Microsoft Word - AJIS Vol13-2 o.doc 201 Australasian Journal of Information Systems Volume 13 Number 2 May 2006 STRIKING A BALANCE BETWEEN ETHICS AND ICT GOVERNANCE Graeme Pye & Matthew J. Warren School of Information Systems, Faculty of Business and Law, Deakin University, Geelong, Victoria, Australia, 3217 Email: mwarren@deakin.edu.au ABSTRACT Ethics and Information Communication Technology (ICT) Governance both have their place in today’s business organisations, but can their practical applications present an ethical ambiguity for the IT professional employed within the business organisation? The guidelines contained within various codes of ethics recommend principles regarding the ethical behaviour of individual IT professionals. In contrast, IT Governance as outlined in the new Australian Standard for Corporate Governance of Information and Communication Technology (ICT) provides ICT governance advice for business. This paper explores the difference between these viewpoints. Keywords: Ethics, IT governance, ICT and ACS. INTRODUCTION Depending on your personal perspective, ethics can have a number of relevant meanings. In general terms ethics is regarded as the moral rationales that influence a person’s behaviour or the carrying out of an activity or alternatively, ethics can also refer to the area of knowledge that deals with moral principles (Pearsall, 1998). However, from an information technology (IT) business domain perspective, Clarke’s (1999) view was that the term ethics is intended to refer to the guiding principles of doing what is right or wrong from a moral perspective, in reference to ethical behaviour of both the individual IT professional and the governance of an IT department within a business organisation. As an overview, this research seeks to investigate and philosophically appreciate the ethical perceptions, interpretations, principles and professed tenets of the Australian Computer Society’s (ACS) Code of Ethics (2003), while also investigating the genesis and potential influence of IT governance in light of the recent publication of the Australian Standard for the recommended guiding principles of Corporate Governance of Information and Communication Technology AS 8015-2005 (2005). As a result of this circumstance, the IT professional is now potentially faced with two behavioural conventions in the workplace that can both exert their own normative influences on the employees’ ethical behaviour. So initially this paper will explain and philosophically define ethics and morality, before proceeding to examine and compare the particular focus of the key principles underpinning the ASC Code of Ethics (2005) and the Australian Standard for ICT Governance (2005). Australasian Journal of Information Systems Volume 13 Number 2 May 2006 202 PHILOSOPHY OF ETHICS AND MORIALTY According to the Oxford Dictionary of Philosophy, ethics is ‘the study of the concepts involved in practical reasoning: good, right, duty, obligation, virtue, freedom, rationality, choice’ (Blackburn p.126 1994) while, applied ethics is ‘the subject that applies ethics to actual practical problems …’ (Blackburn p.126 1994). Furthermore, the ethics and morality of an individual or people can be regarded as the same thing according to Blackburn (1994), however a usage of morality by German philosopher Kant (1724 – 1804) restricts the usage of morality to ideas of duty, obligation and principles of conduct, while reserving ethics for the Aristotle (384 – 322 BC) approach of practical reasoning pertaining to the ideas of virtue and generally avoiding the separation of moral considerations from other practical considerations. These philosophical rationales will form the basis of a philosophical analysis from an ethical and moral perspective of the information content of the ACS Code of Ethics (2003) and the ICT Governance Standard (2005) respectively, to gain a deeper understanding of their philosophical basis, considered roles and application within the IT domain of any business organisation. CODE OF ETHICS Many computing codes of ethics abound and are generally based on a number of perceived ethical or moral principles that provide guidance and engender a commitment toward ethical behaviour that is appropriate for and expected of IT professionals. For example, the Australian Computer Society Code of Ethics (ACS 2003) is a code of conduct that applies only to their members. Generally, such codes are used as guiding principles for professional computing industry associations as a resource for their members and as a means of outlining the ethical expectations of both the association’s membership and individual IT professionals in general. ACS Code of Ethics The ACS Code of Ethics (2003) document delivers ethically based behavioural recommendations that are strongly focused on delivering sound ethical and moral advice to individual IT professionals that are members of the ACS, while also providing a reference resource that addresses the following ten principles: 1. Honour and Dignity; 2. Personal Commitment; 3. Values and Ideals; 