An employee code of conduct is the written policy that tells your workforce which behaviors are expected, which are prohibited, and what happens when the line is crossed. A personnel file is the record of what actually happened for each employee, from hiring paperwork to the last disciplinary note. The two documents are the practical backbone of any HR function: the code is the rulebook, the personnel file is the audit trail, and every well-run hiring team maintains both together.
This guide covers what belongs in an employee code of conduct, what belongs in a personnel file, and the recordkeeping rules that govern both in the US. It also walks through how to communicate the code internally so employees actually read it, and how the hiring workflow (including AI-assisted Round 1 interviews on platforms like Fabric) feeds records into the personnel file from day zero. It is written for the CHRO or head of people ops at an enterprise doing bulk hiring, where a single mishandled disciplinary record or missing acknowledgment can turn into a class-action headache. It is not legal advice.
Table of contents
- What is a code of conduct?
- What belongs in a strong employee code of conduct
- What is a personnel file?
- What belongs in a personnel file: recordkeeping requirements
- How to communicate the code of conduct internally
- Where the hiring workflow feeds the personnel file
- Common mistakes when writing and applying a code of conduct
- Related posts
- FAQ
What is a code of conduct?
A code of conduct is a written policy that sets out the standards of behavior an organization expects from its employees, together with the consequences for breaching those standards. It sits above individual policies (anti-harassment, confidentiality, IT acceptable use) as the umbrella document that names the values and the rules those specific policies implement. In practice, an employee code of conduct is what a manager or HR partner points to when a behavioral question comes up, and what an employment tribunal, arbitrator, or regulator asks for first when reviewing a workplace complaint.
The single most important editorial choice in writing one is who is responsible for the behavior described. A code of conduct is not a corporate values poster. It is a rule set with enforceable consequences, applied consistently, and grounded in a documented process for reporting, investigation, and discipline. If the code cannot be quoted verbatim to defend a firing or discipline decision, it is not doing its job.
What belongs in a strong employee code of conduct
A strong employee code of conduct covers roughly twelve sections: purpose and scope, core values, compliance with law, anti-discrimination and harassment, conflicts of interest, confidentiality and data protection, use of company systems, outside employment, gifts and hospitality, whistleblowing and non-retaliation, the disciplinary process, and a signed acknowledgment. Each section is a rule with a consequence, not an aspiration. The goal is that a first-week hire can read the whole document in one sitting, and that a manager or HR partner can quote it verbatim to defend any discipline decision. Anything that cannot be enforced belongs in a values statement, not in the code.
The full sequence, in the order the sections should appear:
- Purpose and scope. One paragraph naming the organization, the employees and contractors it applies to, and the reason the code exists.
- Core values. A short statement of the principles the code implements. Kept to three or four values, not a wall of adjectives.
- Compliance with law. A statement that employees are expected to follow all applicable laws in the jurisdictions they work in, and to escalate any conflict between company practice and law to HR or Legal.
- Anti-discrimination and harassment. Explicit list of protected characteristics, examples of prohibited conduct, and the reporting channel (with an anonymous option).
- Conflicts of interest. What counts as a conflict, and the disclosure and approval process.
- Confidentiality and data protection. Handling of customer data, employee data, and internal information; specific reference to the data-protection regime the company is subject to (e.g. GDPR, HIPAA, DPDP Act in India).
- Use of company property and systems. IT acceptable use, personal use limits, and monitoring practices.
- Outside employment and moonlighting. Whether it is permitted, and any approval or non-compete provisions.
- Gifts and hospitality. Approval thresholds and prohibited categories.
- Whistleblowing and non-retaliation. How to raise a concern, who receives it, and the explicit protection against retaliation.
- Disciplinary process. The stages of discipline, from informal counseling through written warning to dismissal, and the appeal route.
- Acknowledgment. A signature block confirming the employee has read and understood the code, filed in the personnel file (see below).
Every one of these sections should be short enough that a first-week hire can read the full code in one sitting. The dense compliance detail belongs in linked policies, not in the master document.
What is a personnel file?
A personnel file is the collected employment record for a single employee, kept by the employer, that documents the individual's hiring, performance, discipline, pay, benefits, and separation. It is the audit trail behind every employment decision that individual is subject to, from starting salary through promotion, discipline, and eventual termination. Personnel files are the primary evidence source in almost every wrongful-termination or discrimination claim, which is why what goes into them (and what stays out) is regulated.
Most US employers now maintain personnel files digitally, either inside an HRIS or across a set of restricted-access folders. The physical-file era is essentially over, but the recordkeeping obligations are unchanged: content, retention, and access rights are set by federal and state law regardless of storage medium.
