Ethical Standards for Information Systems Professionals

Ethical Standards for Information Systems Professionals: A Case for a Unified Code Author(s): Effy Oz Source: MIS Quarterly, Vol. 16, No. 4 (Dec., 1992), pp. 423-433 Published by: Management Information Systems Research Center, University of Minnesota Stable URL: http://www.jstor.org/stable/249729 . Accessed: 09/05/2014 14:35

Your use of the JSTOR archive indicates your acceptance of the Terms & Conditions of Use, available at . http://www.jstor.org/page/info/about/policies/terms.jsp

. JSTOR is a not-for-profit service that helps scholars, researchers, and students discover, use, and build upon a wide range of content in a trusted digital archive. We use information technology and tools to increase productivity and facilitate new forms of scholarship. For more information about JSTOR, please contact [email protected].

.

Management Information Systems Research Center, University of Minnesota is collaborating with JSTOR to digitize, preserve and extend access to MIS Quarterly.

http://www.jstor.org

This content downloaded from 194.29.185.103 on Fri, 9 May 2014 14:35:59 PM All use subject to JSTOR Terms and Conditions

Issues and Opinions: Unified Ethics Code

Ethical Standards for Information Systems Professionals: A

Case for a Unified Code

By: Effy Oz Department of Accounting School of Business Administration Wayne State University 207 Rands House Detroit, Michigan 48202 U.S.A.

Abstract Professions have adopted ethical codes and codes of conduct. Physicians, lawyers, and engineers have moral responsibilities and know to whom they are responsible. Professionals in the information systems field need similar guidance. Unfortunately, multiple professional standards in the field are offered by individual organizations. Many of the precepts in these codes are similar, but some are not. This article presents the principles of five codes: three U.S. codes, the Canadian code, and the British code. After an examination of their similarities and dif- ferences, it is proposed that we (1) resolve the differences and (2) adopt a single, coherent, in- terational code of ethics for the information systems community.

Introduction Computer-related legislation started in the late 1970s. However, the need for ethical behavior among computer professionals was already recognized by the late 1960s as the use of com- puters quickly spread in academic and business organizations. Because computer laws did not exist, professional organizations initiated their own ethical codes.

Some ethical concerns have been resolved in the form of new or amended laws. Some will be ad- dressed by future legislation. Yet many issues will remain to be dealt with by the individual profes- sional. Many professional groups have adopted ethical codes. The emergence of the information systems (IS) professional spurred the major organizations of computer professionals to draft their own codes.

All physicians solemnly swear to heed the Hip- pocratic oath. All lawyers in the same state, or country, vow to abide by the same ethical stan- dards. However, not all IS professionals are bound by the same set of rules. The reason is simple: the law does not require certification of computer professionals. Certification is voluntary at most. Many IS professionals do not belong to any organization. Membership in a professional organization could, at least, make the member aware of the organization's ethical code. Worse yet, those organizations that have established ethical codes have failed to collaborate and formulate one set of widely accepted rules.

In this article the ethical codes of the five largest IS professional organizations are analyzed and compared. This is done in the hope of inspiring these and other organizations to eliminate dif- ferences and establish a "Hippocratic oath" for the entire IS community.

The Organizations The following is a brief introduction of the pro- fessional organizations whose ethical codes are evaluated.

DPMA The Data Processing Management Association (DPMA) is dedicated to the professional develop- ment of the IS professional. Founded in 1951, the

MIS Quarterly/December 1992 423

This content downloaded from 194.29.185.103 on Fri, 9 May 2014 14:35:59 PM All use subject to JSTOR Terms and Conditions

Issues and Opinions: Unified Ethics Code

organization now has about 35,000 members throughout the U.S., Canada, and 35 other coun- tries. Its mission is "to advocate effective, respon- sible management of information to the benefit of its members, employers, and the business community." The organization has adopted a Code of Ethics and Standards of Conduct.

ICCP The Institute for Certification of Computer Pro- fessionals (ICCP) encourages IS professionals to take its exams to ensure proper knowledge and professionalism. It is currently the only U.S. certificate-granting organization in the field. The certificates offered are: Associate Computer Pro- fessional (ACP), Certified Computer Programmer (CCP), Certified Systems Professional (CSP), and Certified in Data Processing (CDP). Certificate holders must recertify their skills every three years by either retesting or involvement in ap- proved continuing education courses. Since its establishment in 1973, the organization has cer- tified more than 40,000 professionals in the U.S. and other countries. Candidates for the Institute's certification exams must subscribe to its Code of Ethics.

