IT Governance, Accountability and Ethical Decision-Making

Introduction and Context

Information technology is no longer merely an operational support function. Digital platforms, data assets, algorithms, cloud services and cybersecurity capabilities influence an organisation’s revenue, reputation, legal exposure, resilience and social impact. Consequently, technology decisions must be governed with the same seriousness as financial, investment and strategic decisions.

IT governance is the system by which an organisation directs and controls information and technology. It establishes who has authority, how decisions are made, how performance and risk are monitored, and how the organisation remains accountable to stakeholders. Governance is broader than management: governance determines direction, approves boundaries and exercises oversight, whereas management plans, builds, operates and monitors technology within those boundaries.

For postgraduate IT professionals, governance is important for at least four reasons. First, technology decisions frequently create obligations under privacy, cybersecurity, intellectual-property, employment and sector-specific laws. Second, technology risk is often distributed across suppliers, subsidiaries, cloud providers and automated systems. Third, technical expertise does not itself resolve ethical questions involving fairness, autonomy, transparency or harm. Fourth, boards and senior executives increasingly require evidence that technology investments produce value while remaining controlled and defensible.

This chapter develops the relationship among governance, accountability, fiduciary and managerial responsibility, professional ethics, organisational policies, codes of conduct and board oversight. It also examines ethical decision-making through frameworks that can be applied to difficult technology cases.

Learning Objectives

After studying this chapter, the reader should be able to:

1. Distinguish IT governance from IT management and explain their relationship.
2. Analyse fiduciary, managerial, professional and operational accountability in technology decisions.
3. Apply recognised governance principles and accountability models to organisational situations.
4. Evaluate technology decisions using ethical theories, stakeholder analysis and structured decision processes.
5. Explain how policies, codes of conduct, controls, reporting and board oversight support responsible technology.
6. Critically assess governance challenges involving cloud computing, artificial intelligence, data and third-party providers.

1. Foundations of IT Governance

1.1 Governance and management

Governance concerns the exercise of authority and accountability. It asks questions such as:

• What outcomes should technology support?
• Which risks are acceptable?
• Who has the authority to approve a major system or data use?
• What information must be reported to the board?
• How can stakeholders challenge or obtain redress for harmful decisions?

Management concerns execution. It translates approved direction into portfolios, architectures, projects, services, controls and operational activities. Governance without competent management produces policies that are not implemented. Management without governance can produce technically effective systems that are strategically misaligned, unlawful or ethically unacceptable.

A useful distinction is:

Governance is not synonymous with bureaucracy. Effective governance should make important decisions clearer, assign responsibility before action occurs, and create proportionate evidence that decisions were reasonable.

1.2 The governance objective

A central governance objective is the responsible delivery of value from technology. Value is multidimensional. It may include financial return, service quality, resilience, regulatory compliance, public trust, safety and social benefit. A project that reduces cost but creates unacceptable privacy or safety risks has not necessarily created value.

The widely used governance logic of value, risk and resources can be expressed conceptually as:

This is not an accounting equation and should not be treated as a precise financial calculation. It is a decision principle. Benefits and harms may be financial, legal, operational, social or ethical, and some cannot be reduced credibly to a common monetary unit.

1.3 Principles of sound IT governance

Although frameworks use different terminology, sound governance commonly includes the following principles:

Strategic alignment. Technology priorities should support organisational purpose and strategy rather than follow novelty or vendor pressure.

Value realisation. Investments should have defined benefits, owners, measures and post-implementation review.

Risk optimisation. Risks should be identified, assessed, treated and accepted by an appropriately authorised person.

Resource stewardship. People, information, infrastructure, intellectual property and financial resources should be used efficiently and responsibly.

Performance transparency. Decision-makers should receive timely, accurate and sufficiently independent information.

Conformance. Activities should comply with applicable law, regulation, contracts, policies and ethical commitments.

Accountability. Responsibilities must be assigned to identifiable roles, with mechanisms for explanation, challenge, correction and consequences.

