In an environment where public scrutiny is high and enforcement expectations are rising, investing in strong corporate ethics and oversight frameworks has become a strategic necessity for public companies. Effective compliance programs are no longer merely regulatory check-the-box exercises. They are essential tools for managing risk, safeguarding reputation, and meeting the expectations of regulators, investors, and other stakeholders.
In this Insight, we explore core elements of ethical governance for public companies, focusing on compliance programs, oversight and governance, codes of ethics, reporting mechanisms, investigations, and the nuanced landscape of code waivers and disclosures.
Despite speculation about regulatory fatigue, compliance remains central to corporate governance. As emphasized by the head of the US Department of Justice’s (DOJ’s) Criminal Division at SIFMA’s Anti-Money Laundering and Financial Crimes Conference earlier this year, companies with well-functioning compliance programs “have a unique role to play” in detecting and preventing misconduct and will be held accountable if they fail to do so.
Compliance is fundamentally the process of ensuring companies and their employees follow applicable laws, regulations, and internal standards. Effective programs reduce the risk of misconduct and support early detection. Regulators, law enforcement, and shareholders now expect tailored compliance structures that reflect a company’s specific risks, industry, size, and global footprint.
Seven core elements shape a strong compliance program:
Other hallmarks include third-party risk management, robust merger and acquisition due diligence, processes for new market or product entry, and business record retention policies and procedures across all platforms, including messaging apps and personal devices.
Oversight begins at the board level. Regulators expect boards (or designated subcommittees, such as audit committees) to oversee ethics and compliance programs. These programs must be reasonably designed to prevent and detect misconduct, including both criminal liability and reputational harm.
Companies must designate qualified compliance leadership with sufficient seniority, autonomy, and resources. Chief compliance officers should have direct access to the board and operate with independence.
In addition, management-level compliance committees, composed of senior leadership from across business, functional, and geographic areas, should meet regularly to support a culture of compliance and prepare for board-level reporting. Quarterly reporting to both senior management and the board subcommittee is considered best practice.
A cornerstone of governance is a clear, accessible, and comprehensive code of ethics. Regulators expect companies to not only make their codes publicly available (ideally online) but also ensure they are understandable and actively promoted.
Best practices include the following:
Codes should also align with applicable regulatory frameworks. For example:
Required topics for codes of ethics under the NYSE’s rules include conflicts of interest, corporate opportunities, confidentiality, fair dealing, protection and proper use of company assets, legal compliance (including insider trading laws), and reporting of any illegal or unethical behavior. Nasdaq does not prescribe specific topics, but it requires compliance with definitions and principles set forth in Section 406(c) of the Sarbanes-Oxley Act and Item 406 of Regulation S-K.
To ensure early detection of misconduct, regulators encourage companies to provide multiple reporting avenues (including anonymous channels) and to actively promote their use. Most employees raise concerns to their managers first, so management training on how to escalate issues is essential.
Reporting mechanisms should be:
Anti-retaliation is a key focus. Companies should maintain stand-alone anti-retaliation policies and conduct post-investigation check-ins with individuals who raised or were involved in the matter.
Investigations must be objective, consistent, and well-documented. Companies should ensure the following:
Under Item 5.05 of Form 8-K, domestic public companies must disclose material amendments or waivers to the code of ethics for the officers subject to Item 406 of Regulation S-K. Companies may
Item 5.05 of Form 8-K also requires disclosure of “implicit waivers,” which can occur when a company fails to act on a known violation in a reasonable timeframe. Foreign public companies that file annual reports on Form 20-F are subject to similar requirements under Item 16B of Form 20-F. To avoid unintentional waivers, companies must have mechanisms to address and document any departures from code provisions quickly and appropriately.
NYSE and Nasdaq rules are stricter and require disclosure of waivers granted to any executive officer (as defined under Rule 16a-1(f) under the Securities Exchange Act of 1934, as amended) or director. Additional key requirements include the following:
Because “materiality,” “reasonable time,” and even whether a violation occurred are often subjective judgments, disclosures of waivers and implicit waivers are rare. Nevertheless, companies should be vigilant, especially where codes integrate other policies (e.g., insider trading, anti-pledging), as exceptions granted under one policy may inadvertently trigger waivers under the code of ethics.
While the SEC allows different codes for different groups (e.g., executives, employees, board members), many compliance professionals recommend maintaining a single, comprehensive code for all personnel. Tailored training can then address the specific responsibilities of high-risk or gatekeeper functions, such as legal, finance, HR, or procurement.
Only one code that satisfies Item 406 of Regulation S-K requirements must be disclosed, and only the portions covering the required officers and topics need to be made publicly available to comply with SEC regulations.
Ethics and oversight are not static compliance exercises. Rather, they are dynamic, enterprise-wide commitments essential to public company governance. With regulatory scrutiny intensifying and stakeholders demanding transparency and accountability, companies must maintain their compliance infrastructure accordingly. By embedding the principles discussed above into daily operations and remaining agile in the face of evolving regulatory complexity, companies can minimize risk and build stronger, more resilient organizations.