Professional Ethics and Compliance
Professional Ethics and Compliance
This domain tests integrity, confidentiality, conflicts of interest, data protection, and compliance in client work.
Core rules
- Protect confidential information: need-to-know access, secure storage, no reuse across clients, and return or destroy at engagement end.
- Disclose conflicts of interest promptly, including personal, financial, or competing-client relationships.
- Bill accurately; do not charge non-project time, unapproved work, or expenses without receipts and policy compliance.
- Do not misrepresent certifications, experience, or solution capability.
- Follow anti-bribery and gifts or hospitality rules; obtain approval where required.
- Comply with privacy law and client policy when handling personal data; minimize collection and report breaches.
- If asked to hide a defect, falsify a test result, or bypass a control, refuse, document, and escalate.
Worked example
A client manager asks the consultant to sign off a security test as passed although two high findings remain. The consultant refuses, records the findings and risk in the status report, and escalates to the sponsor and engagement lead. Reasoning: sign-off is an assurance statement; false assurance exposes the client and violates professional integrity.
Traps
- Treating client data as reusable IP.
- Accepting a gift that creates obligation.
- Overstating expertise to win work.
- Relying on verbal compliance assurances.