Event Code of Conduct: How to Handle Complaints

A practical framework for handling complaints at an event: scope of the rules, reporting channels, emergency route, roles, case record and measures.

A code of conduct is useless if it ends with a list of prohibitions. Participants need to understand where to turn, who will see the message, what the team will do immediately and when the matter will be handed to those with the necessary authority. The organiser needs an equally clear route, otherwise a complaint will land with a random coordinator and start circulating through work chats.

At Aventura, we treat the code as part of the event's operational plan. It connects the rules, reporting channels, initial assessment, interim measures and the transfer of information to the client. The event team does not replace HR, legal, security, medical staff or the police. The international codes and procedures below are used as reference points for designing the process, not as binding norms for a Russian event.

What should a code of conduct address?

An event code of conduct sets out observable rules, explains their scope and shows how to report an issue. It does not decide guilt in advance and does not turn the coordinator into an investigator. The document helps stop dangerous or disruptive behaviour, preserve access to the event for other participants and pass a complex issue to the person responsible.

A good code answers four practical questions: what behaviour is unacceptable, where the rules apply, how to report a problem and what actions are possible after a report. The wording should be clear to a guest with no knowledge of the company's internal policies.

We avoid the vague requirement to "behave appropriately". It helps neither the participant nor the coordinator. It is better to name categories of behaviour and give several recognisable examples: threats, humiliation, unwanted touching, persistent attention, discriminatory remarks, deliberate violation of personal boundaries, harassment after a request to stop, disruption of a performance, damage to property, dangerous actions and retaliation for reporting.

Examples are needed for understanding, but a list cannot anticipate every situation. So it should be accompanied by a general framework: behaviour that creates a threat, humiliates a person, interferes with their participation or violates the approved rules of the venue and programme is prohibited.

Brand values describe the company's desired culture. A code addresses a narrower task: it sets out minimum rules, the reporting route and the team's actions. The phrase "we stand for respect" sounds good, but it does not say whom to write to or what will happen after a report.

A code also does not replace a security plan. A fire, a medical situation, a fight, the discovery of a weapon, a threat to life or another emergency requires a separate route. You can check the general logic of command-centre work against our material on event security, and in the code it is enough to clearly show the transition to that route.

Scope of the rules

The rules cover the people, spaces and channels connected with the event. These are usually guests, speakers, the client's employees, organisers, contractors, partners, venue staff and online participants. The code applies in the hall, at registration, on transfers, at dinner, in the broadcast chat and in other parts of the programme controlled by the organiser.

We list the roles first. A guest should see that the same basic requirements apply both to a participant and to a person wearing an organiser's badge. The status of speaker, executive, partner or guest of honour does not place a person outside the rules.

Next we describe the space. For a conference, this may include the entrance area, cloakroom, halls, exhibition zone, meeting rooms, catering, transport, the official dinner and the digital platform. For a corporate party, activities, the stage, changing rooms, the lounge area and organised transfers are added. In organising conferences, forums and seminars we link the rules to the guest journey map, because issues often arise away from the main stage.

It is useful to set the time boundaries. If the official chat opens before the event and stays active afterwards, the rules apply to that period. If guests continue communicating in a private channel that the organiser did not create and does not moderate, the event team's options there are limited. It is better to state this limitation directly.

We address the question of contractors separately. Their employees may be the first to notice a problem at the entrance, in the hall or backstage. The contract and briefing must specify where they report a signal and who is authorised to make decisions. The guest-facing code itself should not be overloaded with the internal scheme, but the team must know it.

Before publication, we check the code against the venue's rules, the client's internal documents and applicable requirements. If the event is held at an enterprise, in a government institution or at a restricted-access facility, some decisions are made by the venue's services. We incorporate their procedures into the scenario and explain them to the team and guests in advance.

What reporting channels are needed?

Important: A single email address is not enough. Participants need several accessible routes: a personal approach to a designated employee, a phone number or messenger for the response team, and a written channel. At least one route must allow bypassing the direct manager, curator, speaker or coordinator if the report concerns them or a close colleague.

Channels are chosen based on how the audience actually behaves. At a one-day conference, an email may be read too late. At an off-site corporate event, a personal approach can be awkward because of the open space. At an online event, you need a moderator route that does not require writing about a problem in the general chat.

We usually build a three-tier scheme:

1. Quick on-site contact. A participant approaches an employee with a visible role, such as a support coordinator or zone lead. The employee knows a short script for receiving a report and does not ask for details to be retold in front of others.
2. Remote operational channel. A phone number or work messenger is available during programme hours. It is answered by a designated role, not the entire project team.
3. Written channel for a detailed report. A form or dedicated address allows a description and materials to be attached. Access is limited to a pre-approved circle of people.

