Policy Governance · 19 min read
Conflict of Interest Policy: What to Include, Who Needs One and How to Keep It Current
A conflict of interest policy is a written set of rules that tells everyone in your organization what counts as a conflict between their personal interests and their duties, requires them to disclose those interests, and sets out how each disclosure is reviewed, decided and recorded, including when someone has to step out of a decision. It is one of the policies that sits under your wider policy governance, and for small and growing companies it is often the first policy that a board, an investor or a regulator asks to see.
Most of the pages that rank for this topic are written for nonprofit boards, and most of the templates are written for HR, but a growing company usually needs both views at once, because its conflicts show up in the boardroom and in purchasing, sales and hiring. This guide covers what the policy should say, who is required to have one, what the disclosure form should ask, and how to keep the whole thing current and acknowledged every year without a compliance department.
Key takeaways
- A conflict of interest policy defines actual, potential and perceived conflicts, requires disclosure, and says who reviews each disclosure and how decisions and recusals are recorded.
- Nonprofits filing Form 990 must say publicly whether they have one, and investment advisers, federal award recipients, federal contractors and PHS-funded researchers have written requirements of their own.
- The policy and the disclosure form are two different documents: the policy sets the rules once a year, and the form captures each person’s answers.
- The policy only works if it is reviewed, approved, sent out and acknowledged every year, with a record you can show the board, the auditor or the IRS.
What is a conflict of interest policy?
A conflict of interest exists when something a person stands to gain personally, such as money, a relationship or a future job, could influence a decision they make for the organization. The policy doesn’t assume anyone is dishonest, because most conflicts are innocent and arise simply because people have families, investments and lives outside work. What it does is make sure those interests are out in the open and that someone without a stake makes the call.
Good policies name three kinds of conflict, because each needs a slightly different response and people tend to disclose only the first kind unless the other two are spelled out.
The IRS describes the purpose of a conflict of interest policy for charities in much the same terms, as a set of procedures that protect the organization against charges of impropriety, under which the person with the conflict discloses the facts and is excused from voting on the matter.
Source: IRS, Form 1023: purpose of conflict of interest policy, irs.gov
Is a conflict of interest policy required?
For most private companies, no general federal law requires a conflict of interest policy, but a surprising number of small and mid-sized organizations fall under a rule, a form or a contract that expects one in writing. Here is where the federal expectations come from, so you can see quickly whether one applies to you.
| Who you are | What the rule or form expects | Where it comes from |
|---|---|---|
| A nonprofit filing Form 990 | The form asks whether you have a written conflict of interest policy, whether officers, directors, trustees and key employees disclose interests every year, and how you monitor and enforce the policy. The answers are public. | IRS Form 990, Part VI, lines 12a to 12c and 19 |
| A registered investment adviser | A written code of ethics, a written acknowledgment from each supervised person that they received the code and every amendment, and personal holdings and transaction reports from access persons. | SEC Rule 204A-1 |
| A recipient of a federal grant or award | Written disclosure of any potential conflict to the awarding agency, and written standards of conduct covering conflicts for anyone involved in selecting, awarding or managing contracts paid for by the award. | 2 CFR 200.112 and 200.318(c)(1) |
| A federal contractor | A written code of business ethics and conduct within 30 days of award, available to every employee working on the contract, with a fuller compliance program for larger companies. | FAR 52.203-13 |
| A research organization with PHS funding | An up-to-date, written and enforced financial conflict of interest policy on a public website, investigator training at least every four years, and disclosures at least annually and within 30 days of a new interest. | 42 CFR 50.604 |
| Every other company | No general federal rule requires one, but investors, lenders, larger customers and auditors often ask how you handle conflicts, and a written policy is the simplest answer. | Good practice |
Sources: IRS Form 990 (2025) Part VI Section B, 17 CFR 275.204A-1, 2 CFR 200.112, 2 CFR 200.318(c)(1), 48 CFR 52.203-13, 42 CFR 50.604
State laws, particularly for nonprofit corporations, can add their own requirements on top of these, so check the rules where you are incorporated. This guide is general information rather than legal advice, and your counsel or adviser should review the final policy.
What a conflict of interest policy should include
The strongest policies are short enough that people actually read them and specific enough that nobody has to guess, which usually means a few pages covering the same core sections. This outline, written in our own words rather than copied from any template, is a sound starting point that you can adapt to your size, your industry and any rule from the table above.
- Purpose. One or two sentences on why the policy exists, which is to protect the organization’s decisions and reputation, and the people making them.
