Ethical considerations

CIMA-P3 · Chapter 7

Ethical considerations

1 What ethics is, and why it is a P3 topic

Ethics is concerned with distinguishing between good and evil, between right and wrong human actions, and between virtuous and non-virtuous characteristics of people and organisations, and the rules and principles that ought to govern behaviour.

About the lecture.

The recording for this chapter is current and matches it closely — the five fundamental principles, threats and safeguards, the business case for behaving ethically and the approach to a dilemma are all taught well. Three points to hold in mind while you watch:

its running illustration is a 2019 news story, introduced as “at the moment as this recording is going on”. The illustration still works; treat it as dated rather than current.
it explains whistleblowing and the finder’s duty by reference to UK law in particular. P3 names no national regime: learn the principle — that raising a matter outside the organisation is a last resort, must be in good faith, and must be reasonable in the circumstances — and expect a question to supply any specific rule it needs.
the professional code it describes has since been restructured. §4.1 below gives the current position. Nothing it says about the five principles has changed.

YouTube video

1.1 Ethics is not the same thing as legality

Ethics is about what is right, not about what is permitted. The two overlap heavily — if something is illegal it is usually also unethical, at least where the law is broadly fair — but they are different tests, and P3 is interested in the wider one. A course of action can be entirely lawful and still damage the organisation, because the people who decide whether to buy from it, work for it, lend to it or partner with it are applying an ethical test, not a legal one.

1.2 Judgements differ, and that is the starting point

There is, of course, a range of views on what constitutes ethical behaviour. Different individuals and people from different cultural backgrounds might disagree on what constitutes acceptable behaviour in business. For example, in Japan punctuality is extremely important and to be late for a meeting is simply unacceptable. People from some other countries assume that a meeting starting at 2pm probably won’t start until 3pm and punctuality is almost seen as a peculiarity. Ethical judgements also differ on matters such as:

Health and safety
Commissions/backhanders
Conflict of interest
Intellectual property rights

We do not need to get into how or why certain actions are considered ethical or unethical, but if investors, governments and customers or employees think, for whatever reason, that a company has acted unethically then the company will be damaged because of reputational loss, regulatory and legal sanctions, and also the fear that if one instance of unethical behaviour has been discovered how many other instances might still be hidden.

As mentioned above, different stakeholders are likely to have different ethical views. For example, on a crowded train some standard class passengers might see nothing unethical about sitting in first class (“I’ve bought a ticket I should have a seat”); some other passengers and managers of the train company might see this as unethical (“You can buy extra comfort if you want to”). Some shareholders might have ethical objections to their company taking part in arms manufacturing whilst directors and employees might have no ethical objections.

2 The risks of unethical behaviour

P3B2 names “risks of unethical behaviour” as a topic to be covered. The point is not that unethical behaviour is expensive when you are caught. It is that the damage runs in a chain, and the far end of that chain is strategic: it changes what the organisation can afford to do next.

Even if stakeholders disagree about what appropriate ethics are, the importance of an organisation being ethical can be linked to its profitability or its financial viability. Organisations might obtain advantages by being unethical (for example to encourage sales a pharmaceutical company could conceal a drug’s side effects) but most ethical breaches are discovered and then huge damage is done both financially and reputationally. The damage runs in a chain:

	What happens	Why it is a strategic risk and not just a cost
1 You are found out	Someone leaks it. An employee, a supplier or a customer who feels strongly enough can record, post and distribute in minutes.	The realistic planning assumption is not whether but when. A strategy that depends on something staying hidden is not a strategy.
2 Fines and damages follow	And they are far larger where the organisation knew and concealed it than where it disclosed a problem it had just discovered.	Concealment converts a compensatable problem into a punitive one. The cover-up is usually worse than the act.
3 Regulators stop trusting you	Closer supervision, tighter licence conditions, more frequent inspection — and sometimes new rules written for the whole industry because of you.	A permanent increase in the cost and the constraint of operating, borne long after the fine is paid.
4 Reputation, then sales	Customers move to a competitor. Why buy from an unethical company if there is an ethical one?	Recurring revenue lost, not a one-off charge.
5 Perceived risk rises	Investors ask the obvious question: if this was hidden, what else is?	The market prices what it cannot see, and it prices it conservatively.
6 The cost of capital rises	Shareholders and lenders demand a higher return for the higher perceived risk.	This is where an ethics failure becomes a strategy failure: every future project now has to clear a higher hurdle rate, so projects that would have created value are rejected.
7 Recruitment gets harder	The best candidates choose a rival with a better reputation.	Capability erodes quietly, and the effect compounds over years.
8 Partners and joint ventures close off	No one wants the association: it would tarnish their reputation too.	Whole growth routes — collaboration, licensing, joint development of expensive new products — become unavailable.

