Codes of Ethics, Corporate Culture and Whistleblowing
This domain tests how ethical intent becomes operational: a code that is enforced, a culture that rewards the right behaviour, and safe channels that surface problems early.
Codes of ethics
A credible code names the principles (for CA Sri Lanka members these are integrity, objectivity, professional competence and due care, confidentiality and professional behaviour), then translates them into rules on gifts and hospitality, conflicts of interest, inside information, bribery, fair dealing and confidentiality. It should also cover consequences, a contact point and annual acknowledgement. Threats to compliance - self-interest, self-review, advocacy, familiarity and intimidation - are managed through safeguards rather than denied.
Culture
Schein's model separates artefacts, espoused values and basic assumptions; the gap between the stated code and what gets rewarded is the real culture. Tone at the top matters only if it is matched by incentives, promotion criteria, middle-management behaviour and how misconduct is handled. Ethics and compliance programmes typically combine leadership commitment, risk assessment, standards and controls, training, monitoring, discipline and remediation.
Whistleblowing
Channels should include a line manager route, a confidential hotline and an external option, with anonymity available, documented triage, independent investigation and a clear anti-retaliation guarantee. The audit committee should receive reports on volume, nature and outcomes. In Sri Lanka, the Anti-Corruption Act No. 9 of 2023 provides whistleblower protection alongside the Bribery Act, so retaliation is a legal as well as an ethical failure.
Worked example
A junior accountant notices that a sales manager is paying commissions to a customer's procurement officer. She should preserve evidence, avoid confronting the parties, report through the whistleblowing channel, and have the matter escalated to the audit committee chair and, depending on the law, to the authorities. Her identity should be protected and no adverse action taken.
Traps that cost marks
Assuming a code on the intranet proves ethical culture. Confusing anonymity with confidentiality. Treating a whistleblower as disloyal. Investigating informally without documentation. Dismissing small gifts as cultural when the code sets a threshold.