Our Code of Conduct

Our policy
We prohibit bribery, kickbacks and facilitation payments, directly or through others, in public and private business.

Our work can involve procurement teams, public officials, referral partners and decision-makers whose choices affect our business. No commercial opportunity justifies offering, requesting or accepting an improper advantage, whether money, employment, a personal favour or another benefit. This applies equally to payments made by someone acting for us. Fees must reflect legitimate services and be supported by clear records. Where a demand or arrangement raises concern, we pause the transaction, seek guidance and document the response. A threat to personal safety requires a safety-first response followed by reporting as soon as it is safe.

Our policy
Business courtesies must be modest, transparent, lawful and free from any expectation of preferential treatment.

Hospitality can support a professional relationship, but it can also create an obligation or the appearance of influence. We assess the purpose, value, frequency, timing and participants together, including whether a tender, selection or assessment is underway. An offer that seems modest in isolation may be inappropriate when repeated or extended to relatives. We follow the recipient’s restrictions as well as our own approval requirements. Expenses must have a genuine business purpose, and declining an inappropriate offer must never disadvantage the person who raises the concern.

Our policy
We disclose and manage actual, potential and perceived conflicts before they affect advice, procurement or client acceptance.

Clients rely on us to exercise judgment without hidden loyalties. Personal relationships, investments, outside work, referral arrangements and software sales incentives can all affect that judgment or how it is perceived. Disclosure is therefore required before participation in a relevant decision, not only after a conflict causes harm. We assess whether the conflict can be managed through separation of responsibilities, independent review or appropriate disclosure and consent. Consent alone does not make every conflict acceptable. If credible safeguards cannot protect independent judgment and confidentiality, we decline or end the affected work.

Our policy
Our advice, training and software claims must be evidence-based, within our competence and clear about their limitations.

Our reputation depends on whether clients can use our work to make sound decisions. We define the question being addressed, the evidence available and the boundaries of each engagement. Advice must reflect the client’s circumstances rather than simply repeat a template. Training must have relevant learning objectives, and software must be described according to its tested capabilities. We distinguish legal requirements, professional judgment and illustrative guidance. Significant limitations and contrary evidence belong in our conclusions. Where specialist competence is needed, we obtain it rather than imply expertise we do not possess.

Our policy
We maintain complete, accurate records and prohibit fraud, false billing, asset misuse and assistance with tax evasion.

Financial integrity includes how we propose, deliver, record and charge for our services. Clients and colleagues must be able to trace charges to agreed work and understand who approved a commitment. We separate preparation and approval where practicable, review exceptions and retain evidence sufficient to explain transactions. Performance targets must not encourage inflated hours, misleading revenue recognition or concealed liabilities. Company resources are entrusted to us for authorised purposes. Suspected fraud requires careful preservation of records and appropriate review, not informal adjustments that hide the underlying issue.

Our policy
We seek to understand who we work with and reject arrangements that disguise criminal proceeds or illicit funding.

Professional services can be misused to lend credibility to questionable entities or to explain movements of funds that lack a genuine commercial basis. Our checks therefore consider ownership, the nature of the requested work, payment arrangements and inconsistencies in the information supplied. The depth of review should reflect the risk and applicable obligations; it is not a claim that every engagement is subject to identical regulated-sector duties. We do not proceed merely because payment is available or a client is well known. Unresolved concerns require escalation and, where necessary, refusal or lawful reporting.

Our policy
We assess applicable sanctions, export controls and cross-border restrictions before providing services, software or technical assistance.

Cross-border exposure may arise through client ownership, connected banks, technology access, subcontractors or the eventual use of our advice. We examine the restrictions relevant to the jurisdictions and activities involved rather than assume one screening list provides a complete answer. Controls must consider indirect ownership, service restrictions and changes during the engagement. A request to remove a country reference or introduce an unexplained intermediary is a reason for further review. We do not design structures to evade restrictions or give assurance beyond the facts and specialist analysis available.

Our policy
We compete on quality and value, safeguard competitively sensitive information and prohibit collusion and misuse of inside information.

We may meet competitors through conferences, professional networks, partnerships and joint proposals. These settings do not justify sharing information that reduces independent competition. We distinguish legitimate collaboration from arrangements that coordinate prices, customers or bidding behaviour, and seek review where the boundary is unclear. Information obtained through client work must not become an advantage in personal trading or another engagement. Confidentiality continues after the project ends. When a discussion becomes improper, silence is not sufficient: we make our objection clear, leave where appropriate and report the incident.

Our policy
We select and monitor partners, instructors, suppliers and subcontractors using proportionate integrity and capability checks.

Others who represent us can affect our clients and reputation as directly as our own employees. Selection must therefore consider integrity, competence, security and the ability to meet agreed standards, not price alone. We apply checks proportionate to the service and exposure, set clear contractual expectations and review material changes over time. Outsourcing does not transfer away our responsibility to exercise oversight. Where concerns arise, we evaluate the severity, available remedies and consequences of continuing the relationship, documenting why corrective action, suspension or termination is appropriate.

Our policy
We protect client and personal information throughout its lifecycle and use it only for authorised, lawful purposes.

