Governance, Ethics and Professional Obligations in a Technology-Enabled Environment
Core concepts
Governance is the system by which an entity is directed and controlled. Candidates must understand tone at the top, board and audit-committee oversight of technology and cyber risk, delegation of authority, and the three lines model. Technology intensifies governance obligations: data stewardship, privacy, third-party/cloud accountability, and algorithmic accountability all remain with the entity even when a vendor supplies the tool.
Professional obligations derive from the IESBA/APES 110 Code of Ethics, adopted by CA ANZ. The five fundamental principles are integrity, objectivity, professional competence and due care, confidentiality and professional behaviour. Independence is required for assurance engagements, not all engagements. Learn the five threats: self-interest, self-review, advocacy, familiarity and intimidation - and the safeguards hierarchy: eliminate the circumstance, apply safeguards, or decline the engagement.
Other obligations: NOCLAR (responding to non-compliance with laws and regulations), whistleblowing protections, confidentiality surviving the end of an engagement, and the duty not to overstate the reliability of automated outputs.
Traps in questions
- Self-review threat is the classic technology trap: designing or implementing a system, then auditing or assuring it.
- Familiarity with a long-standing vendor or client team is a threat even without financial interest.
- Confidentiality is not breached by a legally mandated disclosure, but is breached by using client data in a generative AI tool without authorisation.
- Ethics codes do not prohibit conflicts; they require identification, evaluation and management.
Worked example
A consultant is asked to configure an ERP's automated three-way-match control and, six months later, to provide assurance over that control. This creates a significant self-review threat. Safeguards (a separate assurance team, independent review of the configuration) may reduce it to an acceptable level; otherwise the assurance engagement should be declined.
Rule of thumb: if you built it, configured it or advised on it, you cannot objectively assure it without robust structural safeguards.