EPI: Ethics, Risk, and Compliance

Ethics, Risk, and Compliance tests whether you can improve performance without creating avoidable harm, legal exposure, or loss of trust. Questions cover ethical decisions, conflicts of interest, privacy, risk assessment, controls, compliance obligations, escalation, and benefit integrity.

Core rules and concepts

• Apply explicit ethical tests: legality, fairness, transparency, affected parties, reversibility, and whether the action would survive public scrutiny. Ethics is not limited to what is legally permitted.
• Manage conflicts of interest by disclosing, recusing, or separating decision rights. A benefit owner who is also the sole verifier of benefits has a control gap.
• Follow a risk process: establish context, identify risks, analyze likelihood and impact, evaluate against tolerance, treat, and monitor. Assign an owner and a review date to every material risk.
• Use a risk register with cause, event, consequence, existing controls, residual rating, treatment, and trigger. A heat map without owners is decoration.
• Map compliance obligations to controls and evidence. Compliance is a floor, not the whole of ethics; a legally compliant change can still be unfair or harmful.
• Protect data and privacy: minimize collection, restrict access, define retention, and use de-identification where possible. Escalate breaches and near misses promptly.

Worked example

A cost-reduction initiative proposes automating eligibility checks. The risk register lists a privacy breach from excess data collection, a fairness risk from a biased rule set, and a compliance risk from missing audit evidence. Likelihood and impact scoring gives privacy 4×5 = 20 (high), fairness 3×4 = 12 (medium), and audit evidence 3×3 = 9 (medium). The reasoned response treats privacy first: minimize fields, restrict access, and test retention. Fairness is tested by comparing approval rates across groups and documenting the rule source. Audit evidence is designed into the workflow, not reconstructed later. Residual risks are re-scored and accepted by the accountable owner.

Traps that cost marks

• Treating compliance as sufficient and ignoring fairness or reputational harm.
• Building a risk register with no owners, dates, or treatment status.
• Ignoring conflicts of interest in benefit measurement or vendor selection.
• Collecting more personal data than the process needs.
• Hiding a near miss instead of using it to strengthen controls.