Code of Conduct Training: What to Include and How to Do It
What is code of conduct training? 6 topics to cover, how to create a program, delivery methods, and how to make it effective at a growing business.
Code of Conduct Training
What to cover, how to deliver it, and why it matters at every company size
At a previous company, we had a code of conduct. It was a 14-page document that every employee signed during their first week. Nobody read it. I know because when a conflict-of-interest issue surfaced eight months later, the employee involved said: "I did not know that was against policy." He had signed the acknowledgment. He had not understood what he signed.
That is the difference between having a code of conduct and having code of conduct training. The document defines the rules. The training ensures people understand them, can apply them to real situations, and know what to do when they see violations. This guide covers what code of conduct training should include, the six topics every program needs, how to create and deliver training that actually changes behavior, and how often to repeat it. I built training modules and document management into FirstHR because code of conduct training requires both delivering content and collecting signed acknowledgments, and most growing businesses need a single system that handles both.
What Is Code of Conduct Training?
Code of conduct training is structured employee education that covers the behavioral, ethical, and legal standards employees are expected to follow. It goes beyond handing someone a document: it explains what the rules mean, shows how they apply to real workplace situations, and ensures employees know how to report violations.
This guide covers how to train employees on the code of conduct effectively.
Workplace Behavior Training and Ethics Training
Two other names cover most of the same ground. Workplace behavior training is the half about how people treat each other day to day: professionalism, respectful communication, how a disagreement gets handled, what crosses the line into harassment. Ethics training is the half about judgment calls, the situations where no rule reads cleanly.
The two halves fail in different ways, which is why the distinction is worth keeping. Behavior content dies when it stays abstract, so it needs practice: what you actually say to a colleague whose jokes are landing badly. Ethics content dies when the answer is obvious, so it needs situations where a reasonable person could argue the other side.
At a small business you run all of it as one session rather than three programs, and the six topics further down are the agenda for that session. Buying separate courses called behavior, ethics, and conduct gets you three overlapping sets of slides and three signature sheets to chase.
Why Code of Conduct Training Matters
Code of conduct training matters for three reasons, each of which is independently sufficient to justify the investment.
First, legal protection. When an employee files a harassment complaint and the employer cannot demonstrate that the employee received anti-harassment training, courts treat this as evidence that the employer did not take prevention seriously. Six states (CA, CT, DE, IL, ME, NY) mandate anti-harassment training by law, and everywhere else training still cuts legal exposure.
The affirmative defense is where training records do their work. The EEOC describes a narrow escape from liability for harassment by a supervisor, and half of it is the employer showing it took reasonable care to prevent the behavior in the first place. A dated roster with no content behind it does not show that.
Second, behavioral standards. A code of conduct that employees have not been trained on is a document nobody follows. Training transforms abstract policies into concrete expectations: not "act with integrity" but "if a vendor offers you tickets to a game, here is what you do."
Third, culture protection. At growing businesses, culture is fragile. Every new hire either reinforces or dilutes the existing culture. Code of conduct training explicitly communicates "this is how we operate here" to every person who joins. Without it, cultural norms are transmitted informally, inconsistently, and sometimes incorrectly.
Early turnover is part of what informal transmission costs. According to the Work Institute, more than a third of newly hired employees quit within their first year, and the reason they give most often is the job not matching what they expected rather than pay. Expectations about conduct sit inside that gap.
6 Topics Every Code of Conduct Training Should Cover
Regardless of industry or company size, effective code of conduct training covers six core topics. Not every topic requires equal depth: prioritize based on your industry, your regulatory requirements, and the issues most likely to arise at your company.
State Anti-Harassment Training Mandates: The Details That Matter
The first topic in that list is the only one with hard legal deadlines attached for most small businesses, and the requirements are more specific than "six states require it." Each mandate has its own employee-count threshold, its own deadline for new hires, its own duration, and its own refresh cadence. Getting the topic right but the timing wrong still leaves you out of compliance.
| State | Who must be trained | Deadline for new hires | Duration and refresh |
|---|---|---|---|
| California | Employers with 5+ employees: all employees, supervisors and non-supervisors | Within 6 months of hire or of promotion into a supervisory role | 2 hours for supervisors, 1 hour for everyone else, repeated every 2 years |
| Connecticut | Employers with 3+ employees: all employees. Employers under 3: supervisors only | Within 6 months of hire, or of assuming a supervisory position | 2 hours, with supplemental training suggested at least every 10 years |
| Delaware | Employers with 50+ employees. Excludes anyone employed less than 6 months | Within 1 year of starting; supervisors within 1 year of taking the role | Every 2 years, with additional content for supervisors |
| Illinois | All employers, regardless of size: every employee | Employees hired mid-year still need training in that calendar year | Annually. Restaurants and bars have supplemental requirements |
| Maine | Employers with 15+ employees: all employees | Within 1 year of hire; supervisors within 1 year of assuming the role | No refresh interval set in statute; annual practice is the safe default |
| New York | All employers, regardless of size: every employee | State guidance directs training as soon as practicable after hire | Annually, and the training must be interactive |
Three details trip up small employers more than anything else in this area.
