Environmental, Social and Governance (ESG) - Principles and Practice · Business Ethics, Code of Conduct and Anti-Bribery

Code of Conduct and Ethics Framework for Companies

Updated 11 October 2026 · Fact-checked

A code of conduct is a written set of rules that tells directors and employees what behaviour is expected and what is forbidden. An ethics framework adds the values, policies, vigil mechanism and oversight that make the code work. To answer questions, cover content, adoption, communication, enforcement and reporting.

Understand Code of Conduct and Ethics Framework

A code of conduct is a written document. It lists the standards of behaviour a company expects from its directors, senior management and employees. It covers conflicts of interest, confidentiality, gifts, fair dealing, compliance with law and use of company assets. It is rule-based and usually carries consequences for breach.

A code of ethics is broader and value-based. It states the principles the company stands for, such as integrity, honesty, fairness and respect. In practice many companies merge both into one document. In an exam, say so, but still draw the distinction: ethics explains the why, conduct sets out the what and the consequences.

An ethics framework is the whole system around the code. It has the board's commitment (tone at the top), the code itself, supporting policies (anti-bribery, conflict of interest, related party dealings, insider trading), training, a channel to raise concerns, investigation, discipline and periodic review. A code that only sits on a website is weak. A code that is adopted by the board, communicated, tested and enforced is strong.

The vigil mechanism (whistle-blower mechanism) is the channel for raising concerns. It lets directors and employees report genuine concerns about unethical behaviour, actual or suspected fraud, or violation of the code, without fear of victimisation. Under the Companies Act, 2013, listed companies and certain other prescribed classes must set up a vigil mechanism. It must give adequate safeguards against victimisation and provide direct access to the chairperson of the audit committee in appropriate or exceptional cases. Listed companies must also disclose the policy on the company's website.

The Act also has a Code for Independent Directors in Schedule IV, and SEBI's listing regulations require listed companies to lay down a code of conduct for board members and senior management, with annual affirmation of compliance and website posting. Confirm the exact clause numbers from your study material before quoting them. The code should also tie in with anti-bribery duties. Under the Prevention of Corruption Act, 1988, a commercial organisation can be fined if a person associated with it gives or promises an undue advantage to a public servant to obtain or retain business. It has a defence if it proves it had adequate procedures in place. A clear code is the base of such procedures.

Key rules to remember

Code of conduct vs code of ethics: Code of conduct = specific rules and consequences; Code of ethics = values and principles; Many companies publish one combined document. State this in answers.
Elements of an effective ethics framework: Tone at the top + Code + Policies + Training + Reporting channel + Investigation + Discipline + Review; Use this as a checklist for any 'how will you build or assess' question.
Vigil mechanism safeguards: Genuine concern reported → protection from victimisation → direct access to audit committee chairperson in appropriate cases; Required for listed companies and prescribed classes under the Companies Act, 2013. Check the class list in your material.
Undue advantage (Prevention of Corruption Act, 1988, section 2(d)): Undue advantage = any gratification whatever, other than legal remuneration; Gratification is not limited to money or things estimable in money. Gifts and hospitality policies must reflect this.
Commercial organisation defence (section 9): Offence by associated person + intent to obtain or retain business or advantage → organisation fined, unless it proves adequate procedures; The defence applies to the organisation only if it proves the procedures were in place, following prescribed guidelines.
Bribery offence (section 8): Giving or promising undue advantage to induce or reward improper performance of public duty → imprisonment up to 7 years, or fine, or both; Not applicable where a person is compelled, but the compelled person must report within 7 days. A commercial organisation is punishable with fine.

How to solve Code of Conduct and Ethics Framework questions

Case-based questions on codes and ethics follow provision, analysis, conclusion. Use this method.

1Read the facts and identify the problem: a gap in the code, a breach, a whistle-blower issue or a bribery risk.
2Name who is covered: directors, senior management, employees, agents or other associated persons.
3State the relevant rule in plain words: code content, vigil mechanism requirement, or the section of the Prevention of Corruption Act, 1988.
4Apply the rule to the facts, point by point. Quote facts from the question.
5Check protection and process: was there a channel, was the complainant protected, did the audit committee get access.
6Check enforcement: investigation, disciplinary action, record keeping, board reporting.
7Conclude clearly with a recommendation: amend the code, adopt a policy, train, report or disclose on the website.
8Add a practical drafting or compliance point, such as board approval, annual affirmation or periodic review.

Quickest way: The ACE-V check

When to use it: Use when time is short and the question asks you to evaluate or draft an ethics arrangement.

A: Adopt. Board approves the code and policies.
C: Communicate. Train people, post on the website, obtain affirmations.
E: Enforce. Investigate, discipline and apply rules equally to senior people.
V: Voice. Give a vigil mechanism with protection and access to the audit committee chairperson.
Write one line under each letter, then apply it to the facts.

