Code of Conduct Training: What to Include and How to Do It
What is code of conduct training? 6 topics to cover, how to create a program, delivery methods, and how to make it effective at a growing business.
Code of Conduct Training
What to cover, how to deliver it, and why it matters at every company size
At a previous company, we had a code of conduct. It was a 14-page document that every employee signed during their first week. Nobody read it. I know because when a conflict-of-interest issue surfaced eight months later, the employee involved said: "I did not know that was against policy." He had signed the acknowledgment. He had not understood what he signed.
That is the difference between having a code of conduct and having code of conduct training. The document defines the rules. The training ensures people understand them, can apply them to real situations, and know what to do when they see violations.
This guide covers what code of conduct training should include, the six topics every program needs, how to create and deliver training that changes behavior, and how often to repeat it. I built training modules and document management into FirstHR because code of conduct training requires both delivering content and collecting signed acknowledgments, and most growing businesses need a single system that handles both.
What Is Code of Conduct Training?
Code of conduct training is structured employee education that covers the behavioral, ethical, and legal standards employees are expected to follow. It goes beyond handing someone a document: it explains what the rules mean, shows how they apply to real workplace situations, and ensures employees know how to report violations.
Workplace Behavior Training and Ethics Training
Two other names cover most of the same ground. Workplace behavior training is the half about how people treat each other day to day: professionalism, respectful communication, how a disagreement gets handled, what crosses the line into harassment. Ethics training is the half about judgment calls, the situations where no rule reads cleanly.
The two halves fail in different ways, which is why the distinction is worth keeping. Behavior content dies when it stays abstract, so it needs practice: what you actually say to a colleague whose jokes are landing badly. Ethics content dies when the answer is obvious, so it needs situations where a reasonable person could argue the other side.
At a small business you run all of it as one session rather than three programs, and the six topics further down are the agenda for that session. Buying separate courses called behavior, ethics, and conduct gets you three overlapping sets of slides and three signature sheets to chase.
Why Code of Conduct Training Matters
Code of conduct training matters for three reasons, and any one of them would justify the investment on its own.
First, legal protection. When an employee files a harassment complaint and the employer cannot demonstrate that the employee received anti-harassment training, courts can treat this as evidence that the employer did not take prevention seriously. Six states (CA, CT, DE, IL, ME, NY) mandate anti-harassment training by law, and everywhere else training still cuts legal exposure.
Training records do their real work in the affirmative defense. The Equal Employment Opportunity Commission (EEOC) describes it as a narrow escape from liability for harassment by a supervisor, and half of it is the employer showing it reasonably tried to prevent the behavior and to correct it promptly. A dated roster with no content behind it does not show that.
Second, behavioral standards. A code of conduct that employees have not been trained on is a document nobody follows. Training transforms abstract policies into concrete expectations: not "act with integrity" but "if a vendor offers you tickets to a game, here is what you do."
Third, culture protection. At growing businesses, culture is fragile. Every new hire either reinforces or dilutes the existing culture. Code of conduct training explicitly communicates "this is how we operate here" to every person who joins. Without it, cultural norms are transmitted informally, inconsistently, and sometimes incorrectly.
Early turnover is part of what informal transmission costs. According to the Work Institute, more than a third of newly hired employees quit within their first year, and the common reasons it names include unclear job expectations, insufficient onboarding, and a lack of support from leadership. Expectations about conduct fall under the first of those, unclear job expectations.
6 Topics Every Code of Conduct Training Should Cover
Regardless of industry or company size, effective code of conduct training covers six core topics. Not every topic requires equal depth: prioritize based on your industry, your regulatory requirements, and the issues most likely to arise at your company.