Read the chain in the other direction and it is the business case for behaving ethically. Good ethics therefore:

Reduces the risk for shareholders.
Lower risk means that capital can be raised more cheaply (the cost of capital and risk are linked).
Goodwill towards the company is increased – improving sales.
Regulatory compliance is easier to achieve, reducing the cost of damages and fines.
Good candidates are attracted to companies with good reputations
Joint ventures are easier if the company has a good reputation

Two cross-references, so that this chapter does not duplicate work done elsewhere. The sources and impact of reputational risk — where it comes from, how it damages the brand, and how it is managed — are Chapter 1's, The types of risk facing an organisation. How a governance failure damages a strategy is Chapter 5 §7. This section covers only the limb the syllabus files under ethics: the risk that arises from behaving unethically in the first place.

3 Managing ethical risk: codes, training and enforcement

Perhaps what is most important is that stakeholders are informed about a company’s ethical position on a number of issues so that there is openness and that everyone understands the company’s ethical stance. Corporate codes of ethics can help to achieve this and therefore manage risks arising from unethical behaviour. These are documents issued to employees that attempt to establish ethical rules or guidelines so that employees know how to behave if, for example, offered a bribe by a supplier or they see a machine in a dangerous condition, or they are considering whom to promote.

A corporate code of ethics does two different jobs, and it is worth separating them:

Guidance to employees — what is acceptable and what is not, so that someone offered a bribe by a supplier, or looking at a machine in a dangerous condition, or deciding whom to promote, does not have to work it out alone.
Evidence to other stakeholders — a published statement of where the organisation stands, which customers, investors, regulators and prospective partners can hold it to.

Both jobs fail in the same way. A code is a document, and a document changes nothing on its own. Four things have to sit behind it:

Training — normally by working through short dilemmas and discussing what should and should not be done, rather than by handing out the code and hoping.
Consequence — disciplinary procedures that are actually used, so that the code is understood to be a rule and not a wish.
A route to ask — somewhere an employee who is troubled can go for guidance, so that genuinely ambiguous situations are not resolved privately and badly.
Example from the top — there is no point issuing an ethical guide if directors and managers visibly ignore it. This is the control environment of Chapter 6 §2, applied to behaviour rather than to bookkeeping.

The gap between what a code says and what an organisation does is itself a risk, and it is the gap regulators, journalists and litigants look for. A company that publishes a code saying safety comes before cost, and is then shown to have traded one against the other, is in a worse position than one that published nothing — because its own document is the evidence.

A published example. This is an extract from The Coca-Cola Company’s Code of Business Conduct, from the section dealing with customers, suppliers and consumers:

“Always deal fairly with customers, suppliers and consumers, treating them honestly and with respect:

Do not engage in unfair, deceptive or misleading practices.
Always present Company products in an honest and forthright manner.
Do not offer, promise or provide anything to a customer or supplier in exchange for an inappropriate advantage for the Company.”

A code that changed nothing

G plc issues every employee with a twenty-page Code of Conduct on joining. It is available on the company website. It states that G plc “does not tolerate any payment made to secure an improper advantage”.

An internal audit of the overseas sales division finds that facilitation payments to speed up customs clearance are routine, are recorded in the ledger as “agency fees”, and are known to the divisional managing director, whose bonus depends on shipment volumes. Sales staff interviewed say they have never discussed the Code since induction, that nobody has ever been disciplined under it, and that they “assumed head office knew”.

Required

Explain why G plc’s Code has not worked.
Recommend four changes, and state for each what risk it addresses.