Participants must be able to find the contacts without searching through a long policy document. We place them on the event page, in the email before the event, in the app or programme, at the help desk and in the online platform rules. A QR code is acceptable as an additional entry point, but a regular address or number must be next to it. A dead phone battery, a weak signal or a swapped sticker should not deprive a person of the ability to report.

An anonymous channel can lower the threshold for a first report, but it has limitations. Without feedback, it is difficult to clarify the circumstances and communicate the status. In the channel description, we honestly explain that the team can only verify information sufficient for action. The absence of a name does not make a report less significant, but it may narrow the available steps.

After setting up the contacts, we run the same check as for event participant registration: we verify the channel owner, the backup, working hours, notifications and the exceptions route. A public address with no one reading it creates a false sense of protection.

Initial assessment of a complaint

In the first conversation, the employee determines urgency and chooses the reporting route. No decision on guilt is made at this stage. The employee checks immediate safety, clarifies the preferred method of contact, records a minimum of facts and communicates the next step. They do not promise a specific outcome, do not argue with the person and do not conduct a detailed interview in a noisy or public area.

The first reaction affects trust in the process. A suitable formula is simple: "I have received your report. First I will check whether you need help right now, then I will pass the information to the responsible person." It acknowledges the report but contains no premature conclusion.

The initial assessment process can be set out in an employee card:

1. Move to a quiet place if it is safe and the person agrees.
2. Clarify whether there is currently a threat to life or health, or a continuation of unwanted contact.
3. Ask what immediate help is needed: accompaniment, a different location, medical assistance, contact with venue security, or the opportunity to contact a trusted person.
4. Record what happened, where and when, who was involved, and whether any witnesses or materials are available.
5. Do not require evidence as a condition for accepting the report.
6. Explain to whom the information will be passed and why.
7. State the nearest status: for example, contact from the responsible employee or confirmation of the reporting route.

If the person tells a long story, the receiver is not obliged to immediately gather a full chronology. At the venue, safety and maintaining contact are more important. A detailed conversation is held later under suitable conditions and with a person who has the authority.

We do not use phrases such as "it's nothing serious", "are you sure" or "it's just a joke". They assess the situation before verification. We do not promise dismissal, removal from the event or punishment either. The decision depends on the facts, the rules, the client's authority and, in some cases, on the actions of the relevant services.

If the report comes from a witness, it is also accepted. In the card, a distinction is made between what the person saw themselves and what they heard from others. This distinction helps prevent a retelling from becoming an established fact.

When should the emergency route be activated?

In short: The emergency route is activated in cases of immediate threat to life or health, violence, a fight, weapons, a serious medical condition, fire, dangerous stalking or any other situation where delay increases harm. The team follows the venue's plan and calls the emergency or specialist service if the situation requires it. It does not wait for a routine complaint review.

The code should include a short boundary: the regular channel receives reports of rule violations, while an emergency is passed immediately to venue security, the medical service or the emergency services. In practice, a single incident can move from the first route to the second within seconds.

The first action depends on the situation. Sometimes people need to be separated and security called. In another situation it is safer to keep your distance, alert the venue's service and help other participants leave the area. These actions are determined by the specific venue's safety plan. A one-size-fits-all text is not suitable here.

The code does not need a long instruction on restraining a person. Coordinators do not take measures for which they have no training or authority. They must recognise the danger, call for help, state the exact location and not get in the way of the specialists.

Before an event, the team records:

• the venue's internal security number and a backup contact;
• the exact address and ways to describe the required entrance or area;
• the location of the medical post, if one is provided;
• the employee who meets the emergency service;
• the procedure for stopping the programme or closing an area;
• the communication channel with the project manager and the client;
• the way to keep a log of actions without publicly discussing details.

A danger report must not wait for approval in a general chat. Each shift needs a person authorised to launch the approved route. If that person is not on site, the regulations must name a deputy.

And one more boundary: contacting the organiser does not deprive a person of the right to contact the police, a medical organisation, their employer, HR or a lawyer independently. The team can help find the right contact, a safe place or someone to accompany the person. At the same time, it must not prevent the person from seeking help outside the event.

How should roles be divided and conflicts of interest handled?

The process is best split into at least receiving the report, initial assessment, verification of the circumstances and a decision on the measure. One person can combine roles only in a small project and where there is no conflict of interest. If the complaint concerns a manager, client, speaker or a close colleague of the person receiving it, the report is immediately passed along a backup route.

The role matrix is approved together with the client. Authority is distributed among several parties: the event team takes operational measures, the employer handles HR matters, the venue is responsible for access and security, and the police act within their own remit. These roles must not be mixed, and it is not enough to fall back on the phrase “the organisers will sort it out”.