What belongs in a personnel file: recordkeeping requirements
A personnel file holds four categories of record: the main employment record (hiring paperwork, performance reviews, discipline, training, separation), payroll and tax records, I-9 employment-eligibility records, and medical, benefits, and accommodation records. In the US, federal law requires the last three to be stored in physically or logically separate folders from the main file, so that reviewing a promotion decision does not incidentally expose an employee's I-9, W-4, or medical history. Retention floors are set by the FLSA, EEOC recordkeeping rules, IRCA, and ERISA, and state law can extend any of them. The specific breakdown below is the working checklist most enterprise HR teams keep on file.
Main personnel file
- Job application and resume
- Offer letter and signed job description
- Signed acknowledgment of the code of conduct and employee handbook
- Performance reviews and goal documents
- Disciplinary notes, written warnings, and any performance improvement plan (PIP)
- Training completion records
- Promotion and compensation change letters
- Separation paperwork and exit interview notes
Payroll and tax records (kept separate under FLSA)
- W-4, state withholding equivalents
- Timekeeping records, pay rate history, payroll registers
The Department of Labor's FLSA Fact Sheet #21 requires payroll records to be kept for three years, with the underlying time and wage-computation records kept for two years.
I-9 records (kept separate under IRCA)
- Form I-9 and supporting identity/eligibility documents
I-9s must be retained for three years from date of hire or one year from termination, whichever is later, and stored so they can be produced within three business days of a government request.
Medical, benefits, and ADA records (kept separate under ADA and HIPAA)
- Health plan enrollment and beneficiary designations
- Leave paperwork (FMLA certifications, ADA accommodation requests)
- Workers' compensation records
- Any medical documentation used to substantiate leave or accommodation
The Equal Employment Opportunity Commission's recordkeeping requirements require most personnel records to be kept for at least one year from the date the record was made or the personnel action was taken; educational institutions and certain other employers have a two-year floor. Records tied to a pending discrimination charge must be preserved until the matter is fully resolved.
The retention rules that most often trip employers up:
| Record | Minimum retention (US federal) | Governing rule |
|---|---|---|
| Personnel and employment records | 1 year from action or record date | EEOC (Title VII, ADA, GINA) |
| Payroll records | 3 years | FLSA (Fact Sheet #21) |
| Time cards, wage-rate tables | 2 years | FLSA |
| Form I-9 | 3 years from hire or 1 year from separation, whichever is later | IRCA (USCIS) |
| Benefit plan records (ERISA) | 6 years | ERISA §107 |
State law can extend any of these. California, for instance, requires payroll records to be kept for three years but also gives employees an inspection right that lasts for the retention period plus one year. Where state and federal periods differ, apply the longer one.
How to communicate the code of conduct internally
Publishing a code of conduct is not the same as employees knowing it exists. The distinction between the two is the entire reason internal communication is a core HR discipline rather than a marketing sub-task: a written policy is only enforceable to the extent employees have been fairly notified of it and given the chance to read it.
The rollout pattern that holds up in discipline hearings and audits:
- Include the code in the offer packet. Send the full text with the offer letter, before the employee signs. This puts acceptance of the code inside the employment contract itself.
- Walk through it during onboarding. A 30-minute live session in the first week, ideally with Legal or HR present, that talks through the reporting channels and the disciplinary process.
- Capture a signed acknowledgment. Store the signed acknowledgment in the personnel file. This is the single document that gets pulled first in any later dispute.
- Publish it on the intranet with a searchable index. Employees should be able to find the anti-harassment section in under a minute during a real incident.
- Repeat the training annually. Refresher training with a fresh acknowledgment. Track completion in the HRIS.
- Reference the code when incidents happen. Every disciplinary letter, every HR investigation summary, every training refresh should cite the specific section of the code the incident touches. That is what makes the policy live rather than shelfware.
- Update it, and version it. Every substantive change should be dated, versioned, and communicated to all employees, with a fresh acknowledgment where the change is material.
For distributed teams, the internal communication channel matters as much as the content. A Slack announcement is not sufficient notice for a substantive policy change; the email plus intranet plus acknowledgment pattern is what regulators expect to see.
Where the hiring workflow feeds the personnel file
The personnel file begins before day one. Every artifact produced during hiring, from the signed application through interview notes to the offer letter, becomes part of the record that governs the employment relationship after start date. For enterprises hiring at bulk-hiring volumes (roughly 50+ people per month), the interview record is often the highest-volume input to personnel files, and the most exposed to a discrimination or wrongful-non-hire claim. Structured scoring, retained interview notes, and a defensible audit trail from Round 1 forward are the difference between "we made a call" and "here is exactly why we made this call." Two categories of hiring record deserve specific attention:
- Screening and interview records. The written notes from every interview stage, structured scoring rubrics, take-home evaluations, and reference-check summaries. These are the evidence base if a candidate later alleges disparate treatment or discrimination in hiring, and they belong in the pre-hire section of the personnel file.
