Professional Ethics and Legal Requirements in risk governance refers to the binding obligations — both ethical and legal — that a CRISC-certified or aspiring risk professional must uphold in their practice. Ethically, these obligations are codified in the ISACA Code of Professional Ethics and center on four mandatory principles: integrity (honest and trustworthy conduct), objectivity (unbiased, evidence-based judgment), confidentiality (protecting sensitive information entrusted to you), and competency (maintaining current knowledge and skills). Legally, these obligations arise from the regulatory environments in which the professional operates — securities law, data privacy law, whistleblower protection statutes, sector-specific regulations — and can create personal civil or criminal liability. Together, these obligations define the floor of acceptable professional conduct, not aspirational ideals. This competency concerns the personal and professional accountability of the individual risk practitioner — distinct from organizational governance structures, specific regulatory content, or policy design.
Where it stops · what it isn't
- —IS: The four ISACA ethical principles (integrity, objectivity, confidentiality, competency) as mandatory personal obligations enforceable through ISACA's disciplinary process
- —IS: Personal legal liability exposure of individual risk professionals under applicable law (SOX 906, GDPR, whistleblower statutes, duty-of-care doctrine)
- —IS: Systematic reasoning through ethical dilemmas, conflicts of interest, and escalation decisions
- —IS: Documentation requirements to evidence competent professional judgment
- —IS NOT: A comprehensive catalogue of regulations by jurisdiction — that belongs to domain-specific regulatory knowledge cubelets
- —IS NOT: Organizational governance structures or the Three Lines of Defense model — covered in the Enterprise Risk Management cubelet
- —IS NOT: Policy design to implement legal requirements — covered in the Policies, Standards, and Business Processes cubelet
- —IS NOT: An audit methodology or technical risk assessment process
Connected concepts in the graph
Every cubelet sits in a knowledge graph. Here's what this one connects to.
PART OFcrisc-d1-governance-domain
ENABLEScrisc-d1-governance-policies-standards-business-processescrisc-d1-governance-enterprise-risk-management-three-lines-of-defense
REQUIREScrisc-d1-governance-risk-assessment-concepts-standards-frameworks
RELATED TOcrisc-d1-governance-organizational-structures-roles-responsibilities
CONSTRAINScrisc-d2-it-risk-assessmentcrisc-d3-risk-response-and-reporting