Research Ethics, Integrity and Governance

Introduction and context

Accounting and finance research often uses information that is commercially sensitive, personally identifiable, financially consequential, or capable of influencing decisions about investors, employees, customers, borrowers and taxpayers. A dissertation may involve interviews with finance directors, analysis of company accounts, employee surveys, customer credit data, market databases, or automated tools that process large volumes of information. These activities create responsibilities that extend beyond producing a technically correct report.

Research ethics concerns the principles governing what researchers ought to do. Research integrity concerns honesty, accuracy, transparency, accountability and reproducibility throughout the research process. Research governance concerns the structures, approvals, policies and controls through which an institution supervises research. Together, they protect participants, organisations, researchers, data users and the credibility of accounting and finance as professions.

Ethical research is not simply research that has received an approval form. Approval is an important control, but ethical judgement must continue during recruitment, data collection, analysis, publication, storage and disposal. A project can comply with a procedure while still being unfair, misleading or careless. Conversely, a low-risk project may require little formal review but still demands careful attention to privacy, attribution and accuracy.

Learning objectives

By the end of this chapter, students should be able to:

1. Explain the relationship between research ethics, integrity and governance.
2. Design an appropriate informed-consent process.
3. Protect confidentiality, anonymity and personal data.
4. Identify and manage conflicts of interest.
5. Distinguish plagiarism, fabrication, falsification and acceptable scholarly practice.
6. Apply responsible principles to authorship and the use of artificial intelligence.
7. Determine when institutional ethical approval is required and how to document it.
8. Analyse ethical risks in an accounting or finance dissertation and propose proportionate controls.

1. The ethical foundations of research

1.1 Respect for persons and autonomy

Respect for persons means recognising participants as decision-makers rather than merely sources of data. Participants should receive sufficient information to make a voluntary and informed choice. This is particularly important where there is a power imbalance, such as research involving an employee, student, subordinate, client or borrower.

Autonomy is limited when a person lacks capacity to understand or decide, when participation is coerced, or when refusal carries an unreasonable penalty. Researchers must therefore use understandable language, allow time for questions, and avoid implying that participation is required when it is not.

1.2 Beneficence, non-maleficence and justice

Beneficence requires researchers to seek meaningful benefits, such as improved understanding, better reporting practice or improved financial decision-making. Non-maleficence means avoiding or minimising harm. Possible harms include reputational damage, employment consequences, financial loss, distress, disclosure of misconduct, identification of a vulnerable person, or misuse of confidential commercial information.

Justice concerns the fair distribution of burdens and benefits. Researchers should not select participants merely because they are accessible or powerless. For example, repeatedly surveying junior employees about sensitive management practices may place the burden on those least able to refuse while the benefits accrue to senior decision-makers.

1.3 Respect for law, professional standards and the public interest

A dissertation must comply with applicable law, institutional rules, professional codes and contractual restrictions. Legal compliance is a minimum, not a complete ethical justification. A researcher may technically be permitted to access a dataset yet still be expected to limit collection, protect identities and avoid harmful publication.

Accounting and finance researchers should be alert to duties concerning confidentiality, market-sensitive information, anti-money-laundering controls, data protection, intellectual property, insider information and professional independence. The exact legal requirements vary by jurisdiction, so students must consult current institutional and national guidance rather than relying on general summaries.

2. Ethical governance across the research lifecycle

Ethical responsibility can be understood as a lifecycle rather than a single event.

Figure: Ethical governance is continuous across the research lifecycle.

At the planning stage, the researcher identifies participants, data sources, risks, legal constraints and the proposed benefits. During approval, the institution evaluates the protocol and consent materials. During collection, the researcher follows the approved procedure and records deviations. During analysis, integrity requires accurate coding, appropriate methods and honest reporting of uncertainty. During dissemination, the researcher protects confidentiality, acknowledges limitations and corrects errors where necessary. Records should be retained and securely destroyed according to the approved plan.

A useful governance document is a research protocol. It should state the research question, population, recruitment method, inclusion and exclusion criteria, instruments, data sources, consent process, risk assessment, data-management plan, analysis strategy, dissemination plan and responsibilities. A protocol reduces the risk of making improvised ethical decisions after data have been collected.