ICCP's ethical code consists of two parts: the Code of Conduct, and the Code of Good Prac- tice. While the former is mandatory in its nature, and its violation may lead to revocation of a cer- tificate, the latter is recommended behavior, and its violation cannot result in such revocation. The code of ethics includes provisions for revocation of a certificate.

ACM The Association for Computing Machinery (ACM) was established in 1947 as the society for the computing community. It is the oldest educational and scientific computing society. With more than 82,000 members worldwide, it is also the largest professional organization in the information systems industry. Its goals are to develop infor- mation processing as a discipline and to promote responsible use of computers. Its purposes are "to advance the sciences and arts of information processing, to promote the free interchange of information among specialists and the public, and to develop and maintain the integrity and com- petence of individuals in the field." Members are

expected to adhere to the ACM Code of Ethics and Professional Conduct. An extensively revised Code has been recently introduced to address new problems, such as hacking and computer viruses.

CIPS The Canadian Information Processing Society (CIPS), founded in 1958, has evolved into Canada's largest association of computer profes- sionals, with more than 6,000 members. The association promotes professionalism among in- formation systems practitioners. It started a cer- tification program in 1989. Currently, 1,200 of its members hold ISP (Information Systems Profes- sional) certificates. Certified members have to meet standards of education and experience.

BCS The British Computer Society (BCS) was formed in 1957 and became a full member of England's Engineering Council in 1990. It is the professional body of computer practitioners in the United Kingdom and has more than 34,000 members. The Society is concerned with the development of computing and its effective application. It has assumed responsibilities for education and train- ing, for public awareness, and for standards, quality, and professionalism. Its role is to set the professional standards of competence, conduct, and ethical practice for computing in the United Kingdom. It is an authoritative voice to society, government, and industry on all aspects of IS. It influences legislation on data protection, safe- ty, copyright, and product liability; it also provides experts for international standards committees and expert witnesses for courts and tribunals.

The Society has three degrees of membership: associate, member, and fellow. Members at the three levels are accepted according to their qualifications. Higher status is attained if the member has passed the Society's qualifications examinations or has a degree from a BCS- accredited college or university. Thus, BCS is also an accrediting institution.

Evaluation Framework It has been propsed that professional codes of ethics should be examined along four types of obligations (Johnson, 1985):

424 MIS Quarterly/December 1992

This content downloaded from 194.29.185.103 on Fri, 9 May 2014 14:35:59 PM All use subject to JSTOR Terms and Conditions

Issues and Opinions: Unified Ethics Code

1. Obligations to society, 2. Obligations to employer, 3. Obligations to clients, and

4. Obligations to colleagues and professional organizations.

These obligations serve as a framework in the following analysis. However, the fourth type of obligation may actually be divided into three dif- ferent, but related, obligation sets: (1) obligations to colleagues, (2) obligations to the organization, and (3) obligations to the profession. Therefore, the ethical codes will be compared along these six commitments. Table 1 provides a summary of the codes.

Obligations to Society

The issue A professional should always consider the welfare of the public when performing his or her job. Information systems have a great impact on the public's security, privacy, and economic in- terests. Accepted ethical theories require that if a conflict of obligations arises, the net common good should be favored. This means that the good of the public at large should usually stand above the interests of other, smaller constituencies.

Similarities and differences Although the wording may be different, all the codes address the following points saying that the IS professional should:

* Educate the public about information technology (IT)

* Protect privacy and confidentiality of infor- mation

* Avoid misrepresentation of the member's qualifications

* Avoid misrepresentation of IT

* Obey laws

* Avoid taking credit for others' achievements

Additional elements appear in some of the codes but not in others. Other elements are addressed

differently in the codes. For example, DPMA divided its code into two parts: a Standard of Con- duct, which contains the abstract ethical prin- ciples the member agrees to uphold, and the Standards of Conduct, which specifies the ideal day-to-day behavior of the member. In the Code of Ethics, society is not mentioned per se. The member has an obligation to "my country." The member therefore "shall uphold my nation and shall honor the chosen way of life of my fellow citizens."

