Maintenance
Who signs a code of conduct and who answers for it at each level
Who signs and owns a code of conduct, what boards, CEOs, compliance leads, managers and employees each answer for, and the attestation and escalation records to keep
What to take away
- Boards own the code as a governance document. Chief executives sign the public commitment. The compliance or ethics lead runs the program and carries personal risk.
- Managers hold the heaviest daily duty, applying the rules to real decisions and escalating what they cannot settle.
- Employees attest each year, and that signature is an acknowledgment rather than a shield.
- Attestation registers, escalation logs and board minutes are the first records a regulator or a plaintiff asks for.
- Signing last does not move accountability onto somebody else.
The signature chain behind a code of conduct
Sorting out codes of conduct roles and accountability starts with the paperwork. Boards adopt the document. Chief executives sign the public version. Staff attest on a schedule, usually once a year, with extra signatures at hiring and promotion.
Who signs and owns the code
Role
- Board of directors
- Adopting resolution
- Chief executive
- Public commitment letter
- Compliance lead
- Charter, attestation register
- Business unit managers
- Annual certification
- Employees
- Annual acknowledgment
- Suppliers and agents
- Contractual code clauses
Signs
- Board of directors
- Oversight, complaints, reporting
- Chief executive
- Ethics resources, board disclosure
- Compliance lead
- Training, investigations, records
- Business unit managers
- Escalation, reporter protection
- Employees
- Reading rules, conflicts, concerns
- Suppliers and agents
- Passing terms down chain
Personally owns
- Board of directors
- Chief executive
- Compliance lead
- Business unit managers
- Employees
- Suppliers and agents
Before names get attached, the rules have to hold up. Teams that want the writing sequence can build a codes of conduct framework stage by stage, then return to attach an owner to each rule.
The signature chain
| Role | What they sign | What they personally own |
|---|---|---|
| Board of directors | Resolution adopting the code | Oversight of the program, complaint channels and reporting |
| Chief executive | The public commitment letter | Resources for the ethics function and disclosure to the board |
| Compliance or ethics lead | Program charter and attestation register | Training, investigations, record keeping and regulator contact |
| Business unit managers | Annual manager certification | Applying the code to decisions, escalating reports, protecting reporters |
| Employees | Annual acknowledgment | Reading the rules, disclosing conflicts, raising concerns |
| Suppliers and agents | Contractual code clauses | Passing equivalent terms down their own chain |
A signature proves only that someone read a version of the text. Code of conduct accountability rarely stops there. What decides the outcome is whether the code survives real pressure when a top performer breaks a rule near the end of a quarter.
Board oversight of a code of conduct
Most boards hand the code to the audit committee or a standing ethics committee. Membership usually leans on independent directors. The committee reviews hotline volume, investigation outcomes, retaliation claims and any waiver granted to a senior officer. Audit committee duties in U.S. governance cover that kind of complaint oversight, which is why the code lands there.
A board that approves a document once a year and never reads the investigation log has delegated blame, not authority. Ask for substantiated case counts, average days to close, and repeat findings inside the same business unit.
The compliance officer's personal exposure
The compliance or ethics lead is the code of conduct owner in practice. That person designs training, runs investigations, keeps the register and reports to the board. The role also carries personal exposure, because U.S. law allows charges against compliance professionals who knowingly enable misconduct, as this overview of compliance officer liability explains.
Prosecutors also ask whether compliance staff had real authority, direct board access and enough budget. Revisions to DOJ guidance put individual accountability at the center of program evaluation, so a paper program will not shield the people who ran it (see the DOJ guidance revisions).
How managers answer for the code
A manager's duty starts the moment a concern reaches them. The sequence is short.
Manager response sequence
- Stop ongoing conduct and separate people
- Write down report, date, names, first actions
- Escalate to ethics or legal within policy window
- Tell reporter next steps without promising outcome
Managers appear in retaliation findings more often than any other role, because they control pay, schedules and promotions. A manager certificate that claims otherwise is easy to disprove.
Example: a gray-area supplier call
A plant manager wants to keep a supplier that failed a safety audit, because switching costs four weeks of production. The quality manager argues the audit result governs. Neither is corrupt. They are weighing duties and outcomes differently. Naming which ethical framework is in the room usually ends the argument faster than an appeal to the code's preamble.
The usable rule for that pair: whoever holds the safety or legal duty decides, and the other manager files a written dissent with the ethics office.
Attestation requirements and the records to keep
Attestation requirements and records
- A dated attestation that names the version of the code the employee read.
- Training completion records tied to job role and refreshed each year.
- An escalation log showing who was notified, when, and what happened next.
- Board minutes recording code approval, senior officer waivers and investigation summaries.
- Supplier clauses with audit rights, held by procurement rather than by the supplier.
Attestation is not consent to the rules. It is evidence that the person knew them. Store the version number with every signature, or the record proves nothing about what was signed.
Attestation records to keep
- Dated attestation naming code version read
- Training completion records tied to job role
- Escalation log with who, when, what next
- Board minutes on approval, waivers, investigations
- Supplier clauses with audit rights held by procurement
The cost side of these programs, from hotline contracts to investigation hours, sits in the site's wider corporate responsibility reporting.
