Skip to main content
Policy Authority
Category: Ethics and Culture

Integrity Framework

Also known as: Integrity Maturity Framework
Simply put

An integrity framework is a structured set of principles, policies, and practices that an organization uses to promote ethical conduct and sound decision-making. It typically helps an entity design, implement, and review measures intended to support integrity across its operations. Such frameworks are commonly used in the public sector, though the specific principles and scope vary by organization and jurisdiction.

Formal definition

An integrity framework is a governance construct that consolidates an organization's integrity principles, laws, policies, and procedures into a coherent structure for directing ethical decision-making and conduct. In public-sector applications it may be organized around defined integrity principles, for example, the Commonwealth Integrity Maturity Framework references a set of eight integrity principles derived from key Commonwealth integrity laws, policies, and procedures, and is often paired with maturity or improvement models that enable agencies to diagnose, plan, implement, and review the effectiveness of their integrity arrangements. As a governance instrument it primarily addresses the structures and expectations that guide ethical behaviour; it is distinct from, though frequently interrelated with, risk management and compliance activities. The specific principles, scope, and applicability depend on the issuing body, sector, and jurisdiction, and this entry does not cover implementation specifics, tooling, or the requirements of any particular legal regime.

Why it matters

Integrity frameworks matter because they give organizations a coherent structure for directing ethical conduct rather than relying on ad hoc judgments or scattered policies. By consolidating an entity's integrity principles, laws, policies, and procedures, such frameworks help clarify the expectations that guide decision-making and establish a reference point against which conduct and governance arrangements can be assessed. In public-sector settings in particular, this coherence supports accountability and public trust, since agencies are expected to demonstrate that their integrity arrangements are deliberate and reviewable rather than incidental.

A further reason these frameworks are significant is that they are commonly paired with maturity or improvement models. This pairing allows an agency to diagnose the current state of its integrity arrangements, plan improvements, implement measures, and review their effectiveness over time. For example, the Commonwealth Integrity Maturity Framework is described as helping agencies design, implement, and review the effectiveness of their integrity frameworks, while comparable tools such as the UNDP framework support public entities to diagnose, plan, and manage their arrangements. This diagnostic-and-improvement orientation makes integrity a matter of ongoing governance attention rather than a one-time statement of values.

Because the specific principles, scope, and applicability vary by issuing body, sector, and jurisdiction, an integrity framework should be understood in its particular context. It primarily addresses the governance structures and expectations that guide ethical behaviour, and while it interrelates with risk management and compliance, it is distinct from them. Organizations that treat an integrity framework as a substitute for compliance obligations or risk controls, rather than as a complementary governance instrument, may misread its intended role.

Who it's relevant to

Public-sector governance professionals
Governance staff in government agencies and public entities are a primary audience, since integrity frameworks are commonly applied in the public sector. Examples such as the Commonwealth Integrity Maturity Framework and the ANAO Integrity Framework are designed to help agencies improve governance practices and support ethical decision-making, and to design, implement, and review the effectiveness of their integrity arrangements.
Ethics and integrity officers
Those responsible for promoting ethical conduct within an organization can use an integrity framework as a structured set of principles and practices to guide decision-making. Where the framework is paired with a maturity model, these officers may use it to diagnose current arrangements, plan improvements, and review effectiveness over time.
Internal auditors and assurance functions
Assurance professionals may reference an integrity framework as a benchmark when evaluating the maturity and effectiveness of an organization's integrity arrangements. Consistent with their independent and objective role, they assess these arrangements rather than manage them, keeping assurance activity distinct from the governance measures being reviewed.
Risk and compliance practitioners
Because an integrity framework primarily addresses governance structures and expectations but frequently interrelates with risk management and compliance, practitioners in those functions may find it relevant as a complementary reference. It should not be treated as a substitute for risk controls or specific legal and regulatory compliance obligations.

Inside Integrity Framework

Ethical values and standards of conduct
A statement of the organization's core values and expected behaviors, commonly articulated through a code of conduct or code of ethics that translates high-level principles into observable expectations for personnel.
Governance and accountability structures
Defined roles, decision rights, and oversight responsibilities, typically involving the board or equivalent body and senior management, that assign ownership for setting the tone at the top and monitoring integrity outcomes. This element sits within the governance pillar.
Policies, standards, and procedures
Documented instruments that direct conduct in specific areas such as conflicts of interest, gifts and hospitality, anti-bribery, and fair dealing. A policy states intent and principle, a standard sets measurable requirements, and a procedure describes the steps to comply; these are distinct instruments and should not be treated as interchangeable.
Risk identification and assessment for integrity risks
Processes to identify and evaluate exposures to unethical conduct, such as fraud, corruption, and conflicts of interest, against organizational objectives. This element draws on the risk management pillar and may distinguish inherent exposure from residual exposure after controls are considered.
Awareness, training, and communication
Activities intended to build understanding of expected conduct and applicable obligations, and to reinforce the framework across the organization on an ongoing basis.
Reporting and speak-up mechanisms
Channels, such as confidential or anonymous reporting lines, through which suspected misconduct can be raised, together with protections against retaliation where applicable. The availability and legal protections for such mechanisms vary by jurisdiction.
Monitoring, assurance, and continual improvement
Management monitoring activities combined with independent assurance to evaluate whether the framework operates as intended. Management-led monitoring should be distinguished from independent assurance provided by an objective function such as internal audit.