Stakeholder respect. Governance should consider customers, employees, communities, suppliers, regulators, shareholders and people affected indirectly by technology.

2. Governance Frameworks and Accountability Models

2.1 The governance system

Governance is best understood as a system rather than a committee. A governance system includes:

1. Objectives: desired organisational and stakeholder outcomes.
2. Authority: rights to approve, reject, escalate or intervene.
3. Processes: planning, investment, risk, architecture, change and incident processes.
4. Structures: board committees, executives, control functions and delivery teams.
5. Information: metrics, risk reports, audit evidence and management information.
6. Behaviour: leadership example, professional judgement and organisational culture.
7. Assurance: independent review, testing, audit and remediation tracking.

The system should operate across three levels. The board and senior leadership establish purpose, risk appetite and oversight. Executive management converts these into portfolios, policies and operating models. Operational teams design, acquire, secure and run technology.

2.2 The three-lines model

A practical accountability model separates responsibilities into three lines:

The model does not mean that the second or third line owns operational risk. A security office may define controls and monitor compliance, but the business and system owners remain responsible for the risks created by their services. Internal audit should not design or operate the controls it later audits, because that would impair independence.

2.3 RACI and the danger of collective responsibility

RACI is a responsibility-assignment technique:

• Responsible: performs the work.
• Accountable: owns the outcome and is the final decision authority.
• Consulted: provides input before a decision.
• Informed: receives relevant information after or during the decision.

A sound RACI assignment normally has one clearly accountable role for a decision, although several people may be responsible for activities. “The committee is accountable” can be inadequate if no individual has authority to act or answer for the result. Committees support judgement; they should not obscure ownership.

2.4 Accountability versus responsibility

Responsibility refers to a duty to perform an activity. Accountability refers to answerability for the outcome, including explanation and consequences. Authority must accompany accountability. Holding a system owner accountable while denying access to budget, data, staff or decision rights is defective governance.

Accountability also requires traceability. A defensible decision record should identify the decision, options considered, assumptions, evidence, risks, approvals, dissenting views, conditions and review date. Documentation is not a substitute for good judgement, but undocumented judgement is difficult to audit, learn from or defend.

3. Fiduciary, Managerial and Professional Duties

3.1 Fiduciary responsibility

Fiduciary responsibility arises where a person or body is entrusted with authority over the interests or resources of another. Its precise legal content varies by jurisdiction and organisational form, so legal advice may be necessary. In general, directors and equivalent governing officers are expected to act within authority, in good faith, with due care, and in the organisation’s interests while managing conflicts appropriately.

In technology, fiduciary concerns may arise when approving:

• major digital investments;
• cybersecurity budgets and resilience measures;
• outsourcing or cloud concentration;
• acquisition or monetisation of personal data;
• artificial-intelligence systems with material impact;
• technology projects whose risks are known but poorly reported.

A director does not need to be a software engineer to discharge oversight duties. However, a board should obtain competent advice, ask informed questions, understand material risks and avoid treating technology as an area exempt from scrutiny. Blind reliance on management or vendors is not a governance strategy.

3.2 Managerial responsibility

Managers are responsible for translating governance requirements into operational decisions. Their duties include setting objectives, allocating resources, maintaining competent teams, escalating material risks, ensuring controls operate, and stopping or changing work when evidence indicates unacceptable exposure.

A manager may not avoid accountability by stating that a supplier or technical team made the decision. Delegation transfers tasks and authority within limits; it does not automatically eliminate oversight. Contracts, service-level agreements and assurance reports can support oversight, but they do not transfer all organisational accountability to a vendor.

3.3 Professional responsibility

IT professionals have obligations that extend beyond an employer’s immediate commercial interest. Common professional values include competence, honesty, confidentiality, respect for privacy, avoidance of harm, fairness, independence of judgement and disclosure of conflicts. Professional codes from computing and engineering bodies differ in wording but generally reject deceptive conduct, reckless deployment and concealment of material risks.

