: professionalism, respectful communication, how a disagreement gets handled, what crosses the line into harassment. Ethics training is the half about judgment calls, the situations where no rule reads cleanly.
The two halves fail in different ways, which is why the distinction is worth keeping. Behavior content dies when it stays abstract, so it needs practice: what you actually say to a colleague whose jokes are landing badly. Ethics content dies when the answer is obvious, so it needs situations where a reasonable person could argue the other side.
At a small business you run all of it as one session rather than three programs, and the six topics further down are the agenda for that session. Buying separate courses called behavior, ethics, and conduct gets you three overlapping sets of slides and three signature sheets to chase.
Why Code of Conduct Training Matters
Code of conduct training matters for three reasons, each of which is independently sufficient to justify the investment.
First, legal protection. When an employee files a harassment complaint and the employer cannot demonstrate that the employee received anti-harassment training, courts treat this as evidence that the employer did not take prevention seriously. Research from SHRM emphasizes that documented training is a critical component of an employer's affirmative defense. Six states (CA, CT, DE, IL, ME, NY) mandate anti-harassment training by law, but even in states without mandates, training significantly reduces legal exposure.
Second, behavioral standards. A code of conduct that employees have not been trained on is a document nobody follows. Training transforms abstract policies into concrete expectations: not "act with integrity" but "if a vendor offers you tickets to a game, here is what you do."
Third, culture protection. At growing businesses, culture is fragile. Every new hire either reinforces or dilutes the existing culture. Code of conduct training explicitly communicates "this is how we operate here" to every person who joins. Without it, cultural norms are transmitted informally, inconsistently, and sometimes incorrectly. Research from the Work Institute shows that cultural fit issues are a significant driver of early turnover.
6 Topics Every Code of Conduct Training Should Cover
Regardless of industry or company size, effective code of conduct training covers six core topics. Not every topic requires equal depth: prioritize based on your industry, your regulatory requirements, and the issues most likely to arise at your company.
State Anti-Harassment Training Mandates: The Details That Matter
The first topic in that list is the only one with hard legal deadlines attached for most small businesses, and the requirements are more specific than "six states require it." Each mandate has its own employee-count threshold, its own deadline for new hires, its own duration, and its own refresh cadence. Getting the topic right but the timing wrong still leaves you out of compliance.
| State | Who must be trained | Deadline for new hires | Duration and refresh |
|---|---|---|---|
| California | Employers with 5+ employees: all employees, supervisors and non-supervisors | Within 6 months of hire or of promotion into a supervisory role | 2 hours for supervisors, 1 hour for everyone else, repeated every 2 years |
| Connecticut | Employers with 3+ employees: all employees. Employers under 3: supervisors only | Within 6 months of hire, or of assuming a supervisory position | 2 hours, with supplemental training suggested at least every 10 years |
| Delaware | Employers with 50+ employees. Excludes anyone employed less than 6 months | Within 1 year of starting; supervisors within 1 year of taking the role | Every 2 years, with additional content for supervisors |
| Illinois | All employers, regardless of size: every employee | Employees hired mid-year still need training in that calendar year | Annually. Restaurants and bars have supplemental requirements |
| Maine | Employers with 15+ employees: all employees | Within 1 year of hire; supervisors within 1 year of assuming the role | No refresh interval set in statute; annual practice is the safe default |
| New York | All employers, regardless of size: every employee | State guidance directs training as soon as practicable after hire | Annually, and the training must be interactive |
Three details trip up small employers more than anything else in this area.
The count usually includes people you do not think of as employees. California's five-employee threshold has been read broadly, and the state provides free online courses precisely because it expects very small employers to be covered. Temporary and seasonal workers are not exempt: in California, someone hired to work fewer than six months must be trained within 30 calendar days or 100 hours worked, whichever comes first. If you run a summer operation, that means training in the first week, not at the six-month mark that never arrives.