3. Informed consent

Informed consent is a process through which a person voluntarily agrees to participate after receiving relevant information and having a reasonable opportunity to ask questions. It is not merely a signature. For secondary data research, consent may have been obtained by the original data collector, may be impracticable, or may be replaced by another lawful and ethically defensible basis for using the data. The researcher must document the reasoning and obtain institutional advice where uncertainty exists.

A good participant information sheet normally explains:

• the researcher, supervisor and institution;
• the purpose and expected duration of the study;
• what participation involves;
• foreseeable risks, discomforts and benefits;
• how recordings and data will be handled;
• whether quotations or identifiable results will be published;
• the voluntary nature of participation;
• the right to refuse or withdraw, including any applicable deadline;
• contact details for questions or complaints; and
• the relevant approval or reference number, where available.

Consent must be specific enough to cover the proposed activities. Consent to an interview does not automatically authorise public release of a named quotation, future unrelated research, or transfer of identifiable data to a commercial provider. If the project changes materially, researchers should seek revised approval and, where necessary, renewed consent.

Consent can be written, electronic, recorded verbally, or evidenced through another approved method. The method should suit the risk and context. A tick box hidden in a long online form may be inadequate for a sensitive study. Consent should be separated from unnecessary declarations, and refusal should not disadvantage a participant.

4. Confidentiality, anonymity and privacy

These terms are related but distinct. Confidentiality is the researcher's promise to control access to information. Anonymity means that an individual's identity is not collected or cannot reasonably be linked to the response. Pseudonymisation replaces direct identifiers with codes, but the data remain potentially identifiable if the key or other information exists.

In accounting and finance, complete anonymity is often difficult. A case may be identifiable from job title, company size, location, transaction value and unusual events even when names are removed. Small samples and prominent executives create a particular risk of deductive identification. Researchers should assess combinations of attributes, not just direct names.

Practical safeguards include:

• collect only information necessary for the research question;
• separate identity keys from research data;
• encrypt devices and approved storage;
• use access controls and strong authentication;
• avoid sending identifiable files through ordinary email;
• remove or generalise rare characteristics in publications;
• suppress small cells where identification is plausible;
• use quotations cautiously and seek explicit permission for attribution;
• maintain an access log where appropriate; and
• securely delete data when the retention period ends.

A confidentiality promise must be realistic. Researchers should not promise absolute secrecy if disclosure may be required by law, institutional policy, safeguarding duties or a serious risk of harm. Such limits should be explained before participation.

5. Data protection and responsible data management

Data protection principles commonly include lawfulness and fairness, transparency, purpose limitation, data minimisation, accuracy, storage limitation, security, and accountability. Their precise legal expression differs across jurisdictions, but the underlying discipline is broadly applicable.

A data-management plan should answer five questions:

1. What data will be collected, and why are they necessary?
2. What is the lawful or institutionally approved basis for processing them?
3. Who will access them, and under what controls?
4. How long will they be retained and in what form?
5. How will they be shared, archived or destroyed?

Researchers should distinguish personal data from confidential business data. A company dataset may contain no names yet still reveal proprietary pricing, customer concentration or strategy. Conversely, publicly available information may remain personal data when it is combined, profiled or republished in a new context. Public availability does not automatically remove ethical responsibilities.

A breach includes loss, unauthorised access, accidental disclosure, corruption or inappropriate transfer. If a breach occurs, the researcher should not conceal it or attempt an informal fix. They should follow the institution's incident procedure, notify the supervisor or data-protection contact promptly, preserve relevant evidence, and support any required risk assessment or notification.

6. Conflicts of interest and independence

A conflict of interest exists when a personal, financial, professional or institutional interest could affect—or reasonably appear to affect—research judgement. A conflict is not necessarily misconduct. The ethical problem arises when it is concealed or unmanaged.

Examples include researching an employer's financial controls while seeking promotion, accepting sponsorship from a company whose performance is being assessed, holding shares in a firm discussed in the dissertation, supervising a project involving a close relative, or allowing a client to veto inconvenient findings. Conflicts can be actual, potential or perceived; each can damage credibility.