A professional confronted with an unsafe or unlawful instruction should first clarify facts and raise the concern through appropriate channels. Escalation may involve a manager, security officer, privacy officer, ethics office, audit committee or regulator, depending on the issue and applicable law. Whistleblowing can be justified where serious harm or illegality is credible and internal remedies are ineffective, but it should be informed by legal protection, evidence preservation and personal safety considerations.

3.4 Conflicts of interest

A conflict occurs when personal, financial, relational or institutional interests could improperly influence judgement, or reasonably appear to do so. Examples include selecting a supplier owned by a relative, accepting valuable hospitality from a bidder, approving a system that benefits an executive’s private venture, or suppressing a risk report to protect a bonus.

Effective controls include disclosure, independent review, recusal, competitive procurement, segregation of duties, gifts registers and documented approval. A conflict is not necessarily misconduct; undisclosed or unmanaged conflict is the governance failure.

4. Ethical Decision-Making in Technology

Legal compliance is necessary but not sufficient. Law may be incomplete, ambiguous, slow to change or silent on an emerging practice. Ethical analysis asks what ought to be done, not merely what can be done without immediate legal penalty.

4.1 Ethical theories as complementary lenses

Consequentialism evaluates likely outcomes. A decision is ethically stronger when it produces greater overall benefit and avoids serious harm. Its weakness is that aggregate benefit can conceal injustice to minorities or vulnerable groups.

Deontological ethics emphasises duties, rights and principles. Consent, truthfulness, privacy and non-discrimination may constrain actions even where a favourable aggregate outcome is claimed. Its difficulty is that duties can conflict.

Virtue ethics focuses on character and practical wisdom. It asks what an honest, courageous, fair and responsible professional would do. This approach highlights culture and leadership but may provide less procedural certainty.

Justice and fairness approaches examine the distribution of benefits, burdens and opportunities. They are especially relevant to algorithmic decisions affecting employment, credit, education, healthcare or public services.

Care ethics emphasises relationships, vulnerability, dependence and contextual responsibility. It encourages decision-makers to consider the lived experience of people affected by technology rather than treating them as abstract data points.

These are not competing checklists with one universally correct answer. They expose different dimensions of a decision and can reveal that a technically feasible option is ethically unacceptable.

4.2 A structured ethical decision process

A practical process consists of eight stages:

1. Frame the decision. State what is being decided and why it matters.
2. Identify affected stakeholders. Include direct users, non-users, vulnerable groups, employees, suppliers and future stakeholders.
3. Establish facts and uncertainty. Separate verified evidence from assumptions and forecasts.
4. Identify duties and constraints. Consider law, contracts, professional obligations, policies, rights and safety.
5. Generate alternatives. Include postponement, limited deployment, human review, redesign and non-technology options.
6. Test consequences and fairness. Examine benefits, harms, distribution, reversibility, misuse and worst-case scenarios.
7. Decide, document and communicate. Record reasons, conditions, dissent and accountability.
8. Monitor and revise. Treat deployment as provisional where evidence is incomplete; provide appeal and remediation.

The “publicity test” is useful: would decision-makers be prepared to explain the decision accurately to affected people, an independent auditor or a responsible journalist? The test does not replace legal analysis, but discomfort may indicate hidden assumptions or weak justification.

4.3 Proportionality and precaution

Proportionality asks whether the objective is legitimate, whether the means are suitable, whether less intrusive means exist, and whether the benefits justify the burdens. Precaution is relevant where potential harm is serious and evidence is uncertain. It does not require eliminating all innovation; it requires safeguards, staged deployment, monitoring and a willingness to stop.

5. Policies, Codes and Controls

5.1 The policy hierarchy

Organisations should distinguish governance instruments by authority and specificity:

A policy should identify its owner, scope, mandatory requirements, exceptions process, enforcement, review cycle and relationship to law and contracts. A policy that simply says “protect data appropriately” may express intent but is not sufficient operational guidance without standards and procedures.