Remote workers follow the law where they sit, not where you sit. A Texas company with one salesperson living in New York generally owes that person New York's annual interactive training. This is the most common gap I see at distributed small businesses: the founder checks their own state, finds no mandate, and stops. Run the check per employee location rather than per company, rerun it when someone moves, and rerun it again when someone is promoted into a supervisory role, because in California, Connecticut and Maine the promotion starts its own deadline whether or not the person was trained last year.
"Interactive" is a defined term, not an adjective. New York and California both require the training to be interactive, which the state guidance describes in concrete terms: employees must be able to ask questions and receive answers, whether live or through a documented follow-up channel, and the training should include participation such as questions, feedback or scenario responses rather than passive viewing. A video with no mechanism for questions and no record of responses does not meet that bar, even if the content is perfect.
Several additional states mandate training for public-sector employers only, and others (Vermont, Rhode Island, Massachusetts and Hawaii among them) strongly encourage it without requiring it. Encouragement is not nothing: in those states, having trained is still the evidence you will want if a complaint is filed.
How to Create a Code of Conduct Training Program
Creating code of conduct training does not require an external compliance vendor or a dedicated L&D team. It requires your code of conduct document, real scenarios from your business, and 90 minutes of structured delivery.
| Step | What to Do | Time Investment |
|---|---|---|
| 1. Identify your core topics | Select which of the six topics apply to your business. All six are relevant for most companies, but depth varies by industry. | 30 minutes |
| 2. Write real scenarios | For each topic, create 1-2 scenarios based on situations that have actually happened or could realistically happen at your company. | 1-2 hours |
| 3. Structure the training session | For each topic: state the rule (2 min), present the scenario (3 min), discuss as a group (5 min). Total: 10 min per topic, 60-90 min for all six. | 30 minutes |
| 4. Prepare acknowledgment | Create a document that employees sign confirming they received and understood the training. Include the date, topics covered, and a statement of understanding. | 15 minutes |
| 5. Schedule delivery and refreshers | Train new hires within 30 days. Schedule annual refreshers. Add to the calendar now. | 15 minutes |
Total setup time: approximately 3 to 4 hours for the first time. Annual refresher updates take 1 to 2 hours (update scenarios, add new policies, remove outdated content).
Writing Scenarios That Actually Work
Step 2 above is the step people skip, because writing scenarios is the only part of this that requires thinking. It is also the part that determines whether the session changes behavior. A scenario works when the right answer is not obvious from the wording, when a reasonable person could argue for the wrong answer, and when the situation could plausibly happen at your company next month.
Every scenario I use has the same five parts:
| Part | What it does | How long |
|---|---|---|
| The situation | One paragraph, specific, using roles that exist at your company | 60 seconds to read aloud |
| The ambiguity | The reason a good employee might get this wrong. State it out loud | The heart of the discussion |
| The rule | The exact section of your code that applies, quoted, not paraphrased | 30 seconds |
| The action | What the employee should literally do next: who they tell, in what form, by when | The part people remember |
| The wrong answers | Two plausible responses that are wrong, and why | Where the real learning happens |
Worked scenario one: the gift. A vendor your operations lead has used for three years sends her a $150 gift basket at the holidays, addressed to her home. She has an annual renewal decision with that vendor in February. The ambiguity is that the basket is not a bribe by any normal understanding of the word, refusing it feels rude, and she was going to renew anyway. If your code sets a nominal-value threshold, say $50, with disclosure required above it, the rule answers the question cleanly: disclose it in writing to her manager, and either return it, donate it or share it with the team as the policy directs. The wrong answers are "keep it, it did not affect my judgment" (the standard is the appearance, not the outcome) and "quietly return it and say nothing" (the disclosure exists so the pattern is visible if the vendor tries again). Note the sharp edge here: if any part of your business sells to government customers, the applicable limits may be far stricter than your internal threshold. Federal executive branch employees generally cannot accept gifts worth more than $20 per occasion, capped at $50 per year from any one source, and offering something above that puts your employee in the position of causing a violation.
