Corporate Policy Templates UK: Ethics & Compliance

What this document is

Corporate policy statements are internal documents that set out, in writing, how a business intends to behave in a particular area of its operations. They are not usually required by a single piece of legislation in the way that, say, a set of company accounts is, but they often exist to evidence compliance with laws such as the Bribery Act 2010, the Proceeds of Crime Act 2002, the Money Laundering Regulations, the Modern Slavery Act 2015, and various pieces of employment and equality law.

A good policy does two jobs at once. It tells employees, contractors and third parties what the company expects of them, and it gives the board a defensible position if something goes wrong and questions are asked later. The exact mix of policies a business needs depends on its size, sector and customer base.

A regulated firm will need more; a small consultancy will need fewer. What matters is that the policies are genuine reflections of how the company actually operates, not documents copied and forgotten in a drawer.

How to use this document

1. Work out which policies you actually need. Start by mapping the legal and commercial risks your business faces. A construction firm has different exposures from a fintech or a training provider. Look at the sectors you sell into, the countries you deal with, the size of your workforce, and whether any of your clients require specific policies as a condition of contract.
2. Draft in plain English, not legalese. Policies only work if the people who have to follow them can understand them. Write in the voice of the business, set out what is and isn't acceptable, explain who owns the policy, and describe what happens if it is breached. Avoid cutting and pasting from a competitor, because that tends to produce documents nobody recognises as their own.
3. Tie each policy to real processes. A policy on anti-bribery means very little without a register of gifts and hospitality, a way to report concerns, and a named person responsible for handling them. The same applies to AML, ethics and CSR. Make sure every policy points to the procedures that support it, and that those procedures genuinely happen.
4. Approve, communicate and train. Policies should be signed off at board level and then actively communicated to staff. That means induction for new joiners, periodic refreshers for everyone, and keeping a record of who has seen and acknowledged which documents. Training is what turns a policy from a piece of paper into something that shapes day-to-day decisions.
5. Review at sensible intervals. Law changes, businesses grow, and risks shift. A yearly review is a reasonable default for most policies, with an out-of-cycle update whenever something significant happens, such as a new regulation, a major incident, or entry into a new market. Keep dated versions so you can show an auditor or court exactly what was in force at any point.

Common questions