5.2 Codes of conduct

A code of conduct translates values into expected behaviour. It should address integrity, confidentiality, conflicts, respectful treatment, use of organisational resources, reporting concerns, retaliation, supplier interactions and responsible handling of data and systems. Codes are effective when leaders model them, training is scenario-based, reporting channels are trusted, investigations are fair, and consequences are consistent.

A code should not be used to shift organisational accountability onto individuals for structural failures. If a company rewards delivery at any cost, a statement about ethical behaviour will have limited credibility unless incentives, performance measures and escalation routes reinforce it.

5.3 Control design

Controls may be preventive, detective or corrective; manual, automated or hybrid; and administrative, technical or physical. Examples include approval thresholds, access reviews, segregation of duties, encryption, logging, vulnerability testing, incident response, vendor assurance and post-implementation review.

Control design should be risk-based. Excessive controls create workarounds and concealment; inadequate controls allow preventable harm. A control is meaningful only when it has an owner, defined operation, evidence, testing and remediation when it fails.

6. Board Oversight and Assurance

6.1 The board’s technology responsibilities

Boards do not normally manage servers, write code or approve routine configuration changes. They should, however, oversee whether technology supports strategy and whether material risks are understood and controlled. Questions for a board include:

• Which technology risks could materially affect viability, safety, reputation or compliance?
• What assumptions support management’s risk assessment?
• How dependent is the organisation on one provider, platform or key individual?
• Are incident response and business continuity capabilities tested?
• What personal or sensitive data is held, why is it needed, and how is it governed?
• How are automated decisions validated, monitored and challenged?
• What risks have been accepted, by whom and for how long?

A board should receive information that is concise but decision-useful. A dashboard with many green indicators can be misleading if metrics measure activity rather than control effectiveness.

6.2 Useful oversight indicators

Metrics should connect to outcomes. Examples include unresolved high-severity vulnerabilities by age, recovery-test results, percentage of critical suppliers with current assurance, access-review exceptions, material privacy incidents, control failures, audit-remediation age and model performance across relevant groups.

Metrics require interpretation. A decline in reported incidents may mean improved security—or reduced detection and reporting. Similarly, a high training-completion rate does not demonstrate ethical culture. Boards should examine trends, definitions, thresholds, confidence and management response.

6.3 Independent assurance

Assurance may include internal audit, external audit, penetration testing, privacy impact assessment, algorithmic impact assessment, red-team exercises, certification audits and independent review. Assurance should be proportionate to risk and sufficiently independent from the activity being assessed. Management remains responsible for remediation; assurance providers should not become substitute managers.

7. Applied Case: Automated Loan-Eligibility Platform

The following is a fictional illustrative case designed for academic analysis.

Background

Northbridge Credit Union plans to deploy an automated platform that predicts whether applicants should receive expedited approval for personal loans. The system uses application information, repayment history, transaction patterns and selected external data. Senior management expects lower processing costs and faster decisions.

Problem

Before deployment, the data science team discovers that approval rates differ significantly across neighbourhoods. The difference may reflect legitimate risk variables, historical discrimination in lending, proxy variables for protected characteristics, or data-quality problems. The vendor claims that the model is proprietary and refuses to disclose its complete feature set. The business sponsor argues that delaying launch will sacrifice competitive advantage.

Analysis

The board has fiduciary and oversight responsibilities because the platform may affect revenue, legal exposure, reputation and access to credit. The executive sponsor is accountable for the business outcome, while the model owner is responsible for technical operation and monitoring. Compliance, privacy and risk functions should provide challenge rather than assume ownership of the model’s consequences.

Ethically, consequentialist analysis considers faster service and potentially broader access, but also denial of credit and downstream hardship. A rights-based analysis asks whether applicants receive adequate notice, explanation and an opportunity to challenge an adverse decision. A fairness analysis examines whether error rates and approval outcomes are distributed unjustly. A professional analysis questions whether deployment without adequate validation is competent and responsible.

