Ethics, Compliance, and Risk Management
Domain 7 tests whether you can spot a control weakness and choose a proportionate, documented response.
Ethics at work
Ethical reasoning draws on consequences (utilitarian: greatest good), duties and rules (deontological), and character (virtue). Items usually reward the answer that discloses, escalates, or refuses, not the one that manages the optics. Conflicts of interest are handled by disclosure, recusal from the decision, and sometimes divestment. A code of conduct works only with tone at the top, training, a speak-up channel, and consistent sanctions.
The risk cycle
Identify, assess (likelihood × impact), treat, monitor. Treatment options are avoid (stop the activity), reduce (add controls), transfer (insurance, contract), and accept (documented tolerance). Residual risk is what remains after treatment and must be accepted by the accountable owner, not by the person who designed the control.
Controls and the three lines
The three lines model: management owns risk, a risk and compliance function provides oversight, and internal audit gives independent assurance. Segregation of duties splits initiation, approval, custody, and reconciliation. The fraud triangle (pressure, opportunity, rationalisation) explains why opportunity-reducing controls matter most.
Compliance operations
A working programme has scoped obligations, a risk assessment, written policy, training, monitoring, an investigations process, and remediation tracking. Evidence matters: if a control is not documented, an auditor treats it as not operating.
Worked example
A buyer can create a vendor, approve the purchase, and release payment. The risk register rates this high impact and high likelihood, since the buyer could pay a fictitious supplier. The response is to reduce risk: vendor-master approval moves to finance, payment release to a second approver, plus a monthly vendor-master change review. This is not transfer, because insurance does not fix a control failure that compounds over time.
Traps that cost marks
- Labelling insurance as avoidance.
- Treating a policy document as evidence that a control operates.
- Accepting risk without a named owner and documented tolerance.
- Confusing legal compliance with ethical adequacy; both are examined.
- Escalating externally before internal channels, unless the item says those channels are compromised.