A proportionate management plan may include disclosure to the supervisor and ethics committee, independent review, separation of roles, restrictions on access, preregistration of analysis decisions, transparent reporting, or withdrawal from a decision. Financial interests should be disclosed when relevant, but disclosure alone may not be sufficient where the risk to independence is substantial.

Researchers must distinguish confidentiality from sponsor control. A sponsor may legitimately review confidential information for factual accuracy, but should not control methods, suppress adverse results or require misleading conclusions. Agreements should address access, publication rights, ownership and conflicts before data collection begins.

7. Research integrity and unacceptable practices

Research integrity requires that the scholarly record represent what was actually done and found. Three serious forms of misconduct are often distinguished:

• Fabrication: making up data, participants, observations, transactions, references or results.
• Falsification: manipulating materials, procedures, images, coding, exclusions or results so that the record is misleading.
• Plagiarism: presenting another person's words, ideas, structure, data or work as one's own without appropriate acknowledgement.

Honest error is not automatically misconduct. A spreadsheet mistake, an incorrect citation discovered after submission, or a flawed interpretation may be serious, but intent, recklessness and the response after discovery matter. Researchers should correct errors openly rather than silently altering records.

Questionable practices can also undermine integrity. These include selective reporting, undisclosed changes to hypotheses, inappropriate removal of inconvenient observations, p-hacking, duplicate publication, misleading graphs, invented citations, excessive self-citation and claiming certainty beyond the evidence. In an accounting dissertation, changing the treatment of outliers only after observing the results is problematic unless the change is transparently justified and sensitivity analysis is reported.

Good practice includes preserving raw data, maintaining a dated research log, version-controlling files, recording transformations, retaining syntax or calculation steps, checking source documents, using a second-person review for critical coding, and reporting limitations. Reproducibility does not require exposing confidential data; it may be supported by a data dictionary, synthetic example, restricted-access process and complete analytical documentation.

8. Plagiarism, citation and intellectual property

Academic writing requires a clear distinction between the researcher's contribution and material obtained from others. Direct quotations require quotation marks and a citation. Paraphrasing requires genuine re-expression and a citation; changing a few words is not sufficient. Ideas, theories, datasets, tables, software, images and distinctive methods may all require acknowledgement.

A reference list is not a substitute for accurate attribution. Each important claim should be traceable to an appropriate source, and citations should not be used to imply that a source supports a claim it does not make. Students should follow the required referencing style consistently and retain source details while researching.

Copyright and licensing also matter. A table copied from a commercial database, a proprietary industry report or a software output may have restrictions even when a citation is provided. Researchers should check licence terms, obtain permission where needed, and prefer data and materials whose reuse is authorised.

Similarity-detection software can identify matching text but cannot determine plagiarism by itself. Common phrases may create matches, while uncited ideas may escape detection. Academic judgement remains essential.

9. Authorship, acknowledgements and contribution

Authorship should reflect a substantial intellectual contribution, participation in drafting or critical revision, approval of the final version, and accountability for the work. A person who only provides funding, access, administrative assistance or proofreading may merit acknowledgement rather than authorship, depending on institutional policy. Conversely, a person who makes a substantial intellectual contribution should not be omitted because of status or hierarchy.

Honorary authorship—adding a supervisor, manager or famous collaborator who did not contribute appropriately—misrepresents responsibility. Ghost authorship—omitting a substantial contributor—also undermines integrity. Authorship expectations should be discussed early and revisited if contributions change. A contribution statement can record who designed the study, collected data, analysed evidence, drafted sections and approved the final work.

For an undergraduate dissertation, the student is normally the author, while supervisors guide and assess rather than take ownership. Acknowledgements should not reveal confidential information or imply endorsement by an organisation that has not approved the wording.

10. Responsible use of artificial intelligence

Generative AI can assist with brainstorming, language improvement, coding suggestions, transcription, translation, literature discovery and data organisation. It can also invent citations, produce biased summaries, expose confidential information, reproduce copyrighted material, conceal a student's lack of understanding, or generate plausible but false analysis.

