A-Level Revision Aid: This resource is designed to support your revision. Content may contain errors. If you find a discrepancy with your class teaching, your teacher is correct — please let us know at alevelrevise@scott.scottrix.co.uk.
Ethics, Technology and Society
Year 1 / ASYear 2 / A-LevelAQA
A* revision of ethics and technology for AQA 7127 (3.18, 3.1): the five fundamental ethical principles, threats and safeguards, creative accounting and its stakeholder impacts, accounting software, spreadsheet modelling and data security under UK GDPR.
🎯 Learning Objectives
Explain the five fundamental ethical principles - integrity, objectivity, professional competence and due care, confidentiality, professional behaviour - and apply them to scenarios (AQA 7127, 3.18) (AO1/AO2).
Analyse techniques of creative accounting and window dressing and evaluate their impact on the business, the accounting function and stakeholders (3.18) (AO2/AO3).
Evaluate the benefits and costs of computerised accounting systems and the strengths and risks of spreadsheet modelling (3.1) (AO2/AO3).
Assess data security threats and safeguards, including UK GDPR duties, and communicate justified recommendations (3.1/3.18) (AO3).
📋 Key Definitions and Core Concepts
Integrity: Being straightforward and honest in all professional and business relationships; not being associated with information the accountant believes is materially false or misleading.
Objectivity: Not allowing bias, conflict of interest or undue influence of others to override professional judgement.
Professional competence and due care: Maintaining knowledge and skill at the level required and acting diligently in accordance with applicable standards.
Confidentiality: Not disclosing professional information without proper authority or using it for personal advantage, subject to legal duties to disclose.
Professional behaviour: Complying with laws and regulations and avoiding conduct that discredits the profession.
Creative accounting: Manipulating the presentation of financial information within (or beyond) the rules to present a misleading picture of performance or position - e.g. overstating revenue or hiding liabilities.
Window dressing: Legal timing of transactions just before the year end to improve reported figures or ratios (e.g. delaying payments to raise the current ratio), improving appearance without substance.
Data protection (UK GDPR): The regime governing personal data: lawful, fair and transparent processing; purpose limitation; data minimisation; accuracy; storage limitation; security; and accountability.
📌 Key Points
The five principles come as a package: a technically perfect but dishonest computation breaches integrity and objectivity even if it is arithmetically correct.
Threats: self-interest (financial stake), self-review (checking your own work), familiarity (long relationships), intimidation (pressure from client or employer), advocacy (promoting the client's position).
Creative accounting distorts every ratio built on profit or assets - margins, ROCE, gearing - so users inherit the distortion; auditors and governance exist to detect it.
Accounting software automates double entry and reporting but concentrates risk: one database error or breach multiplies; backups, access controls and audit trails are not optional.
Spreadsheets are powerful modelling tools but weak controls: no audit trail, formula rot, version chaos - validate inputs, protect cells, document versions.
Ethical principles, the accountant's role, and threats and safeguards (AQA 7127, 3.18 with 3.1)
The accountant's role (3.1) is to provide information for decision-making and control - and that role only works if the information is trustworthy. Ethics is therefore not an appendix to accounting; it is the condition on which the entire specification depends. The profession's code (ICAEW and equivalent international codes, which AQA's 3.18 draws on) rests on five fundamental principles, and exam questions either ask you to state and explain them or - far more often - drop you into a scenario and ask which principle is threatened and what should happen.
Principle
Meaning
Scenario trigger
Integrity
Straightforward and honest; no association with false or misleading information
Being asked to leave a figure out of the accounts
Objectivity
No bias, conflict of interest or undue influence over judgement
Valuing the asset owned by a relative's firm
Professional competence and due care
Up-to-date skills; diligent work to standards
Using out-of-date tax rules; rushing a job
Confidentiality
No disclosure without authority; no use of information for personal gain
Telling a friend a client is for sale
Professional behaviour
Comply with laws; no conduct discrediting the profession
Overstating qualifications; regulatory breaches
The code then names five threats to those principles, and scenario questions are built directly from them. Self-interest: your own stake distorts judgement - a performance bonus tied to reported profit, shares in the client, or a close personal relationship with a supplier you are evaluating. Self-review: you check your own work - the preparer of a forecast then audits it, or an audit firm sells consulting on the system it audits. Familiarity: long or close relationships breed sympathy - auditing the same client for fifteen years, or your brother runs the business. Intimidation: pressure replaces judgement - 'agree with this valuation or lose the engagement'; threats of dismissal for raising a query. Advocacy: promoting the client's position compromises independence - acting as the client's spokesman in a dispute while also reporting on its statements.