A practical division looks like this:

For large business events, these roles are conveniently built into the overall command structure and communication scenario. We covered the principle of a single person accountable for the result and a system of deputies in the article on the event responsibility matrix.

Conflicts of interest are checked when a case is assigned, not after a complaint about bias. The responsible person speaks up if they report to one of the parties, have a contract with them, took part in the incident or have previously commented on the situation. In that case, the person responsible for the review appoints someone else or refers the matter to the client.

At a small event, there may be no independent reviewer on the project team. This must be acknowledged in advance, and an external or corporate route agreed. Independence cannot be faked simply by renaming the role.

We publish breakdowns of scenarios, command work and business event preparation in the Aventura Telegram channel. The channel will be useful to those putting together working procedures for their team.

Incident Record and Minimum Data

Important: The incident record contains only the information needed for safety, communication, verification and decision-making. Passport data, medical details, personal correspondence or a full contact list "just in case" are not collected. The client, together with a lawyer and a personal data specialist, determines why the information is needed, who will see it, where it will be stored and when it will be deleted.

The record helps preserve the facts and avoid retelling a sensitive story in every chat. It must have restricted access. A regular project spreadsheet that contractors, the host and the technical team can access is not suitable for such entries.

The minimum set of fields may include:

• internal incident number;
• date, time and channel of receipt;
• the name or chosen designation of the reporting person, if provided;
• a safe method and time for follow-up contact;
• the location and a brief description of the event;
• the roles of those involved, without unnecessary biographical data;
• whether there is an immediate threat;
• the assistance requested;
• available witnesses or materials;
• interim actions taken;
• the person responsible for the next step and the status.

In the description field, we separate the person's direct words from the intake officer's notes. If an exact quote is needed, we mark it as a quote and do not improve the wording. If an employee recorded their own observation, they state what they saw themselves. An assumption remains an assumption.

Photos, videos, correspondence and audio recordings are not copied into all project systems without necessity. The team first determines who is entitled to receive the material, where it will be stored and whether it is needed for the chosen route. A link to an open cloud drive can create a new problem instead of serving as evidence.

Full confidentiality cannot be promised. Verification may require passing some of the information to the person making the decision, to the person whose actions are described in the complaint, to the security service or to another responsible party. Only those who need the information for safety or for reviewing the complaint are granted access. Each person sees only the part of the information they need for their work.

The roles of the personal data operator and other parties involved in processing are determined by the actual arrangement: who sets the purposes and the composition of the data, receives the record and stores the materials. The client and the organiser agree on these roles and legal grounds with a lawyer and a personal data specialist. Foreign recommendations help build the process but do not replace verification under Russian rules.

How do you verify the circumstances and choose a measure?

Verification begins with a neutral list of questions and available sources. The measure depends on the current risk, confirmed facts and the authority of the person responsible for the decision. A temporary action may be taken before a final conclusion if it is needed for safety or the normal running of the programme. Such an action is not considered a disciplinary decision.

First, we formulate the subject of the review in one sentence. For example: "We need to establish whether repeated unwanted contact occurred after a request to stop, and whether interaction between the participants needs to be restricted." Such a record is more precise than a label about a person's character.

Next, we draw up a plan:

1. Clarify with the complainant the course of events, the preferred way of communicating and information about possible witnesses.
2. Preserve the available materials without altering the original files and without sending them to unnecessary people.
3. Speak with the participants separately in calm conditions.
4. Ask the person whose actions are described in the complaint specific questions and give them the opportunity to explain their version.
5. Compare the time, place, messages, access records and independent observations, if these are lawfully available.
6. Record the matches, discrepancies and information that could not be verified.
7. Pass the conclusion to the person responsible for the decision without emotional characterisations or unconfirmed statements.

The reviewer does not start with the task of confirming or refuting the complaint. They gather facts sufficient to make a decision about the event. Complex HR, legal or criminal matters are passed to those who have the necessary authority and procedure.

Temporary measures are needed when contact between the parties may continue the harm or disrupt the programme. Options include accompanying a participant, changing the seating arrangement, assigning a different coordinator, a separate route, restricting access to a specific area, stopping unwanted communication or pausing participation. The choice depends on the situation. Where possible, the measure should not worsen a person's position merely because they reported a problem.

The final measures for an event may include a warning, a requirement to stop the behaviour, removal from a specific area, termination of access to the event or referral of the matter to the employer, the venue or a competent authority. The code lists the possible categories in advance but does not promise the same response to different circumstances.

