Information systems are an integral part of business today and the benefits are numerous. But, there is also a downside to the easy data access that IS provides. There are opportunities for invasion of privacy, as well as theft of data, money, and intellectual property (such as software and product designs). Harm can also be done by altering data or modifying software. Studies have cited the monetary loss to businesses as a result of the misuse of computers and computer fraud amounts to billions of dollars per year. A recent article in Fortune magazine reported how easily the security of a business information system was breached. The article noted that many companies do not report such problems to avoid harmful publicity. Information Week surveyed security managers and IS chiefs and found that nearly half of the 1,300 respondents suffered security-related losses.
Most of the research in IS ethics has concentrated on premeditated computer misuse and fraud and what preventive measures might be effective. However, the results discussed here explore situations where an employee's behavior is not blatantly criminal. Not everyone sets out to commit a computer crime or to do harm, but the extensive systems and computer networks available today sometimes put people in situations where they must make decisions with ethical implications. For example, an employee might be able to search through another person's computer files, which is somewhat like rummaging through someone else's desk. Is this acceptable behavior? What if the employee is looking for a spreadsheet, but the person who is responsible for the spreadsheet is out of the office? Is there any harm in locating the spreadsheet, making a copy, then using the spreadsheet? How should management respond? Another example is when an employee has access to sensitive information, such as personnel data, as a result of an error made when rights and restrictions were set by the network administer. Is the employee behaving unethically by viewing information he or she believes may have the right to see?
Because employees are often faced with making decisions where an ethical dilemma exists, we were interested in exploring opinions regarding: Was the behavior ethically acceptable? What influenced the ethical judgment? Using scenarios similar to these, we asked study participants whether a person's behavior was acceptable or unacceptable, and what factors influenced their judgment. The results of this study should give managers and supervisors some insight into employees' decisions when faced with ethical dilemmas.
What Might Influence Our Ethical Judgment?
One aim of this study, which is part of an ongoing research effort, was to determine whether factors could be related to judgments of what is ethically acceptable or unacceptable. The factors investigated in this study were derived from a number of sources that are summarized in Table 1. There were five possible influential environmental factors: individual, societal, belief system, legal, and professional. Everyone has an individual environment that consists of family and peers. Although there is no written standard of behavior within the individual environment, a person might ask "What would mom say?" when trying to decide if a particular behavior is acceptable. Two broader environmental influences are the society in which a person lives (social norms) and a person's religious community or belief system. The legal environment might be considered the codification of society's disapproval of certain behavior--laws that prohibit certain behavior and dictate punishment when it occurs. Another possible source of influence is the professional environment. Many professions develop a formal code of conduct; for some the code serves simply as a guideline, while other professions try to enforce their code through regulation and licensing.
In addition to environmental influences a person has internalized experiences, values, and perceptions which might collectively be called "personal values." A person's characteristics, such as gender, age, and education may also affect one's view of what is ethical [3, 6]. In earlier studies of ethics, differences in ethical decisions have been determined to be gender based . In addition to the possible influences on one's judgment, two other questions were asked in this study's survey. One was the degree to which one feels a moral obligation to take corrective action if a certain behavior occurred [2, 8]. The second question concerned whether the awareness of consequences for the behavior might alter the outcome . (For more detailed information on the survey, visit www.uark.edu/depts/cisqinfo/cronan/pchome.html).
The study was conducted at a midwestern university. The participants were 307 students in various IS classes. Many of the students had full-time work experience (55%), with an average of 2.2 years of experience. One hundred seventy-nine, or 58%, of the subjects were men and 128 were women. It is interesting to note that 42% of the subjects with full-time work experience said they had faced an ethical dilemma in their job (although this was not limited to IS-related situations).
There is information from this study that has practical significance for managers. Insight is given into what influences people's decisions when they are faced with an ethical dilemma and, perhaps of more practical importance, what might alter their behavior. The following discussion involves five scenarios and what respondents had to say about the behavior of the individual described . For each scenario percentages are given for the "unacceptable" and "acceptable" ethical judgments made by men and women. Overall, women were more likely to judge a behavior as unacceptable.