Common questions

Answers to the questions practitioners most commonly ask about Integrity Framework.

Is an integrity framework the same as a compliance program?
No. Although the two overlap and are often coordinated, they are conceptually distinct. A compliance program is oriented primarily toward adherence to external laws, regulations, and internal policies, and is typically structured around identifying obligations and demonstrating conformance. An integrity framework is broader and values-based, aiming to foster ethical conduct and organizational culture that goes beyond the minimum required for legal adherence. In many organizations the integrity framework provides the ethical foundation within which the compliance program operates, but conflating the two can obscure the distinction between adhering to rules and cultivating principled behavior. This entry does not address the specific structure of any particular compliance program.
Does having an integrity framework guarantee ethical behavior or prevent misconduct?
No. An integrity framework is intended to reduce the likelihood of misconduct and to promote ethical decision-making, but it cannot guarantee outcomes. Frameworks establish expectations, structures, and supporting mechanisms, yet their effectiveness depends on leadership tone, culture, consistent application, and individual conduct. Treating a documented framework as assurance of ethical behavior is a common misconception; the presence of a framework and its lived operation can differ significantly. Residual risk of misconduct typically remains regardless of framework maturity.
Which roles or functions are commonly involved in operating an integrity framework?
Responsibilities are commonly distributed rather than held by a single function. Governing bodies and senior leadership typically set the tone and approve the framework; management commonly owns day-to-day operation, embedding expectations into processes and decisions; dedicated ethics, compliance, or integrity functions often coordinate, advise, and monitor. Independent assurance functions such as internal audit may evaluate the framework's design and operation, but their role is to provide objective assurance rather than to manage the framework. The specific allocation varies by organization size, sector, and jurisdiction.
How can an organization assess whether its integrity framework is operating effectively?
Assessment commonly combines multiple lines of evidence rather than relying on documentation alone. Approaches may include culture and ethics surveys, analysis of reported concerns and whistleblowing data, review of decision-making in practice, and independent evaluation by assurance functions. Because an integrity framework addresses culture and conduct, effectiveness is generally difficult to measure directly and is often inferred from a range of qualitative and quantitative indicators. This entry does not prescribe specific metrics, tools, or methodologies, which vary by organization and context.
How does an integrity framework relate to an organization's broader governance and risk management arrangements?
An integrity framework typically operates within the wider governance structure and connects to risk management where ethical failures or misconduct represent sources of risk to objectives, reputation, or legal standing. It commonly informs risk identification and assessment relating to conduct and culture, and its expectations may be reflected in policies, standards, and procedures. The framework does not replace governance structures or risk management processes; rather, it complements them by articulating the values and ethical expectations that inform decisions and controls.
What common challenges arise when implementing an integrity framework?
Frequently cited challenges include achieving genuine embedding rather than a documented framework that is not reflected in practice, sustaining consistent leadership tone, avoiding a checkbox or purely rule-based approach, and adapting expectations across differing jurisdictions, business units, and cultures. Measuring effectiveness and demonstrating value can also be difficult given the framework's focus on culture and conduct. Implementation specifics depend heavily on organizational context, and this entry does not provide implementation guidance, tooling recommendations, or legal advice.

Common misconceptions

An integrity framework is the same as a compliance program.
The two overlap but are not identical. A compliance program focuses on adherence to specific external laws, regulations, and internal policies. An integrity framework is broader and values-driven, addressing ethical conduct and culture that may extend beyond what any specific rule requires; it commonly spans the governance, risk, and compliance pillars rather than compliance alone.
Adopting an integrity framework prevents misconduct.
A framework can reduce the likelihood and impact of unethical conduct, but it does not guarantee prevention. Residual risk typically remains, and the framework's effectiveness depends on consistent operation, culture, and oversight rather than on its existence alone.
Publishing a code of conduct means the framework is complete.
A code of conduct is one element. An operating framework typically also requires governance ownership, risk assessment, training, reporting channels, and monitoring or assurance. A written document without supporting structures and monitoring is unlikely to function as intended.

Best practices

Establish clear governance ownership, with the board or equivalent body and senior management accountable for setting the tone at the top and overseeing integrity outcomes.
Base the framework on a documented assessment of integrity risks, such as fraud, corruption, and conflicts of interest, and prioritize controls where exposure to objectives is greatest.
Distinguish policies, standards, and procedures clearly so that intent, measurable requirements, and operational steps are each documented and consistent.
Provide confidential and, where legally permitted, anonymous reporting channels with protections against retaliation, tailoring their design to applicable jurisdictional requirements.
Deliver ongoing awareness and training rather than one-time communication, and reinforce expected conduct across the organization.
Separate management monitoring from independent assurance, engaging an objective function such as internal audit to evaluate whether the framework operates as intended, and use findings to drive continual improvement.
a promotional banner asking how ready are you for PCI DSS 4.0? With a call-to-action to get the checklist now.