Safeguards are the counter-moves, and answers score by matching threat to safeguard specifically: professional safeguards - independent regulation and inspection of audit firms, codes of ethics with disciplinary consequences, mandatory second-partner review of significant judgements, rotation of audit partners after a set period; firm safeguards - quality control procedures, consultation on difficult matters, independence declarations each year; personal safeguards - declining the engagement or the instruction, escalating to senior management or the audit committee, and whistleblowing to a regulator where internal routes fail and the public interest is engaged. The judgement step AQA rewards: identify the threat, name the principle breached, propose the proportionate safeguard, and say what should happen if it fails (resign, disclose). Doing nothing is never an acceptable answer in this specification.
Confidentiality deserves its boundary drawn precisely because it is the principle students most often overstate. It is NOT a licence to conceal wrongdoing: the law can compel disclosure (court orders, money laundering regulations), the public interest can justify it (reporting fraud to a regulator), and the client can consent. Equally, confidentiality binds after the engagement ends. In exam answers, treat a request to 'keep quiet about a £500,000 overstatement' as a threat to integrity FIRST (false information) with confidentiality used as the cover story - that ordering shows genuine understanding rather than memorisation.
Ethics questions also test the impact chain (3.18's core demand): how does an unethical act flow through the business, the accounting function and stakeholders? Build the chain in every answer: the act (overstated profit) → internal consequences (bonuses paid from fictitious profit, dividends from capital, decisions taken on false margins) → external consequences (investors misprice shares, lenders extend credit on false gearing, employees' pensions hold worthless equity, HMRC collects wrong tax) → discovery (restatements, resignations, fines, audit collapse) → long-run damage (the market discounts all of the company's numbers; the profession's credibility falls). Enron (2001) and WorldCom (2002) are the canonical illustrations: Enron used off-balance-sheet vehicles to hide debt; WorldCom capitalised operating expenses to inflate profit; both collapsed, their auditor (Arthur Andersen) failed with them, and the regulatory response (Sarbanes-Oxley, stricter audit independence) reshaped the profession. Name them, one line each, and always bring the analysis back to the scenario in the question.
Threat-to-safeguard matching drill
Scenario
Threat
Principle at risk
Proportionate safeguard
Bonus depends on hitting a profit target
Self-interest
Objectivity, integrity
Independent review of reported figures; disclosure of incentive scheme
Audit firm sells IT consulting to its audit client
Self-interest / self-review
Objectivity, independence
Limit non-audit services; audit committee pre-approves work
Preparing then checking your own cash flow forecast
Self-review
Professional competence
Independent reviewer signs off the model
Auditing a client owned by a close friend
Familiarity
Objectivity
Declare and withdraw; reassign the engagement
'Remove the query or lose the contract'
Intimidation
Integrity, objectivity
Escalate; document; resign the engagement if unresolved
Speaking for a client in a tax dispute you also audit
Advocacy
Objectivity
Separate the roles; another team acts as advocate
Two boundary topics complete the picture. Conflicts of interest: acting for two parties whose interests clash (auditing two competing clients, or advising both sides of a sale) is managed by disclosure and consent where genuine independence is possible, and by declining where it is not - the test is whether a reasonable, informed observer would doubt the accountant's objectivity. Whistleblowing: internal escalation (line manager, senior management, audit committee) comes first; external disclosure to a regulator (or prescribed person) is protected when it is reasonably believed to be in the public interest; the last resort is resigning with a written record of the concern. Answers that show this staged reasoning - not a single jump to 'tell the press' - score the evaluation marks.