Scenario I: Is Making Unauthorized Program Modifications Acceptable?
Most of the study participants said making unauthorized program modifications was unacceptable and more women than men said so. Personal values were very influential in judging the programmer's behavior. Of those who said the behavior was unacceptable, 75% percent of the men and 86% of the women said personal values strongly influenced their judgment. For men, 64% also said the legal environment was very influential; for women, 63% said the professional environment was influential.
Subsequent discussions with students helped explain the judgments made about the scenarios. Some reasons students give for saying what the programmer did was okay are that "no one was hurt by what the programmer did" and "avoiding the overdraft charge is not really theft." A few students even admitted they would do the same thing, if they could be certain of not being caught. Many students said the risk of getting fired was not worth the small savings in overdraft charges. Such comments indicate that awareness of detective  security measures probably has some impact on people's behavior.
Scenario 2: Is it Okay to Keep Something You Didn't Pay For?
Men and women were less decisive in their judgment of a person who kept software that was not ordered or paid for, yet the majority still said this was unacceptable--55% of the men and 68% of the women. Seventy-six percent of the men and 80% of the women who decided this behavior was unacceptable said personal values was very influential in their decision. For 62% of the women, the belief system factor was also very influential in their judgment.
Many students argue that since the software company made the mistake (by sending the software), the person who received the software is not obligated to pay for it or send it back. Students often said they would do the same thing. The opposing view expressed was that the person should send the software back or at least notify the mail-order company of the error.
Scenario 3: Can I Use Company Resources on My Own Time?
The large majority of study participants approved of the programmer using company equipment on his own time. This was the only scenario for which the majority of people said the behavior was acceptable. Women were still slightly more conservative than the men. Eighty-four percent of the women said this behavior was acceptable while 89% of the men said it was acceptable. For this scenario no factor was determined to be very influential in helping the men make their judgment. A slight majority of women (53%) said the professional environment was very influential in their decision.
Comments from students generally indicated the programmer's behavior is acceptable--but with some qualifications. They felt the company has a responsibility to have clear policies for such things as using company resources for personal use. Many students also felt employees should make their manager aware of what they're doing, in case there are any objections or restrictions the manager wants to make. Although most students felt what the programmer was doing was fine, students said company policy forbidding such use would change their judgment.
Scenario 4: Do I Have to Pay for Programs I Use?
Using a program without paying the required fee was judged unacceptable by the majority of men and women (66% and 71%, respectively). Once again, personal values played a part the decision; a slight majority of the men (57%) said it was very influential, while more women (65%) were influenced by this factor. For many women (63%) the legal environment factor was also very influential.
This scenario often brought a mix of comments similar to scenarios 1 and 2. As in the first scenario, some students link what they would do in this case to how certain they would feel about not getting caught. Similar to the second scenario, many students argue that the company made an error in allowing access to the program, therefore it is fine to use the program, but they, personally, would not do so.
Scenario 5: I Have a Copy of the Data, Can't I Use it as I Wish?
This scenario had the biggest difference between men and women in terms of the percentage who decided this was unacceptable or acceptable. For men, copying data from a contract job was a marginal case with only 51% of the men stating the behavior was unacceptable. However, 72% of the women said this was unacceptable. Personal values were again very influential for those who said copying the data was unacceptable (70% of the men and 72% of the women). Men and women also relied on the legal environment factor (62% and 76%, respectively). For women the belief system and professional environment factors were also very influential (61% and 60%, respectively).
This scenario often brings up a wide range of comments from students. From a legal perspective, some students said copying the data was acceptable because it did not violate the terms of the contract for processing the data. Some students argued that any data collected by the government is available for public use, but others expressed concern about infringing on people's privacy. The scenario also introduces a complication for many students since the person who copied the data was told to do so by the boss. Some students said they would copy the data for their boss, even if they were unsure whether it was ethical to do so.
