A Code of Conduct on Paper Is Not a Code of Conduct in Practice
“We’ve got a policy on company vehicles, cards and phones. It’s covered.”
Having the document is the easy part. A workplace code of conduct in practice is only as strong as whether that policy gets applied consistently, whether anyone has ever been pulled up under it before, and whether the business can point to it being enforced rather than just written. A code of conduct nobody has ever been held to isn’t a control. It’s a document that makes a business feel covered right up until it needs it to hold up.
The short answer: a code of conduct only protects a business if it has actually been enforced, consistently, before the day it matters. A policy that has never been applied to anyone is a document, not a control.
What a code of conduct is actually meant to do
Corporate assets (vehicles, credit cards, mobile phones, expense accounts) are some of the most common sources of workplace misconduct, and also some of the easiest to get procedurally wrong when it’s time to act. A code of conduct exists to set the standard before there’s a problem, so that when private use, dishonest reporting, or misuse of an account happens, the business already has a clear, previously communicated line to point to. Its value is entirely in having been applied evenly, which is precisely where a lot of Australian businesses fall down.
The rule, with conditions
Misuse of a company vehicle, card or phone genuinely can be a valid reason to discipline or dismiss someone. But a valid reason isn’t the whole test the Fair Work Commission applies.
A dismissal over asset misuse is more likely to hold up when: the code of conduct clearly and specifically covers the asset in question, it was actually communicated to the employee (not buried in an induction pack years ago), the business has applied it consistently to others in the same position, the employee was given a genuine, specific allegation and a real opportunity to respond, and the process wasn’t a box-ticking exercise dressed up as consultation.
It’s at serious risk of being found harsh, unjust or unreasonable when: the policy exists but has never actually been enforced against anyone, there’s a known culture of tolerating the exact behaviour now being treated as serious misconduct, or the “consultation” was procedural theatre that could never have changed the outcome.
The Fair Work Commission has dealt with exactly this pattern, and the two outcomes below show it cuts both ways. In Mahamed Ali v Sydney Trains [2024] FWC 33, a manager dismissed over misuse of a corporate purchasing card argued the conduct had effectively been sanctioned by senior management and reflected a wider culture of poor compliance in his division. The Commission agreed that a “poor management culture” around card use genuinely existed in that part of the business, and still found the dismissal was not harsh, unjust or unreasonable, and dismissed his application. Acknowledging a culture problem didn’t automatically excuse the conduct. But it’s not a result to bank on: the Commission was prepared to go looking for that pattern and weigh it seriously, and a business that’s been genuinely loose about enforcement is gambling on a finding that, this time, happened to go the employer’s way.
In Barber-Fleming v Billi Australia Pty Ltd [2020] FWC 6029, a Commissioner found an employee’s “repeated, deliberate and dishonest misuse” of a company credit card was real misconduct and valid grounds for dismissal, and still found the dismissal itself unfair, because the employer gave him no advance notice of the specific allegations and no genuine opportunity to respond before what the decision described as an ambush designed to induce his resignation. The Commission awarded nominal compensation of $1,230 (roughly two weeks’ pay, halved to reflect his own conduct) and found reinstatement inappropriate. The conduct being real didn’t save a process that wasn’t.
The detail most businesses miss entirely
There’s a second, more technical risk worth knowing about, because it changes who can even bring an unfair dismissal claim in the first place. In Dart v Trade Coast Investments Pty Ltd [2015] FWC 4355, a facilities manager’s private use of his company vehicle, mobile phone and iPad was valued at roughly $12,845 a year on top of his $121,560 salary, enough, combined, to push his total earnings over the high income threshold that applied at the time ($133,000) and exclude him from unfair dismissal protection altogether.
That threshold is indexed and reviewed each financial year, so the figure that applies today is higher than the one that applied in 2015. The principle is unchanged regardless of the exact figure: corporate assets aren’t just a conduct risk. They’re part of the earnings calculation a business needs to get right when working out who is, and isn’t, covered.