A code that changed nothing

(a) Why the Code has not worked

Every element that has to sit behind a code is absent, and one element actively works against it:

No training. The Code was issued at induction and never discussed. Staff cannot apply a rule they have met once, in a pack, on their first day.
No consequence. Nobody has been disciplined under the Code, so it is understood — correctly — as a statement rather than a rule.
No route to ask. Staff who were uneasy concluded that “head office knew”, which is what people conclude when there is nowhere to go and no answer coming back.
No example from the top. The divisional managing director knows and permits it, so the control environment says the opposite of what the document says.
An incentive pointing the other way. The divisional managing director is paid on shipment volumes, and the payments speed shipments. The reward system is buying the behaviour the Code prohibits.

The recording of the payments as “agency fees” is a separate and more serious matter: it is a concealment, and §2 shows that concealment is what converts a problem into a punitive one.

(b) Four changes

Change	Risk it addresses
Mandatory dilemma-based training, repeated annually, with attendance recorded — including a worked case on facilitation payments.	Employees not knowing how to apply the Code, and being unable to recognise the situation when they are in it.
Rebalance the divisional managing director’s bonus away from volume alone, and make any variable pay conditional on compliance.	The incentive that is currently buying the prohibited behaviour. A code cannot outvote a bonus.
A confidential route — an ethics or audit committee contact — for an employee to raise a concern, with a stated response time and protection from detriment.	The “I assumed head office knew” failure: concerns that never reach anyone with the standing to act.
Enforce the Code: investigate, discipline where appropriate, and report the outcome (anonymised) so that staff see it applied. Correct the ledger classification.	The credibility of the whole framework, and the concealment risk in the “agency fees” description.

A fifth mark is available for noting that this is a control weakness of the compliance kind rather than the design kind (Chapter 6 §5.1): the Code exists and is well drafted. Writing a better Code would change nothing.

4 CIMA’s Code of Ethics

4.1 Where it comes from

CIMA’s Code of Ethics is based on the Code issued by the International Ethics Standards Board for Accountants (IESBA), an independent standard-setting board. The IESBA Code has been restructured, and its current title is the International Code of Ethics for Professional Accountants (including International Independence Standards). Older material refers to the “IFAC Handbook”, which is where the Code used to be published.

Two features of the current Code matter to a risk paper. It is built around a conceptual framework — identify threats to the fundamental principles, evaluate them, and address them — rather than a list of prohibitions. And it contains provisions on non-compliance with laws and regulations (NOCLAR), which set out what a professional accountant is expected to do on becoming aware that an employer or a client is breaking the law: raise it internally, escalate it, and, where the response is inadequate and the matter is serious, consider disclosing it. That is the professional counterpart of §6 below.

The Code applies to all CIMA members and students, in industry and commerce as much as in practice. It is not an auditors’ code.

4.2 The five fundamental principles

Integrity: Be straightforward and honest in all professional work. Stand up for what you believe to be right and do not be pressurised into accepting something you know to be wrong. Do not ‘turn a blind eye’ if you think something is wrong or unethical.

Objectivity: Do not allow bias, self-interest or conflicts of interest to influence professional judgements and conclusions.

Professional competence and due care: Carry out work to proper standards; don’t skimp; keep up to date with changes in legislation, methodology and regulations.

Confidentiality: Do not disclose information received through professional work without permission or if there is a legal duty or right to disclose it.

Professional behaviour: Comply with laws and regulations and do not act in a way that brings CIMA or the wider accountancy profession into disrepute.

4.3 Threats and safeguards

Compliance with the principles is continually under pressure, and the Code deals with that by naming the kinds of pressure. The five threats below are assumed knowledge from earlier papers rather than a P3 topic in their own right — P3 names ethical dilemmas, not this taxonomy. They are set out here because this chapter and its lecture both refer to “threats” without saying what they are, and because each of them has a specific risk-management form:

Threat	What it is	How it appears in risk management
Self-interest	A financial or other interest influences judgement.	The risk assessment for a project is written by someone whose bonus depends on the project going ahead.
Self-review	Evaluating your own earlier work or judgement.	Being asked to give assurance on a control you designed — the objection to merging the risk manager and the internal auditor (Chapter 6 §4.2).
Advocacy	Promoting a position to the point where objectivity is lost.	Having argued the business case for an acquisition to the board, being asked to review its risks objectively.
Familiarity	A long or close relationship makes you too sympathetic or too trusting.	Not reporting a control failure because it would embarrass a colleague of many years — the reason internal audit rotates assignments.
Intimidation	Actual or perceived pressure, including attempts to exert undue influence.	A dominant chief executive making it clear that a risk report showing the strategy as high-risk would be unwelcome (Chapter 5 §7).