State Anti-Harassment Training Mandates: The Details That Matter
Anti-harassment, the first topic on that list, is the only one with hard legal deadlines for most small businesses, and the rules are more specific than "six states require it." Each mandate has its own employee-count threshold, new-hire deadline, duration, and refresh cadence. Getting the topic right but the timing wrong still leaves you out of compliance.
| State | Who must be trained | Deadline for new hires | Duration and refresh |
|---|---|---|---|
| California | Employers with 5+ employees: all employees, supervisors and non-supervisors | Within 6 months of hire or of promotion into a supervisory role | 2 hours for supervisors, 1 hour for everyone else, repeated every 2 years |
| Connecticut | Employers with 3+ employees: all employees. Employers under 3: supervisors only | Within 6 months of hire; at employers under 3, within 6 months of becoming a supervisor | 2 hours, with supplemental training required at least every 10 years |
| Delaware | Employers with 50+ employees. Excludes anyone employed less than 6 months | Within 1 year of starting; supervisors within 1 year of taking the role | Every 2 years, with additional content for supervisors |
| Illinois | All employers, regardless of size: every employee | Employees hired mid-year still need training in that calendar year | Annually. Restaurants and bars have supplemental requirements |
| Maine | Employers with 15+ employees: all employees | Within 1 year of hire, including the additional training for supervisors and managers | No refresh interval set in statute; annual practice is the safe default |
| New York | All employers, regardless of size: every employee | No set deadline; state guidance encourages training as soon as possible after hire | Annually, and the training must be interactive |
Four details trip up small employers more than anything else in this area.
The count usually includes people you do not think of as employees. According to the state Civil Rights Department, California's five-employee threshold counts independent contractors, volunteers, and unpaid interns, plus employees based outside California. The department also offers free online courses that satisfy the requirement.
Temporary and seasonal workers are not exempt either. Under California Government Code 12950.1, anyone hired to work fewer than six months must be trained within 30 calendar days after the hire date or within 100 hours worked, whichever comes first. If you run a summer operation, that means training in the first weeks, not at a six-month mark that never arrives.
Remote workers follow the law where they sit, not where you sit. A Texas company with one salesperson living in New York generally owes that person New York's annual interactive training. This is the most common gap I see at distributed small businesses: the founder checks their own state, finds no mandate, and stops.
Run the mandate check per employee location, not per company, and rerun it when someone moves. Rerun it again at a promotion into a supervisory role. In California and Delaware, and at Connecticut employers with fewer than three employees, that promotion starts its own deadline whether or not the person was trained last year.
"Interactive" is a defined term, not an adjective. New York and California both require it, and New York State guidance puts the bar in concrete terms: a web-based course qualifies when it asks questions the employee has to answer correctly, or when the employee can submit a question and get an answer immediately or in a timely manner.
A video with no mechanism for questions and no record of responses does not clear that bar, however good the content is. Build the follow-up channel into the session, and write down what was asked and who answered it. That record is also what proves the session was interactive if a regulator or a plaintiff ever asks.
Washington sits in a category of its own. RCW 49.60.515 reaches hotels, motels, retail businesses, security guard firms and property services contractors that employ an isolated worker: a janitor, security guard, hotel or motel housekeeper, or room service attendant who spends at least half of their working hours without a coworker or supervisor present, or works where coworkers cannot respond to an emergency without being summoned.
Those employers must train managers, supervisors and the isolated employees themselves. It is a mandate on particular industries rather than on every employer in the state.
Several additional states mandate training for public-sector employers only, and others (Vermont, Rhode Island, Massachusetts and Hawaii among them) encourage it without requiring it. Encouragement is not nothing: in those states, having trained is still the evidence you will want if a complaint is filed.
How to Create a Code of Conduct Training Program
Creating code of conduct training does not require an external compliance vendor or a dedicated learning and development team. It requires your code of conduct document, real scenarios from your business, and 90 minutes of structured delivery.
| Step | What to Do | Time Investment |
|---|---|---|
| 1. Identify your core topics | Select which of the six topics apply to your business. All six are relevant for most companies, but depth varies by industry. | 30 minutes |
| 2. Write real scenarios | For each topic, create 1-2 scenarios based on situations that have actually happened or could realistically happen at your company. | 1-2 hours |
| 3. Structure the training session | For each topic: state the rule (2 min), present the scenario (3 min), discuss as a group (5 min). Total: 10 min per topic, 60-90 min for all six. | 30 minutes |
| 4. Prepare acknowledgment | Create a document that employees sign confirming they received and understood the training. Include the date, topics covered, and a statement of understanding. | 15 minutes |
| 5. Schedule delivery and refreshers | Train new hires within 30 days. Schedule annual refreshers. Add to the calendar now. | 15 minutes |
Total setup time: approximately 2.5 to 3.5 hours for the first time. Annual refresher updates take 1 to 2 hours (update scenarios, add new policies, remove outdated content).
