Skip to main content
Regulatory Council
green gradient background, "The Future of Application Security Is Already Here." and a read the report button.
Category: Ethics & Conduct

Ethical Values

Also known as: Moral Values, Values (ethics)
Simply put

Ethical values are the principles or standards that help people and organizations decide what is morally right or wrong. They reflect a shared sense of appropriate conduct, and often include ideas such as honesty, fairness, and treating others equally. They typically guide how individuals and communities choose to act and what outcomes they consider good or just.

Formal definition

Ethical values are broad, normatively grounded preferences concerning appropriate courses of action or outcomes that guide moral decision-making and behavior for individuals and communities. They express a sense of right and wrong and function as standards against which conduct is evaluated, commonly encompassing principles such as honesty, fairness, and equality. Ethical values are conceptually distinct from legal compliance: adherence to law is not equivalent to ethical behavior, and ethical standards may extend beyond, or occasionally diverge from, what regulation strictly requires. In a governance context, articulated ethical values often inform an organization's tone at the top, codes of conduct, and culture, though the specific content and application of such values are context-dependent and may vary across jurisdictions, cultures, and organizations.

Why it matters

Ethical values matter because they shape conduct in situations that rules alone cannot fully anticipate. Adherence to law is not equivalent to ethical behavior; ethical standards may extend beyond, or occasionally diverge from, what regulation strictly requires. Because compliance frameworks cannot foresee every circumstance, an organization's shared sense of what is right and wrong often fills the gaps, guiding decisions where written policy is silent or ambiguous.

In a governance context, articulated ethical values typically inform an organization's tone at the top, its code of conduct, and its broader culture. When values such as honesty, fairness, and equality are clearly expressed and consistently reinforced by leadership, they can help align individual behavior with the organization's stated standards. This connection between values and conduct is one reason many governance frameworks treat ethical values as foundational rather than incidental.

At the same time, the specific content and application of ethical values are context-dependent and may vary across jurisdictions, cultures, and organizations. What is treated as appropriate conduct in one setting may be understood differently in another, so organizations generally cannot assume that a single articulation of values will translate uniformly across all environments in which they operate.

Who it's relevant to

Boards and Senior Leadership
Because articulated ethical values often inform an organization's tone at the top, boards and executives are central to how values are expressed and reinforced. Their conduct and stated priorities signal which standards the organization treats as appropriate, shaping culture beyond what formal rules require.
Compliance and Ethics Officers
Ethical values are conceptually distinct from legal compliance, and professionals in these roles work at the intersection. They typically help translate values such as honesty, fairness, and equality into codes of conduct while recognizing that ethical standards may extend beyond, or occasionally diverge from, what regulation strictly requires.
General Counsel and Legal Advisors
Because adherence to law is not equivalent to ethical behavior, legal advisors often navigate situations where legal requirements and ethical expectations do not fully align. Understanding this distinction supports advice that accounts for both binding obligations and broader standards of appropriate conduct.
Governance and Culture Practitioners
Those responsible for organizational culture rely on ethical values as a foundation for shared expectations of conduct. Given that the specific content and application of such values are context-dependent and may vary across jurisdictions, cultures, and organizations, these practitioners must consider how values will be interpreted in the settings where the organization operates.

Inside Ethical Values

Integrity
The expectation that individuals and the organization act honestly and consistently with stated principles, forming a foundational element of ethical values within many governance frameworks.
Tone at the Top
The commitment and behavior demonstrated by the board and senior management, which in many governance models signals the organization's ethical priorities and influences conduct throughout the entity.
Code of Conduct
A documented articulation of the standards of behavior expected of personnel, often used to translate abstract ethical values into observable expectations. Content and enforceability typically vary by organization and jurisdiction.
Accountability
The assignment of responsibility for decisions and actions, and the mechanisms by which individuals answer for adherence to ethical expectations. This element frequently spans the governance and compliance pillars.
Standards of Conduct
The behavioral norms an organization adopts, which may draw on external requirements as well as voluntary commitments. These often inform both governance oversight and compliance monitoring.

Common questions

Answers to the questions practitioners most commonly ask about Ethical Values.