Compliance work can reveal allegations, employee details, commercial strategies and sensitive evidence. Access to that information is a responsibility, not permission to use it freely. We define the purpose of collection, limit what we request and establish appropriate access, retention and disposal arrangements. Client material must remain separated where necessary, including in demonstrations and training. Personal data rights and contractual confidentiality both require attention. Before sharing information with a platform, supplier or another country, we check the relevant safeguards and authorisations. Suspected exposure is escalated promptly so that containment and any required notifications can be assessed.

Our policy
We protect systems and client evidence through secure access, careful development and prompt incident response.

Our websites, tools and document-sharing arrangements must be designed around the information they handle and the harm that unauthorised access could cause. Security involves clear permissions, secure configuration, tested recovery arrangements and careful management of changes. A feature is not ready simply because it functions in a demonstration. We consider how it behaves with real client information, errors and misuse. Suppliers and integrations require similar scrutiny. When an incident occurs, the priority is containment, preservation of relevant evidence and coordinated communication, rather than hiding the issue or making unverified assurances.

Our policy
We use AI with human accountability, appropriate data safeguards and verification proportionate to the consequences of its use.

AI can assist research, drafting, analysis and software development, but it does not carry our professional responsibility. We assess each use by its impact on people, confidentiality and the reliability of the resulting advice. Review must be substantive: a person approving an output must be able to challenge its sources, logic and conclusions. We consider provider data practices, intellectual property, bias and the need to explain AI-supported work to clients. Where adequate verification or safeguards are unavailable, we limit or avoid the use. Efficiency never justifies presenting uncertain machine-generated content as established fact.

Our policy
We respect human rights and seek to prevent, address and avoid contributing to abuses in our operations and business relationships.

Human rights considerations extend beyond our own workplace to the clients, suppliers and activities with which our services are connected. We pay attention to vulnerable people and to circumstances in which our work could enable, legitimise or conceal harm. Reviews should consider the severity of potential impacts, not only the commercial risk to Compliance House. Where we identify concerns, we use the influence available to prevent or reduce harm and assess appropriate remedy. Disengagement decisions must also consider their effects on people. We do not treat contractual assurances as a substitute for examining credible evidence of abuse.

Our policy
We maintain a respectful workplace and learning environment, free from discrimination, harassment, bullying and retaliation.

Respectful conduct is required in offices, client premises, training sessions, travel and digital communications. Seniority, commercial importance or a successful track record does not excuse intimidation or exclusion. We aim to make opportunities and participation accessible through fair criteria and reasonable adjustments. Managers must respond to concerns without blaming the person affected or assuming that informal behaviour is harmless. Complaints require attention to dignity, fairness and the rights of everyone involved. A person should be able to disagree professionally, ask for help or report inappropriate conduct without fear of losing opportunities.

Our policy
We plan work, travel and events to protect physical and psychological wellbeing and prevent avoidable harm.

Our work may involve intensive deadlines, remote working, travel and unfamiliar client locations. We assess these conditions before they create avoidable harm, including fatigue, isolation and psychological pressure. Everyone has a responsibility to follow relevant precautions and raise concerns, while leaders must provide realistic workloads and respond to unsafe conditions. Client deadlines do not override safety. Incident and near-miss reporting is used to learn and improve, not to discourage disclosure. Where specialist or emergency support is needed, obtaining that support takes priority over maintaining the appearance of uninterrupted service.

Our policy
We seek to reduce the environmental impact of our operations and make environmental claims only when supported by evidence.

Although our services are primarily knowledge-based, travel, digital infrastructure, equipment and purchasing have environmental consequences. We consider practical ways to reduce avoidable consumption without shifting impacts out of sight. Decisions should take account of the useful life and responsible disposal of equipment as well as immediate cost. Environmental reporting must distinguish measured results, estimates and aspirations. We avoid overstating the effect of individual actions or suppliers’ claims. Where we advise clients on environmental matters, we stay within our competence and communicate the evidence and limitations behind our conclusions.

Our policy
We respect ownership and licensing rights and communicate accurately about our work, clients and capabilities.

Our materials combine original work with sources, standards, software and images that may carry separate rights. We establish what may be used, adapted, shared or sold before incorporating it into a deliverable. Attribution does not replace a required licence or permission. Public communication must accurately describe our experience, certifications and relationships, including on social media and in demonstrations. Approval to work for a client is not automatically approval to publicise that relationship. When an error or rights issue is identified, we correct the material and address affected distributions rather than simply remove the local copy.

Our policy
Political engagement and charitable support must be transparent, properly authorised and never used to secure improper business advantage.

Community support and participation in public debate must remain separate from improper influence. A contribution can create risk even when the recipient is a legitimate organisation, particularly if a client or official requests it during a business decision. We examine the actual beneficiary, purpose and connection to pending matters before approval. Personal political choices remain personal and must not become a condition of employment or business access. Company representation in public affairs requires a clear mandate, accurate statements and records sufficient to explain what was supported and why.

Our policy
We encourage good-faith concerns, prohibit retaliation and protect fair, impartial fact-finding and relevant records.

Early reporting allows concerns to be assessed before harm grows. A reporter is not expected to prove a breach or conduct an investigation before seeking help. We distinguish an honest concern that cannot be substantiated from a deliberately false allegation. Reviews must be proportionate, impartial and respectful of privacy and procedural fairness. Relevant evidence must remain intact, including when normal deletion schedules would otherwise apply. Information is shared only as needed for legitimate handling and legal duties. Decisions and corrective actions should be documented, and lessons used to improve controls rather than focus solely on individual blame.