Professional Ethics, Law and Regulatory Issues in Information Systems
What the exam tests
This domain tests ethical judgement, professional codes, confidentiality, conflicts of interest, intellectual property, data protection, computer misuse and records issues. Expect scenarios where legal and ethical duties overlap but are not identical.
Core rules and concepts
- Professional ethics include integrity, objectivity, confidentiality, competence and professional behaviour. A conflict of interest should be disclosed and managed.
- Law sets minimum enforceable duties; ethics may require more. Accepting a vendor gift may be legal but still breach procurement ethics.
- Information systems raise intellectual property, licensing, contract, e-signature, computer misuse and evidence issues.
- Data protection law governs personal data processing. Access rights do not equal permission to use data for any purpose.
- Records must be retained according to law and policy, protected during investigations, and disposed of securely. Cross-border transfers need a lawful basis.
Worked example
An employee finds a vendor invoice overcharge and the vendor offers a personal gift to resolve it quietly. The correct action is to decline or disclose the gift, correct the invoice through procurement and finance, and document the decision. Reasoning: the gift creates a conflict of interest and may breach policy even if no law is broken. Concealment risks fraud and reputational harm.
Traps that cost marks
Do not assume legal means ethical. Do not treat data access as authority to use or disclose. Do not delete records during an investigation. Do not ignore jurisdiction and cross-border transfer rules. Confidentiality survives leaving an employer.
Key points
- Professional ethics can demand more than legal compliance.
- Conflicts of interest must be disclosed and managed.
- Access rights do not authorise misuse of personal data.
- Records need lawful retention, protection and secure disposal.
- Cross-border data transfers require a lawful basis.