Governance, Ethics and Professional Standards in Data Analytics
What you must know
Understand data governance frameworks: ownership, stewardship, data dictionaries, access controls, retention and disposal. Know privacy principles - collection limitation, purpose specification, use limitation, security, openness, access and correction - and the concept of personal and sensitive information. Understand confidentiality, integrity and availability (the CIA triad). Know the professional obligations of a CA: integrity, objectivity, confidentiality, professional competence and due care, and compliance with laws and regulations. Understand algorithmic bias, transparency, explainability and accountability, and the ethical risks of automated decision making. Know the APES 110 fundamental principles and the threats-and-safeguards approach (self-interest, self-review, advocacy, familiarity, intimidation).
Traps in questions
A frequent trap is assuming that because data is de-identified it carries no privacy obligation - re-identification risk remains. Another is treating confidentiality as absolute; disclosure may be required by law or permitted with consent. Questions may test whether an analyst may use client data for a secondary purpose - generally not without consent or legal basis. Watch for confusion between governance (who decides) and management (who executes).
Rule of thumb
Apply the four-question ethics test: Is it legal? Is it consistent with professional standards? Would I be comfortable if it were public? Does it respect the individuals whose data it is?
Worked example
An analyst is asked to use client payroll data to build a benchmarking product. Even if de-identified, the secondary use exceeds the original purpose. The correct response is to decline unless a lawful basis and client consent exist, and to document the reasoning.