Organizational Culture, Professional Conduct, and Whistleblowing
Scope
This domain tests the organisational conditions for ethical behaviour and the professional obligations that apply when an organisation will not correct itself.
Culture
- Compliance culture versus ethical culture: the first asks whether the rule was followed; the second asks whether people felt able to raise the problem and were heard. Regulators increasingly assess the second.
- Tone at the top, and tone in the middle: middle managers determine whether policies are real or decorative.
- Psychological safety (Edmondson) predicts speaking up more reliably than the existence of formal channels.
- Ethical fading (Tenbrunsel and Messick): the ethical dimension of a decision fades when it is framed as a business or technical problem.
- Moral disengagement (Bandura): euphemism, diffusion of responsibility and blaming the system let individuals act against their own standards.
- Incentives: targets, ranking and bonus structures that reward throughput over accuracy predictably produce shortcuts.
Professional conduct
Know a code and use it. The ACM Code of Ethics (contribute to society and human well-being; avoid harm; be honest and trustworthy; be fair and take action not to discriminate; respect privacy; honour confidentiality), the IEEE Code of Ethics and the BCS Code of Conduct are the common references. The BCS principles - public interest, competence, integrity, professional behaviour - are a useful default when codes conflict. Confidentiality duties carry a public-interest exception, and conflicts of interest must be disclosed, not silently managed.
Whistleblowing
- Escalate in order: line manager, designated ethics or compliance officer, internal audit, then regulator or media. Keep contemporaneous written records at each stage.
- Legal shields: the EU Whistleblower Protection Directive (2019/1937) requires internal and external channels and forbids retaliation; the US Whistleblower Protection Act and Dodd-Frank bounty provisions protect federal employees and SEC reporters; the UK Public Interest Disclosure Act 1998 protects qualifying disclosures.
- Tests for justified external disclosure: the harm is serious and specific, internal channels have failed or are unsafe, the disclosure is proportionate and evidence-based, and the recipient can act.
- Protection gaps: contractors, interns and former employees are unevenly covered, and anonymity is technically fragile.
Worked example
A junior analyst is told to change the threshold on a fairness dashboard so a model passes its release gate. Refusing silently protects no one. The defensible sequence is to ask for the change in writing, record the original result, raise it with the model owner, then the ethics or risk function, then internal audit; if the model ships into a regulated domain, escalate to the relevant regulator. Keep copies outside company systems only where that is lawful.
Traps
Believing HR is a confidential reporting channel; assuming loyalty requires silence; waiting for conclusive proof before raising a documented concern; treating a press leak as the first step rather than the last.