The ISACA code of professional ethics for IT professionals

It Professional Code of Conduct and Ethics

The objective of this work in writing is to examine the code of conduct and ethics for Internet Technology (IT) professionals. Towards this end this study will examine the literature in this area of study.

Defining the IT Professional

There is no one set definition for the IT professional however, an IT professional is a professional that works with information technology including installation, implementation, servicing, training, and upgrades to computer and networking systems. Being a professional however, is more that possessing the knowledge of how to perform a job or possessing specific skills because being a professional means acting and conducting oneself in an ethical and honorable manner.

II. Outcomes of Lack of Compliance With Professional Code Of Ethics

When Internet Technology (IT) professionals fail to comply with the Code of Professional Ethics, it is reported that the result may be the conduction of an investigation into the conduct of the professional and disciplinary measures where required. ISACA reports that when there are violations of the Code of Professional Ethics, that the complaint process can be utilized and that those who are accused of failing to comply with the Professional Code of Ethics are given the chance to respond to any allegations made in the complaint. The filing of the compliant involves the completion of an Ethics Complaint Form which must be submitted to -- . When an individual submits a complaint the complainant must "maintain all information exchanged pursuant to the Ethics Complaint as confidential and proprietary and support the investigation and resolution of the complaint." (ISACA, 2014, p. 1) ISACA states the report must be "truth, substantive and complete" and must "provide a complete accounting and supporting documentation of the alleged Code violation" and must "disclose if the conduct is subject to criminal or civil investigation or suit." (ISACA, 2014, p. 1) When a complete complaint is submitted to ISACA, an initial assessment is conducted and a recommendation is made to the Ethics Committee." ( ) The recommendation and complaint is then reviewed by the Ethics Committee which makes one of the following determinations:

(1) The Complaint should be dismissed;

(2) the Complaint warrants a summary finding (as in the case of a reported criminal conviction affecting an individual's adherence to the Code of Ethics); or (3) the Complaint will proceed for formal investigation. (ISACA, 2014, p. 1)

Both the respondent and complainant will receive notification of the Complaint and Ethics Committee's course of action and where a complaint is to proceed to a formal investigation, the respondent is given the opportunity to respond using the 'Response to Complaint Form'." (ISACA, 2014, p. 1) Where the Ethics Committee initiates an investigation that is formal in response to the complaint considered will be the information in the complaint and the response along with any other information or evidence that is relevant and that is procured during its investigation. It is reported as well that at any time during the process the partiers can agree upon any resolution of the matter to include any agreement on taking of disciplinary actions. If there is not resolution agreed upon before the investigation is conduced the Ethics Committee will make a determination if:

(1) there should be a dismissal of the complaint;

(2) the complaint warrants a summary finding; or (3) the complaint should proceed to a formal hearing. (ISACA, 2014, p. 1)

If the respondent is deemed to have violated the ISACA Code of Professional Ethics, then disciplinary action may include;

(1) reprimand;

(2) prohibition of participation in specified ISACA activities;

(3) suspension or revocation of membership; and/or

(4) Revocation of ISACA certifications held. (ISACA, 2014, p. 1)

Appeals on the part of the Respondent should be submitted to the Ethics Appeal Committee. (ISACA, 2014, p. 1)

III. Canada's Association of IT Professionals

The Code of Ethics for IT Professionals stated by Canada's Association of IT Professionals includes the following stated principles and imperatives:

(1) IT Professionals are required to protect the public interest and maintain integrity;

(2) Demonstrate competence and quality of service;

(3) Maintain confidential information and privacy;

(4) avoid conflict of interest; and (5) uphold responsibility to the IT professional. (Canada's Association of IT Professionals, 2014, p. 1)

IV. Association for Computing Professionals (ACM)

The Association for Computing Professionals (ACM) reports having developed and adopted ethical codes of conduct for information technology professionals and users for the purpose of making provision of guidance concerning ethical behavior. Stated as AMC's 'General Moral Imperative 1.5 is "Honor property rights including copyrights and patents" presupposes situations where matters of public security require custody of personal property in order to acquire information of unlawful activity." ( p. 1) The Association for Computing Machinery states that each member is requires to be committed to ethical professional conduct and that the ACM code is comprised by 24 imperatives "formulated as statements of personal responsibility." ( )

V. ACM General Moral Imperatives

The General Moral Imperatives are reported to include the following stated general moral imperatives:

(1) Contribute to society and human well-being;

(2) Avoid harm to others;

(3) Be honest and trustworthy;

(4) Be fair and take action not to discriminate;

(5) Honor property rights including copyrights and patent.

(6) Give proper credit for intellectual property.

(7) Respect the privacy of others.

VI. ACM Specific professional responsibilities

ACM states that more specific professional responsibilities include those stated as follows:

( 1) Strive to achieve the highest quality, effectiveness and dignity in both the process and products of professional work.

( 2) Acquire and maintain professional competence.

( 3) Know and respect existing laws pertaining to professional work.

