A regional bank's code of conduct forbids gifts above $100. Its sales incentive plan pays a 40% bonus for hitting quarterly volume targets. Both documents were board-approved. The exam expects you to see that the second one quietly repealed the first.
At the organizational level, ethics is a system with owners, inputs, and outputs. It is not the sum of employees' private morals. The exam tests whether you can locate the failure point in that system.
The working parts are: a code of conduct (the written statement of expected behavior), tone at the top, incentive and performance structures, hiring and vendor screening, training, a reporting channel, investigation procedures, and consistent discipline. Together they carry the ethical, legal, and compliance requirements that apply to an organization, and a weakness in any one part degrades the whole.
KEY: Incentives beat policy every time. When a stem gives you both a strong written code and a compensation plan that rewards the prohibited behavior, the ethical culture is weak.
Common mistakes
- Treating legal compliance as sufficient. A practice that violates no statute can still breach stated values and harm stakeholders. That is an ethics finding, reported to the audit committee.
- Reading low hotline volume as strength. Three reports across 4,000 employees signals a broken or distrusted channel, never a clean culture.
- Putting internal audit in the owner's seat. Management owns the ethics program, the board oversees it, internal audit assures it. Answer choices where internal audit writes the code or decides discipline are distractors.
Bottom line
- Requirements come from four sources: legal and regulatory, contractual, internal policy, and voluntary ethical standards; each carries a different consequence for breach.
- Lawful conduct and ethical conduct are separate sets; an act can satisfy every statute and still be an ethics finding.
- Ownership split: management owns the ethics program, the board oversees it, internal audit assesses and assures it.
- Red flags: outcome-only incentives, uncovered third parties, near-zero or collapsing hotline volume, inconsistent discipline, frequent policy waivers, and management override.
Exam shortcut
Sort every stem by source first. "Regulator," "statute," "license" means compliance. "Agreement," "covenant," "service level agreement (SLA)" means contractual. "Code," "policy," "procedure" means internal. "Values," "commitment," "reputation" means ethics. The consequence named in the answer choices must match the source you identified. When the stem says "no law was broken," expect the correct answer to still be a finding.
The full lesson (about 2,545 words, 17 min read) adds 2 worked examples, all 6 common mistakes, a self-check, free in the app.
Learning objectives
- 3
Browse all free CIA Part 1 lessons or jump into free CIA Part 1 practice questions.