Culture is the mechanism that makes all of this stick, and it is worth one developed paragraph in any 25-marker. Tone at the top - whether directors genuinely expect honest numbers or merely compliant ones - flows through the accounting function: where the chief executive 'adjusts' quarters, staff learn that estimates are negotiable; where the audit committee asks difficult questions, staff learn that evidence matters. That is why governance safeguards (independent non-executive directors, audit committees, internal audit reporting lines outside the finance department) are ethical devices, not just administrative ones: they change the incentives under which the accountant exercises judgement. Weave the point into stakeholder answers: the accountant in business (3.1) is often the first line of defence, because manipulation passes through the ledger before it reaches the market.
Creative accounting, window dressing and stakeholder impacts (AQA 7127, 3.18)
Creative accounting manipulates reported numbers to mislead; window dressing is its mildest, usually legal, cousin - timing transactions around the year end. Both matter to the accountant-in-business (3.1) because the accounting function is where the manipulation happens, and to stakeholders (3.18) because they rely on the numbers the manipulation corrupts. Distinguish the two precisely in definitions and the distinction itself earns marks.
Technique
Mechanism
Effect on statements/ratios
Ethical status
Early revenue recognition
Booking orders not yet delivered (realisation breached)
Revenue and profit overstated now; reversed later
Breach of concepts; often fraudulent
Capitalising expenses
Operating costs recorded as non-current assets (WorldCom's line costs)
Profit overstated; assets overstated; future depreciation spreads the lie
Fraud
Off-balance-sheet financing
Debt hidden in unconsolidated vehicles (Enron)
Gearing understated; ROCE flattered
Breach of substance over form
Cookie-jar provisions
Over-providing in good years, releasing in bad years
Smooths profit; misleads trend analysis
Breach of prudence in reverse
Inventory overstatement
Inflating closing inventory
Gross profit overstated this period; detectable next
Fraud
Window dressing
Delaying payables; year-end bulk sales on easy terms
Current ratio and revenue flattered briefly
Legal but misleading
The arithmetic behind the manipulation is worth internalising because questions increasingly ask you to quantify. Overstate closing inventory by £40,000: cost of sales understated £40,000, gross and net profit overstated £40,000, current assets and equity overstated £40,000 - and next year's opening inventory inflates cost of sales, reversing the effect, which is why a one-year 'miracle' followed by an unexplained margin fall is a red flag sequence. Understate the allowance for receivables by £25,000: profit and net receivables overstated by £25,000. Every manipulated figure then contaminates the ratios: the gross margin, ROCE and current ratio read from those statements are fiction with clean arithmetic.
The stakeholder impact analysis is the exam's evaluation core, and it must be specific to each group. Shareholders and potential investors: buy or hold at a price built on false profits; on discovery the share price collapses - wealth transferred to those who sold first. Lenders: advance credit on understated gearing; covenants measured on fake numbers; recoveries fall short in the collapse. Employees: pensions often hold the employer's shares; jobs go in the aftermath; the bonus pool paid out of fictional profit was never real. Suppliers and customers: extended credit to a hollow business; unfulfilled orders. Government: understated profits mean understated tax (or in some manipulations, tax paid on phantom profit); regulatory resources consumed. The accounting profession: every scandal degrades public trust in all accounts, which is why regulation tightened after Enron - and why integrity, not just compliance, is a principle rather than a rulebook.
Detection and prevention occupy the positive half of any evaluation. Auditors provide independent verification - but Enron showed independence can be compromised by consulting fees (a self-interest threat) and long tenure (familiarity), so safeguards followed: audit committee oversight, partner rotation, limits on non-audit services. Corporate governance structures - a board with independent non-executives, an audit committee, internal audit - separate the people who run the business from the people who check it. Accounting standards (IAS 2 inventory, IAS 16 property, plant and equipment; the substance-over-form principle) narrow the space for manipulation. Ratio cross-checks - comparing the current ratio with the acid test, profit growth with operating cash flow - expose techniques that improve one number and degrade another. And the honest counterweight: most businesses do not manipulate, standards and audit make manipulation harder than ever, and window dressing is often management behaving legally within rules - the evaluation is about the incentive and the consequence, not a claim that all reporting is rotten.