The count usually includes people you do not think of as employees. California's five-employee threshold has been read broadly, and the state publishes free online courses precisely because it expects very small employers to be covered.
Temporary and seasonal workers are not exempt either. Under California Government Code 12950.1, anyone hired to work fewer than six months must be trained within 30 calendar days after the hire date or within 100 hours worked, whichever comes first. Run a summer operation and that means training in week one, not at a six-month mark that never arrives.
Remote workers follow the law where they sit, not where you sit. A Texas company with one salesperson living in New York generally owes that person New York's annual interactive training. This is the most common gap I see at distributed small businesses: the founder checks their own state, finds no mandate, and stops. Run the check per employee location rather than per company, rerun it when someone moves, and rerun it again when someone is promoted into a supervisory role, because in California, Connecticut and Maine the promotion starts its own deadline whether or not the person was trained last year.
"Interactive" is a defined term, not an adjective. New York and California both require it, and New York State guidance puts the bar in concrete terms: a web-based course qualifies when it asks questions the employee has to answer correctly, or when the employee can submit a question and get an answer immediately or in a timely manner.
A video with no mechanism for questions and no record of responses does not clear that bar, however good the content is. Build the follow-up channel into the session, and write down what was asked and who answered it. That record is also what proves the session was interactive if a regulator or a plaintiff ever asks.
Washington sits in a category of its own. RCW 49.60.515 reaches hotels, motels, retail businesses, security guard firms and property services contractors that employ an isolated worker, and makes them train managers, supervisors and those isolated employees. It is a mandate on particular industries rather than on every employer in the state.
Several additional states mandate training for public-sector employers only, and others (Vermont, Rhode Island, Massachusetts and Hawaii among them) strongly encourage it without requiring it. Encouragement is not nothing: in those states, having trained is still the evidence you will want if a complaint is filed.
How to Create a Code of Conduct Training Program
Creating code of conduct training does not require an external compliance vendor or a dedicated L&D team. It requires your code of conduct document, real scenarios from your business, and 90 minutes of structured delivery.
| Step | What to Do | Time Investment |
|---|---|---|
| 1. Identify your core topics | Select which of the six topics apply to your business. All six are relevant for most companies, but depth varies by industry. | 30 minutes |
| 2. Write real scenarios | For each topic, create 1-2 scenarios based on situations that have actually happened or could realistically happen at your company. | 1-2 hours |
| 3. Structure the training session | For each topic: state the rule (2 min), present the scenario (3 min), discuss as a group (5 min). Total: 10 min per topic, 60-90 min for all six. | 30 minutes |
| 4. Prepare acknowledgment | Create a document that employees sign confirming they received and understood the training. Include the date, topics covered, and a statement of understanding. | 15 minutes |
| 5. Schedule delivery and refreshers | Train new hires within 30 days. Schedule annual refreshers. Add to the calendar now. | 15 minutes |
Total setup time: approximately 3 to 4 hours for the first time. Annual refresher updates take 1 to 2 hours (update scenarios, add new policies, remove outdated content).
Writing Scenarios That Actually Work
Step 2 above is the step people skip, because writing scenarios is the only part of this that requires thinking. It is also the part that determines whether the session changes behavior. A scenario works when the right answer is not obvious from the wording, when a reasonable person could argue for the wrong answer, and when the situation could plausibly happen at your company next month.
Every scenario I use has the same five parts:
| Part | What it does | How long |
|---|---|---|
| The situation | One paragraph, specific, using roles that exist at your company | 60 seconds to read aloud |
| The ambiguity | The reason a good employee might get this wrong. State it out loud | The heart of the discussion |
| The rule | The exact section of your code that applies, quoted, not paraphrased | 30 seconds |
| The action | What the employee should literally do next: who they tell, in what form, by when | The part people remember |
| The wrong answers | Two plausible responses that are wrong, and why | Where the real learning happens |
Worked scenario one: the gift. A vendor your operations lead has used for three years sends her a $150 gift basket at the holidays, addressed to her home. She has an annual renewal decision with that vendor in February.