Responsible use requires transparency, verification and human accountability. Students should:

• follow the institution's current rules on permitted and prohibited use;
• never upload confidential company data, personal data, interview transcripts or unpublished research into an unapproved tool;
• verify every factual claim, citation, quotation, calculation and code suggestion;
• retain sufficient records of significant AI assistance;
• disclose material use when required by institutional or publication policy;
• ensure that the submitted argument reflects their own understanding;
• inspect generated code for security, logic and reproducibility; and
• avoid treating an AI system as an author or responsible decision-maker.

AI output is not automatically an authoritative source. A fabricated reference remains fabricated even if an AI system supplied it. Similarly, an AI-generated summary may omit uncertainty or reproduce historical bias. If AI is used to transcribe interviews, participants should be informed where relevant, the service should be approved, and the original recording should be protected.

A useful principle is: the researcher remains accountable for the final work, regardless of which tool assisted its production. AI should support—not replace—critical reasoning, source evaluation, consent, confidentiality and scholarly judgement.

11. Institutional ethical approval

Institutional ethical approval is a formal review of whether a proposed project is acceptable, proportionate and adequately controlled. Requirements vary, but approval is commonly expected when a project involves human participants, identifiable personal data, sensitive topics, vulnerable groups, intervention, deception, biological material, confidential organisational information, or elevated risk.

Some projects using fully public, non-personal data may qualify for exemption or expedited review. Exemption is not the same as self-declaration without evidence. Students should ask the designated institutional process before collecting data. Retrospective approval is generally not a valid substitute for prior approval.

An application commonly includes the protocol, participant information sheet, consent form, recruitment materials, questionnaires or interview schedules, risk assessment, data-management plan, researcher training, funding or sponsor details, and arrangements for complaints or adverse events. The committee may approve, request amendments, impose conditions, or reject the proposal.

Approval applies to the described protocol. Material changes—such as a new population, new data source, different recording method, expanded use of data, or a change in risk—should be submitted for amendment before implementation. Researchers should maintain a decision log showing the approval date, reference number, amendments, deviations and incident reports.

12. Applied case: a finance-control interview study

Background

This illustrative case concerns Maya, an accounting student investigating how small businesses monitor cash-flow risk. She plans to interview ten finance managers and compare their practices with published guidance. A local accounting firm offers to recruit participants and provide access to a client contact list.

Problem

The proposed interviews may reveal weak controls, overdue liabilities and suspected irregular transactions. The firm wants to review transcripts before publication and asks Maya to name the strongest and weakest businesses. Maya also owns shares in one participating company and considers uploading transcripts to a free AI transcription service.

Analysis

The project involves human participants, confidential commercial information and a financial conflict of interest. Naming businesses could cause reputational or commercial harm and may make participants identifiable. The accounting firm's access to clients creates a recruitment power imbalance and a risk that participation is perceived as expected. The sponsor's requested editorial control could compromise independence. The proposed AI service creates a confidentiality and data-transfer risk.

Approach and solution

Maya first submits a risk assessment and protocol for institutional review before recruitment. The information sheet explains that participation is voluntary, that the firm will not be told who declines, and that findings will be reported using pseudonyms and aggregated themes. The consent form separately asks whether interviews may be audio-recorded and whether anonymised quotations may be used.

Maya discloses her shareholding. Her supervisor arranges independent review of the analysis and requires either divestment or a clear management plan approved by the institution. The firm may check factual accuracy of statements about its own procedures but cannot remove adverse findings or control conclusions; this condition is written into the access agreement.

No transcript is uploaded to an unapproved AI service. If transcription software is used, it must be institutionally approved, contractually secure and consistent with the consent information. Otherwise, Maya transcribes manually or uses an approved local system. The identity key is stored separately from coded transcripts, access is restricted, and direct identifiers are removed before analysis.

Outcome

The final dissertation reports patterns rather than rankings, explains the limitations of a small purposive sample, documents the conflict-management process, and retains an audit trail of coding decisions. One participant later requests withdrawal before the stated deadline; Maya removes that participant's data in accordance with the approved protocol. The result is less commercially dramatic than the firm's original proposal but more credible and ethically defensible.

