3.2 ASQ Code of Ethics, Due Care & Confidentiality

3.2 ASQ Code of Ethics, Due Care & Confidentiality

/practice/cqaPractice questions with detailed explanations

Why ethics is scored on CQA (BoK I.E.1 — Apply)

Quality audits influence supplier selection, certification status, product release confidence, and regulatory posture. An auditor who is technically skilled but ethically weak creates false assurance—the most dangerous audit outcome. ASQ therefore tests professional conduct as applied judgment: what you do when incentives pull you toward silence, spin, or shortcuts.

The ASQ Code of Ethics (published by ASQ for members and professional conduct expectations) emphasizes themes you should be ready to apply:

• Be honest and transparent in professional work.
• Avoid conflicts of interest and misrepresentation.
• Do not harm others; treat people with respect and dignity.
• Protect public health, safety, and welfare when professional decisions affect them.
• Work within your competence; improve skills continuously.
• Respect confidentiality of information obtained in professional roles.

CQA does not require you to recite the Code word-for-word. It requires you to choose the ethical action when a stem presents pressure.

---

Ethical pillars mapped to auditor behavior

---

Due care and due diligence

Exam language often pairs due care with due diligence. Use them precisely.

Due care

Due care is the professional standard of performing work with the care, skill, and diligence that a reasonably competent auditor would use in similar circumstances. It is about how you work:

• Adequate preparation against criteria and process risk.
• Sufficient sampling and evidence for the conclusions you draw.
• Clear working papers that support findings.
• Timely communication of critical issues.
• Staying within competence or obtaining help.

Skipping high-risk process observation because the team wants an early flight is a due care failure—even if no one notices that day.

Due diligence

Due diligence is the investigative thoroughness used to gather and evaluate facts before relying on them. In audit contexts it often appears as:

• Verifying a claim with records and observation, not accepting management assertions alone.
• Following a trace when a discrepancy appears rather than stopping at the first convenient answer.
• Checking whether a correction was implemented before closing a follow-up.

Relationship: Due diligence is often how you exercise due care when facts are uncertain. Saying “I used due care” while accepting unsupported verbal claims is hollow.

Mini-scenario

An auditee states CAPA #442 is complete. Due diligence means reviewing the CAPA file, effectiveness check, and a sample of post-change records—not checking a box because the manager nodded. Due care means allocating enough time and competence to that verification relative to risk.

---

Confidentiality

Auditors see proprietary process parameters, customer lists, complaint data, personnel issues, and draft findings. Confidentiality means you use that information only for the audit purpose and disclose it only to those authorized by the engagement rules (client, auditee management as appropriate, audit program channels, legal/regulatory pathways when required).

Practical rules:

1. Do not share draft findings with unauthorized employees “just to get their reaction.”
2. Do not post audit photos of product or documents on personal social media.
3. Secure notes, laptops, and sample printouts; return or destroy per agreement.
4. Be careful in public spaces (airports, hotel lobbies) discussing supplier names and failures.
5. Honor NDAs and site IT rules for data export.

Confidentiality is not absolute secrecy from the client. The client commissioned the audit and generally receives the report. Confidentiality limits unauthorized disclosure and misuse—not professional reporting through the agreed channel.

Confidentiality vs. safety/legal duty: If you discover an imminent hazard or illegal act, ethical and often legal duties to escalate may override a preference for silence. You still escalate through appropriate channels (lead auditor → client/management → regulatory pathways as required)—you do not broadcast recklessly, and you do not bury the issue to protect a relationship.

---

Conflict of interest

A conflict of interest exists when a personal, financial, or organizational relationship could compromise—or appear to compromise—impartial judgment.

Common conflict patterns

Apply sequence on the exam

1. Recognize the conflict (or appearance of conflict).
2. Disclose to the lead auditor / audit program / client as appropriate.
3. Manage—reassign, add oversight, or withdraw.
4. Document the decision.

Hiding a conflict “because I can still be fair” fails both ethics and credibility. Objectivity in your own mind is not enough when appearance is damaged (see 3.4).

---

Illegal activities and unsafe conditions

BoK I.E.1 explicitly includes auditor response when audits reveal illegal activities or unsafe conditions. This is a classic case-study theme.

Unsafe conditions

If the team observes an imminent danger (unguarded machinery with active exposure, chemical spill, blocked egress, lockout violation in progress):

1. Protect people first—stop the observation line if needed; alert area supervision immediately.
2. Notify the lead auditor and auditee management through the agreed escalation path.
3. Document what was observed (objective facts, time, location, witnesses).
4. Do not continue “politely ignoring” the hazard to protect the audit schedule.
5. Reflect related system weaknesses in findings when criteria support them (e.g., safety procedure not followed, emergency preparedness ineffective)—without turning every audit into an unplanned full EHS audit unless scope allows.

Illegal activities

Examples: deliberate falsification of quality records, knowing shipment of nonconforming regulated product, bribery, environmental dumping contrary to law.

Auditor response principles:

• Stick to objective evidence; do not accuse beyond what evidence supports.
• Escalate immediately to the lead auditor; the lead engages client and auditee leadership per severity and program/legal requirements.
• Preserve evidence integrity (do not alter originals; note chain of custody for critical documents when relevant).
• Understand that some industries have mandatory reporting pathways; auditors follow organizational and legal counsel guidance—not freelance public whistleblowing as the first step—while still refusing to conceal.
• Never accept a bribe or agree to omit a material illegal finding in exchange for access or hospitality.

Exam trap: Choosing “say nothing until the final report next month” when there is imminent harm. Timely escalation is part of ethical due care.

---

Pressure scenarios (apply the Code)

Scenario A — Soft finding request: Plant manager offers premium seats at a sporting event if the team “keeps the report clean.” Action: Refuse the gift, document the offer, inform the lead/program, continue evidence-based reporting. Hospitality that could influence judgment is a conflict vector.

Scenario B — Competence stretch: You are assigned alone to audit software validation with no software background. Action: Raise competence gap; request a technical expert or reassignment. Accepting anyway without support violates competence and due care.

Scenario C — Confidential leak: A teammate emails draft supplier audit findings to a personal friend at a competitor “for industry benchmarking.” Action: Stop the disclosure, notify the lead, follow program disciplinary and client-notification rules. Confidentiality breach is an ethics failure with legal risk (section 3.3).

Scenario D — Record falsification signs: Multiple operators describe being told to backdate training forms before the audit. Action: Gather objective evidence carefully, escalate to lead, treat as potential serious integrity issue—not as a joke or “normal pre-audit scramble” to ignore.

---

Ethics vs. consulting boundary

During audits, auditees often ask “What should we do?” Ethical auditors:

• May clarify criteria and the nature of the nonconformity.
• Should avoid designing the solution they will later re-audit, especially in third-party contexts where impartiality rules are strict.
• Internal auditors may have more coaching latitude under program rules—but still must not trade favorable findings for influence.

When in doubt on the exam: prioritize independence, honesty, and public welfare over being helpful or popular.

---

Common traps

Key Takeaways

• Live the ASQ ethics themes: honesty, impartiality, competence, confidentiality, respect, and public welfare.
• Due care is professional diligence in method; due diligence is thorough fact-finding before reliance.
• Disclose and manage conflicts; do not self-certify your own objectivity in secret.
• Protect information; escalate illegal or unsafe issues through proper channels without delay when harm is imminent.
• Refuse influence (gifts, threats, favors) that would trade integrity for comfort.