Writing Scenarios That Actually Work
A scenario works when the right answer is not obvious from the wording, when a reasonable person could argue for the wrong answer, and when the situation could plausibly happen at your company next month.
Step 2 above is the step people skip, because writing scenarios is the only part of this that requires thinking. It also decides whether the session changes behavior. Every scenario I use has the same five parts:
| Part | What it does | How long |
|---|---|---|
| The situation | One paragraph, specific, using roles that exist at your company | 60 seconds to read aloud |
| The ambiguity | The reason a good employee might get this wrong. State it out loud | The heart of the discussion |
| The rule | The exact section of your code that applies, quoted, not paraphrased | 30 seconds |
| The action | What the employee should literally do next: who they tell, in what form, by when | The part people remember |
| The wrong answers | Two plausible responses that are wrong, and why | Where the real learning happens |
Worked scenario one: the gift. A vendor your operations lead has used for three years sends her a $150 gift basket at the holidays, addressed to her home. She has an annual renewal decision with that vendor in February.
The ambiguity is real. The basket is not a bribe by any normal understanding of the word, refusing it feels rude, and she was going to renew anyway. If your code sets a nominal-value threshold, say $50, with disclosure required above it, the rule answers cleanly: disclose in writing to her manager, then return, donate or share it as the policy directs.
The wrong answers are "keep it, it did not affect my judgment" (the standard is the appearance, not the outcome) and "quietly return it and say nothing" (the disclosure exists so the pattern is visible if the vendor tries again).
Government customers change the arithmetic. If any part of your business sells to them, the limits on gifts to their staff may be far stricter than your internal threshold: under 5 CFR 2635.204, a federal executive branch employee generally cannot accept a gift worth more than $20 per occasion, or more than $50 in a calendar year from any one source.
Worked scenario two: the relationship. A team lead has begun dating someone who reports to him. Both are adults, both say it is consensual, and nobody has complained. The ambiguity is real here too, because employees genuinely do not understand why the company gets a say.
The rule is not about the relationship; it is about the reporting line. A supervisor controls pay, scheduling, performance ratings and continued employment, which makes consent very difficult to establish after the fact and exposes every subsequent personnel decision. The action is a written disclosure to HR or the owner, followed by a change to the reporting structure so neither person evaluates the other.
The wrong answers are "wait until it gets serious" and "disclose it verbally to a peer." Have this scenario ready before you need it, because the first time it comes up you will be improvising in front of someone who is already anxious.
Pull your scenarios from your own history where you can. The conflict-of-interest incident I described at the top of this article became a scenario, with the names and details changed enough that nobody could identify the person. Real situations land differently than invented ones, and employees can tell the difference immediately.
Delivery Methods for Code of Conduct Training
Four delivery methods work for code of conduct training: live sessions, self-paced online modules, a hybrid of the two, and third-party compliance courses. The table shows where each one fits and what you give up with it.
| Method | Best For | Pros | Cons |
|---|---|---|---|
| Live session (in-person or video) | Initial training, small teams | Interactive, allows questions, most effective for behavior change | Requires scheduling, manager time commitment |
| Self-paced online modules | Annual refreshers, distributed teams, compliance documentation | Scalable, trackable, employees complete at own pace | Less interactive, lower engagement without discussion component |
| Hybrid (online module + live discussion) | Growing and mid-size companies | Combines scalability with interactivity. Employees review content first, then discuss in a group. | Requires more planning |
| Third-party compliance courses | HIPAA security training, FCPA anti-bribery programs, and state-mandated training | Expert content, legally validated, updated automatically | Per-employee licensing cost, and the content will not reflect your own policies |
For most growing businesses, the practical approach is live sessions for initial training (where discussion matters most) and self-paced modules for annual refreshers (where scalability matters more).