Why does it recur? Because the incentives are real, and naming them is analysis. Remuneration: bonuses and share options priced on reported profit pay today for numbers that may be fiction tomorrow. Debt covenants: gearing or interest-cover tests measured on the accounts create a motive to move the measurement. Market expectations: missing analyst forecasts by a penny moves share prices, so the temptation is to 'manage' earnings into line - the practice called earnings management, creative accounting's respectable-sounding sibling. Survival: loss-making businesses fear that honest numbers trigger lender withdrawal. Every one of these incentives is visible in the case studies: Enron's executives were compensated on the inflated profits; WorldCom's controllers were pressured from above. The counter-incentives - audit, regulation, imprisonment for fraud, director disqualification - exist to make honesty cheaper than dishonesty, and the exam answer evaluates whether they currently do.
UK context sharpens the evaluation. Audit and reporting are overseen by the Financial Reporting Council (FRC), which sets accounting and auditing standards and inspects audit quality; auditors of public interest companies face independent review; and successive scandals (Carillion among them) have driven debate about audit-market competition and the splitting of audit from consulting. You do not need the reform details - you need the direction of travel: regulators respond to manipulation by tightening independence, expanding audit scope and lengthening accountability chains. For an evaluation conclusion, that regulatory response is evidence that the problem is real, costly and permanent - which is why the ethical principles in section 1 are written as duties rather than aspirations.
Worked example: reading the red flags in two years of figures
Year 1: revenue £500,000; gross profit £150,000 (30%); receivables £60,000 (43 days); allowance for receivables £9,000 (15% of receivables); operating cash flow £120,000. Year 2: revenue £700,000; gross profit £252,000 (36%); receivables £126,000 (66 days); allowance £5,000 (4% of receivables); operating cash flow £115,000.
Signal
Reading
Gross margin up 6 points on 40% revenue growth
Either genuine pricing power - or sales pulled forward / revenue recognised early
Receivables days 43 → 66
Sales booked but cash not collected - the classic early-recognition fingerprint
Allowance percentage 15% → 4%
Provision cut exactly when receivables age - profit managed through the estimate
Profit up ~£87,000 but operating cash flow flat
Earnings quality failing: profit not converting to cash
No single flag is proof - growth businesses legitimately show all four for honest reasons - but the combination demands investigation: cut-off testing at the year end, confirmation of the largest receivables, and re-computation of the allowance. This is the auditable version of the scepticism the ethical principles require, and it links 3.18 back to the ratio toolkit of topic 3.
Accounting software, spreadsheets and data security (AQA 7127, 3.1 and 3.17)
Technology changed what the accounting function does (3.1): much of the mechanical double entry is now automated, and the accountant's value moved to design, control, interpretation and assurance. For the exam you need a balanced benefits-and-costs evaluation, the specific strengths and risks of spreadsheets, and data security duties under UK GDPR - three things AQA asks about directly.
Computerised accounting system
Benefits
Costs / risks
Entry and processing
Speed; double entry automated from one input (invoice posted to sales, customer and VAT records at once); validation checks (unbalanced entries rejected)
Software and training costs; implementation time; a wrong masterfile rule multiplies errors silently
Reporting
Instant trial balance, aged receivables, budgets-versus-actuals; dashboards for non-financial managers
Over-reliance: users trust output without understanding the model behind it
Control
Audit trails (who entered what, when); access levels by role; automatic control account totals
Concentration risk: one database is one point of failure; needs backups and security investment
Dependency on suppliers; upgrade and compatibility costs; cyber attack surface widens with connectivity
The evaluation line to remember: computerisation removes clerical error and speeds processing, but it concentrates risk rather than removing it - one corrupted file, one breach, one misconfigured automation affects everything, so control shifts from checking arithmetic to controlling access, backup and change. A strong answer names both sides of that shift.
Connect software to the rest of the specification and the benefits become concrete rather than generic. The control accounts you drilled in topic 1 are produced automatically - aged debtor reports, control account totals and lists of balances reconcile in seconds, so error detection shifts from manual comparison to exception review. Recurring entries (depreciation, accrual reversals, standing orders) post on schedule, removing the classic sources of year-end error. Validation prevents the trial balance ever disagreeing: most packages refuse unbalanced entries outright, which is why suspense-account questions are rarer in the software age - but understanding them remains essential, because someone must know what the software is doing. Integration with incomplete records (3.14): where a business adopts proper software mid-year, the earlier records remain incomplete, so the accountant still needs mark-up and margin techniques to bridge the gap - technology changes the mix of skills, it does not abolish the syllabus.
