Can a policy be signed electronically?

Yes. Electronic signatures are generally enforceable under the ESIGN Act (15 U.S.C. §7001) and UETA in most states, provided intent, consent, attribution, and record retention requirements are met.

When is notarization required?

Notarization is rarely required for a Business Conduct Policy itself; however, related documents (powers of attorney, certain affidavits) may require notarization depending on state law.

What authentication is recommended?

Use email verification for general acknowledgments and stronger methods (SSO, SMS OTP, or KBA) for high-risk approvals or external signers to improve attribution and non-repudiation.

How long should signed records be kept?

Retain signed acknowledgments for at least the active term plus three years; follow industry or federal minima such as IRS or HIPAA retention rules when applicable.

Who must receive training?

All covered personnel should receive training; require completion within a defined window (commonly 90 days) and document completion for audit purposes.

What if an employee refuses to sign?

Document refusal, offer a paper alternative, conduct a compliance interview, and apply consistent disciplinary processes per company policy and applicable labor laws.

Electronic Signature
Templates
Miscellaneous
Business Conduct Policies

Business Conduct Policies

This template is fully customizable. Edit the text, fill out the fields, and send it for signature. Give it a try!

BUSINESS CONDUCT POLICIES

Recitals

WHEREAS, Company Name: is engaged in business and requires uniform standards of professional conduct; and

WHEREAS, Recipient Name: (Employee/Contractor) performs duties on behalf of the Company and will be required to adhere to the policies set forth herein; and

WHEREAS, the parties desire to establish, document, and provide acknowledgment of the standards, reporting procedures, and consequences associated with business conduct and compliance.

Parties and Effective Date

Company Address Recipient Title

Effective Date:

Scope of Work / Responsibilities

The following describes the principal responsibilities and scope of expected conduct to which the Recipient shall adhere while performing duties for the Company:

Standards of Conduct

The Recipient shall at all times conduct business with honesty, integrity and in compliance with applicable law. The Recipient shall not engage in theft, fraud, misrepresentation, unlawful discrimination, harassment, or other conduct detrimental to the Company. The Recipient shall exercise due care in performing duties and shall escalate matters to supervision where potential legal or ethical issues arise.

Prohibited Activities (examples — list any specific items applicable)

Conflicts of Interest

The Recipient must avoid situations in which personal interests conflict with the interests of the Company. The Recipient shall promptly disclose to the Company any actual or potential conflict of interest that could influence decision-making or objectivity.

Conflict Disclosure Contact

Gifts and Entertainment

Gifts, hospitality, or entertainment from third parties that are intended to influence a business decision are prohibited. Modest gifts that conform to local custom and do not create an appearance of impropriety may be accepted only if pre-approved as set forth below.

Maximum Permitted Gift Value

All gifts above the maximum permitted value require prior written approval by the Company.

Confidentiality and Data Protection

The Recipient shall hold in strict confidence all proprietary, confidential, or non-public information of the Company and its clients and shall not disclose such information except as required in the performance of duties or as authorized in writing by the Company. This obligation survives termination of the Recipient's relationship with the Company.

Definition of Confidential Information (if additional specification required)

Use of Company Resources

Company equipment, systems, and facilities are provided for business use. Limited personal use is permitted when it does not interfere with duties or violate policy. The Company may monitor usage consistent with law. The Recipient shall safeguard passwords and access credentials and shall not permit unauthorized access to systems or data.

Anti-Bribery and Anti-Corruption

The Recipient shall not offer, promise, give, solicit, or accept any bribe, kickback, or improper payment to obtain or retain business, secure any improper advantage, or influence a public official. The Recipient must comply with all applicable anti-corruption and anti-bribery laws.

Reporting, Investigation and Non-Retaliation

The Company maintains procedures for reporting suspected violations. The Recipient shall report any suspected unlawful or unethical conduct promptly. The Company prohibits retaliation against any person who reports in good faith or participates in an investigation.

Reporting Contact Reporting Phone or Extension

Disciplinary Actions, Remedies and Restitution

Violations of this policy may result in corrective action up to and including termination, restitution of losses, and referral for criminal prosecution where warranted. The Company reserves the right to pursue all available legal and equitable remedies.

Restitution Amount (if applicable) Late Fee Percentage on Recoverable Amounts

Training and Recordkeeping

The Recipient shall complete any required training related to these policies. The Company will retain records of training, disclosures, and investigations in accordance with applicable record retention policies.

Recipient is required to complete policy training.

Training Frequency / Schedule

Term and Termination

This Policy is effective as of the Effective Date and shall remain in force until superseded or revoked by the Company. Either party may terminate any employment or engagement relationship in accordance with applicable agreement terms.

Start Date: End Date (if applicable):

Notice Period for Termination (days)

Governing Law

This Policy shall be governed by and construed in accordance with the laws of the state identified below, without regard to conflict of law principles.