What to Document, and How Long to Keep It
"Documentation is your legal defense" is the kind of sentence that everyone nods along to and nobody acts on, because it does not say what to write down. Here is the specific version: one record per person and session, showing who was trained, when, for how long, on what and how, kept well past the day they leave.
The reason records matter traces to a pair of 1998 Supreme Court decisions, Faragher v. City of Boca Raton and Burlington Industries v. Ellerth. Both hold that an employer sued over harassment by a supervisor may avoid liability by proving it exercised reasonable care to prevent and correct harassing behavior promptly, and that the employee unreasonably failed to use the opportunities provided.
Training records, a distributed policy and a documented complaint process are how the first half gets proven. The second half only works if the reporting procedure is genuinely accessible: if your only complaint channel is the person accused, the defense collapses.
One limit gets overlooked. The defense is not available at all when the harassment ended in a tangible employment action such as a firing, demotion or pay cut. In that situation liability attaches whatever the training file holds, which is worth knowing before you treat documentation as a complete answer.
A training record that supports your reasonable-care showing contains all of the following. A signature sheet alone does not.
| What to record | Why it matters | Common gap |
|---|---|---|
| Employee name, role, and whether supervisory | California and Chicago set a longer session for supervisors | Supervisors trained on the non-supervisory module |
| Date and duration of the session | California, Connecticut, and Chicago set minimum hours; you have to be able to show them | No start and end time captured |
| Topics covered and the version of the code used | Proves the content matched the policy in force at the time | Code updated, training record still points at the old version |
| Delivery method and who led it | Distinguishes interactive training from passive viewing | Self-paced module with no record of the Q&A channel |
| The materials themselves, archived | Two years later, nobody remembers what was on slide 14 | Deck edited in place, prior version lost |
| Signed acknowledgment with date | Employee confirmation of receipt and understanding | Signed during onboarding week, never repeated |
| Questions asked and answers given | Direct evidence the training was interactive | Nobody takes notes |
On retention: keep training records for the length of employment plus several years afterward, and do not treat the minimum federal personnel-record retention period as your guide. The reason is timing, and the clock that matters runs on the employee side rather than yours.
According to the EEOC, a worker has 180 calendar days to file a charge, extended to 300 days where a state or local agency enforces a law prohibiting the same conduct. A lawsuit comes later still: once the worker receives a notice of right to sue from the agency, they have 90 days to file in court.
A claim can surface long after someone has left. When one does, the training record from their first month is the document you need, and it has to still exist. Three years past separation is a reasonable floor for a small business, and longer is cheap when the records are digital.
How Often to Conduct Code of Conduct Training
Train new hires within their first 30 days and everyone annually, then add shorter sessions after policy changes, incidents, and promotions to management. The table sets out what each occasion should cover and the format that fits it.
| Timing | What to Cover | Format |
|---|---|---|
| First 30 days (new hires) | Full training: all six topics with company-specific scenarios and acknowledgment signature | Live session (90 min) or hybrid |
| Annual refresher | Updated scenarios, new policies, reinforcement of key points. Focus on topics where incidents occurred. | Self-paced module (30-60 min) + brief group discussion |
| After policy changes | New or updated policies only. Explain what changed, why, and what employees need to do differently. | Email notification + brief module (15-30 min) |
| After incidents | Relevant topic only. No need to name the specific incident. Reinforce the standard and reporting process. | Team meeting or targeted module (15-30 min) |
| Promotion to management | Supervisor-specific responsibilities: recognizing violations, handling reports, modeling behavior, additional legal requirements | Live session (60 min) |
Common Mistakes in Code of Conduct Training
Five mistakes turn code of conduct training from a protective measure into a liability, and each one is avoidable.
