Code of Business Conduct & Ethics

1. Purpose and intent

Defines the conduct expected of everyone representing the organisation. This policy is intended to provide a consistent reference for decisions, conduct and controls. It should be read alongside applicable laws, contractual obligations and relevant internal procedures. Where requirements differ, the applicable legal requirement and formally approved internal control take precedence.

2. Scope and application

Applies to directors, officers, employees, temporary personnel and representatives, and informs expectations of relevant business partners.

Business partners are expected to observe equivalent standards where these are relevant to the services they provide or the activities they undertake on the organisation’s behalf. Application should be proportionate to role, activity, risk and applicable legal requirements.

3. Core principles

• Act honestly and communicate accurately.
• Treat colleagues, clients, suppliers and communities with dignity and respect.
• Comply with applicable laws, regulations, contractual obligations and internal controls.
• Protect confidential information, company property and entrusted resources.
• Avoid conflicts and disclose circumstances that could impair objective judgement.
• Maintain complete and accurate business records.
• Raise concerns about suspected misconduct, unsafe practices or control failures.

4. Minimum standards and controls

The following controls describe the expected minimum approach. Specific procedures, approval limits, forms and technical controls may be established separately and updated through controlled internal documents.

• Do not falsify, conceal or improperly alter records, reports, time entries, invoices or approvals.
• Do not discriminate, harass, intimidate or retaliate against another person.
• Do not use organisational resources for unlawful or unauthorised personal benefit.
• Do not disclose confidential or personal information without a lawful business basis.
• Do not bypass approval limits or ask another person to do so.
• Seek guidance when a situation is unclear and escalate concerns in good faith.

5. Roles and accountability

Leaders must set the example, communicate expectations and respond consistently to concerns. Every individual is personally responsible for understanding and following this Code.

Any person who is uncertain about the application of this policy should seek guidance before taking action. No individual may override a legal obligation or approved control without appropriate authority and documented justification.

6. Reporting and escalation

Concerns, suspected breaches, control weaknesses and incidents should be raised promptly through the relevant management or designated reporting channel. Urgent threats to health, safety, the environment or the security of information must be escalated immediately. Reports should be handled fairly, sensitively and in accordance with applicable privacy and records requirements.

7. Monitoring, assurance and review

Concerns may be raised through management or designated reporting channels. Reports should be reviewed fairly. Breaches may lead to corrective, disciplinary, contractual or legal action, as appropriate.

Where improvement actions are identified, they should be assigned to an accountable owner, given a proportionate target date and monitored to closure. Material changes in law, risk, organisational context or operating arrangements should trigger an earlier review.

8. Non-compliance

Failure to follow applicable requirements may result in corrective action, additional training, restricted authority, disciplinary measures, contractual remedies or referral to relevant authorities, depending on the circumstances and applicable law. Any response should be proportionate and follow fair process.

9. Related policies and standards

Anti-Bribery; Conflicts of Interest; Human Rights; Information Security; Whistleblowing.

Additional policy requirements

The following provisions expand the practical expectations set out in this policy. They should be applied in conjunction with applicable law, approved internal procedures, contractual obligations and the circumstances of each activity.

Respectful workplace

Every person should be treated with dignity and fairness. Harassment, bullying, intimidation, discrimination, threats and humiliating conduct are not acceptable. Professional disagreement should remain respectful and must not become retaliation or obstruction.

Confidentiality and information

Non-public business, personal, commercial, technical and security information must be accessed only for legitimate authorised purposes. Information must not be disclosed, copied, transferred or retained beyond approved requirements. Suspected loss or unauthorised disclosure must be reported promptly.

Use of assets and resources

Company property, systems, credentials, vehicles, facilities, funds and time must be used responsibly, securely and for authorised purposes. Theft, fraud, falsification, unauthorised personal use and circumvention of controls are prohibited.

Accuracy and representations

Records, reports, time entries, expenses, procurement documents and external statements must be complete and truthful. No person may knowingly mislead colleagues, clients, suppliers, regulators or other stakeholders or conceal material facts.

Speaking up

Personnel are expected to raise concerns about unlawful conduct, unsafe practices, misconduct or control weaknesses. Reports should be made in good faith and without fear of retaliation. Managers must take concerns seriously and escalate matters beyond their authority.

10. Document governance

This web page is a public policy statement. The controlled internal version, where formally approved, is maintained through the organisation’s document-control process. Approval status, document owner, effective date, review cycle and revision history must be confirmed in the controlled document register before this text is represented as a formally issued internal policy.