Spreadsheets are the accountant's most-used tool and a favourite exam topic. Strengths: flexible modelling of any scenario; instant what-if analysis - change a cell and every dependent figure recalculates; cheap and universally available; ideal for break-even models, cash budgets, sensitivity tables and quick consolidations. Worked what-if: a model holds selling price £20, variable cost £12, fixed costs £60,000, so break-even = 60,000 ÷ 8 = 7,500 units. Raise price by £2: contribution 10, break-even 6,000 units - one keystroke, and the margin of safety, target profit and chart all update. For management, that interactivity is the entire value: pricing decisions, cost-cutting options and volume scenarios can be compared in minutes.
The risks are just as examinable. Formula errors propagate silently - a range missed by one row corrupts every downstream total, and famous public spreadsheet failures (mis-sorted ranges, hardcoded overrides) show they happen to experts; no audit trail - unlike accounting software, spreadsheets rarely record who changed what, so errors hide; version control - 'budget_v7_final_FINAL.xlsx' is the industry joke because it is real: multiple copies diverge and decisions get taken on stale files; input errors - no validation unless deliberately added. Safeguards: separate inputs from calculations (an assumptions sheet feeding locked formula cells); data validation on input cells; cell protection; version control with a single master; documentation of formulas; and independent review of any model that feeds significant decisions. For 12-mark questions the shape is always the same: capability, then risk, then controls, then judgement on fitness for purpose - a quick what-if model is low risk; a statutory consolidation built by one person in a spreadsheet is high risk.
Data security completes the section, and it now has statutory teeth. UK GDPR requires that personal data (employee records, customer names, payment details) be processed lawfully and transparently, collected for specified purposes, minimised, kept accurate, retained only as long as necessary, processed securely, and handled accountably - the business must be able to demonstrate compliance. Security safeguards to recommend in answers, mapped to threats: access controls and role-based permissions (threat: insider misuse); encryption of data at rest and in transit (threat: stolen laptops, intercepted files); frequent automated backups held offline or in a separate location (threat: ransomware, which encrypts live data and demands payment - backups are the recovery route); multi-factor authentication and staff training against phishing (threat: credential theft - the most common breach route); patching and firewalls (threat: exploitation of known weaknesses); an incident response plan (threat: everything - GDPR requires reporting qualifying breaches to the Information Commissioner's Office within 72 hours, and affected individuals where risk is high). Penalties scale with turnover, and the reputational damage of a breached customer database outlasts any fine - the evaluation point that security spending is cheap relative to the downside.
Worked scenario: prioritising a security budget
A 20-person wholesaler holds customer names, addresses, cardholder data and staff payroll. Budget allows four of six measures: (1) offline daily backups, (2) multi-factor authentication, (3) staff phishing training, (4) encryption of laptops, (5) a marketing analytics platform, (6) a new website theme.
Take (1): ransomware without backups means either payment or data loss - existential.
Take (2): stolen credentials are the most common breach route; MFA blocks the cheapest attack.
Take (3): phishing defeats technical controls by tricking people; training addresses the human layer.
Take (4): a lost laptop holding customer data is a notifiable breach - encryption makes the data unreadable and the breach largely containable.
Reject (5) and (6): neither reduces risk. The reasoning pattern - threat, control, consequence - is exactly the structure AQA rewards in recommendation questions.
The wider-society angle (3.18, and the 'society' in this topic's title) deserves two sentences in any extended answer: automation of bookkeeping shifts employment from clerical processing towards analysis and assurance - a structural change the accountant-in-business must manage through training; and stakeholders increasingly expect reporting to cover environmental and social impacts alongside financial results, so the accounting function's duty - honest, complete, decision-useful information - now extends beyond the traditional statements. That extension is exactly why the ethical principles of section 1 apply to dashboards, spreadsheets and databases as much as to ledger accounts: the medium changed, the duty did not.
