ICT and Professional Ethics: Controls, Data and Conduct
Systems and controls
Credit and finance functions run on spreadsheets, accounting packages, ERP modules, databases and cloud platforms. Know the control vocabulary: input validation, access rights, segregation of duties, audit trails, reconciliation, backup and disaster recovery, encryption, hashing and digital signatures. Cloud computing raises data-residency and availability questions; mobile money and e-commerce raise authentication and chargeback questions. A control is only useful if it is documented, monitored and its exceptions reviewed.
Law and professional conduct
In Kenya, the Data Protection Act governs lawful processing, minimisation, retention, security and data-subject rights, while the Computer Misuse and Cybercrimes Act criminalises unauthorised access and interference. Anti-money-laundering rules require customer due diligence, monitoring and suspicious-transaction reporting - with no tipping off the customer. The ethical framework is integrity, objectivity, professional competence and due care, confidentiality, and professional behaviour; confidentiality is not absolute and yields to legal or regulatory disclosure or a professional duty.
Traps
- Claiming confidentiality always overrides disclosure - it does not.
- Confusing encryption (protects content) with hashing (verifies integrity).
- Treating a backup as an archive: backups are for recovery, not retention.
- Assuming IT staff may bypass segregation of duties “because they administer the system”.
Rule of thumb
When an ethics vignette appears, ask three questions: is it lawful, is it consistent with the code, and would I be comfortable if it were published? If any answer is no, the correct answer is to decline, document and escalate.