Worked scenario two: the relationship. A team lead has begun dating someone who reports to him. Both are adults, both say it is consensual, and nobody has complained. The ambiguity is real: employees genuinely do not understand why the company gets a say. The rule is not about the relationship, it is about the reporting line. A supervisor controls pay, scheduling, performance ratings and continued employment, which means consent is very difficult to establish after the fact and every subsequent personnel decision is exposed. The action is a written disclosure to HR or the owner, followed by a change to the reporting structure so neither person evaluates the other. The wrong answers are "wait until it gets serious" and "disclose it verbally to a peer." Have this scenario ready before you need it, because the first time it comes up you will be improvising in front of someone who is already anxious.
Pull your scenarios from your own history where you can. The conflict-of-interest incident I described at the top of this article became a scenario, with the names and details changed enough that nobody could identify the person. Real situations land differently than invented ones, and employees can tell the difference immediately.
Delivery Methods for Code of Conduct Training
| Method | Best For | Pros | Cons |
|---|---|---|---|
| Live session (in-person or video) | Initial training, small teams (5-30 people) | Interactive, allows questions, most effective for behavior change | Requires scheduling, manager time commitment |
| Self-paced online modules | Annual refreshers, distributed teams, compliance documentation | Scalable, trackable, employees complete at own pace | Less interactive, lower engagement without discussion component |
| Hybrid (online module + live discussion) | Companies with 20-100 employees | Combines scalability with interactivity. Employees review content first, then discuss in a group. | Requires more planning |
| Third-party compliance courses | Industry-specific requirements (HIPAA, FCPA), state-mandated training | Expert content, legally validated, updated automatically | Cost per employee ($20-$75), may not reflect your specific policies |
For most growing businesses, the practical approach is live sessions for initial training (where discussion matters most) and self-paced modules for annual refreshers (where scalability matters more).
What to Document, and How Long to Keep It
"Documentation is your legal defense" is the kind of sentence that everyone nods along to and nobody acts on, because it does not say what to write down. Here is the specific version.
The reason records matter traces to a pair of 1998 Supreme Court decisions, Faragher v. City of Boca Raton and Burlington Industries v. Ellerth, which established an affirmative defense in supervisor harassment cases. To use it, an employer has to show two things: that it exercised reasonable care to prevent and promptly correct harassing behavior, and that the employee unreasonably failed to use the reporting channels the employer provided. Training records, a distributed policy and a documented complaint process are how the first half gets proven. The second half is why the reporting procedure has to be genuinely accessible: if your only complaint channel is the person accused, the defense collapses. And note the limit that gets overlooked: the defense is not available at all when the harassment resulted in a tangible employment action such as a firing, demotion or pay cut.
A training record that actually supports that showing contains all of the following. A signature sheet alone does not.
| What to record | Why it matters | Common gap |
|---|---|---|
| Employee name, role, and whether supervisory | Several state mandates set different duration by role | Supervisors trained on the non-supervisory module |
| Date and duration of the session | State mandates specify minimum hours; you have to be able to show them | No start and end time captured |
| Topics covered and the version of the code used | Proves the content matched the policy in force at the time | Code updated, training record still points at the old version |
| Delivery method and who led it | Distinguishes interactive training from passive viewing | Self-paced module with no record of the Q&A channel |
| The materials themselves, archived | Two years later, nobody remembers what was on slide 14 | Deck edited in place, prior version lost |
| Signed acknowledgment with date | Employee confirmation of receipt and understanding | Signed during onboarding week, never repeated |
| Questions asked and answers given | Direct evidence the training was interactive | Nobody takes notes |
On retention: keep training records for the length of employment plus several years afterward, and do not treat the minimum federal personnel-record retention period as your guide. The reason is timing. An employee has 180 days to file a charge with the EEOC, extended to 300 days in states with their own fair employment agency, and a lawsuit can follow well after that. If a claim lands three years after someone left, the training record from their first month is the document you need, and it needs to still exist. Three years past separation is a reasonable floor for a small business; longer is cheap when the records are digital.