- Who it covers. Employees, officers, directors or trustees, and anyone else who can influence decisions, such as contractors, advisers or volunteers in key roles.
- Definitions. What counts as a conflict, including actual, potential and perceived conflicts, and who counts as family or a close relationship.
- Examples. Real situations from your own departments, because people recognize a conflict from an example far faster than from a definition.
- Duty to disclose. When to disclose (as soon as the person notices it, and every year), how (the form or channel) and to whom.
- Review and decision. Who reviews disclosures from staff, who reviews them for leadership and the board, and the options they have, from clearing the interest to setting conditions or asking the person to end it.
- Recusal. What stepping out of a decision means in practice, including leaving the discussion and the vote, and how that is recorded.
- Gifts, hospitality and outside roles. Limits and approval rules for gifts and entertainment, second jobs, side businesses and board seats.
- Confidentiality. How disclosures are stored and who can see them.
- Records. What gets kept, where and for how long, linked to your records retention schedule.
- Consequences. What happens if someone fails to disclose or ignores a decision, up to and including termination or removal.
- Annual statement and acknowledgment. A yearly confirmation that each person has read the current policy and completed their disclosure.
- Review of the policy. Who owns it, how often it is reviewed and who approves changes, which should follow your policy on policies.
Two sections deserve extra care. The examples section is what makes a policy usable, so write examples from your own departments rather than generic ones, and the review and decision section is what makes it defensible, because a policy that collects disclosures without saying who decides what is only half a process.
Conflict of interest examples by department
People recognize a conflict far faster from an example than from a definition, so the best policies include a short table like this one, tailored to the work each team actually does.
| Department | A conflict that often comes up | What the policy usually asks |
|---|---|---|
| Purchasing and operations | A buyer’s relative owns or works for a supplier that is bidding for work | Disclose, step out of the selection, and let someone else approve the contract |
| Sales and account management | A customer offers gifts, trips or hospitality while a deal or renewal is open | Follow the gift limits in the policy, log anything above them, and ask before accepting |
| Engineering and IT | An engineer holds shares in, or advises, a vendor the team is evaluating | Disclose the interest before the evaluation starts and leave the final choice to others |
| Finance | Someone who approves payments has a personal loan or investment tied to a payee | Disclose, and route those payments to a second approver |
| HR and hiring | A manager wants to hire, promote or review a family member or partner | Disclose the relationship and move the decision to another manager |
| Leadership and the board | A director’s other company could sign a deal with yours, or their pay is being set | Disclose, leave the discussion and the vote, and record that in the minutes |
| Anyone | A side business, a second job or a board seat that competes with or sells to the company | Disclose it and get written approval before taking it on |
Notice that most of these conflicts arise well below the board, which is why an employee conflict of interest policy that covers staff in purchasing, sales, finance and hiring matters as much as the board version, and why many growing companies use one policy with a scope that covers everyone.
The conflict of interest disclosure form
The policy sets the rules, while the disclosure form captures each person’s answers, and keeping the two separate makes both easier to maintain, because the policy changes once a year while the form is filled in by everyone. A good annual disclosure form is short, asks only what the reviewer needs, and makes “I have nothing to disclose” an explicit answer so that a blank form is never ambiguous.
Who and when. The person’s name, role, department and manager, and the period the disclosure covers.
Outside roles. Second jobs, consulting work, side businesses, and board or advisory seats at other organizations.
Financial interests. Ownership, investments, loans or other financial ties to suppliers, customers, competitors or anyone seeking business with the organization.
Relationships. Family members or close personal relationships with people at those organizations, and with colleagues the person hires, manages or pays.
Gifts and hospitality. Anything received above the limit set in the policy, who gave it and why.
Confirmation. A statement that the answers are complete, a promise to update them when something changes, and a signature and date.
Many small organizations build this form in a tool they already use, such as Google Forms or Typeform, and in AllyMatter the clean way to handle it is to keep the two apart: the policy stays a policy that people acknowledge every year, while the form goes into its own short page, with the form embedded, that the policy links to, so people find both in one place and the answers stay in your form tool where your reviewer works through them.
What happens after someone discloses a conflict
Collecting disclosures is the easy part, and the part that boards, auditors and regulators actually look at is what you did with them. A clear four-step process, written into the policy, means the answer never depends on who happens to be in the room.
The reviewer for staff disclosures is usually a manager or whoever owns compliance, while disclosures from senior leaders and directors should go to someone independent of them, such as a board committee or the chair. Whoever reviews, the decision and its reason belong in writing, because a decision that was never recorded looks, to an outsider, exactly like a decision that was never made. Our guide to the policy owner role covers who should hold the file.