Common mistakes in Code of Conduct and Ethics Framework

Treating code of conduct and code of ethics as identical with no comment.
Companies often publish one document, so students assume there is no difference.
Fix: Write one line: ethics is values, conduct is rules with consequences. Then note they are often combined.
Saying the vigil mechanism is only for employees.
The word 'whistle-blower' suggests staff.
Fix: State that directors and employees can use it, as the Companies Act, 2013 provides for directors and employees.
Leaving out the safeguard against victimisation and access to the audit committee chairperson.
Students remember that a mechanism is needed but not its conditions.
Fix: Always list both safeguards when you explain the vigil mechanism.
Claiming an organisation is always liable for bribes by its agents.
Students ignore the defence in section 9.
Fix: Say the organisation is fined unless it proves adequate procedures, as prescribed by guidelines, were in place.
Defining undue advantage as cash only.
Bribery is imagined as money passing hands.
Fix: Quote section 2(d): any gratification other than legal remuneration, not limited to pecuniary gratification.
Stopping at 'adopt a code' without enforcement.
Students describe the document, not the system.
Fix: Add communication, training, investigation, discipline and review to every answer.

Worked examples

Example 1

Sundaram Textiles Ltd, a listed company, has a code of conduct on its intranet. A purchase manager reports to the CFO that a senior vice-president took gifts from a supplier. The CFO ignores it and the manager is moved to another unit. Advise the company.

Show the solution

Issue: handling of a concern about a possible code breach and apparent victimisation of the reporter.
Rule: a listed company must have a vigil mechanism for directors and employees, with adequate safeguards against victimisation and direct access to the audit committee chairperson in appropriate cases. The policy must be disclosed on the website.
Analysis: the manager reported a genuine concern. The report went to the CFO, so the channel appears not to have worked as intended. Moving the manager after the report suggests victimisation.
Gifts from a supplier raise a conflict of interest. Gratification includes non-monetary benefits, so the gift policy must cover them.
Conclusion: the audit committee should investigate the original concern and the transfer, reverse any retaliation, and discipline anyone found in breach.

Answer: The company should refer the matter to the audit committee, investigate the gift and the transfer, restore the manager's position if retaliation is found, take action under the code, and strengthen the vigil mechanism through training, a direct access channel and website disclosure.

Example 2

Kaveri Infra Pvt Ltd bids for a state road contract through a consultant. The consultant gives a public servant ₹5,00,000 to secure the contract. The company has a written anti-bribery policy, trains staff yearly and requires consultants to sign it. Is the company liable?

Show the solution

Issue: liability of a commercial organisation for bribery by an associated person under section 9.
Rule: where an associated person gives or promises undue advantage to a public servant intending to obtain or retain business, the organisation is punishable with fine. It is a defence to prove it had adequate procedures, following prescribed guidelines, to prevent such conduct.
Analysis: the consultant performs services on behalf of the company, so is an associated person whatever the capacity. The payment was to obtain business. Section 9 is therefore engaged.
The company has a policy, training and a consultant undertaking. These support the defence. The burden is on the company to prove them.
Conclusion: prima facie the company faces a fine, but it may escape liability if it proves its procedures were adequate and in line with the guidelines. The consultant can be prosecuted under section 8.

Answer: The company is exposed to a fine under section 9, but may rely on the adequate procedures defence if it proves its policy, training, consultant controls and records meet the prescribed guidelines. The consultant is liable under section 8.

Exam tips

Structure answers as provision, analysis, conclusion. Examiners reward the link to the facts.
Give a drafting or compliance point: board approval, website posting, annual affirmation, periodic review.
Always name the safeguards of the vigil mechanism when it appears in a case.
Link ethics to anti-bribery. Mention section 2(d), section 8 and section 9 when facts involve public servants.
Do not quote clause numbers of SEBI listing regulations unless you are sure; describe the rule in words.

Practice questions from Business Ethics, Code of Conduct and Anti-Bribery

Code of Conduct and Ethics Framework in other exams

The same ground in other exams, if you are preparing for more than one or want another angle on it.

Code of Conduct and Ethics Framework: frequently asked questions

What is the difference between a code of conduct and a code of ethics?

A code of ethics states the values and principles of the company. A code of conduct sets specific rules of behaviour and consequences for breach. Many companies combine them in one document.

Who must have a vigil mechanism under the Companies Act, 2013?

Listed companies and certain prescribed classes of companies must establish one. It must protect genuine reporters from victimisation and give direct access to the audit committee chairperson in appropriate cases. Check the prescribed classes in your study material.

What is the role of an ethics committee?

It oversees the code, reviews breaches and reports to the board. In many companies the audit committee handles vigil mechanism complaints. The exact structure is a matter of company policy.

How does a code of conduct help against bribery charges?

Under section 9 of the Prevention of Corruption Act, 1988, a commercial organisation can defend itself by proving it had adequate procedures to prevent bribery by associated persons. A code and policies are part of those procedures.