How Often to Conduct Code of Conduct Training
| Timing | What to Cover | Format |
|---|---|---|
| First 30 days (new hires) | Full training: all six topics with company-specific scenarios and acknowledgment signature | Live session (90 min) or hybrid |
| Annual refresher | Updated scenarios, new policies, reinforcement of key points. Focus on topics where incidents occurred. | Self-paced module (30-60 min) + brief group discussion |
| After policy changes | New or updated policies only. Explain what changed, why, and what employees need to do differently. | Email notification + brief module (15-30 min) |
| After incidents | Relevant topic only. No need to name the specific incident. Reinforce the standard and reporting process. | Team meeting or targeted module (15-30 min) |
| Promotion to management | Supervisor-specific responsibilities: recognizing violations, handling reports, modeling behavior, additional legal requirements | Live session (60 min) |
Common Mistakes in Code of Conduct Training
Five mistakes that turn code of conduct training from a protective measure into a liability. Each one is avoidable.
Frequently Asked Questions
What is code of conduct training?
Code of conduct training is structured employee education that covers the behavioral and ethical standards employees are expected to follow at work. It includes topics like anti-harassment, conflicts of interest, confidentiality, reporting procedures, and professional communication standards. The training ensures employees understand not just the rules but why they exist, how they apply to real situations, and what to do when they see violations.
Is code of conduct training legally required?
The code of conduct itself is not federally mandated, but several components within it are legally required. Anti-harassment training is mandatory in California, Connecticut, Delaware, Illinois, Maine, and New York. Data privacy training (HIPAA, PCI DSS) is required for employees handling sensitive information. Anti-bribery training is required under FCPA for companies with international operations. Even where not legally required, code of conduct training significantly reduces legal liability in harassment and discrimination lawsuits.
How often should code of conduct training be conducted?
At minimum, train during onboarding (first 30 days) and annually thereafter. Additional training should occur when the code of conduct is updated, after a workplace incident that relates to the code, when employees are promoted to management (supervisors often need additional training), and when laws change that affect your policies. Annual refreshers prevent the training from fading into forgotten paperwork.
What should a code of conduct training program include?
Six essential topics: anti-harassment and discrimination (what it is, how to report it), conflicts of interest (financial, personal, and professional conflicts and disclosure requirements), confidentiality and data privacy (handling sensitive information), workplace communication standards (email, social media, representing the company), reporting and whistleblower protections (how to report violations safely), and gifts and anti-bribery (what employees can accept, documentation requirements). Each topic should include real-world examples relevant to your specific business.
How long should code of conduct training take?
Initial training during onboarding should take 1 to 2 hours, covering all six core topics with examples and discussion. Annual refresher training can be shorter, 30 to 60 minutes, focusing on updates, new scenarios, and reinforcement of key points. Anti-harassment training has specific duration requirements in some states: California requires 2 hours for supervisors and 1 hour for non-supervisory employees.
What is the difference between a code of conduct and a code of ethics?
A code of conduct defines specific behavioral rules: what employees should and should not do in concrete situations (gift acceptance limits, social media policies, harassment reporting procedures). A code of ethics defines broader principles and values: integrity, fairness, respect, accountability. The code of ethics is the 'why.' The code of conduct is the 'how.' Most companies combine both into a single document, but the training should cover both the principles and the specific rules.
How do you make code of conduct training effective?
Three practices separate effective training from checkbox exercises. First, use real scenarios from your industry instead of generic examples. Second, make the training interactive: discussion, case studies, and questions rather than a passive document review. Third, demonstrate that leadership follows the same code: employees pay attention to what leaders do, not what the training says. A code of conduct that leadership visibly ignores is worse than no code at all.
Do small businesses need code of conduct training?
Yes. Small businesses face the same ethical and legal risks as large companies, often with less infrastructure to handle them. A harassment complaint at a 15-person company does not receive a gentler legal standard than one at a 15,000-person company. Code of conduct training establishes expectations, provides reporting mechanisms, and creates documentation that protects the business. The training does not need to be elaborate. A 90-minute session covering the six core topics with your company-specific examples is sufficient.