The vendor’s confidentiality claim does not eliminate the credit union’s accountability. Procurement should require sufficient information for validation, audit, incident response and regulatory compliance. If the model cannot be assessed, the organisation should not treat it as trustworthy merely because it performs well on a vendor-supplied benchmark.

Approach and solution

Northbridge establishes a conditional approval process:

1. Conduct a documented impact assessment covering legal, privacy, discrimination, security and operational risks.
2. Define permitted and prohibited data uses and test for proxy discrimination.
3. Validate performance on representative, current data rather than relying solely on historical accuracy.
4. Examine outcome and error-rate differences across relevant groups, recognising that fairness metrics can conflict and require contextual judgement.
5. Introduce human review for borderline or adverse cases and provide a meaningful appeal route.
6. Require vendor transparency, audit rights, incident notification and cooperation with investigations.
7. Begin with a limited pilot, predefined stop conditions and independent review.
8. Report material risks and unresolved limitations to the appropriate board committee.

Outcome

The pilot reveals data gaps affecting applicants with limited transaction histories. Northbridge pauses automated adverse decisions for those applicants, adds a manual review path and changes the data-retention design. The model is later used only to prioritise applications for review, not to make final adverse decisions without human oversight. Performance and fairness indicators are reviewed quarterly.

Learning points

The case demonstrates that governance is not a final approval ceremony. It is a continuing system of authority, evidence, challenge and correction. Vendor dependence does not transfer accountability. Ethical deployment requires attention to affected people, uncertainty, appeal and remedy—not simply predictive accuracy or cost reduction.

8. Contemporary and Emerging Issues

8.1 Artificial intelligence governance

AI intensifies existing governance challenges because models may be difficult to interpret, change as data changes, amplify historical patterns and operate at scale. Organisations should maintain an inventory of material AI systems, assign owners, classify impact, document data provenance, validate performance, monitor drift, secure models and establish human oversight appropriate to the use case.

Human involvement must be substantive rather than ceremonial. A reviewer who cannot understand, challenge or override an automated recommendation is not meaningful oversight. Governance should also address generative AI risks such as confidential-data disclosure, fabricated outputs, intellectual-property concerns, prompt injection, inaccurate advice and unclear accountability for content.

8.2 Cloud and third-party governance

Cloud adoption changes control boundaries but does not remove organisational responsibility. Governance should address concentration risk, data location, subcontractors, portability, exit planning, resilience, identity management, logging, service commitments, breach notification and independent assurance. A contract should be read alongside actual architecture and operating practice; contractual promises cannot compensate for an organisation that has not configured or monitored its environment properly.

8.3 Data governance and privacy

Data governance covers ownership, quality, classification, access, retention, lineage, sharing, disposal and permitted use. Privacy requires more than security. A system can be secure yet use data unfairly, without adequate purpose limitation or without respecting individual expectations and rights. Data minimisation, privacy by design, access controls, retention limits and impact assessments are governance mechanisms, not merely legal paperwork.

8.4 Resilience and sustainability

Boards increasingly consider operational resilience, climate-related disruption, energy consumption, electronic waste and the social consequences of digital exclusion. Responsible technology governance therefore includes continuity planning, recoverability, accessibility, inclusive design and lifecycle sustainability.

9. Challenges and Limitations

Governance frameworks cannot guarantee ethical outcomes. They may become compliance theatre if evidence is produced only to satisfy an audit. Responsibility matrices can oversimplify complex socio-technical systems. Ethical principles may conflict, and fairness metrics may produce different conclusions. Boards may receive incomplete information because bad news is filtered through organisational hierarchies. Independent assurance can also be constrained by limited expertise, budget or access.

There is no universal governance design. A regulated hospital, start-up, public agency and global platform require different structures and thresholds. Proportionality is essential, but it must not become an excuse for ignoring material risk. Governance should evolve as technology, law, business models and stakeholder expectations change.