Questions to ask yourself
Five questions worth answering honestly.
- Do I actually know whether my code of conduct has been applied the same way to everyone, or am I assuming it has?
- If I had to defend a dismissal over asset misuse tomorrow, would I trust my own memory of how consistently it’s been enforced?
- Am I confident I’d notice a “poor management culture” like the one in the Sydney Trains case forming in my own business, or would I be the last to see it?
- Have I actually worked out what private use of company assets adds to an employee’s earnings, or have I assumed it doesn’t matter?
- Is my code of conduct something I could genuinely defend under questioning, or something I wrote once and haven’t looked at since?
If you’re not genuinely comfortable with your own answers, the policy isn’t protecting the business yet, and that’s not something you can fix by rereading the document.
Frequently asked questions
Can a business dismiss an employee for misusing a company car or credit card?
Yes, misuse of a company vehicle, card or phone can be a valid reason for dismissal. But a valid reason is only part of the test. The Fair Work Commission also looks at whether the policy was clearly communicated, applied consistently to others, and whether the employee got a genuine, specific allegation and a real chance to respond.
Does having a written code of conduct protect a business from an unfair dismissal claim?
Not on its own. A code of conduct that has never actually been enforced against anyone is at serious risk of being found harsh, unjust or unreasonable if it’s suddenly relied on for a dismissal. What protects a business is a documented history of the policy being applied consistently, not just the existence of the document.
What is the high income threshold and why does it matter for asset misuse cases?
It’s the earnings cap above which an employee generally isn’t protected from unfair dismissal. Private use of a company vehicle, phone or other assets counts toward an employee’s total earnings for this calculation, not just their base salary, so a business needs to work out the real value of that private use, not assume it’s negligible.
How often should a code of conduct be reviewed?
On a regular, ongoing basis, not once at induction and never again. It needs to be reviewed as the business changes (new assets, new roles, new ways of working) and it needs to be checked against how it has actually been enforced, so gaps between the written policy and real practice get closed before they matter.
Why WLSS
Whether a code of conduct has actually been applied consistently is hard for a business to judge about itself. Inconsistent enforcement usually looks, from the inside, like a series of reasonable one-off calls, not a pattern. Spotting that pattern before it becomes a Sydney Trains-style argument is a professional review job: checking the policy against how it’s actually been enforced, closing the gaps, and keeping it under constant review as the business, its assets and its people change.
Done properly, this doesn’t mean a longer policy. It usually means a shorter, sharper one. A code of conduct built to match exactly what the business actually has (which vehicles, which cards, which roles carry them) needs none of the generic, catch-all clauses businesses add when they’re guessing at what might come up. The WLSS team builds these around how a business genuinely operates, not a generic template, and treats consistent implementation, not just the document, as the actual deliverable.
Ask whoever wrote your code of conduct when it was last enforced, and against whom. If the honest answer is “never,” it isn’t protecting the business yet.
- Triple ISO certified: ISO 9001, ISO 45001, ISO 14001
- 80+ years combined team experience
- 500+ SA businesses supported
Recent Posts
Creating a Single Source of Truth with Areesa
"The software will sort our compliance out." No platform...
First Aid Kit Inspection and Servicing: Frequency, Contents and Risk-Based Modules”
"It's got a cross on the front and some bandaids...
Microwave Electrical Safety Testing: More Than a Basic Test and Tag
"It's tagged the same as the kettle. Should be fine."...
When Replacing an Extinguisher Beats Retesting It
"Just get it retested. It's cheaper than a new one."...
A Compliant Tag Is Not the Right Extinguisher
"Our fire equipment provider handles all that. They know what...
Common Fire Extinguisher Servicing Shortcuts and Warning Signs
"They're in and out fast. Very efficient." Speed alone...
Ready to Take the Next Step in Workplace Safety?
WLSS delivers tailored, ISO-certified solutions to help you minimise risk, exceed compliance, and create a thriving workplace.