Frequently Asked Questions
What is code of conduct training?
Code of conduct training is a structured program that teaches employees how your workplace rules apply in real situations, instead of simply handing them a document to sign. Typical topics include anti-harassment, conflicts of interest, confidentiality, reporting procedures, and professional communication. The aim is that people understand why each rule exists, can recognize a violation when they see one, and know whom to tell and how. Done well, it turns a policy on paper into behavior you can expect from every person who joins.
Is code of conduct training legally required?
No federal law requires employers in general to adopt a code of conduct, but federal contractors are an exception, and several components inside a code carry their own mandates. Under the Federal Acquisition Regulation, a contract expected to exceed $7.5 million and run 120 days or more requires a written code of business ethics and conduct within 30 days of award. Anti-harassment training is required in California, Connecticut, Delaware, Illinois, Maine, and New York, and Washington requires it of hotels, retail businesses, and a few other industries that employ isolated workers. HIPAA obliges covered entities and their business associates to run a security awareness and training program for all members of their workforce, management included. PCI DSS is a card-brand standard rather than a federal statute, so it generally reaches you through your merchant agreement, though Nevada writes compliance with it into state law. The Foreign Corrupt Practices Act mandates no training of its own: the Justice Department and Securities and Exchange Commission resource guide treats periodic training as a hallmark of an effective compliance program, which is what prosecutors weigh. Everywhere else, documented training is the evidence behind an employer's defense rather than a legal obligation.
How often should code of conduct training be conducted?
At minimum, train during onboarding (first 30 days) and annually thereafter. Additional training should occur when the code of conduct is updated, after a workplace incident that relates to the code, when employees are promoted to management (supervisors often need additional training), and when laws change that affect your policies. Annual refreshers prevent the training from fading into forgotten paperwork.
What should a code of conduct training program include?
Six essential topics: anti-harassment and discrimination (what it is, how to report it), conflicts of interest (financial, personal, and professional conflicts and disclosure requirements), confidentiality and data privacy (handling sensitive information), workplace communication standards (email, social media, representing the company), reporting and whistleblower protections (how to report violations safely), and gifts and anti-bribery (what employees can accept, documentation requirements). Each topic should include real-world examples relevant to your specific business.
How long should code of conduct training take?
Initial training during onboarding should take 1 to 2 hours, covering all six core topics with examples and discussion. Annual refresher training can be shorter, 30 to 60 minutes, focusing on updates, new scenarios, and reinforcement of key points. Anti-harassment training has specific duration requirements in some states: California requires 2 hours for supervisors and 1 hour for non-supervisory employees.
What is the difference between a code of conduct and a code of ethics?
A code of conduct defines specific behavioral rules: what employees should and should not do in concrete situations (gift acceptance limits, social media policies, harassment reporting procedures). A code of ethics defines broader principles and values: integrity, fairness, respect, accountability. The code of ethics is the 'why.' The code of conduct is the 'how.' Most companies combine both into a single document, but the training should cover both the principles and the specific rules.
How do you make code of conduct training effective?
Three practices separate effective training from checkbox exercises. First, use real scenarios from your industry instead of generic examples. Second, make the training interactive: discussion, case studies, and questions rather than a passive document review. Third, demonstrate that leadership follows the same code: employees pay attention to what leaders do, not what the training says. A code of conduct that leadership visibly ignores is worse than no code at all.
Do small businesses need code of conduct training?
Yes. Small businesses face many of the same ethical and legal risks as large companies, often with less infrastructure to handle them. Federal harassment protections under Title VII of the Civil Rights Act cover employers with 15 or more employees, and several state laws reach smaller ones. Where a law applies, a harassment complaint at a small business is judged by the same liability standard as one at an enterprise. Code of conduct training establishes expectations, provides reporting mechanisms, and creates documentation that protects the business. The training does not need to be elaborate. A 90-minute session covering the six core topics with your company-specific examples is a sound starting point, though a state anti-harassment mandate may set longer minimum hours.