In an environment of fast, transborder telecom- munication and a "global village," it is disturb- ing to find an obligation, though patriotic, that does not mention humankind as a whole and the welfare of members of other nations. The obliga- tion is clearly to "my country," not to society in the broader sense of the word. But the organiza- tion has members in 37 countries. To whom should a DPMA member be obliged if the member is a British national but heads a project for a French company?

The ACM code addresses recent concerns regarding unauthorized access to computers, viruses, and software piracy by specifically pro- scribing these activities in its code. Similarly, ICCP members promise not to diminish the ef- fectiveness of a system through "acts of com- mission or omission." The ACM and BCS codes emphasize the obligation to protect intellectual property. CIPS goes beyond prohibiting misrepresentation of information. Its members are obliged to not withhold information of public concern.

BCS is the only organization that places the public good above the interests of employers and clients. It mandates that its members ensure that the public good is not prejudiced while fulfilling obligations to employer and clients.

Although all five codes require their members to obey laws, this is an area where the codes ac- tually contradict. Under the DPMA code the member must obey local, state, and federal laws (ostensibly those of the U.S.). Under the CIPS code, the member must obey "the law of the country." The ACM code clearly states that "violation of a law may be ethical when that law or rule has an inadequate moral basis or when it conflicts with another law judged to be more important." If you are a member of both PDMA and ACM, whose precept should you obey?

MIS Quarterly/December 1992 425

This content downloaded from 194.29.185.103 on Fri, 9 May 2014 14:35:59 PM All use subject to JSTOR Terms and Conditions

Table 1. Characteristics of Professional Ethical Codes DPMA ., , ICCP* . ,, CIPSBC

.DPMA ICCP* ACM* CIPS BCS* 1. I . . I I m- I -I.. -.w_mJ - - P S.mq CS.-

Obligation to "my country"; Combat ignorance about IT; Contribute to society and human Further public knowledge; Ensure public good is not Protect privacy and Give opinion only in area of well-being; Give opinion only in area of prejudiced while fulfilling

confidentiality of information; expertise; Avoid harm to others; expertise; obligations to employer and Inform the public of own Protect individual privacy; Be honest and trustworthy; Not withhold information of clients;

expertise; Further public education; Be fair and take action not to public concern; Respect laws and regulations, Ensure products of own work are Not diminish the effectiveness of discriminate; Challenge false information; especially with regard to

used in socially responsible a system through acts of Honor property rights including Not offer misleading information; fiscal matters, health and way; commission or omission; copyrights and patents; Not acquire information that is safety, and protection of

Obey (all) laws; Not exaggerate capability of IT. Give credit for intellectual not rightly mine; personal data; Never misrepresent or withhold property; Obey laws of the country. Ensure my work doesn't interfere

information of public Access computing and with the rights of third concern; communication resources parties;

Not use confidential knowledge only when authorized to do Have regard to effect of systems without authorization or for so; on human rights; personal gain. Respect the privacy of others; Acknowledge and protect

Respect users' confidentiality; intellectual property. Know and respect existing laws

pertaining to professional work;

Give comprehensive and thorough evaluations of computer systems and their impacts, with special emphasis on risks;

Improve public understanding of computing and its consequences.

Keep personal knowledge up- Not disclose information that can Respect confidentiality; Faithful service; Complete work within time and to-date; adversely affect third party; Give comprehensive and Accept responsibility for my own budget;

Share knowledge with others; Be accountable for my work and thorough evaluations of work; Notify employer if work can't be Present only factual info. to my subordinates' work; computer systems and their Disclose to others parts of my completed within time or

management; Protect individual privacy; impacts, with special work they need to know; budget so corrective action Accept responsibility for own Disclose limitation of work; emphasis on risks. Reject work I can't perform to can be taken;

work; Further my education; management's satisfaction; Not disclose confidential Not misuse authority; Not diminish the effectiveness of Guard employer's private info.; information; Not take advantage of others' a system through acts of Guard employer's proprietary Exercise competence to the

inexperience; commission or omission; interest; extent I claim; Not use others' lack of Be discrete with employer Respect commercial aspects of Declare level of competence

knowledge for personal gain; information; my obligations to employer. when my service is sought. Ensure employer is aware of Reject a position that involves

potential conflicts of interest; conflict of interest, unless Present fair, honest, objective parties are informed.

viewpoint; Protect employer's interests at all

times; Not use employer's resources for

personal gain; Not exploit computer system

weakness for personal gain.