Are ethical values the same as compliance with laws and regulations?
No. Compliance concerns adherence to external laws, regulations, and internal policies, whereas ethical values are the underlying principles and standards of conduct that guide behavior and decision-making. An action can be legally compliant yet still conflict with an organization's stated ethical values, and conversely some ethical commitments extend beyond what any law requires. In many governance frameworks, ethical values are treated as part of the control environment or organizational culture that supports, but is not reducible to, the compliance function. Where a specific behavior's legality is in question, that is a matter for legal interpretation rather than ethical judgment alone.
Does having a written code of conduct mean an organization's ethical values are effectively established?
Not necessarily. A documented code of conduct is often the formal articulation of ethical values, but the existence of such a document does not by itself demonstrate that those values are understood, embraced, or applied in practice. Many governance frameworks distinguish between stated values and the operating culture, sometimes described as the difference between espoused and enacted values. Assessing whether ethical values are effective typically involves looking at leadership behavior, decision-making patterns, and how conduct is reinforced, rather than the presence of a document alone.
Where do ethical values fit within a governance and control structure?
Ethical values are commonly positioned within the governance pillar as a foundational element of organizational culture and, in several internal control frameworks, as part of the control environment that underpins other controls. Because culture influences how risks are perceived and how compliance obligations are treated, ethical values can legitimately span more than one GRC pillar. Responsibility for setting the ethical tone is often attributed to the board and senior management, sometimes described as 'tone at the top,' though reinforcement typically depends on managers and staff throughout the organization.
How might an organization reinforce ethical values beyond publishing them?
Reinforcement often involves consistent leadership modeling of the stated values, integrating expectations into hiring, performance, and reward processes, providing channels for raising concerns, and responding consistently when conduct falls short. Many frameworks note that incentives and disciplinary practices signal what an organization truly values, sometimes more powerfully than formal statements. The specific mechanisms appropriate to any given organization vary by sector, size, and jurisdiction, and this description reflects common convention rather than a binding requirement.
How can ethical values be assessed or monitored over time?
Assessment approaches often combine multiple sources of evidence rather than relying on a single metric. These may include culture or ethics surveys, analysis of conduct-related concerns raised through reporting channels, review of decisions where values were tested, and observation of leadership behavior. Because ethical values concern conduct and perception, they are typically evaluated qualitatively as well as through indicators, and results should be interpreted with an awareness of their limitations. Any specific measurement method should be validated against the organization's own context and objectives.
What is the relationship between ethical values and risk management?
Ethical values can influence how uncertainty is identified, escalated, and treated, since a culture that supports candor may surface risks earlier, while one that discourages it may obscure them. Some risk frameworks recognize conduct or ethics-related exposures as a category of risk in their own right. However, ethical values are not themselves a control that modifies a specific risk in a measurable way; they form part of the environment in which controls operate. Organizations should avoid treating stated values as an assurance that misconduct or compliance failures cannot occur.

Common misconceptions

Ethical values are the same as legal compliance.
Compliance concerns adherence to external laws, regulations, and internal policies, whereas ethical values concern broader principles of conduct. An action may be lawful yet inconsistent with an organization's stated ethical values, and the two are not interchangeable, though they frequently overlap.
Publishing a code of conduct guarantees ethical behavior.
A documented code articulates expectations but does not by itself ensure conduct. In many frameworks, ethical values are reinforced through tone at the top, accountability mechanisms, and ongoing reinforcement rather than documentation alone.
Ethical values are solely a governance matter for the board.
While tone at the top is typically a governance responsibility, ethical values often span governance, risk, and compliance, influencing risk culture and compliance behavior at all levels of an organization.

Best practices

Establish and visibly demonstrate tone at the top, so that board and senior management behavior reinforces stated ethical values rather than relying on documentation alone.
Articulate expected standards in a code of conduct and review it periodically to keep it aligned with the organization's values, applicable requirements, and operating context.
Distinguish ethical expectations from legal compliance obligations in communications, so personnel understand that lawful conduct and ethical conduct are related but not identical.
Define accountability mechanisms that assign responsibility for adherence and provide a means for individuals to answer for their conduct.
Reinforce ethical values through recurring communication and awareness efforts rather than treating publication of a code as a one-time exercise.
Where the application of ethical values to a specific situation is unclear or carries legal implications, seek qualified professional or legal advice, as interpretation can be context-dependent.
Promotional banner for the Penetration Report Template Kit