Ethics, Conduct, and Professional Standards
This domain tests ethical judgement under pressure plus your knowledge of the professional codes a certification holder is bound by.
Code of conduct versus ethics
A code of conduct states expected behaviours and prohibited acts; ethics is the reasoning behind them. Values-based programs rely on judgement, rules-based programs rely on thresholds, and mature programs combine the two.
Conflicts of interest
Conflicts may be actual, potential, or perceived. The test is not only "am I biased?" but "would a reasonable outsider think I might be?" Manage by avoiding the situation, disclosing and recusing, or applying safeguards such as independent review. For gifts and hospitality: monetary thresholds, pre-approval, a central register, and a standing rule that anything creating an obligation is refused regardless of value.
Speak-up
Confidential, independently operated reporting channels, anonymity where lawful, and an explicit anti-retaliation commitment. Retaliation is itself a disciplinary matter, and the absence of retaliation must be actively monitored.
Professional codes
The IIA Code of Ethics rests on four principles - integrity, objectivity, confidentiality, and competency - with rules against engaging in illegal activity, against accepting gifts that impair judgement, and requiring disclosure of material facts. Objectivity is threatened by self-review, familiarity, and intimidation; safeguards include rotation, independent review, and disclosure.
Worked example
A GRC manager's spouse is a sales director at a proposed vendor. The conflict is potential and perceived, not necessarily actual. Correct handling: disclose in writing to the ethics officer, recuse from the vendor evaluation and award decision, ensure the decision record states the recusal, and confirm the manager has no access to confidential bid information. "Being careful" is not a control.
Traps that cost marks
- Promising confidentiality that cannot be kept - legal obligations, court orders, and imminent harm override it, and the person must be told this in advance.
- Assuming a gift below the threshold is automatically acceptable.
- Treating the code of conduct as an HR artefact rather than a governance document.
- Remaining silent about a suspected violation, which itself breaches integrity.