The response is a safeguard — an action that eliminates the threat or reduces it to an acceptable level. Not every threat can be eliminated; the test is whether a reasonable and informed third party would conclude that the principle has not been compromised. Safeguards come from two places: from the profession and the regulatory environment (qualification and continuing development, professional standards, corporate governance requirements, external review), and from the work environment (rotating who performs an assignment, review by someone not involved in it, a reporting line to the audit or ethics committee, and the ability to escalate).

5 Ethical dilemmas associated with risk management

P3A3 lists “ethical dilemmas associated with risk management” among its topics to be covered, and it is worth being precise about what that means. A dilemma is not a choice between right and wrong — that is a temptation, and it is easy to write about. A dilemma is a choice where two defensible positions conflict and something is lost whichever is taken. Risk management generates them constantly, because its whole subject is who bears a loss that has not happened yet.

The decision	The tension in it	How to approach it
How much to disclose in the risk report	Investors are entitled to understand the principal risks. A full description may itself damage the company — telling attackers where the weaknesses are, or telling competitors what worries you.	Disclose the risk and the response at a level that informs without operationally compromising. Silence about a known principal risk is not a judgement call; it is a misstatement.
Transferring a risk to a weaker counterparty	Pushing a risk down the supply chain on to a small supplier is efficient for the buyer and may be ruinous for the supplier, who cannot price or absorb it.	Ask whether the party taking the risk can bear it and is being paid to. A transfer that will fail when the risk crystallises has not transferred the risk at all.
Accepting a risk whose downside falls on someone else	The expected value may be positive for shareholders while the loss, if it happens, lands on employees, a community or the environment.	Identify who bears the downside separately from who takes the decision. This is stakeholder theory (Chapter 5 §2) in an operational form.
A risk assessment that would kill a favoured project	Objectivity says report it; self-interest, advocacy and intimidation all push the other way.	Name the threat (§4.3), and use the safeguard: independent review, and a reporting line that does not run through the project’s sponsor.
Whose appetite is the risk appetite	A “risk appetite” signed off by a dominant chief executive may be one person’s preference presented as the organisation’s.	Appetite is a board decision, taken with the risk committee (Chapter 5 §6.5), and it should be recorded with the reasoning.
Insuring a risk you could have prevented	Insurance is cheaper than the control. But insurance pays for the loss; it does not stop it happening to whoever suffers it.	Where the loss is financial, insurance is a legitimate response (Chapter 2's TARA). Where the loss is harm to a person, it is not a substitute for prevention.

5.1 Wider ethical dilemmas in business

Beyond risk management itself, these are the situations that generate ethical questions in a strategic scenario:

Moving a factory to another town or country: many existing employees will lose their jobs.
Building a new factory: local roads will become busier and there might be more pollution.
Extracting resources from the earth: the potential for environmental damage.
Insisting that the cost of bought-in products is reduced: potential exploitation of labour.
Ignoring health and safety rules, minimum pay and maximum working hours rules: exploitation of labour.
Gathering and swapping information about customers: loss of customer privacy.
Careless custody of customer data: potential fraud attacks on customers.
Poor software testing: inconvenience and damage to customers.
Not paying suppliers promptly: damage to suppliers and their workforces.
Poor testing of products: potential damage to customers.

6 Approach to an ethical dilemma

The approach below is the one to use in an answer, and its steps are in order for a reason: each is used only if the one before it has failed.

Identify the threat or the problem.
Evaluate its significance.
Raise it internally — a manager, and if the manager is the problem, above the manager: the audit committee, an ethics committee, a professional colleague.
Raise it externally — the professional body, legal advice, and in the last resort a regulator.
Remove yourself from the situation.

Step 2 does real work and is the step most often skipped. Not every ethical question is worth escalating, and an organisation in which everything is escalated learns to ignore escalations. Proportionality is part of judgement: the same question at a trivial scale and at a serious one calls for a different answer.