Moral Obligation and Knowledge of Consequences
The participants in this study were also asked whether they would feel morally obligated to take corrective action if they had knowledge of the behavior in the scenario. Based on the study results, the sense of moral obligation to take corrective action was indeed a significant indicator of a person's judgment of whether something was acceptable or unacceptable for every scenario. In other words, people who said they would feel an obligation to take corrective action most likely said the behavior as unacceptable.
Participants were also asked if knowing there were negative consequences, such as a reprimand or monetary fine, would affect what a person should or should not do. Perhaps the most useful information this study offers managers is the fact that both men and women indicated that an awareness of consequences for a behavior could alter how people behave. Even participants who said a behavior was acceptable said knowing there would be negative consequences should affect what people do. Therefore, management could very likely affect behavior by making a clear statement of policy and expectations--what behavior is unacceptable and what the consequences are for such behavior. As noted earlier, in discussions of the scenarios students said that businesses should have clearly stated policies and codes of behavior. For example, in Scenario 3, where the programmer uses company equipment on the weekends, students said businesses should state what behavior is expected and clearly articulate the restrictions. If a company does not want employees using company equipment for their personal use, the company should state this rather than rely on the employees' judgment. Otherwise, employees may see that as a perk of the job.
A stepwise regression analysis of the data for all the scenarios showed that men and women have different factors that influence their decision regarding unacceptable behavior. A summary of the influential factors are presented in Table 2, which shows what factors were significant in determining whether a person's judgment of a scenario would be "acceptable" or "unacceptable." The significant factors for women were societal environment, belief system, personal values, legal environment, moral obligation, and the scenario. The significant factors for men were legal environment, moral obligation, awareness of consequences, and the scenario. Exploring the influence a specific factor had on a person's judgment could indicate whether his/her decision was "ethically acceptable" or not. For example, 58% of the women who decided the behavior in the scenarios was unacceptable indicated the belief system factor had a strong influence on their judgment, yet 73% of the women who decided the behavior was acceptable said the belief system factor had moderate to no influence. Therefore, knowing how influential a woman says her belief system is can help determine her reaction to ethical dilemmas. The stronger the influence, the more likely she will judge questionable behavior as unacceptable. This type of information can contribute to our understanding of ethical decision making. In addition, the predictive power (R2) of each regression model (0.38 and 0.46, respectively) is statistically significant. This indicates that 38% and 46% of the acceptable/unacceptable decision is explained by the significant factors listed in Table 2 for men and women, respectively.
Most people said they were strongly influenced by their personal values when they make judgments about ethical issues. In all five scenarios personal values were very influential for the majority of participants. This is not a surprising finding. In addition, there are other influential factors that affect ethical decision making, depending on the particular scenario, or ethical issue, involved. Other results of this study have practical implications for managers and organizations. The results lend support for a plan by management to formulate, implement, and enforce codes of conduct for personnel, thereby enforcing ethical standards.
Men and women were distinctly different in their assessment of what is ethical and unethical behavior. For all scenarios, men were less likely to consider a behavior as unethical. Moreover, their judgment was most often influenced by their personal values and one environmental cue--whether the action was legal. Women were more conservative in their judgements and considered more environmental cues, as well as their own personal values.
Clearly, the results of this study have implications for managers and organizations. The results provide insight into differences in what might influence the ethical judgments of male and female employees. From the manager's viewpoint, men may be influenced more effectively through statements of what is legal (or not) and what the consequences of certain behavior would be. Women might be effectively influenced by passive deterrents (policy statements and awareness training of unacceptable ethical behavior).
In addition to preventive measures, such as policy statements, managers could utilize deterrent and detective measures  if they are concerned with employees' misuse of information technology. The knowledge that detectives are used and there are consequences for detected misuse will likely have an impact on how people behave. Nonetheless, further research is warranted. A better understanding of the ethical behavior of personnel and the specific factors that affect ethical behavior are important in order to develop guidelines for management to curb the problem of unethical behavior in the use information systems.