( 4) Accept and provide appropriate professional review.

( 5) Give comprehensive and thorough evaluations of computer systems and their impacts, including analysis of possible risks.

( 6) Honor contracts, agreements, and assigned responsibilities.

( 7) Improve public understanding of computing and its consequences.

VII. ACM Organizational Leadership Imperatives

ACM Organizational leadership imperatives are reported to include the following stated imperatives:

( 1) Articulate social responsibilities of members of an organizational unit and encourage full acceptance of those responsibilities.

( 2) Acknowledge and support proper and authorized uses of an organization's computing and communication resources.

( 3) Ensure that users and those who will be affected by a system have their needs clearly articulated during the assessment and design of requirements; later the system must be validated to meet requirements.

( 4) Articulate and support policies that protect the dignity of users and others affected by a computing system.

( 5) Create opportunities for members of the organization to learn the principles and limitations of computer systems.

( 6) Imperatives stated by ACM for compliance with the code include the following stated imperatives:

( 7) Uphold and promote the principles of this Code.

( 8) Treat violations of this code as inconsistent with membership in the ACM.

VIII. Institute for the Certification of Computing Professionals (ICCP) Code of Ethics

The Institute for the Certification of Computing Professionals (ICCP) Code of Ethics is reported to include that professional activities include:

(1) A high standard of both knowledge and skill;

(2) A confidential relationship with those served;

(3) Public Reliance upon the standards of conduct and established practice;

(4) The observance of an ethical code. (ICCP, 2011, p. 1)

Components of the ethical code of the ICCP include the following stated components:

Disclosure: This relates to the confidential relationship that exist between the individual and their client or employer and the expectation that they will keep confidential information acquired that might result in a serious effect on a third party. (ICCP, 2011, p. 1)

Social Responsibility: This relates to the individual's acceptance of a responsibility to clear any confusion or wrong perceptions related to the information processing industry and the cognition to act in accordance with procedures and regulations in improving public safety. (ICCP, 2011, p. 1)

Conclusions and Opinions: The professional should only state a conclusion that is founded on knowledge that is adequate. (ICCP, 2011, p. 1)

Identification: The professional should ensure that one is properly qualified when expressing an opinion that might be held by a third party to be expert testimony. (ICCP, 2011, p. 1)

Integrity: The professional will not claim competence that they do not in reality possess. (ICCP, 2011, p. 1)

Conflict of Interest: The professional will act with "strict impartiality when purporting to give independent advice." (ICCP, 2011, p. 1)

Accountability: It is reported that the "degree of professional accountability for results will be dependent on the position held and type of work performed." (ICCP, 2011, p. 1)

Protection of Privacy: It is reported that the professional is required to "…protect the privacy and confidentiality of all entrusted information. One shall have special regard for the potential effects of computer-based systems on the right of privacy of individuals whether this is within one's own organization, among customers or suppliers, or in relation to the general public." (ICCP, 2011, p. 1)

Education: The professional is reported to have a "special responsibility to keep oneself fully aware of developments in information processing technology relevant to one's current professional occupation. One will contribute to the interchange of technical and professional information by encouraging and participating in educational activities directed to both fellow professionals and to the public at large. One will do all in one's power to further public understanding of computer systems. One will contribute to the growth of knowledge in the field to the extent that one's expertise and ability allow." (ICCP, 2011, p. 1)

Personal Conduct: The professional is required to "support, respect and abide by the appropriate laws and in general to apply the same high standards of behavior in one's personal life as are demanded in one's professional activities." (ICCP, 2011, p. 1)

Competence: The professional is required to "at all times exercise technical and professional competence at least to the level one claims. One shall not deliberately withhold information in one's possession unless disclosure of that information could harm or seriously affect another party, or unless one is bound by a proper, clearly defined confidential relationship. One shall not deliberately destroy or diminish the value or effectiveness of a computer- based system through acts of commission or omission." (ICCP, 2011, p. 1)

Statements: It is stated that the professional shall not "make false or exaggerated statements as to the state of affairs existing or expected regarding any aspect of information technology or the use of computers." (ICCP, 2011, p. 1)

Discretion: the professional is required to "exercise maximum discretion in disclosing, or permitting to be disclosed, or using to one's own advantage, any information relating the affairs of one's present or previous employers or clients." (ICCP, 2011, p. 1)

Conflict of Interest: The professional is forbidden to "hold, assume, or accept a position or a client with which one's interests conflict or are likely to conflict with one's current duties or clients unless that interest has been disclosed in advance to all parties involved." (ICCP, 2011, p. 1)

Public Safety: The professional is reported to have a responsibility to "protect fundamental human rights and dignity and to respect cultural diversity. (ICCP, 2011, p. 1)

Violations: The professional is expected to report code violations as well as provide testimony in ethical proceedings when they have 'expert or firsthand knowledge, and serve on panels to judge complaints of violations of ethical conduct." (ICCP, 2011, p. 1)