Step 4 conflicts with confidentiality, and the Code resolves the conflict rather than ignoring it. Confidentiality is one of the five fundamental principles, so taking information outside the organisation needs justification. The conditions are consistent across regimes even though the detail of the law is not: you must be acting in good faith; there must be genuine evidence of a real concern rather than a suspicion or a grievance; the step must be reasonable in the circumstances; and it must be a step you have been forced into because the internal route has failed. Taking a story to a newspaper because you dislike your employer, or because you have been offered money for it, is none of those things. ⚠️ P3 names no national regime — learn the conditions, and expect a question to supply any specific legal protection it needs.

Step 5 is not a defeat. If a serious ethical transgression is happening and nothing will be done about it, remaining is itself a failure of integrity. Often the proportionate version is to leave the project rather than the organisation.

An ethical dilemma in risk management

You are the management accountant supporting the risk function of J plc, a listed manufacturer. The board is about to approve a new plant. Your analysis of the site shows a low-probability, high-impact risk of a chemical release affecting a residential area two kilometres away. Expected financial cost to J plc, after insurance, is immaterial.

The operations director, who is sponsoring the plant, asks you to remove the release scenario from the board paper on the grounds that it is “remote, insured and alarmist”, and observes that the risk function’s budget is under review.

Required

Explain why this is an ethical dilemma rather than simply a wrong instruction, and identify the threats to the fundamental principles.
Set out, in order, the steps you should take.

An ethical dilemma in risk management

(a) Why it is a dilemma, and the threats

The operations director’s position is not simply dishonest, and treating it as though it were will lose marks. Two defensible propositions are in conflict:

a board paper that lists every remote scenario is unreadable, and burying a decision in improbable risks is itself a failure of risk reporting;
a risk whose financial expected value is immaterial to J plc is not immaterial at all — the downside falls on people who are not party to the decision and who receive nothing for bearing it.

That second point is what resolves it. Materiality to the company is not the test where the downside falls on someone else. The insurance answers the financial consequence to J plc and does nothing whatever about the harm; and this is precisely the “accepting a risk whose downside falls on someone else” dilemma of §5. It is also a governance question, because a low-probability high-impact scenario affecting a residential population is exactly what a board is for.

Three threats to the fundamental principles are present, and naming them is what §4.3 is for:

Threat	How it arises here	Principle threatened
Intimidation	The reference to the risk function’s budget being under review, made by the person asking for the change.	Objectivity, and ultimately integrity.
Advocacy	The director is the plant’s sponsor and is asking the risk function to present his case rather than its own assessment.	Objectivity.
Self-interest	Your own position and budget are, on the face of it, at stake.	Objectivity.

(b) The steps, in order

Identify and evaluate. The threat is intimidation, the significance is high: this is a board-level decision, the harm falls on third parties, and removing the scenario would leave the board approving the plant without knowing the thing it most needs to know. This is not the ten-cents case.
Document. Record the analysis, the request and your response, contemporaneously. Whatever happens next, the record is what protects both the decision and you.
Discuss with the operations director. Say why the scenario has to stay, and offer the proportionate answer to his real objection: keep the board paper readable by summarising the scenario, its likelihood, its impact and the proposed controls in a few lines, with the full assessment appended. Removing it is not on the table; presenting it well is.
Escalate internally if that fails — to the head of risk, then to the risk committee or the audit committee, which exist precisely so that a report can reach the board without passing through the person it concerns (Chapter 5 §6.3, §6.5).
Escalate externally only if the internal route fails: take advice from CIMA, and take legal advice. Where a serious risk to public safety is being concealed from a board, the NOCLAR provisions in §4.1 and the conditions in §6 above are the framework — good faith, real evidence, reasonable in the circumstances, and forced on you because nothing else has worked.
Withdraw as a last resort. If the plant proceeds with the scenario suppressed, continuing to sign off risk work for that project would associate you with a concealment. Leaving the project is the proportionate first version of this step.

Do not skip to the last two steps. An answer that goes straight to whistleblowing or resignation has missed the point of the approach, which is that each step is used only when the one before it has failed — and in this scenario steps 2 and 3 will very often be enough.

7 Test your knowledge

Two quick checks before you move on: work through the flashcards to fix this chapter’s key terms and definitions, then sit the objective questions for exam-style practice. Both mark themselves and explain the answers as you go.

Answer the questions one at a time. Your progress is saved so you can leave and come back.

Open chapter practice