Obligation to:

Society

10

C)

0)

CD (r%

-t (O ;0

CO (

Cb

0)

:3

Q

0

V.

0

Employer

This content downloaded from 194.29.185.103 on Fri, 9 May 2014 14:35:59 PM All use subject to JSTOR Terms and Conditions

Not disclose information that can Respect confidentiality; Frank counsel; Same as obligations to employer; adversely affect third party; Give comprehensive and Guard confidential information; As consultant: notify client in

Protect individual privacy; thorough evaluations of Protect user of my product or writing when my interest Disclose limitation of work computer systems and their service against loss or harm; may prejudice theirs; provide

performed; impacts, with special Avail expertise; a written contract before Not diminish the effectiveness of emphasis on risks; Avoid conflict of interest and give accepting an assignment;

a system through acts of Honor contracts, agreements, notice of potential ones; notify client of potential time commission or omission; and assigned Apply obligation to employer to or budget overruns; and do

Not exaggerate capability of IT; responsibilities. client when I'm a consultant. not invite an employee of Avoid professional jargon; the client to consider Be discrete with client alternative employment

information; without client consent. Reject a position that involves

conflict of interest, unless parties are informed.

Colleagues (Not a constituency)

The professional Honesty; organization or Take action against others' its members unethical conduct;

Share own knowledge; Cooperate for understanding and

problem solving; Not take undue credit.

Not denigrate colleagues; Contribute to colleagues'

education.

(Not a constituency) Treat colleagues with respect, (Not a specific constituency) hold their right to success as important as mine;

Contribute to professional knowledge.

Report violations of the Code; Uphold and promote the Code; (Not a specific constituency) Avoid acts detrimental to the testify in ethical Agree to take action to remedy if profession; proceedings; and serve on the Code is violated. Apply high professional panels to judge. standards to my social life;

Strive to enhance public confidence in the profession;

Act with integrity; Not do anything that may

adversely affect another member;

Not misrepresent the organization;

Declare my position when in conflict of interest with the organization.

Profession Same obligations as to organization members.

Sanctions None

Guidance to Not offered Members

Priority of No Constituents

Apply high professional stan- Strive to achieve the highest Maintain competence; dards to my personal life; quality in the process and Maintain high personal

Exercise competence to the level products of professional work; standards; I claim; Acquire and maintain Give due credit to others.

Not withhold professional professional competence; knowledge, unless dis- Accept and provide appropriate closure harms a third party. professional review.

Revocation of certificate; Clear procedure.

Not offered

No

Termination of membership; Procedure not specified.

Not offered

No

Warning, suspension, or revocation of membership;

Clear procedure.

Not offered

No

As sole U.K. organization, all that applies to the Organization also applies to the Profession.

Reprimand, suspension, or revocation of membership;

Clear procedure.

Offered

No

* The code is not arranged by constituencies but by type or responsibility (e.g., accountability, protection of privacy, etc.). Wherever no constituent is specified in the code, placement of the obligations in the different categories (society, employer, etc.) was determined by applicability.

References: The draft of the ACM Code appears in Communications of the ACM (1992). MIS Quarterly readers can examine the appendices of Couger (1989) for a full reprint of the ACM and DPMA codes as they existed at that time. The other codes can be obtained directly from the respective organizations. The codes are presented in their entirety in Oz (forthcoming, 1993).

Clients None

Cl),

0

(b 0

(B

(0 N)

cz

::3 CL

D' C)

Zs

This content downloaded from 194.29.185.103 on Fri, 9 May 2014 14:35:59 PM All use subject to JSTOR Terms and Conditions

Issues and Opinions: Unified Ethics Code

Obligations to Employer

The issue An employee is paid and trusted by the employer to perform assigned tasks to the best of the employee's ability. Protecting the employer's in- terests is what people usually mean by "work ethics." If the employee is a professional, the employer's trust is greater because the employee performs activities that require expertise that the employer may not possess. Thus, the employer may not be able to scrutinize the professional.

