Rules
Board ethics committee and audit committee: SEC rules, records and jurisdiction
How board ethics committees work in US public companies: SEC proxy disclosure, records to keep, audit committee jurisdiction and waiver filing consequences.
What to take away
- The ethics committee owns conduct riskthe code, waivers, training and the escalation path for retaliation claims.
- The audit committee owns reporting integrity, auditor oversight and the complaint procedures required by Exchange Act Rule 10A-3.
- The whistleblower log is shared, but the charter must assign each category of allegation to one owner.
- Exchange listing rules require a published code of business conduct and prompt disclosure of any waiver for an officer or director.
- Delaware courts allow an oversight claim when a board had no monitoring system for a central risk.
Who has jurisdiction over board ethics oversight
Three authorities reach a US public company board, and they do different work. The SEC sets what appears in the proxy statement and the annual report. The exchange sets what the company publishes and how fast. State corporate law, usually Delaware, sets the fiduciary duty underneath both.
The SEC has never required a separate ethics committee. Item 406 of Regulation S-K asks only whether the company adopted a code of ethics for its senior financial officers. Exchange Act Rule 10A-3 does require an independent audit committee, and the 2003 auditor independence release describes the complaint procedures that committee must establish.
An ethics committee stays optional. Once the board creates one, its authority comes from the resolution and charter, not from the SEC. An audit committee overview separates duties that rule imposes from duties a company chose.
What a compliant proxy disclosure contains
| Rule | Where it appears | What it must state |
|---|---|---|
| Item 406, Regulation S-K | Form 10-K | Whether a code of ethics applies to the senior financial officers |
| Item 5.05, Form 8-K | Form 8-K | Any amendment to, or waiver of, that code, within four business days |
| Item 407(d)(5) | Proxy statement | Whether the audit committee has a written charter, and where it is posted |
| Item 407(b) | Proxy statement | The audit committee's report on its review of the audited financials |
| NYSE 303A.10 and Nasdaq 5610 | Website or Form 8-K | The code of business conduct, and any waiver for a director or officer |
A missing charter reference is easy to fix. A missing waiver disclosure is not, because the clock has run. The codes of conduct checklist sets out what the document must cover before it reaches a filing.
Records the ethics committee keeps
- The charter, dated and board-approved, in its current form
- Minutes naming each conduct matter and its disposition
- The waiver file, with proof of the Form 8-K or website posting
- The complaint log built under Rule 10A-3, retaliation claims included
- Training completion by business unit, with the year attached
Retention matters more than most committees assume. Sarbanes-Oxley Section 802 makes it a federal crime to alter or destroy records with intent to impede an investigation. Summary minutes alone may not show what the committee knew and when.
Ethics Committee Record Retention
- Charter, dated and board-approved
- Minutes naming each conduct matter
- Waiver file with proof of disclosure
- Complaint log under Rule 10A-3
- Training completion by business unit
Employee ethics metrics supply the other half of the record. One complaint shows an incident; a trend shows a system.
Example: a sales contest that paid for the wrong behavior
A mid-cap industrial company ties an annual bonus to booked orders. Finance later finds orders booked before the customer signed. The audit committee reads this as a revenue recognition question. The ethics committee reads it as a conduct question.
Under a charter that gives pressure to misstate results to audit, the ethics committee has nothing to do. Under one that gives incentives that reward misconduct to ethics, it owns the remedy. One clause decides which committee writes to the board.
What happens when the ethics committee does nothing
Delaware supplies the sharpest consequence. In Marchand v. Barnhill, the Delaware Supreme Court let an oversight claim proceed against a board with no committee or process for monitoring a central safety risk. The claim survived because the board made no good faith effort, not because the outcome was bad. Leadership ethics examples show how quickly that gap becomes public.
A second consequence is cheaper to trigger. A company that fails to disclose a waiver of its code for an executive officer gets a listing deficiency, and an uncured one can end in suspension or delisting.
Where the rules differ by state and exchange
Delaware leans toward stockholder primacy and a demand requirement before suit. Pennsylvania, Indiana and Connecticut have constituency statutes that let directors weigh employees and communities. California's board diversity statutes were struck down in 2022, so state mandates come and go.
Private companies face no exchange standard at all, so their ethics obligations come from contracts, employment law and credit terms. Corporate responsibility separated from giving sits in that space, where the promise is voluntary and the measurement is not.