10. Best-Practice Guidance

A mature technology governance programme should:

• align technology decisions with organisational purpose and stakeholder outcomes;
• assign one accountable owner for every material decision;
• match authority, resources and competence to accountability;
• distinguish ownership, oversight, assurance and execution;
• maintain current policies, standards, procedures and records;
• integrate legal, privacy, security, risk and ethical analysis early;
• require transparent treatment of conflicts and dissent;
• use independent assurance proportionate to impact and exposure;
• demand meaningful vendor accountability and exit options;
• test controls and resilience rather than relying on written claims;
• monitor outcomes, not merely activity completion;
• provide channels for challenge, appeal, reporting and remedy;
• ensure leaders’ incentives support responsible behaviour;
• review decisions after implementation and learn from failures.

Chapter Summary

IT governance directs and controls technology so that it creates sustainable value within acceptable legal, operational and ethical boundaries. Governance sets direction, authority, risk appetite and oversight; management executes approved decisions and controls operations. Effective governance requires strategic alignment, value realisation, risk optimisation, resource stewardship, conformance, transparency and accountability.

Accountability is answerability for outcomes and requires clear ownership, authority, traceability and consequences. Fiduciary duties require governing bodies to exercise informed and responsible oversight. Managers must implement controls, escalate material concerns and manage delegated authority. IT professionals must act competently, honestly and with regard for privacy, fairness, safety and the public interest.

The three-lines model, RACI assignments, policy hierarchies, codes of conduct and independent assurance help distribute and clarify governance responsibilities. Ethical decision-making supplements legal compliance through stakeholder analysis, consequence assessment, rights and duties, fairness, care, proportionality and precaution. Board oversight should focus on material technology risks, resilience, data, suppliers, AI and evidence of control effectiveness.

Contemporary systems—especially AI, cloud platforms and data-intensive services—require continuous governance rather than one-time approval. No framework eliminates judgement or guarantees ethical outcomes. Mature governance combines structure with professional courage, transparent evidence, meaningful challenge and willingness to correct or stop harmful technology.

Key Terms

Accountability: Answerability for decisions and outcomes, including explanation and consequences.

Board oversight: Direction, monitoring and challenge exercised by an organisation’s governing body.

Code of conduct: A formal statement of expected ethical and professional behaviour.

Conflict of interest: A personal, financial or institutional interest that could improperly influence judgement or appear to do so.

Control: A measure designed to prevent, detect or correct undesired events or outcomes.

Due care: The level of attention, competence and diligence reasonably expected in a situation.

Ethical decision-making: Structured evaluation of what ought to be done using values, duties, consequences and stakeholder interests.

Fiduciary responsibility: Duties arising from entrusted authority over another party’s interests or resources.

Governance: Direction, authority, accountability and oversight of organisational activity.

IT management: Planning, building, operating and monitoring technology within governance direction.

Proportionality: Matching the intrusiveness and burden of an action to its objective and expected benefit.

RACI: A responsibility-assignment model identifying Responsible, Accountable, Consulted and Informed roles.

Risk appetite: The level and type of risk an organisation is willing to accept in pursuit of objectives.

Stakeholder: A person or group that affects, is affected by or has an interest in a decision.

Three-lines model: A model separating operational risk ownership, specialist oversight and independent assurance.

Transparency: The availability of understandable information about decisions, assumptions, processes and outcomes.

Value realisation: The process of ensuring that expected benefits from an investment are achieved and sustained.

Vendor accountability: The requirement that suppliers meet agreed obligations and support organisational oversight without replacing the customer’s responsibility.

Review Questions

Short Answer Questions

1. Distinguish IT governance from IT management.
2. What are the three lines in the three-lines accountability model?
3. Explain the difference between responsibility and accountability.
4. Identify four principles of sound IT governance.
5. Why is legal compliance not sufficient for ethical technology decision-making?

Long Answer Questions

1. Explain how fiduciary, managerial and professional responsibilities interact in a major technology investment.
2. Discuss how a board can exercise effective oversight of cybersecurity and technology risk without managing technical operations.
3. Compare consequentialist, rights-based, virtue-ethical and fairness approaches to technology decisions.
4. Explain how policies, standards, procedures and codes of conduct combine to create an effective control environment.
5. Critically evaluate the claim that outsourcing technology transfers accountability to the supplier.