Similarities and differences All five codes share a core of obligations to the employer, which include:

* Update my knowledge in the field of IT

* Accept responsibility for my own work

* Present work-related information to the em- ployer in an objective manner

* Respect confidentiality

Only some of the codes include the following points:

* Protect employer's interests

* Inform the employer of, or reject a position that involves, conflicts of interest

* Reject work I cannot perform * Do not use employer's resources for my own

use

The codes differ in that they do not all have the same elements, but they do not contradict each other. All of the shared rules should appear in the unified code because they reflect important protection of the employer against misconduct.

There is one unclear point in the DPMA code. It starts with the words "I acknowledge that I have an obligation to management." A reasonable per- son would understand that management is one's employer. Nevertheless, the code goes on to state an obligation to the employer: "I have an obligation to my employer whose trust I hold, therefore, I shall endeavor to discharge this obligation to the best of my ability, to guard my employer's interests, and to advise him or her

wisely and honestly." The standards of conduct toward management and standards of conduct toward employer are practically the same and should not be split.

Obligations to Clients

The issue The business depends on clients for its survival. Failure of an employee to satisfy the employer's contractual and ethical obligations to the client hurts the employer. When the professional serves a client as a consultant, the client's relationship with the professional is similar to that of an employer, with all the ethical implications of such a relationship.

Similarities and differences DPMA's code ignores the client. ICCP combines employer and client in the same ethical obliga- tions. It states that "certified computer profes- sionals have an obligation to serve the interests of their employers and clients loyally, diligently and honestly." Indeed, employers and clients are similar in the sense that both receive services from the professional. However, it is unrealistic to expect an employee to be equally loyal to a client and the employer. After all, it is the employer who pays for the employee's work. Also, the employee may not have the complete picture of the employer's contractual obligations to the client. And he or she is not directly bound by any contract with the client. For these reasons we cannot expect the employed professional to be as obligated to the client as to the employer.

The situation is different when the professional serves as an independent consultant. In this capacity, the professional assumes full respon- sibility to perform the task using his or her own opinion as to methods and means. He or she is then directly responsible to the client and bears all the obligations without an intermediary entity. The BCS code includes a special section speci- fying the member's ethical obligation when serv- ing as a consultant. ICCP requires the consulting professional to apply the obligations to employer to the client.

The four codes (all but DPMA's) share these obligations to the client:

428 MIS Quarterly/December 1992

This content downloaded from 194.29.185.103 on Fri, 9 May 2014 14:35:59 PM All use subject to JSTOR Terms and Conditions

Issues and Opinions: Unified Ethics Code

* Protect confidential information and privacy * Give comprehensive opinion regarding infor-

mation systems

At least one, but not all, of the codes includes:

* Avoid, or notify the client of, conflict of interests

* Do not diminish the effectiveness of a system through commission or omission

* Honor contractual obligations * Avail expertise * As a consultant, do not employ an employee

of the client without the client's consent

* Avoid professional jargon

All of these obligations should be included in the unified code. Except for the second edict, these are obligations of any professional to a client. IS professionals are also required to not abuse their expertise to diminish the effectiveness of their creations. Perhaps positive language would be more appropriate: "Use my expertise to provide the client with the best system within contractual limits."

Professionals have developed their own jargon. The use of such vernacular sometimes allows members of the same trade to more efficiently exchange ideas. However, when a professional uses jargon when communicating with a lay per- son, the results may be undesirable. Lay people are often reluctant to admit they do not under- stand jargon terms. While the professional means one thing, the other party may understand another thing. In the IS industry, where systems development is frequently expensive, clear per- sonal communication is of utmost importance. The ICCP took notice. Its code encourages the certified professional to use plain language in communication with clients.

Obligations to clients across the codes do not contradict each other. They are either missing in some codes or emphasized to different degrees.

Obligations to Colleagues

The issue Members of the same trade share many interests. Thus, one is expected to help one's colleagues and respect their work.

