Business Ethics and Code of Conduct in Governance of Enterprise IT (CGEIT)
Introduction
Business Ethics and Code of Conduct is a foundational topic within the Governance of Enterprise IT domain of the ISACA CGEIT (Certified in the Governance of Enterprise IT) certification. Ethics shapes how an enterprise makes decisions, uses information and technology (I&T), treats stakeholders and manages risk. CGEIT candidates are expected to understand how ethical principles and a formal code of conduct are built into the governance framework. They must also know how these principles are communicated, enforced and monitored, and how they support the enterprise's culture, values and strategic objectives.
Why Business Ethics and Code of Conduct Are Important
1. Setting the tone at the top: Governance begins with the board and executive management. Their ethical stance, the tone at the top, shapes behaviour throughout the organization. Without visible ethical leadership, policies and controls become paper exercises.
2. Protecting stakeholder trust: Customers, regulators, investors, employees and partners expect the enterprise to handle data, technology and decisions responsibly. Ethical lapses such as data misuse, privacy breaches or biased algorithms can destroy reputation and enterprise value.
3. Supporting regulatory and legal compliance: Many laws and regulations require ethical conduct programmes. Examples include anti-bribery laws, the Sarbanes-Oxley Act, GDPR and industry-specific rules. A code of conduct is often the primary instrument for demonstrating due diligence and due care.
4. Reducing risk: Ethical behaviour reduces fraud, conflicts of interest, insider threats and misuse of I&T assets. It is a key part of the control environment described in frameworks such as COSO and COBIT.
5. Enabling value creation: Governance aims at value delivery while optimizing risk and resources. Ethical conduct ensures that value is created sustainably and legitimately rather than through shortcuts that create hidden liabilities.
6. Shaping culture and behaviour: COBIT identifies Culture, Ethics and Behaviour as one of the seven governance system components. This makes ethics a formal governance enabler, not just a soft concept.
7. Addressing emerging technology issues: Artificial intelligence, big data analytics, surveillance technologies and automation raise new ethical questions about fairness, transparency, accountability and privacy. The governance body must address these questions proactively.
What Business Ethics and Code of Conduct Are
Business ethics is the set of moral principles and values that guide behaviour and decision-making in an enterprise. It covers integrity, honesty, fairness, accountability, transparency, respect and responsibility toward stakeholders and society.
A code of conduct (also called a code of ethics or ethical standards policy) is a formal, documented statement that turns ethical principles into specific expected behaviours. It typically includes:
- A statement of corporate values and mission
- Expected behaviours of directors, management, employees, contractors and sometimes suppliers
- Rules on conflicts of interest, gifts, bribery and corruption
- Acceptable use of I&T resources and information
- Confidentiality, privacy and data protection obligations
- Fair dealing with customers, competitors and suppliers
- Compliance with laws and regulations
- Reporting channels for violations, such as whistleblower hotlines
- Non-retaliation protections
- Disciplinary consequences for breaches
- Requirements for periodic acknowledgement or attestation
Related concepts CGEIT candidates should know:
- Culture, Ethics and Behaviour (COBIT component): Recognizes that individual and organizational behaviour is often underestimated as a success factor in governance.
- Principles, Policies and Procedures: The code of conduct is a high-level policy derived from enterprise principles.
- ISACA Code of Professional Ethics: The ethical code that CGEIT holders must follow. It covers supporting proper standards and controls, performing duties with objectivity, due diligence and professional care, serving stakeholders lawfully, maintaining privacy and confidentiality, maintaining competency, informing parties of the results of work, and supporting professional education.
- Due care and due diligence: The legal and ethical obligations of directors and officers.
- Corporate Social Responsibility (CSR) and ESG: Broader ethical commitments toward society and the environment.
- Whistleblowing: Protected mechanisms for reporting unethical conduct.
- Segregation of duties and conflict of interest management: Structural controls that support ethical behaviour.
How It Works in Practice
Step 1 - Board establishes values and ethical principles: The board, as the governing body, defines the ethical values of the enterprise and approves the code of conduct. Accountability for ethics rests with the board.
Step 2 - Management develops the code and supporting policies: Executive management, often with HR, legal, compliance and the CIO, drafts the code and related policies. Examples include the acceptable use policy, information security policy, privacy policy and anti-fraud policy.
Step 3 - Communication and training: The code is communicated to all employees and relevant third parties. Training is delivered at onboarding and periodically after that. Employees typically sign an acknowledgement.
Step 4 - Leadership modelling: Leaders demonstrate the expected behaviour. Rewards and incentives are aligned with ethical conduct, not only with financial targets.
Step 5 - Embedding in processes: Ethics is built into procurement, hiring, project approval, vendor management, data governance and technology design. Examples include privacy by design and ethical AI review boards.
Step 6 - Reporting and investigation: Confidential and anonymous reporting channels exist. Reports are investigated independently, and whistleblowers are protected from retaliation.
Step 7 - Enforcement: Violations lead to consistent, fair disciplinary action regardless of seniority. Inconsistent enforcement undermines the entire programme.