Learning points

The case demonstrates that consent, confidentiality, independence, data protection, AI governance and publication rights are interconnected. Ethical approval must occur before data collection, and governance continues when the project changes or a participant exercises a right described in the consent process.

13. Challenges, limitations and best practice

Ethical decisions rarely involve zero risk. Anonymising a small population may reduce usefulness; preserving detailed data may increase identification risk. A strict withdrawal deadline may protect analytical integrity but should be communicated clearly. A sponsor may provide valuable access while creating pressure. Researchers should make these trade-offs explicit rather than claiming that risk has been eliminated.

A practical pre-submission checklist is:

• Is the research question important enough to justify the burden imposed?
• Have all participants received understandable information and voluntary choice?
• Are recruitment and incentives fair?
• Have confidentiality, anonymity and re-identification risks been assessed?
• Is the data-management plan lawful, secure and proportionate?
• Have personal, financial and institutional conflicts been disclosed?
• Is the analysis plan documented before results influence decisions?
• Are sources, contributors, software and AI assistance properly acknowledged?
• Has approval been obtained before recruitment or access to restricted data?
• Can another competent reader understand what was done and why?

These controls support both ethics and research quality. Transparent methods make findings more credible; careful data management reduces operational risk; and honest limitations help users make better decisions.

Chapter Summary

Research ethics protects autonomy, welfare, privacy, fairness and the public interest. Research integrity requires an accurate and transparent scholarly record, while governance provides the institutional procedures that review, monitor and document research. Informed consent is an ongoing process, not merely a signature. Confidentiality, anonymity and pseudonymisation are different protections, and commercial information may remain sensitive even when personal identifiers are absent. Data should be minimised, secured, retained only as necessary and managed through an approved plan.

Conflicts of interest should be disclosed and managed so that independence is both real and credible. Fabrication, falsification and plagiarism are serious breaches, while selective reporting and undocumented analytical changes are questionable practices. Authorship should reflect meaningful intellectual contribution and accountability. AI may assist research only within institutional rules, with verification, transparency and protection of confidential information. Institutional ethical approval should be obtained before relevant research begins and revisited whenever the protocol changes. Ethical governance is therefore a continuous lifecycle responsibility shared by the student, supervisor, institution, sponsors and other research partners.

Key Terms

Anonymity: A condition in which a participant cannot reasonably be identified from the research data.

Beneficence: The ethical duty to promote worthwhile benefits.

Confidentiality: The obligation to control access to information entrusted to the researcher.

Conflict of interest: An interest that could influence, or appear to influence, research judgement.

Consent: Voluntary agreement to participate after adequate information and opportunity for questions.

Data minimisation: Collecting only data necessary for the specified purpose.

Fabrication: Making up data, observations, participants or results.

Falsification: Manipulating research materials, processes or results to create a misleading record.

Integrity: Honesty, accuracy, transparency and accountability in research.

Institutional ethical approval: Formal review and authorisation of a proposed research project by an authorised institutional body.

Justice: Fair distribution of research burdens and benefits.

Non-maleficence: The duty to avoid or minimise harm.

Pseudonymisation: Replacing direct identifiers with codes while retaining a possible route to re-identification.

Research governance: Structures and procedures used to oversee responsible research.

Research protocol: The documented plan specifying a study's purpose, methods, risks and controls.

Plagiarism: Presenting another person's words, ideas, data or work as one's own without appropriate acknowledgement.

Responsible AI use: Transparent, verified and accountable use of artificial intelligence within ethical and institutional boundaries.

Storage limitation: Retaining data no longer than necessary for the approved purpose.

Review Questions

Short Answer Questions

1. Distinguish confidentiality from anonymity.
2. What information should normally appear in a participant information sheet?
3. Define fabrication and falsification.
4. Why is a conflict of interest not automatically misconduct?
5. State two risks associated with uploading research material to an AI tool.