Similarities and differences In some professions obligations to colleagues are sometimes raised above other obligations. For example, in some countries it is virtually impossi- ble to convince a physician to testify against a fellow doctor in malpractice cases. None of the four codes even tries to foster such "loyalties" among IS professionals. On the contrary, two of the codes encourage members of the organiza- tions to expose unethical acts of their colleagues. This implies that loyalty to the organization, or to the profession in general, is more important than loyalty to a colleague. A DPMA member has an obligation to fellow members but not to other colleagues. Likewise, the ACM and BCS codes do not mention col- leagues as the subject of any ethical obligation of the member.

ICCP and CIPS require the member to respect colleagues and contribute to their professional knowledge.

Obligations to the Organization

The issue Professional organizations require their members to uphold the organizations' objectives and serve their interests for the common good of all members.

Similarities and differences Under the DPMA code the member has obliga- tions to fellow DPMA members but not to the organization per se. In the CIPS code, the organization is not addressed as a specific par- ty to which the member has obligations. This may stem from the fact that CIPS regards itself as the sole Canadian IS professional association. Similarly, the BCS does not clearly differentiate between "organization" and "profession," as it is the sole IS professional body in the United Kingrom. But the BCS does include obligations to the organization. It forbids the member to misrepresent the organization. The member must also declare when his or her personal position is in conflict with that of the organization. ICCP and ACM require that the member report violations of the code. In addition, the ICCP

MIS Quarterly/December 1992 429

This content downloaded from 194.29.185.103 on Fri, 9 May 2014 14:35:59 PM All use subject to JSTOR Terms and Conditions

Issues and Opinions: Unified Ethics Code

member agrees to testify in ethical proceedings and sit on judging panels.

Loyalty to an organization is a fine principle but should not exceed obligations to other constituen- cies. Also, the member should not be subject to edicts that may contradict those of other IS organizations of which he or she may be a member.

Obligations to the Profession The issue Ethical obligations to the profession stem from the same reasons for obligations to colleagues. However, a member can help the profession or hurt it, regardless of behavior toward colleagues. For example, repetitive violation of contractual responsibilities may blemish not just the offender but the entire profession. Usually, obligations to the profession as a whole are placed above obligations to a colleague. For example, the member is expected to report an unethical act of a colleague. This follows the notion of preferring the "common good."

Similarities and differences All five organizations encourage commitment to the data processing profession. DPMA's code does not distinguish between the profession in general and fellow members, and, therefore, the obligations are limited to relationships between colleagues. Its code states the same obligations to "fellow members and the profession." The other four codes share one responsibility: the application of high professional competence. At least one code, but not all, includes the following elements:

* Apply high professional standards to personal or social life

* Avoid acts detrimental to the profession * Enhance public confidence in the profession

As the BCS is a sole national organization, its members' obligations to the organization apply to the profession. However, some of the obliga- tions are specifically directed at "the profession." The BCS code is significantly more detailed on this issue than the other codes.

It is recommended that all the above precepts be included in the unified code because all of them contribute to the fostering of high regard for the profession.

Sanctions Against Violations What happens when a member violates the organization's code of ethics? All of the organiza- tions except DPMA include sanctions against violators. ACM is somewhat vague regarding its policy against violators. Violations are "dealt with in accordance with ACM Policies and Pro- cedures," but these policies and procedures do not mention any measures against violations. The provisions of ICCP and CIPS are clear and de- tailed. They specify how a complaint should be submitted, the formation of a hearing panel, the hearing process, and the appealing process.

Conflicts, Priorities, and Guidance One flaw is apparent in all five ethical codes: the lack of priorities among the subjects of moral obligations. Obligation to one party may collide with obligation to another party. Protecting one's employer's interests may harm the public; pro- tecting a colleague's interests may contradict obligations to one's employer; etc. What is the member to do in such cases?

For example, consider this scenario. A program- mer working for a consulting firm is involved in a large project for a client. The programmer comes to realize that some of the code she is developing will not be compatible with other systems employed by the client. When she brings the new facts to the employer, he demands that she follow his instructions. Her responsibility to the employer is to obey the instructions. However, her obligation to the client is to inform him about the incompatibility. The programmer is faced with an ethical dilemma to which there is no solution in any of the above ethical codes.

The codes require that the member not divulge confidential information of the client. Now, let's assume that in the course of the member's work, the member received information of acts commit- ted by the client, or the employer, that could harm the public. Should the member abide by the rule?