Step 8 - Monitoring and assurance: Compliance, internal audit and the ethics officer monitor adherence using surveys, metrics, audits and incident trends. Results are reported to the board or audit committee.
Step 9 - Continuous improvement: The code is reviewed periodically and updated for new regulations, technologies, business models and lessons learned.
Roles and Responsibilities
- Board of Directors: Accountable for setting ethical tone, approving the code and overseeing compliance.
- Executive Management/CEO: Responsible for implementing the code and modelling behaviour.
- CIO/IT Leadership: Ensures I&T is used ethically, including data handling, AI and monitoring.
- Chief Ethics/Compliance Officer: Runs the ethics programme day to day.
- HR: Integrates ethics into hiring, training, performance and discipline.
- Internal Audit: Provides independent assurance on the effectiveness of the ethics programme.
- All employees: Comply with the code and report violations.
Key Metrics for an Ethics Programme
- Percentage of staff who completed ethics training
- Percentage of staff who signed annual acknowledgement
- Number and type of reported ethics incidents
- Time taken to investigate and resolve reports
- Employee perception survey results on ethical culture
- Number of conflict-of-interest declarations
Exam Tips: Answering Questions on Business Ethics and Code of Conduct
Tip 1 - Think like the board: CGEIT is a governance exam. When a question asks who is ultimately accountable for ethics or the code of conduct, the answer is usually the board of directors or governing body, not IT, HR or compliance.
Tip 2 - Tone at the top is critical: If a question asks for the most effective way to establish an ethical culture, prefer answers about senior leadership commitment and modelling behaviour. These beat technical controls or training alone.
Tip 3 - Culture beats documents: A written code is necessary but not sufficient. Questions often test whether you know that awareness, leadership behaviour, enforcement and incentives make the code effective. Be careful with answers that stop at 'publish the policy'.
Tip 4 - Look for consistent enforcement: If the scenario describes a senior executive violating the code without consequences, the biggest concern is usually the damage to the ethical culture and the credibility of the programme.
Tip 5 - Whistleblower protection matters: Answers that include confidential or anonymous reporting and non-retaliation are usually stronger than those relying only on management reporting lines.
Tip 6 - Align incentives: If performance rewards encourage unethical shortcuts, such as bonuses based purely on project delivery speed while ignoring security, the governance response is to realign incentives with values.
Tip 7 - Know the ISACA Code of Professional Ethics: Expect scenario questions about a CGEIT professional's obligations. Typical themes are objectivity, confidentiality, competence, due care, and reporting findings honestly to appropriate parties.
Tip 8 - Choose the governance-level answer: Options may include technical fixes such as deploying monitoring software, or operational fixes such as more training. Governance-level answers usually rank higher, for example establishing policy, defining accountability and board oversight. This applies unless the question is clearly about implementation.
Tip 9 - Watch for key words: FIRST, BEST, MOST important, PRIMARY. 'FIRST' often points to understanding requirements or obtaining board or senior management commitment. 'BEST' often points to culture and leadership. 'PRIMARY purpose' of a code of conduct is to communicate expected behaviour and values.
Tip 10 - Ethics and emerging technologies: For AI, data analytics or employee monitoring scenarios, the right answer often involves ethical review and transparency. It also involves alignment with enterprise values and privacy requirements, plus clear accountability. Technical capability alone is not the answer.
Tip 11 - Third parties are included: Ethical expectations should extend to vendors, outsourcers and partners through contracts, supplier codes of conduct and right-to-audit clauses.
Tip 12 - Link ethics to value and risk: When justifying an ethics programme, the best rationale is usually protecting enterprise value and reputation, enabling trust and managing risk. This aligns with the governance objectives of benefits realization and risk optimization.
Tip 13 - Periodic review and attestation: A mature programme includes regular review of the code and periodic employee acknowledgement. Answers that suggest a one-time effort are generally weaker.
Tip 14 - Conflict of interest: If a decision maker has a personal interest in a vendor or project, the correct response is disclosure and recusal from the decision, guided by policy.
Sample Question Walkthrough
Question: An enterprise has a well-documented code of conduct, but surveys show employees believe unethical behaviour is tolerated among senior managers. What should the governance body do FIRST?
A. Increase mandatory ethics training for all staff
B. Implement automated monitoring of employee activity
C. Ensure senior leadership visibly commits to and is held accountable under the code
D. Rewrite the code of conduct
Answer: C. The root problem is tone at the top and inconsistent enforcement. Training (A) and rewriting the code (D) do not fix leadership behaviour, and monitoring (B) is a technical control that does not address culture.
Summary
Business ethics and the code of conduct form the moral backbone of enterprise governance. For CGEIT, remember these points:
- The board is accountable.
- Tone at the top drives culture.
- A code must be communicated, embedded, enforced consistently and monitored.
- Ethics is a formal governance component in COBIT.
- Ethics directly supports value creation, risk optimization and stakeholder trust.
In the exam, choose answers that reflect leadership commitment, governance-level accountability, cultural embedding and sustainable value rather than purely technical or one-off solutions.