Analytical / Application Questions

1. An organisation wants to deploy an AI recruitment system that reduces processing time but produces lower selection rates for one demographic group. Apply the eight-stage ethical decision process and recommend governance conditions for deployment.
2. A chief information officer discovers that a critical cloud supplier has failed a resilience test, but the business sponsor wants the issue omitted from the board report before a major product launch. Analyse the accountability, fiduciary, professional and ethical issues and propose an escalation path.
3. Using RACI and the three-lines model, design an accountability arrangement for a customer-data platform involving a product team, privacy office, security office, procurement function, internal audit and board risk committee.

Multiple Choice Questions with Answers

Question 1

Which statement best distinguishes governance from management?

A. Governance performs routine technical operations, while management sets organisational purpose.

B. Governance sets direction and oversight, while management executes within approved boundaries.

C. Governance is concerned only with legal compliance, while management is concerned only with ethics.

D. Governance and management are identical terms for the same activities.

Correct Answer: B. Governance sets direction and oversight, while management executes within approved boundaries.

Question 2

In the three-lines model, who primarily owns and manages operational risk?

A. The first line

B. The second line

C. The third line

D. The external regulator

Correct Answer: A. The first line

Question 3

In a RACI assignment, the Accountable role is the role that:

A. Only receives information after a decision

B. Provides optional technical advice

C. Owns the outcome and has final decision authority

D. Performs every task personally

Correct Answer: C. Owns the outcome and has final decision authority

Question 4

Which is the strongest reason that vendor outsourcing does not eliminate organisational accountability?

A. Vendors never have contractual obligations.

B. The organisation remains responsible for the outcomes and risks of its delegated activities.

C. Cloud services cannot be monitored.

D. Outsourcing is always prohibited by law.

Correct Answer: B. The organisation remains responsible for the outcomes and risks of its delegated activities.

Question 5

Which ethical approach focuses primarily on duties, rights and principles?

A. Consequentialism

B. Virtue ethics

C. Care ethics

D. Deontological ethics

Correct Answer: D. Deontological ethics

Question 6

Which item belongs most appropriately in a defensible technology decision record?

A. Only the final decision, without alternatives

B. The decision, evidence, assumptions, risks, approvals and review conditions

C. A vendor’s marketing brochure without independent assessment

D. An undocumented verbal agreement

Correct Answer: B. The decision, evidence, assumptions, risks, approvals and review conditions

Question 7

A code of conduct is most effective when it is supported by:

A. Leadership example, trusted reporting, training and consistent consequences

B. A single annual email with no enforcement

C. Removal of all professional discretion

D. Confidentiality clauses that prohibit reporting concerns

Correct Answer: A. Leadership example, trusted reporting, training and consistent consequences

Question 8

Which board question best reflects effective technology oversight?

A. Which developer wrote each line of application code?

B. Can management explain the material technology risks, assumptions and control effectiveness?

C. Why are all technology projects required to use identical tools?

D. Can routine configuration decisions be transferred to the board?

Correct Answer: B. Can management explain the material technology risks, assumptions and control effectiveness?

Question 9

Why is human involvement in an automated decision system not necessarily meaningful oversight?

A. Humans cannot participate in technology governance.

B. A reviewer may lack the ability to understand, challenge or override the recommendation.

C. Automated systems never require review.

D. Human review always makes a decision unlawful.

Correct Answer: B. A reviewer may lack the ability to understand, challenge or override the recommendation.

Question 10

Which practice best reflects proportional and precautionary governance for a high-impact AI system?

A. Immediate full deployment based only on vendor claims

B. Permanent prohibition of all AI systems

C. A limited pilot with impact assessment, monitoring, stop conditions and appeal mechanisms

D. Deployment without documentation to preserve innovation speed

Correct Answer: C. A limited pilot with impact assessment, monitoring, stop conditions and appeal mechanisms