430 MIS Quarterly/December 1992

This content downloaded from 194.29.185.103 on Fri, 9 May 2014 14:35:59 PM All use subject to JSTOR Terms and Conditions

Issues and Opinions: Unified Ethics Code

Should he or she be "more ethical" toward the public, or toward the employer or client?

While ethical conflicts are just as frequent in other professions, the ethical codes of other profes- sions provide clearer decision rules. For exam- ple, a lawyer's first obligation is always to his or her client. The same principle applies to physi- cians. Journalists strictly obey the rule of not ex- posing a source without the source's consent. Journalists have protected their sources to the point of obstructing justice; namely, they have preferred the source's interests to the public's interests. An architect who learns that a building may not meet safety standards is expected to not proceed with his or her work in order to protect the public even though this may conflict with his or her obligations to the employer or client. Un- fortunately, none of the codes discussed here provides any order of priorities. The leaders of the IS professional organizations should try to outline priorities of moral obligations. A conflict should not always be resolved in favor of the same constituent. Each case should be carefully examined by the individual before mak- ing a decision, and the responsibility of judgment should rest with the individual. Still, a code of ethics should try to help make the judgment. What should the member do when in a quan- dary? BCS offers guidance. Its code starts with the following words: "The Society, through its Professional Advisory Committee, is ready at all times to give guidance on the application of the Code of Conduct, and any member needing clar- ification or amplification of his or her obligation for the proper observance of professional con- duct should seek the Committee's assistance." The codes of the other organizations do not mention any proposed assistance.

Need for a Unified Code of Ethics The reason for multiple ethical codes stems from the fact that IS is, relatively, a new field. The pro- fessional associations felt they had to develop some ethical standards for the emerging trade. They should be commended for that. There are only slight differences among the objectives of the organizations. All seek the public's respect and appreciation of the special knowledge their

members possess. This alone warrants a unified code of ethics.

Perhaps the best way to shape codes into a com- prehensive, single code would be by examining the points of similarity between the profession and other professions that have widely accepted coherent ethical standards. Mylott (1986) equates computer professionals to other professions:

In the services they perform, computer pro- fessionals most resemble a combination of accountants, architects, and engineers. Like architects and engineers, computer professionals create specifications and supervise the implementation of specifica- tions. Yet, while architects and engineers rarely construct the buildings they have designed, computer professionals usually create the object of their specifications; they write computer software and propose combinations of hardware and software to purchasers. In order to develop computer software and to assemble configurations of computer hardware and software, com- puter professionals, like accountants, often perform financial and business analysis (p. 269).

This observation describes us well. Members of the IS community usually regard themselves as a profession. They meet frequently in profes- sional conferences, read and contribute to pro- fessional publications, and share a professional jargon.

The relationship between IS professionals and the public is similar to most other professional relationships in terms of knowledge and reliance. People approach a physician for help because the physician has knowledge that they do not have. People hire a lawyer because the lawyer possesses skills that they do not possess. Lay people trust their interests to experts. This is the main reason why a profession needs an ethical code of conduct. Similarly, IS professionals possess expertise that others do not. Their obligations to the public and clients are therefore similar to those of other experts. Ethical codes from three different countries have been presented here. The similarities among the codes outnumber the differences. As is evident, the differences cannot be attributed to organiza- tional or national interests. IS professionals in one

MIS Quarterly/December 1992 431

This content downloaded from 194.29.185.103 on Fri, 9 May 2014 14:35:59 PM All use subject to JSTOR Terms and Conditions

Issues and Opinions: Unified Ethics Code

country do not differ from their colleagues in other countries, and they are all expected to abide by the same standards of practice, regardless of organizational or national affiliation. This is especially true in the reality of a "global village," where computer networks diminish the importance of national borders.

A single, coherent code of professional conduct will better achieve the five objectives that profes- sional codes of ethics are supposed to achieve (Johnson and Snapper, 1985):

* Inspiration: to inspire members of the profes- sion to act more ethically

* Sensitivity: to encourage the members to be sensitive to the moral aspects of their jobs

* Discipline: to enforce certain rules of the pro- fession on its members to achieve integrity

* Advice: to provide advice in cases of moral complexity and ethical dilemma

* Awareness: to alert employers and clients as to what they can expect of the member when performing his or her job

A single international code would also help in fostering a stronger public recognition of the IT profession and greater commitment on the part of IT professionals toward society, employers, clients, and colleagues.