4. Standards of Conduct; 5. Priorities; 6. Competence; 7. Honesty; 8. Social Implications; 9. Professional Development; 10. IT Professional Behaviour. The ACS Code of Ethics (2003) seeks to deliver advice that is ethically right in relation to the appropriate ethical behaviour expected of an ACS member or for any IT professional that would be reasonably expected to deliver in their professional work. Although the code addresses a wide area of principles, the advice only serves as guidance to the IT professional from a personal behaviour aspect and does not seek to deliver a methodology for resolving ethical dilemmas between 203 Australasian Journal of Information Systems Volume 13 Number 2 May 2006 individuals or an individual and the business practice or goal. This is not to say that the individual could not practically reason for themselves what is ethically right or the morally appropriate behaviour to follow with due consideration of the situation, it is just that no specific guidance is given to the reader of how such an ethical issue could be resolved. From a philosophical standpoint the ACS Code of Ethics (2003) uses an applied ethics approach to addressing the ten principles listed, and what the code is trying to achieve is that in regard to the code’s stated principles: these are the suggested ethical behaviours and obligations that can be practically applied by an individual, in order to be regarded or deemed as acting ethically in respect to the ACS Code of Ethics (2003). It is therefore the view of the authors that from an ethical and moral perspective of the difference between right and wrong that the ACS Codes of Ethics (2003) can guide IT professional to ‘do the right thing’ and this also suggests that such adherence to the moral and ethical principles as laid out in the code would serve the IT professional well from human-centric, behavioural and interactive perspectives. ICT GOVERNANCE According to the OECD (2004), the principles of corporate governance should reflect the set of relationships between an organisation’s management, board, shareholders and other stakeholders to constitute the rights, roles and equitable treatment of shareholders; disclosure and transparency; and the responsibilities of the board. Additionally, corporate governance should be based on sound strategic guidance of the business, effective monitoring of management by the board and accountability of the board to stakeholders. The Australian Standard for Good Governance Principles AS 8000-2003 (2003) reflects the OECD intent and builds further upon other principles covering authority, accountability, stewardship, leadership, direction and how control is exercised within an organisation. In taking governance one step further, the new Australian standard for Corporate Governance of ICT AS 8015-2005 (2005) is a supporting standard that applies to the governance of IT resources and associated technologies used to provide information and communication services within a business organisation. The ICT governance standard provides guidance that allows organisational directors and managers to dictate how ICT assets will be managed to ensure that they support the business goals set by the business owners, management or Board of Directors that are applicable to the principles of good ICT governance. Advantages of ICT Governance As IT technology has become an ingrained and essential part of the enterprise management of transactions, information storage and knowledge management of enterprises, their subsequent dependence on technology has become fundamental to supporting, sustaining and growth of business enterprises. However, the risks associated with ICT become more apparent when considered in the context of doing business on a global scale, twenty-four hours a day, seven days a week, with the reliance placed in ICT resources to provide a competitive edge this can determine the very survivability of the business and ongoing prosperity (ITGI 2003). The research of Weill and Ross (2004) has defined ten key principles essential to effective IT governance that are as follows: Australasian Journal of Information Systems Volume 13 Number 2 May 2006 204 1. Actively design governance and continue to provide adequate resources, support and attention; 2. Know when to redesign and adjust the governance systems; 3. Involve senior managers in committees, decisions and performance reviews; 4. Make choices that are business strategic and manageable; 5. Clarify the exception handling process to deal with the unexpected; 6. Provide the right incentives that rewards alignment to the strategic business goals; 7. Assign ownership and accountability for IT Governance to ‘champion’ the process; 8. Design governance at multiple organisational levels; 9. Provide transparency and eduction; 10. Implement common mechanisms across the six key assets: • Customer relationships; • Product assets; • Human assets; • IT assets; • Physical assets; • Financial assets; These ten principles represent the key outcomes of Weill and Ross’s (2004) research and strongly supports the case for IT Governance as this research also affirms that businesses with effective IT governance programs in place, have attained twenty percent higher profit margins than those businesses with poor quality governance programs that have similar strategic goals. Therefore in the Australian context, the Australian Standard for Corporate Governance of ICT AS 8015-2005 (2005) is focused on promoting effective, efficient and the acceptable use of ICT by being ‘the system by which the current and future use of ICT is directed and controlled. It involves evaluating and directing plans for the use of ICT to support the organisation and monitoring this use to achieve plans. It includes the strategy and policies for using ICT within an organisation.’ (Standards Australia p.6 2005). Ethical Focus of ICT Governance Standard The ICT Governance Standard (2005) document outlines six principles that establish well defined responsibilities for effective ICT governance of Australian businesses (Standards Australia 2005): 1. Establish clearly understood responsibilities for ICT; 2. Plan ICT to best support the organisation; 3. Acquire ICT validly; 4. Ensure the ICT performs well whenever required; 5. Ensure ICT conforms with formal rules; 6. Ensure ICT use respects human factors. The ICT Governance Standard (2005) does deliver a framework for business that suggests how to managerially control IT from a top-down perspective by engendering a view of compliance for good governance of ICT. However, the standard does not deliver any framework or methodology to resolve ICT governance issues within the business and therefore such decisions are deferred to the ethics of the employee to resolve within the business context, as principle five directs that “Directors should direct that all actions relating to ICT be ethical” (Australian Standard p.12 2005). From a philosophical prospective the ICT Governance Standard (2005) is based in the traditional ethics approach by focusing on the ideas behind what is deemed good governance from the practical 205 Australasian Journal of Information Systems Volume 13 Number 2 May 2006 reasoning aspect of what is right, dutiful and obligatory across the governing tasks of evaluating, directing, and monitoring as recommended in the Standard. ICT Governance and the ACS Code of Ethics The Australian Standard for the governance of ICT is ethically vague at the personal level and has been developed with a corporate aspect that prescribes what is deemed as necessary corporate behaviour to achieve good governance of ICT. According to the standard, this can be achieved within a business organisation and with top-down management principles that originate at the Board of Directors level and therefore the ICT Governance Standard (2005) applies a high-level view of compliance through the establishment of checks and balances in evaluating, directing and monitoring of the ICT assets within the business, while providing no moral or ethical guidance to the individual IT professional within the business. We can conclude that governance of ICT as applied can deliver good governance for the management of ICT, but this does not necessarily reflect the ethical standards required by individuals within the business or at the Director level. Therefore we cannot assume that good governance of ICT will necessarily imply the presence of ethically virtuous employees doing what is right within the business. The ACS Code of Ethics (2003) takes a human-centred focus to providing ethical guidance to IT professionals that is didactic in nature and is achieved by explicitly directing the reader on what is deemed as acceptable ethical behaviour, however it is also pays little regard to the management issues that are the focus of the ICT Governance Standard (2005). THE DOCUMENTAL ETHICAL VOICINGS Melsar and Byrne-Armstrong’s (2000) research identified corporate voices and personal voices as being the two distinct discourses that were competing for dominance of the Internet, with each identifying different ethical issues as being the most important to the Internet. Melsar and Byrne- Armstrong go on to establish that the two discourses exhibit differing values and visions of the Internet, such as: the corporate vision as being an extension of property and income generation; while the personal voice is regarded as an extension of creativity and connection between humans. We can identify a similar use of corporate and personal voicing being employed in the ACS Code of Ethics (2003) and the ICT Governance Standard (2005) documents. This is evident in the ACS Code of Ethics (2003) where the document voicing using the first person presents the reader with the more humanistic tone of personal voicing that is focused at addressing the individual. While conversely, the ICT Governance Standard (2005) uses an instructive and impersonal tone in the third person that presents the language of corporate voicing, which also presents a formal and measured tone in regard to document content for guiding professional corporate behaviour. The particular