Governing State

Entire Agreement

This document constitutes the entire Business Conduct Policies of the Company with respect to the subject matter herein and supersedes all prior or contemporaneous policies, agreements, or understandings, whether written or oral, except as otherwise expressly provided in a separate executed agreement.

Acknowledgment

By signing below, the Recipient acknowledges receipt of these Business Conduct Policies, confirms that they have read, understand, and agree to comply with the policies, and understands that violation may result in disciplinary action up to and including termination.

I acknowledge that I have read, understand, and will comply with these policies.

Company Representative:

By:

Date:

Employee Name:

By:

Date:

What Business Conduct Policies Are and when they apply

Business Conduct Policies are written standards that define expected behavior, compliance obligations, and escalation paths for employees, contractors, and third parties who interact with an organization. These policies coordinate regulatory requirements, internal controls, and ethical guidelines to reduce legal risk, protect reputation, and support consistent decision making across departments. They commonly cover conflicts of interest, gifts and hospitality, anti-bribery, confidentiality, data protection, reporting channels, and disciplinary processes, and they form the foundation for training, monitoring, and enforcement programs.

Why a clear Business Conduct Policy matters for organizations

A formal Business Conduct Policy clarifies responsibilities, reduces compliance gaps, and documents the company’s legal and ethical standards under ESIGN and UETA frameworks when policies are distributed electronically.

Who typically implements and relies on these policies

Organizations of all sizes use Business Conduct Policies to set expected conduct and manage regulatory obligations.

Compliance teams and legal departments responsible for drafting and enforcement.
Human resources teams that deploy training, acknowledgments, and disciplinary follow-up.
Line managers and executives who apply rules and approve exceptions.

Clear ownership and regular review cycles improve adherence and simplify audits.

Core components included in a professional Business Conduct Policy

A complete policy balances scope and detail so it is enforceable, understandable, and practical for everyday use by staff and contractors.

Scope

Defines who and which activities the policy covers, including employees, contractors, vendors, and board members, to eliminate ambiguity about application.

Standards

Sets concrete behavioral expectations (conflicts of interest, gift limits, confidentiality) with examples and boundaries that guide decision making.

Reporting

Describes confidential reporting channels, non-retaliation assurances, and escalation routes for investigations to encourage timely disclosures.

Investigations

Outlines investigation procedures, timelines, evidence handling, and roles, ensuring consistency and fairness during compliance inquiries.

Discipline

Specifies potential sanctions and corrective actions for violations, including progressive discipline and termination criteria tied to offense severity.

Review Cycle

Establishes periodic review and update processes, typically annual or upon material regulatory change, with assigned owners.

Step-by-step: issuing and obtaining acknowledgments for a new policy

Follow this sequential guide to publish a Business Conduct Policy and collect employee acknowledgments efficiently and in compliance with electronic record rules.

01

Draft and approve: Prepare text, obtain legal review, secure executive or board approval.
02

Publish and notify: Distribute via internal portal and notify covered personnel of effective date.
03

Collect acknowledgments: Provide the policy and obtain signed acknowledgments electronically or on paper.
04

Archive and monitor: Store the signed records, monitor compliance, and schedule reviews.

Typical digital workflow settings for policy distribution and sign-off

Configure these workflow elements to ensure controlled delivery, authentication, and auditability when sending policies for acknowledgement.

Field	Configuration
Delivery Method	Email link with optional SMS code for stronger authentication
Signer Authentication	Email verification, SMS OTP, or LDAP/SSO for internal users
Reminder Cadence	Automated reminders at 7, 14, and 28 days after initial send
Audit Capture	Enable full audit trail: timestamps, IP, actions, and downloaded copies

Flow overview for electronic policy distribution and sign-off

A concise workflow ensures recipients receive, review, and acknowledge the policy while preserving an audit-ready record.

Upload: Upload finalized policy document to document platform
Place fields: Add signature, date, and checkbox fields for acknowledgment
Send: Send to recipients with defined authentication level
Record: Platform captures signed PDF and audit trail for retention

Technical considerations for secure electronic distribution

Ensure the chosen platform supports strong audit trails, appropriate signer authentication, and secure storage.

Authentication: Email, SMS OTP, or SSO
Document formats: PDF, DOCX accepted
Integrations: Connectors for HRIS and document stores

Align technical settings with legal and retention policies to preserve admissible evidence and simplify audits.