The ambiguity is real. The basket is not a bribe by any normal understanding of the word, refusing it feels rude, and she was going to renew anyway. If your code sets a nominal-value threshold, say $50, with disclosure required above it, the rule answers cleanly: disclose in writing to her manager, then return, donate or share it as the policy directs.
The wrong answers are "keep it, it did not affect my judgment" (the standard is the appearance, not the outcome) and "quietly return it and say nothing" (the disclosure exists so the pattern is visible if the vendor tries again).
Government customers change the arithmetic. If any part of your business sells to them, the limits that apply may be far stricter than your internal threshold: under 5 CFR 2635.204, a federal executive branch employee generally cannot accept a gift worth more than $20 per occasion, or more than $50 in a calendar year from any one source.
Worked scenario two: the relationship. A team lead has begun dating someone who reports to him. Both are adults, both say it is consensual, and nobody has complained. The ambiguity is real here too, because employees genuinely do not understand why the company gets a say.
The rule is not about the relationship, it is about the reporting line. A supervisor controls pay, scheduling, performance ratings and continued employment, which makes consent very difficult to establish after the fact and exposes every subsequent personnel decision. The action is a written disclosure to HR or the owner, followed by a change to the reporting structure so neither person evaluates the other.
The wrong answers are "wait until it gets serious" and "disclose it verbally to a peer." Have this scenario ready before you need it, because the first time it comes up you will be improvising in front of someone who is already anxious.
Pull your scenarios from your own history where you can. The conflict-of-interest incident I described at the top of this article became a scenario, with the names and details changed enough that nobody could identify the person. Real situations land differently than invented ones, and employees can tell the difference immediately.
Delivery Methods for Code of Conduct Training
| Method | Best For | Pros | Cons |
|---|---|---|---|
| Live session (in-person or video) | Initial training, small teams | Interactive, allows questions, most effective for behavior change | Requires scheduling, manager time commitment |
| Self-paced online modules | Annual refreshers, distributed teams, compliance documentation | Scalable, trackable, employees complete at own pace | Less interactive, lower engagement without discussion component |
| Hybrid (online module + live discussion) | Growing and mid-size companies | Combines scalability with interactivity. Employees review content first, then discuss in a group. | Requires more planning |
| Third-party compliance courses | Industry-specific requirements (HIPAA, FCPA), state-mandated training | Expert content, legally validated, updated automatically | Per-employee licensing cost, and the content will not reflect your own policies |
For most growing businesses, the practical approach is live sessions for initial training (where discussion matters most) and self-paced modules for annual refreshers (where scalability matters more).
What to Document, and How Long to Keep It
"Documentation is your legal defense" is the kind of sentence that everyone nods along to and nobody acts on, because it does not say what to write down. Here is the specific version.
The reason records matter traces to a pair of 1998 Supreme Court decisions, Faragher v. City of Boca Raton and Burlington Industries v. Ellerth. Both hold that an employer may avoid liability by proving it exercised reasonable care to prevent and correct harassing behavior promptly, and that the employee unreasonably failed to use the opportunities provided.
Training records, a distributed policy and a documented complaint process are how the first half gets proven. The second half is why the reporting procedure has to be genuinely accessible: if your only complaint channel is the person accused, the defense collapses.
One limit gets overlooked. The defense is not available at all when the harassment ended in a tangible employment action such as a firing, demotion or pay cut. In that situation liability attaches whatever the training file holds, which is worth knowing before you treat documentation as a complete answer.
A training record that actually supports that showing contains all of the following. A signature sheet alone does not.
| What to record | Why it matters | Common gap |
|---|---|---|
| Employee name, role, and whether supervisory | Several state mandates set different duration by role | Supervisors trained on the non-supervisory module |
| Date and duration of the session | State mandates specify minimum hours; you have to be able to show them | No start and end time captured |
| Topics covered and the version of the code used | Proves the content matched the policy in force at the time | Code updated, training record still points at the old version |
| Delivery method and who led it | Distinguishes interactive training from passive viewing | Self-paced module with no record of the Q&A channel |
| The materials themselves, archived | Two years later, nobody remembers what was on slide 14 | Deck edited in place, prior version lost |
| Signed acknowledgment with date | Employee confirmation of receipt and understanding | Signed during onboarding week, never repeated |
| Questions asked and answers given | Direct evidence the training was interactive | Nobody takes notes |
On retention: keep training records for the length of employment plus several years afterward, and do not treat the minimum federal personnel-record retention period as your guide. The reason is timing, and the clock that matters runs on the employee side rather than yours.
According to the EEOC, a worker has 180 calendar days to file a charge, extended to 300 days where a state or local agency enforces a law prohibiting the same conduct. A lawsuit can follow well after the charge is resolved.
