Ethics and Professional Conduct
What the exam tests
Ethics items are scenario-based: a stakeholder applies pressure, a conflict emerges, or a finding is inconvenient. The exam rewards the answer that protects integrity, documents the decision and escalates through the correct channel - not the answer most loyal to the employer.
Core obligations
- Integrity and objectivity: report findings as they are; do not soften conclusions because a sponsor is uncomfortable.
- Confidentiality: protect information obtained through work; the duty typically survives the end of the engagement.
- Competence and due care: accept only work you are qualified for, and disclose the limits rather than bluffing.
- Professional behaviour: comply with law and avoid conduct that discredits the profession.
- Conflicts of interest: disclose early, in writing, and recuse where the conflict is material. Disclosure is not the same as permission.
Decision aids
Useful tests before acting: the publicity test (would you be comfortable if the decision were published), the reversibility test (would you accept it done to you), and a stakeholder analysis of who bears the harm. Distinguish legal from ethical - legal minimums are a floor, and "it's legal" never justifies a misleading disclosure.
Data ethics
For automated decisions, ask: is the purpose legitimate, is the training data representative, can the outcome be explained to affected people, is there meaningful human review, and who is accountable when it errs? Fairness is a design requirement, not a communications problem.
Worked example
A product director asks you to delay disclosing a breach until after a funding round closes. The defensible path: state that the notification obligation is triggered by the facts and the legal clock, not by the commercial calendar; document the request and your response; escalate to the accountable executive and legal; and if it remains unresolved, use the board, audit committee or whistleblowing channel. Delaying is not a business judgement you are authorised to make.
Traps
- Equating legal compliance with ethical conduct.
- Staying silent about a conflict because it seems minor.
- Accepting work beyond your competence to avoid losing it.
- Reporting a finding accurately but omitting its risk effect, which understates it.
- Using "confidentiality" to withhold information from regulators who are entitled to receive it.