Conflict of interest policies for nonprofits and Form 990
For nonprofits the stakes are public, because Form 990 asks three direct questions about the policy and the answers can be read by donors, grant makers and journalists. Part VI of the form asks whether the organization had a written conflict of interest policy, whether officers, directors or trustees and key employees were required to disclose annually any interests that could give rise to conflicts, and whether the organization regularly and consistently monitored and enforced compliance, with a description on Schedule O if it did.
Source: IRS Form 990 (2025), Part VI, Section B, lines 12a, 12b and 12c, and line 19
The form itself notes that these policies are not required by the Internal Revenue Code, but answering “no” in a public filing is rarely a position a board wants to defend, and line 19 also asks whether you made the policy available to the public. The same section asks about a written whistleblower policy and a written document retention and destruction policy, which is one reason nonprofits tend to build all three together, and our guide to the records retention schedule covers the last one.
To answer “yes” to the monitoring question honestly, you need more than a signed form in a drawer, because monitoring means you can show the policy was current, everyone in scope received it, disclosures were reviewed, and decisions and recusals were recorded. That is the same evidence an auditor asks for in a company, which is why the annual cycle below works for both.
Conflict of interest rules in regulated industries
Investment advisers. SEC Rule 204A-1 requires a registered adviser’s code of ethics to set standards of business conduct, require access persons to report their personal holdings when they start and every year, and their transactions every quarter, and require each supervised person to give a written acknowledgment that they received the code and any amendments. That last requirement means every change to the code needs a fresh acknowledgment from everyone, which is exactly the record that falls apart when it is collected by email.
Federal grants and awards. Under the federal grant rules, a recipient must disclose any potential conflict of interest in writing to the awarding agency, and must keep written standards of conduct that stop anyone with a real or apparent conflict from taking part in selecting, awarding or managing contracts paid for by the award, with disciplinary actions for violations.
Federal contractors. The standard contract clause on business ethics requires a written code of business ethics and conduct within 30 days of award, made available to every employee working on the contract, while the fuller ethics training and internal control requirements don’t apply to small businesses or to commercial contracts.
Research with PHS funding. Institutions receiving Public Health Service research funding must keep an up-to-date, written and enforced financial conflict of interest policy on a public website, train investigators before they start and at least every four years, and collect disclosures at least annually and within 30 days of any new significant financial interest.
Sources: 17 CFR 275.204A-1, 2 CFR 200.112, 2 CFR 200.318(c)(1), 48 CFR 52.203-13, 42 CFR 50.604
In each case the regulator is asking the same underlying question, which is whether the rules were written down, whether the right people received the current version, and whether you can prove it. If you work to a standard that we haven’t covered here, our sister site Policy and Compliance explains what common standards require.
Keeping the policy current and acknowledged every year
A conflict of interest policy is a yearly habit more than a document, because both the policy and the disclosures go stale. The organizations that handle it well run the same short cycle at the same time every year, often lined up with the board calendar or the start of the fiscal year, so it becomes routine rather than a scramble before an audit or a filing.
Review on a schedule. Give the policy a review date that repeats every twelve months, so it comes back to its owner whether or not anyone remembers. In AllyMatter, each policy carries a review date, fixed or on a repeating cycle, and a review alert appears on the policy until it is approved again.
Approve every change before it goes out. Whoever approved the policy last year should approve this year’s version, and for a nonprofit that often means the board or its governance committee. In AllyMatter every policy goes through an approval workflow you build once, with up to four steps in order, a rejection has to come with a reason that stays on the record, and only an approved version can ever reach your people. An outside lawyer can be invited to approve as one of the steps, which suits a policy that counsel likes to see.
Show people what changed. Asking people to re-read a whole policy every year to find two changed sentences is how acknowledgment turns into a box-ticking exercise. Years of responding to RFPs taught me to read every agreement line by line, and that habit is why version compare in AllyMatter shows every word removed and added between two versions, so reviewers, approvers and the people acknowledging can see the change itself.
Get the current version acknowledged by everyone in scope. Send the approved policy for acknowledgment to everyone it covers, and each person confirms it while signed in, with their name, the version and the time recorded and automatic reminders going to anyone who hasn’t confirmed. Because every change goes back through approval and back out for re-acknowledgment, with no exception for small edits, what people confirmed is always what is in force. If you prefer people to sign a PDF version of the policy, you can upload the PDF and have it acknowledged by name in the same way. Our guide to policy attestation explains how a yearly confirmation differs from a one-off acknowledgment.