If a claim lands three years after someone left, the training record from their first month is the document you need, and it needs to still exist. Three years past separation is a reasonable floor for a small business, and longer is cheap when the records are digital.
How Often to Conduct Code of Conduct Training
| Timing | What to Cover | Format |
|---|---|---|
| First 30 days (new hires) | Full training: all six topics with company-specific scenarios and acknowledgment signature | Live session (90 min) or hybrid |
| Annual refresher | Updated scenarios, new policies, reinforcement of key points. Focus on topics where incidents occurred. | Self-paced module (30-60 min) + brief group discussion |
| After policy changes | New or updated policies only. Explain what changed, why, and what employees need to do differently. | Email notification + brief module (15-30 min) |
| After incidents | Relevant topic only. No need to name the specific incident. Reinforce the standard and reporting process. | Team meeting or targeted module (15-30 min) |
| Promotion to management | Supervisor-specific responsibilities: recognizing violations, handling reports, modeling behavior, additional legal requirements | Live session (60 min) |
Common Mistakes in Code of Conduct Training
Five mistakes that turn code of conduct training from a protective measure into a liability. Each one is avoidable.
Frequently Asked Questions
What is code of conduct training?
Code of conduct training is structured employee education that covers the behavioral and ethical standards employees are expected to follow at work. It includes topics like anti-harassment, conflicts of interest, confidentiality, reporting procedures, and professional communication standards. The training ensures employees understand not just the rules but why they exist, how they apply to real situations, and what to do when they see violations.
Is code of conduct training legally required?
No federal law requires a code of conduct, but several components inside one carry their own mandates. Anti-harassment training is required in California, Connecticut, Delaware, Illinois, Maine, and New York, and Washington requires it of hotels, retail businesses, and a few other industries that employ isolated workers. HIPAA obliges covered entities and their business associates to run a security awareness and training program for everyone who handles protected health information. PCI DSS is a card-brand contractual standard rather than a statute, so it reaches you through your merchant agreement instead. The Foreign Corrupt Practices Act mandates no training of its own: the Justice Department and SEC resource guide treats periodic training as a hallmark of an effective compliance program, which is what prosecutors weigh. Everywhere else, documented training is the evidence behind an employer's defense rather than a legal obligation.
How often should code of conduct training be conducted?
At minimum, train during onboarding (first 30 days) and annually thereafter. Additional training should occur when the code of conduct is updated, after a workplace incident that relates to the code, when employees are promoted to management (supervisors often need additional training), and when laws change that affect your policies. Annual refreshers prevent the training from fading into forgotten paperwork.
What should a code of conduct training program include?
Six essential topics: anti-harassment and discrimination (what it is, how to report it), conflicts of interest (financial, personal, and professional conflicts and disclosure requirements), confidentiality and data privacy (handling sensitive information), workplace communication standards (email, social media, representing the company), reporting and whistleblower protections (how to report violations safely), and gifts and anti-bribery (what employees can accept, documentation requirements). Each topic should include real-world examples relevant to your specific business.
How long should code of conduct training take?
Initial training during onboarding should take 1 to 2 hours, covering all six core topics with examples and discussion. Annual refresher training can be shorter, 30 to 60 minutes, focusing on updates, new scenarios, and reinforcement of key points. Anti-harassment training has specific duration requirements in some states: California requires 2 hours for supervisors and 1 hour for non-supervisory employees.
What is the difference between a code of conduct and a code of ethics?
A code of conduct defines specific behavioral rules: what employees should and should not do in concrete situations (gift acceptance limits, social media policies, harassment reporting procedures). A code of ethics defines broader principles and values: integrity, fairness, respect, accountability. The code of ethics is the 'why.' The code of conduct is the 'how.' Most companies combine both into a single document, but the training should cover both the principles and the specific rules.
How do you make code of conduct training effective?
Three practices separate effective training from checkbox exercises. First, use real scenarios from your industry instead of generic examples. Second, make the training interactive: discussion, case studies, and questions rather than a passive document review. Third, demonstrate that leadership follows the same code: employees pay attention to what leaders do, not what the training says. A code of conduct that leadership visibly ignores is worse than no code at all.
Do small businesses need code of conduct training?
Yes. Small businesses face the same ethical and legal risks as large companies, often with less infrastructure to handle them. A harassment complaint at a small business does not receive a gentler legal standard than one at an enterprise. Code of conduct training establishes expectations, provides reporting mechanisms, and creates documentation that protects the business. The training does not need to be elaborate. A 90-minute session covering the six core topics with your company-specific examples is sufficient.