Ethics and Information Technology
This domain tests professional conduct under the CA Sri Lanka Code of Ethics (aligned with the IESBA Code) and the practical control and data issues an accountant meets in a computerised environment. Questions usually present a scenario and ask you to name the threat and the safeguard.
The ethical framework
- Five fundamental principles: integrity, objectivity, professional competence and due care, confidentiality, professional behaviour.
- Five threat categories: self-interest, self-review, advocacy, familiarity, intimidation.
- Safeguards operate at firm level (rotation, quality review, independence policies) and engagement level (removing the individual, second partner review, disclosure). Where no safeguard reduces the threat to an acceptable level, decline or resign.
- Confidentiality yields to legal compulsion and to the reporting duties in the anti-money-laundering regime under the Financial Transactions Reporting Act No. 6 of 2006.
IT controls to distinguish
- General IT controls: access management, change control, backups, business continuity, segregation of duties in the ERP.
- Application controls: input validation, sequence checks, reconciliation controls, automated matching.
- Data protection: the Personal Data Protection Act No. 9 of 2022 imposes lawful-basis, purpose-limitation and security duties on controllers.
Worked example
An audit partner's spouse holds a modest shareholding in an audit client. This is a direct financial interest of an immediate family member, creating a self-interest threat. No safeguard reduces it to an acceptable level for an audit engagement, so the interest must be disposed of before the engagement continues, or the partner must be removed from the team - and rotation alone does not cure an ownership interest held by the firm's partner.
Traps that cost marks
Naming a threat without a safeguard; assuming disclosure to the client resolves every conflict; treating a strong ERP as a substitute for audit evidence; forgetting that spreadsheet-based reporting needs version control and access restriction; ignoring personal-data obligations when moving client data to cloud or analytics tools.