voicing used in these documents is intended to address a particular target audience and therefore the primary focus of the ICT Governance Standard (2005) is that as an officially sanctioned Australian Standard, it is focused on delivering sound practical advice that can assist business in managing in a top-down process, the control and management of IT assets and personal within their respective business organisation. Conversely, the ACS Code of Ethics (2003) delivers ethical suggestions that are directly focused on empowering the individual with ethical advice to enable an IT professional to decide upon the appropriate professional behaviour in the particular Australasian Journal of Information Systems Volume 13 Number 2 May 2006 206 ethical situation. The ACS Code of Ethics (2003), from this prospective, promotes a bottom-up style of management that encourages the IT professional to drive ethical behaviour for themselves, their colleagues and perhaps ultimately the ethical behaviour of the business organisation. This difference of documental approach to managing individual ethics from the bottom-up and the ICT governance of business from the top-down, may potentially create an ethical dilemma in itself between the adopted code of ethics of the individual IT professional and the ICT governance requirements of the business. Therefore further investigation is required into the resultant consequences of ethical decisions taken and if contradiction exists, to bring together individual ethical beliefs based on the ACS Code of Ethics (2003) and also the obligations of the ICT Governance Standard (2005), to develop a resolution framework to determine a conciliatory and ethical solution that represents the best intentions of both the individual and the business. CONCLUSION We have determined that there is a marked philosophically ethical difference between the ACS Code of Ethics (2003) and the ICT Governance Standard (2005) that is due in part to the localised focus taken by each of the respective documents. They exist with little or no regard given to the potential influence of each, their effect upon the business or individual in regard to their application, the potential risks for creating conflictive ethical dilemmas or any in-depth consideration given to determining ethically balanced decisions in regard to both their respective applications. While the ACS Code of Ethics (2003) takes a very humanistic and personal view in delivering ethical advice that is based upon the philosophy of applied ethics by employing ethical solutions practically. Conversely it was determined that the ICT Governance Standard (2005) takes an impersonal view that is focused on the recommended business management aspects of evaluating, directing, and monitoring business processes with a more traditional ethical view of complying to what may be deemed as good governance. The nature of the philosophically ethical difference between the code of ethics and ICT governance and the real potential for ethical dilemmas to arise, further research is needed to recognise, address and determine such ethical resolutions by better understanding the consequential effects of such decisions made. To do this from an ethical and moral perspective we need to understand the moral theory behind the consequences of ethical decisions and solutions, before developing a framework to guide ethical resolution of issues between the ACS Code of Ethics (2003) and the ICT Governance Standard (2005). Once this ethical framework is established, the next step in this research is to test the framework against real-world or hypothetical case studies to determine the effectiveness of the framework in addressing and resolving ethical issues between individuals and businesses through the application of applying the philosophical principles of consequentialism. 207 Australasian Journal of Information Systems Volume 13 Number 2 May 2006 REFERENCES ACS 2003, Australian Computer Society Code of Ethics, (Online), Australian Computer Society, Available from: (May 2005). Blackburn S. 1994, The Oxford Dictionary of Philosophy, Oxford University Press, Oxford U.K. Clarke R. 1999, Ethics and the Internet: Cyberspace Behaviour of People, Communities and Organisations., (Online), ANU, Available from: (June 2005). ITGI 2003, Board Briefing on IT Governance, 2nd Ed., IT Governance Institute. Melser P. Byrne-Armstrong H. 2000, 'Corporate Voices, Personal Voices: The Ethics of the Internet.' in 2nd Australian Institute of Computer Ethics Conference (AICE2000), Australian Computer Society, Canberra, ACT. OECD 2004, OECD Principles of Corporate Governance, OECD, Paris, France. Pearsall J. (Ed) 1998, The New Oxford Dictionary of English, Clarendon Press, Oxford. Standards Australia 2003, Good Governance Principles. AS 8000-2003, Standards Australia, Sydney, NSW. Standards Australia 2005, Corporate Governance of Information & Communication Technology. AS 8015-2005, Standards Australia, Sydney, NSW. Weill R., Ross J. W. 2004, IT Governance, Harvard Business School Press, Boston, Massachusetts.