Recommendations The International Code of Ethics and Professional Conduct for IS Professionals should consist of the following principles:

1. The code should be organized along consti- tuencies to which the IS professional has obligations, i.e., the public, the employer, the client, the profession, and colleagues. (The codes of ICCP, ACM, and BCS are not ar- ranged by constituencies.) Focus on the con- stituencies induces a better sense of respon- sibility than does focus on the areas of responsibility.

2. The obligations to the different constituencies should be a union of all of the obligations as detailed in the above five codes. As the BCS code appears to be the most comprehensive,

it may serve as a good basis for the union. Namely, the drafters will add to the BCS code ingredients that it lacks from the other codes.

3. As the unified code is international, it should be free of obligations to any specific country. The professional's obligation to the public is an obligation to humankind, not to the citizens of a country. The countries' laws have to be obeyed by IS professionals anyway, just as any other individuals must. "Colleagues" will mean all colleagues, regardless of nationality.

4. Due to the interorganizational nature of the code, obligations to professional organizations will be identical to obligations to the pro- fession. Therefore, there will be no need for obligations to organizations. If at all neces- sary, individual organizations will still be able to maintain codes specific to their member- ships. These codes should not contradict those of the unified code. (Such codes may relate to the unified code just as state laws relate to the U.S. constitution.)

5. The code should provide general guidelines for priorities of obligations with respect to con- stituencies. That is, they will state the interests of which constituency the professional should prefer in case of a conflict. For example, the code will say that the welfare of the public at large should always come before the interests of clients, employers, and colleagues. Clear- ly, IS professionals may find themselves in conflicts for which there are no prescribed solutions, but the guidelines may help in many cases. To resolve such conflicts, organiza- tions should jointly, or separately, establish "ethics teams" that the individual professional can contact for advice. It should be under- stood by all that this is not legal, but moral, advice. Such advice should be extended on- ly in the absence of applicable law. (For ex- ample, only two U.S. states require that a person who knows of a violation of the state's computer crime statute must report the viola- tion. In other states, an IS professional may be reluctant to report a violation because reporting may harm another party more than the party that is harmed would benefit from the reporting.)

6. The code should detail the procedures for reporting and processing complaints against

432 MIS Quarterly/December 1992

This content downloaded from 194.29.185.103 on Fri, 9 May 2014 14:35:59 PM All use subject to JSTOR Terms and Conditions

Issues and Opinions: Unified Ethics Code

violators of the code and the measures taken against violators. An ethics code without sanc- tions is like a crocodile without teeth. Sanc- tions may include expulsion from professional organizations, revocation of professional cer- tificates, denial of admittance to professional gatherings, and other temporary or life-time penalties.

Conclusion The organizations discussed in this article are among the world's most prominent IS profes- sional associations. Since they, and other similar organizations, promote the same objectives, there is reason to embark on an effort to form an international code of ethics for IS professionals. The unified code will enhance the public's perception of IS specialists as representing a true, responsible profession. It will also assure the public of the profession's concern for ethical development and implementation of information systems.

Acknowledgements Many thanks to the senior editor and anonymous reviewers for their excellent comments on previous drafts of this article.

References Communications of the ACM. "ACM Code of

Ethics and Professional Conduct," (35:5), May 1992, pp. 94-99.

Couger, J.D. "Preparing IS Students to Deal With Ethical Issues," MIS Quarterly (13:2), June 1989, pp. 211-218.

Johnson, D.G. Computer Ethics, Prentice Hall, Englewood Cliffs, NJ, 1985.

Johnson, D.G and Snapper, J.W. Ethical Issues in the Use of Computers, Wadsworth Publishing Company, Belmont, CA, 1985.

Mylott, T.R., III. "Computer Professional Malprac- tice," Computer and High Technology Law Journal (2:2), January 1986, pp. 239-270.

Oz, E. Ethics for the Information Age, Wm. C. Brown Publishing, Dubuque, IA, forthcoming 1993.

MIS Quarterly/December 1992 433

This content downloaded from 194.29.185.103 on Fri, 9 May 2014 14:35:59 PM All use subject to JSTOR Terms and Conditions