Long Answer Questions

1. Explain how informed consent should be designed and maintained throughout an accounting or finance dissertation.
2. Discuss the relationship between data minimisation, confidentiality and data security.
3. Compare plagiarism, questionable research practices and honest research error.
4. Explain how authorship decisions can be governed fairly in a student research project.
5. Describe the purpose, content and timing of institutional ethical approval.

Analytical / Application Questions

1. You plan to interview employees about weaknesses in their employer's financial controls. Identify the principal ethical risks and design proportionate safeguards.
2. A sponsor asks to remove findings that could damage its reputation. Analyse the conflict and propose a governance arrangement that protects research independence.
3. You have a small dataset containing company size, location, job title and unusual transaction values. Explain how a participant might be re-identified and recommend a publication strategy.

Multiple Choice Questions with Answers

Question 1

Which statement best distinguishes anonymity from confidentiality?

A. Anonymity means data are encrypted, while confidentiality means data are deleted.

B. Anonymity means identity cannot reasonably be linked to data, while confidentiality concerns controlling access.

C. Anonymity applies only to online surveys, while confidentiality applies only to interviews.

D. Anonymity requires institutional approval, while confidentiality does not.

Correct Answer: B. Anonymity means identity cannot reasonably be linked to data, while confidentiality concerns controlling access.

Question 2

Which action is an example of fabrication?

A. Correcting a transcription error and documenting the correction

B. Removing a direct identifier from a transcript

C. Inventing interview participants who were never recruited

D. Reporting a limitation in the sample

Correct Answer: C. Inventing interview participants who were never recruited

Question 3

A researcher changes the analysis method after seeing an unexpected result but does not disclose the change. What is the principal integrity concern?

A. The researcher has necessarily committed fabrication

B. The researcher may be engaging in selective or undisclosed analytical reporting

C. The researcher has protected confidentiality

D. The researcher has obtained informed consent

Correct Answer: B. The researcher may be engaging in selective or undisclosed analytical reporting

Question 4

Which is the most appropriate response to a relevant financial conflict of interest?

A. Keep it private unless the results are controversial

B. Disclose it and implement a proportionate management plan

C. Transfer all raw data to the sponsor

D. Remove the conflict from the reference list

Correct Answer: B. Disclose it and implement a proportionate management plan

Question 5

What is the main purpose of data minimisation?

A. To collect as many variables as possible for future use

B. To ensure every dataset is publicly available

C. To collect only data necessary for the specified research purpose

D. To eliminate the need for data security

Correct Answer: C. To collect only data necessary for the specified research purpose

Question 6

Which statement about informed consent is most accurate?

A. A signed form always proves that consent was ethically valid

B. Consent is a voluntary process based on adequate information and understanding

C. Consent is unnecessary when a researcher has a strong academic reason

D. Consent cannot be withdrawn after an interview begins

Correct Answer: B. Consent is a voluntary process based on adequate information and understanding

Question 7

Which practice is generally most responsible when using generative AI in a dissertation?

A. Uploading identifiable interview transcripts to a free public tool

B. Accepting all generated references without checking them

C. Verifying outputs, protecting confidential data and following institutional disclosure rules

D. Listing the AI system as the sole author

Correct Answer: C. Verifying outputs, protecting confidential data and following institutional disclosure rules

Question 8

Why should ethical approval normally be obtained before data collection?

A. To guarantee that the research will produce significant results

B. To allow risks and safeguards to be assessed before participants or restricted data are involved

C. To ensure the sponsor can control the conclusions

D. To replace the need for informed consent

Correct Answer: B. To allow risks and safeguards to be assessed before participants or restricted data are involved

Question 9

Which contribution most clearly supports authorship?

A. Providing office stationery

B. Making a substantial intellectual contribution and approving the final work

C. Being a senior manager who is interested in the topic

D. Allowing the researcher to use a public website

Correct Answer: B. Making a substantial intellectual contribution and approving the final work

Question 10

A dataset contains no names but combines a rare job title, location and unusual transaction amount. What risk remains?

A. Guaranteed anonymity

B. Deductive re-identification

C. Automatic plagiarism

D. Fabrication caused by aggregation

Correct Answer: B. Deductive re-identification