Keep the record together. When the board, an auditor or the IRS asks how you monitor the policy, the answer should be a file rather than an afternoon of searching. Every approval, version and acknowledgment of a policy in AllyMatter lands in its audit trail, which you can filter by date or person and export as a PDF or CSV, and you keep the disclosure answers and decisions from your form tool alongside it in your records.
Common conflict of interest policy mistakes
Most failures in policies of this kind aren’t about the wording at all, and come instead from gaps in scope, timing and record-keeping that are easy to fix once you know to look for them.
| Common mistake | Why it fails | What to do instead |
|---|---|---|
| Only the board signs | Most day-to-day conflicts sit with buyers, managers and salespeople, not directors | Cover everyone who can influence a decision, and say so in the scope |
| Disclosure happens once, at hiring | Interests change, and a form from three years ago proves nothing about today | Ask every year, and require a new disclosure whenever something changes |
| No one is named to review disclosures | Forms pile up unread, which is worse than not asking because you knew and did nothing | Name a reviewer for staff and a separate one for leadership and the board |
| Decisions aren’t written down | Without a record of what was decided and why, the same conflict gets argued again and auditors see no monitoring | Record every disclosure, decision and recusal, and keep them with the policy’s records |
| The policy never changes | New lines of business, new vendors and new rules make old examples and contacts wrong | Put a yearly review date on the policy and send each new version back out for acknowledgment |
Where this policy fits in your policy governance
A conflict of interest policy is a good test of your wider policy program, because it touches the board, every department and often a regulator at the same time. If yours has no clear owner, no review date and no record of who received it, the same is probably true of your other policies, and our guide to policy governance covers how growing companies fix that across the board, from a policy on policies to the elements of an effective compliance program. For the tools that run the whole cycle, our guide to policy management software for small and growing businesses explains what to look for, and our post on policy acknowledgment tracking goes deeper on the acknowledgment record itself.
Start your 30-day free trial of AllyMatter. No credit card to start, and a 30-day money-back guarantee if you subscribe and change your mind. Free migration.
Questions about conflict of interest policies
What is a conflict of interest policy?
A conflict of interest policy is a written set of rules that says what counts as a conflict between someone’s personal interests and their duties to the organization, requires people to disclose those interests, and sets out how disclosures are reviewed, decided and recorded, including when someone has to step out of a decision.
Is a conflict of interest policy legally required?
For most private companies, no general federal law requires one. Nonprofits filing Form 990 must say publicly whether they have one, investment advisers need a code of ethics with written acknowledgments, and recipients of federal awards, federal contractors and PHS-funded research organizations have their own written requirements. State laws can add more, so check with your adviser.
Who should sign a conflict of interest policy?
Everyone who can influence a decision: employees, officers, directors or trustees, and key contractors or volunteers. Boards often stop at directors, but most day-to-day conflicts arise in purchasing, sales, hiring and finance, so staff belong in scope too.
How often should people complete a conflict of interest disclosure?
At least once a year, plus whenever something changes, such as a new investment, a relative joining a supplier, or a new board seat. Form 990 asks nonprofits specifically whether key people disclose annually, and PHS rules require disclosures at least annually and within 30 days of a new interest.
What should a conflict of interest disclosure form ask?
The person’s name, role and the period covered; outside jobs, board seats and businesses; financial interests in suppliers, customers or competitors; family or close relationships with those organizations or with colleagues they manage; gifts and hospitality above your limit; and a clear “nothing to report” option, followed by a signature and date.
What’s the difference between disclosure and recusal?
Disclosure is telling the organization about an interest, while recusal is stepping out of a specific decision because of it. Every conflict gets disclosed, but only some lead to recusal, and the reviewer decides which.
How is a conflict of interest policy different from a code of conduct?
A code of conduct covers behavior across the board, from honesty to safety and respect at work, while a conflict of interest policy goes deep on one risk. Many companies put a short conflicts section in the code and keep the full rules and disclosure process in a separate policy.
The organizations that handle conflicts well aren’t the ones with the longest policy, but the ones that can show, on any day of the year, that the current version was approved, that everyone in scope received it, and that every disclosure was reviewed and recorded, because that record is what turns a document into a defense.
Start your 30-day free trial of AllyMatter. No credit card to start, and a 30-day money-back guarantee if you subscribe and change your mind. Free migration.