If the decision concerns a contractor or a team member, a pre-agreed procedure for response and replacement is useful. The principle of a measurable action, a responsible person and escalation is set out in the article on contractor SLAs at events. The code adds data sensitivity and protection of people from retaliation to this scheme.

After a specific case is closed, the team looks at the systemic cause: the contact was hard to find, the coordinator did not know the route, the area remained without a responsible person, or the rules did not cover the online chat. Such a review improves the process but should not turn into a public discussion of the participants.

Feedback and closing a report

The person needs confirmation that their message was received, to be told who is responsible and what the next step is, and then to be informed of any significant changes in status. The final response explains that the report has been reviewed and what actions are available to the reporter. At the same time, the team does not disclose another person's personal data, internal HR decisions or restricted materials.

Silence after the first conversation undermines even a well-drafted code. If the exact timeframe is unknown, we name the event after which we will return with a status: after contacting the venue's security, appointing an investigator, or completing initial interviews. Then we keep that promise or report a delay.

A short status scale is convenient:

• report received;
• urgency assessed;
• responsible person appointed;
• clarifications requested;
• interim measure taken;
• investigation completed;
• decision passed to the responsible party;
• the team has completed its work on the report at the event.

The phrase "work completed" does not always mean that the person agrees with the outcome or that all issues have been exhausted. It means that the event team has done everything within its authority and has passed the matter to the employer, the venue or another responsible party. If a review procedure exists, the contact for it is provided separately.

The final response is best structured in four parts: confirmation of review, a brief description of the process, the available outcome and further contacts. The measure taken is described in as much detail as personal data rules allow. For example, it can be stated that the team has stopped contact and passed the matter to the employer, without disclosing the content of the HR decision.

We separately monitor signs of retaliation: threats, exclusion from work communications, public ridicule, pressure on witnesses or attempts to reveal the reporter's identity. The event team records the signal and passes it to the person responsible for handling it. If employment relations are affected, the employer decides according to its own procedures.

After the event, an anonymised review can show which channels were used, where the process was delayed and which rules need clarification. A public report on a single closed event often creates a risk of re-identification. Therefore, the content of the report and the list of recipients are determined before it is prepared.

Rehearsing the process before opening

Before opening, the team goes through the entire process as a participant would: finds the contact, sends a test message, receives a notification, passes the card to the backup responsible person and acts out the switch to the emergency route. The rehearsal ends with correcting contacts, access rights and authority. Simply reading the code of conduct is not enough: without a run-through, the document may look ready even though no one is monitoring the channel.

We run the rehearsal together with registration, headquarters communications and a walk-through of the venue. If we are producing the entire event, this block is part of the overall production run-through for a turnkey corporate party, conference or client day.

The check proceeds step by step:

1. Open the participant page and email, and find the code of conduct and contacts without hints from the document's author.
2. Send a test through each channel and measure the actual notification path.
3. Make sure the receiving person sees the instructions, knows a quiet place for a conversation and can call a senior manager.
4. Simulate a conflict of interest and pass the message to the backup responsible person.
5. Check access to the case card and confirm that extra roles have no access.
6. Act out a threat to life or health: state the address, the meeting point for services and the person managing the area.
7. Check communication between the day and evening shifts, the venue, the client and transport.
8. Close the test record and make sure it has not entered working analytics as a real complaint.

During the briefing, the team practises phrases for each role: the receiving person acknowledges the message and checks safety, the area manager explains the temporary measure, and the liaison reports the status. No one promises complete confidentiality, immediate punishment or a guaranteed outcome.

At the briefing we discuss more than just serious cases. Sometimes a participant needs to stop intrusive filming, change location, put an end to offensive comments in the chat or safely exit a conversation. If the team can only handle extreme situations, early signals will go unanswered.

After the rehearsal, we keep a single up-to-date version of the contact and role list. We remove old phone numbers from emails, presentations and printed cards. The project manager confirms that the client, the venue and the organisers share the same understanding of the limits of authority.

The code of conduct is ready for opening when a participant can see the route, the team accepts a message without a public interrogation, an emergency threat immediately goes into a separate route, and a complex issue is quickly passed to the responsible person. In this case, a short document rests on a rehearsed process.

Sources

• World Health Organization: code of conduct for events
• HSE: procedure for assessing and reducing the risk of violence and aggression at work
• International Labour Organization: practical guide on violence and harassment at work
• EEOC: checklist for harassment policy and complaint-handling process
• NIST: privacy risk management framework
• ICO: guidance on the principles of processing and minimising personal data
• Federal Law No. 152-FZ "On Personal Data": key concepts
• Russian Ministry of Emergency Situations: rules for calling an ambulance and the single number 112
• ICO: guidance on receiving and handling complaints about personal data processing