Their employers require them to sign a code of conduct.

They are usually paid more than the people affected by their work.

Computing systems are more complex than other engineered systems.

They hold expertise that others depend on and cannot readily check, which creates an asymmetry the profession has to answer for.

The company’s shareholders, because they carry the financial risk.

The development team, because they will be blamed if it fails.

The people the system will be used on, who are not represented in the decision and cannot opt out of it.

The regulator, because it will have to enforce the rules afterwards.

Values; Rules; Sanctions; Review.

Public Interest; Professional Competence and Integrity; Duty to Relevant Authority; Duty to the Profession.

General Ethical Principles; Professional Responsibilities; Professional Leadership Principles; Compliance with the Code.

Legal Obligations; Employer Obligations; Client Obligations; Public Obligations.

The professional has an obligation to report signs of system risk that might result in harm.

Reporting is discretionary, since no rule requires it.

The obligation falls on the employer rather than on the individual professional.

Reporting is required only if the developer caused the defect.

Both can be true: law sets a floor, and a practice can clear that floor and still be hard to defend.

The professional is mistaken, since ethics applies only where the law is silent.

The professional is mistaken, since legal compliance settles the ethical question.

Both cannot be true, because a professional code cannot require more than the law.