Table 1. Factors proposed to influence ethical decision making Factor Description Environment Societal Social/cultural values. What does society say should be done? Belief system Religious values and beliefs from one's spiritual or religious environment. What does one's church/religion say? Individual Significant others; peer group. What does morn or my close friend say? Professional Codes of conduct and professional expectations. What does my profession say? Legal Law and legasl issues. What does the law say? Business Corporate goals and profit motive. What does my company and the "bottom line" say? Personal values One's internalized, value and experiences. What do I say? Characteristics of Gender, age, education, or the individual experience, etc. Moral obligation A feeling of responsibility or obligation. Awareness of Association of behavior with outcomes. consequences Ethical issue (scenario) Ethical issue involved, such as privacy, ownership, accuracy, etc. Scenario 1 A programmer modifies a bank's accounting system to hide his overdrawn account and avoid the overdraft charge. After making a deposit, the programmer corrects his modification. Unacceptable Acceptable Men 82% 18% Women 93% 7% Scenario 2 A person received software ordered from a mail-order company but also finds another software package sent in error. The extra software was not listed on the invoice. The person keeps the program and does not pay for it. Unacceptable Acceptable Men 55% 45% Women 68% 32% Scenario 3 A programmer uses company equipment to write program for his friends on his own time on weekends. Unacceptable Acceptable Men 11% 89% Women 16% 84% Scenario 4 A person who was inadvertently given access free of charge to a proprietary program uses it without paying the fee. Unacceptable Acceptable Men 66% 34% Women 71% 29% Scenario 5 A company employee contracts with a government agency to process data involving information about children and their parents. The employee copies the date at the boss's request. The job contract does not prohibit this. Unacceptable Acceptable Men 51% 49% Women 72% 28% Factor Men Women Societal environment (1) * Belief system (1) * Individual environment (1) Professional environment (1) Legal environment (1) * * Business environment (1) Personal values (1) * Moral obligation * * Awareness of consequences * Scenario (ethical issue) * * R (1) 0.38 0.46 N 864 631 * Significant at the 0.10 level. (1) Subjects assessed the extent of the factor's influence from "none" to "great"
(1.) Ajzen, I., and Fishbein, M. Undertaking Attitudes and Predicting Social Behavior. Prentice-Hall, Engelwood Cliffs, NJ, 1980.
(2.) Beck, L and Ajzen, I. Predicting dishonest actions using the theory of planned behavior, J. Research in Personality 25, (1991), 285-301.
(3.) Bommer, M., Gratto, C., Gravander, J., and Tuttle, M. A behavioral model of ethical and unethical decision making. J. Business Ethics 6, (May 1987), 265-280.
(4.) Dejoie, R. Fowler, G. And Paradice, D. Ethical Issues in Information Systems. Boyd and Fraser Publishing, Boston, MA., 1991.
(5.) Jones, T.M. Ethical decision making by individuals in organizations: An issue-contingent model. Acad. Manage. Rev. 16. 2 (1991), 366-395.
(6.) Loch, K.D. and Conger, S. Evaluating ethical decision making and computer use. Commun. ACM 39, 7, (July 1996), 74-83.
(7.) Rest, J.R. Development in Judging Moral Issues. University of Minnesota Press, Minneapolis, Minn., 1979.
(8.) Schwartz, S.H. and Tessler, R.C. A test of a model for reducing measured attitude-behavior discrepancies. J. Personality and Social Psychology 24,2 (1972), 225-236.
(9.) Straub, D.W. and Nance, W.D. Discovering and disciplining computer abuse in organizations: A field study. MIS Q. 14, 1, (Mar. 1990), 45-58.
(10.) Trevino, L.K. Ethical decision making in organizations: A person-situation interactionist model. Acad. Manage. Rev. 11, 3, (July 1986), 601-617.
(11.) Victor, B., and Cullen, J.B. The organizational bases of ethical work climate. Admin. Sci. Q. (Mar. 1988), 101-125.
JENNIFER KREIE (firstname.lastname@example.org) is an assistant professor in Business Computer Systems at New Mexico State University, in Las Cruces.
TIMOTHY PAUL CRONAN (email@example.com) is a professor of Computer Information Systems and Quantitative Analysis at the University of Arkansas, Fayetteville.