- Eligibility and integrity signals from Round 1 screening. Modern hiring platforms produce a structured record of eligibility checks (years of experience, location, work authorization) and, on platforms that support it, integrity signals from proctored or AI-led interviews. These signals should be retained with the rest of the interview record, not discarded.
Fabric's Interview Engine screens, scores, and records Round 1 interviews across sourcing, screening, scheduling, and interviews, including role-specific formats like pair programming, case studies, and cold-call simulations for sales roles. Fabric's cheating detection is designed to flag AI-based cheating during interviews and surface it to your recruiter. It is a signal for your team to weigh, not an automatic reject, and the recruiter or hiring panel remains the decision authority for every offer or rejection.
Practically, that means the interview transcript, the eligibility summary, and any cheating-detection flag are records with a natural home in the pre-hire portion of the personnel file. Treating them that way from the start gives you a clean, defensible paper trail if a hiring decision is ever challenged, and it means the same audit-trail logic that governs the personnel file also governs how AI-assisted signals from Round 1 are handled.
Common mistakes when writing and applying a code of conduct
- Confusing values with rules. A page of aspirational adjectives with no enforcement mechanism is not a code of conduct. Every section needs a clear rule and a clear consequence.
- No acknowledgment on file. If HR cannot produce a signed acknowledgment when a discipline decision is challenged, the whole disciplinary process becomes harder to defend.
- Storing everything in one folder. Mixing I-9s, medical records, and the main personnel file in a single location is the fastest way to create a legal problem. Keep the four categories separate.
- Never referring to it again. A code that is signed at onboarding and never mentioned during the employment relationship stops being a live policy. Cite it in every disciplinary letter, every training, and every policy update.
- Ignoring state-specific access rights. Half the US states give employees a statutory right to see their personnel file, and those states also cap how quickly you must respond. A "no employee access" policy is unlawful in those jurisdictions.
- Skipping the update cadence. A code that has not been revisited in three years usually contradicts current practice on remote work, data protection, and AI use. An annual review is the minimum sensible cadence.
Related posts
- Bereavement Leave Policy: What to Include (Template)
- Allyship, ERGs & Cultural Competence at Work
- 15 Best HRIS Systems: Compare Features, Pricing, and Reviews
- Developing an Acceptable Use Policy: Guidelines for AI in Interviews
- What Is a BARS (Behaviorally Anchored Rating Scale)?
FAQ
What is a code of conduct?
A code of conduct is a written policy that sets out the standards of behavior an organization expects from its employees, along with the consequences for breaching those standards. It usually covers ethics, discrimination and harassment, confidentiality, conflicts of interest, use of company property, and how misconduct is reported and handled.
What belongs in a personnel file?
A personnel file typically holds hiring records (offer letter, signed job description, background-check consent), employment eligibility documents (I-9, W-4 or state equivalents), performance reviews, disciplinary records, training completion records, and payroll and benefits paperwork. Medical records, I-9s, and investigation files are usually kept in separate folders to satisfy federal recordkeeping rules.
How long do you have to keep personnel files?
In the US, most personnel records must be kept for at least one year from the date the record was made or the personnel action was taken, per EEOC recordkeeping rules; payroll records must be kept for three years and supporting time records for two years under FLSA Fact Sheet #21. Terminated-employee records generally continue for one year from the termination date, and longer retention periods apply to I-9s, benefits, and OSHA records.
How do you communicate a code of conduct to employees?
The strongest pattern is to distribute the code at offer acceptance, walk through it during onboarding, require a signed acknowledgment stored in the personnel file, and repeat the training annually. Include the code in the employee handbook, publish it on the intranet, and reference it whenever a related incident is handled so employees see it as live policy, not shelfware.
Is a code of conduct legally required?
In the US there is no federal law that requires a code of conduct for private employers, though publicly listed companies must disclose whether they have one for senior financial officers under Section 406 of the Sarbanes-Oxley Act. Even where not mandatory, a written code is treated as material evidence in discrimination, harassment, and wrongful-termination claims, which is why most well-run employers publish and enforce one.
What is the difference between a code of conduct and a code of ethics?
A code of ethics states the values and principles the organization stands for at a high level; a code of conduct translates those principles into specific behavioral rules and consequences. Most employers combine both in a single document, with a short values statement followed by concrete rules that a manager or HR partner can actually enforce.
Can an employee access their own personnel file?
It depends on the state. Roughly half of US states, including California, Illinois, Massachusetts, and Michigan, give current and often former employees a statutory right to inspect and copy parts of their personnel file within a set timeframe. Where no statute exists, access is a matter of employer policy, and most modern handbooks grant a reasonable review right by default.