Security and compliance controls to verify before electronic distribution

Encryption: TLS 1.2/1.3 in transit; AES-256 at rest

Access controls: Role-based access and SSO available

Audit trail: Timestamps, IPs, and event logs retained

Certifications: SOC 2 Type II and ISO 27001

HIPAA support: BAA available for covered workflows

21 CFR Part 11: Compliant features for regulated records

Consequences of incomplete or improperly managed policies

Regulatory fines: Civil penalties and enforcement actions

Employment claims: Increased litigation and wrongful termination risk

Data breaches: Privacy violations and breach notifications

Loss of contracts: Vendor or client termination for noncompliance

Audit failures: Negative findings and remediation orders

Reputational harm: Stakeholder trust erosion

Common mistakes to avoid when preparing Business Conduct Policies

Using vague language that leaves enforcement to ad hoc interpretation and creates inconsistent outcomes across teams.
Failing to assign a named policy owner and update schedule, which results in outdated or conflicting procedures over time.
Distributing policies without clear acknowledgment or verification, making it difficult to prove employees received and reviewed the rules.
Neglecting to map policy coverage by jurisdiction or local law, producing compliance gaps for multi-state operations.

Time-sensitive actions and recommended deadlines

Set and communicate clear timelines for policy approval, distribution, training completion, and investigation response to maintain compliance.

Policy Approval Deadline:

Board or executive sign-off before effective date

Distribution Window:

Notify recipients at least 14 days before effective date

Training Completion:

Require initial training within 90 days of distribution

Investigation Response:

Acknowledge reports within 7 business days

Revision Cycle:

Review policy annually or after material change

Key milestones from drafting to enforcement

Track these sequential milestones as part of the policy lifecycle to ensure timely execution and evidence capture.

01

Draft Completion

Legal and compliance finalize text and examples

02

Approval

Executives or board formally approve the policy

03

Distribution

Policy published and sign-off requests issued

04

Monitoring

Ongoing compliance checks and remediation

Representative eSignature pricing and feature comparison

Compare common pricing and capability dimensions relevant for distributing and collecting policy acknowledgments; signNow is listed first for parity.

	signNow	DocuSign	Adobe Sign	PandaDoc	HelloSign
Starting Price	$8/user/mo	$15/user/mo	$14/user/mo	$19/user/mo	$15/user/mo
Free Trial	7-day free trial	Varies	Varies	Varies	Varies
Bulk Send	Yes	Yes	Yes	Yes	No
Audit Trail	Yes	Yes	Yes	Yes	Yes
HIPAA Compliant	Yes	Yes	Yes	No	No
Envelope Cap	No envelope cap	100 envelopes/user/year	Varies	Varies	Varies

How Business Conduct Policies differ from a general employee handbook

Compare primary attributes to choose the correct instrument for governance or to align the two documents where they overlap.

Criteria	Business Conduct Policies	Employee Handbook
Purpose	ethics & compliance	broad workplace rules
Legal Standing	high	informational
Distribution Frequency	annual or as-changed	annual or on-hire
Typical Signers	all employees	new hires

Who signs and authorizes Business Conduct Policies

Chief Compliance Officer

The Chief Compliance Officer typically approves the policy language, oversees implementation across the organization, and reports on compliance metrics to executive leadership and the board.

Human Resources Director

The HR Director administers distribution, training, and employee acknowledgments, maintains records of signed acknowledgments, and enforces disciplinary processes when required.

Real-world examples of Business Conduct Policy use

These short examples illustrate practical deployments and measurable outcomes from enforcing conduct policies.

Manufacturing Example

A plant operator handbook was merged with a conduct policy to reduce safety violations by clarifying report channels and expectations.

Outcome: 25% fewer reported safety incidents within six months.
By tightly integrating training and signed acknowledgments, the company reduced ambiguity and demonstrated compliance during regulatory inspections, improving audit readiness and worker confidence.

Healthcare Example

A regional clinic added HIPAA-specific clauses and a BAA requirement for vendors and used electronic acknowledgments for staff.

Outcome: faster incident response times and clearer vendor obligations.
The clinic improved its ability to demonstrate policy distribution and staff acknowledgment retention during audits, reducing legal exposure and streamlining vendor onboarding.

Frequently asked questions about Business Conduct Policies

Answers to common practical and legal questions when creating, distributing, and maintaining Business Conduct Policies.

Need help? Contact support

Can a policy be signed electronically?
Yes. Electronic signatures are generally enforceable under the ESIGN Act (15 U.S.C. §7001) and UETA in most states, provided intent, consent, attribution, and record retention requirements are met.
When is notarization required?
Notarization is rarely required for a Business Conduct Policy itself; however, related documents (powers of attorney, certain affidavits) may require notarization depending on state law.
What authentication is recommended?
Use email verification for general acknowledgments and stronger methods (SSO, SMS OTP, or KBA) for high-risk approvals or external signers to improve attribution and non-repudiation.
How long should signed records be kept?
Retain signed acknowledgments for at least the active term plus three years; follow industry or federal minima such as IRS or HIPAA retention rules when applicable.
Who must receive training?
All covered personnel should receive training; require completion within a defined window (commonly 90 days) and document completion for audit purposes.
What if an employee refuses to sign?
Document refusal, offer a paper alternative, conduct a compliance interview, and apply consistent disciplinary processes per company policy and applicable labor laws.

be ready to get more

Join over 28 million airSlate SignNow users

Sign Now