Two closing evaluation habits for this topic. First, quantify where the question permits: 'the current ratio improves from 1.33:1 to 1.38:1' or 'backup costs of a few hundred pounds against a ransom demand of thousands' - numbers anchor ethical and technological judgements just as they anchor financial ones. Second, finish with the decision-usefulness test that runs through the whole specification: information - in a ledger, a spreadsheet or a dashboard - exists to help someone make a better decision, and every ethical principle, software feature and security control in this topic is ultimately a way of keeping that information true. If your conclusion sentence states what the decision-maker can now rely on, and what they still cannot, you have met the highest standard the 3.18 extended questions set.
💡 Worked Example
Exam-style: Evaluate the impact on stakeholders of a business overstating its profits through creative accounting techniques. (12 marks)
Mark-scheme logic: AO1: define creative accounting - manipulation of reported results within or beyond the rules to mislead (techniques: early revenue recognition, capitalising expenses, understating provisions or allowances, overstating inventory); distinguish from legal window dressing. AO2 application: overstatement flows through statements - cost of sales understated or income overstated raises profit and equity; ratios (ROCE, margins, EPS) inherit the distortion; bonuses and dividends may be paid from fictitious profit. AO3 stakeholder analysis: shareholders and potential investors misprice shares - on discovery wealth collapses; lenders over-lend on understated risk and understated gearing; employees hold pensions in the employer's equity and lose jobs in the aftermath; suppliers extend credit to a hollow business; HMRC collects the wrong tax; the profession and auditors suffer reputational and regulatory consequences (Enron and WorldCom as named illustrations - debt hidden off balance sheet; expenses capitalised). Balanced elements: regulation, audit, governance and ratio cross-checks reduce but do not eliminate the risk; incentives (bonuses, covenant compliance, share prices) explain why it recurs. Judgement: the damage is systemic - misallocation of society's capital - and falls hardest on the least-informed stakeholders; ethical principles exist because markets only work on trustworthy information.
❓ Practice Questions & Mark Schemes
State and explain two of the five fundamental ethical principles, and for each, describe a scenario in which an accountant in business would be tested. (8 marks)
Answer: Integrity - being straightforward and honest, and not being associated with misleading information. Test: a manager instructs the accountant to exclude a £500,000 overstatement of inventory from the draft accounts; accepting would breach integrity, so the accountant must refuse, escalate to the audit committee or board, and consider whistleblowing if overruled. Objectivity - not allowing bias, conflict of interest or undue influence to override professional judgement. Test: asked to appraise a supplier bid from a company owned by the finance director's brother; the relationship is a familiarity/self-interest threat, so the accountant should declare the conflict and the valuation should pass to an independent colleague. Mark logic: principle stated accurately (2 × 1); meaning explained (2 × 1); plausible scenario with the threat identified (2 × 2); escalation consequence mentioned for the top marks.
A company overstates its closing inventory by £40,000 and understates its allowance for doubtful debts by £25,000. State the effect of EACH misstatement on profit for the year, current assets and equity, and explain how a ratio analyst might detect them. (10 marks)
Answer: Inventory overstatement: cost of sales understated £40,000, so gross and net profit overstated £40,000; current assets (inventory) overstated £40,000; equity overstated £40,000 (via retained earnings). Next year it reverses: opening inventory overstated inflates cost of sales, so the following year's profit is understated - the 'one good year, one odd year' pattern. Allowance understatement: expense understated £25,000, so profit overstated £25,000; receivables (net) and equity overstated £25,000. Detection: profit rising while operating cash flow flat or falling; receivables days lengthening while the allowance percentage falls; gross margin jumping with no price or cost change; comparing the current ratio with the acid test to expose inventory-heavy 'improvements'; aged receivables schedules revealing stale balances behind the small allowance. Mark logic: each statement effect stated with direction and amount (6); reversal/next-year effect (1); two or more coherent detection methods (3).
Explain the benefits and risks of using spreadsheets for a business's cash budgeting, and recommend three controls. (10 marks)
Answer: Benefits: flexible what-if modelling - change an assumptions cell (e.g. a customer paying 30 days later) and receipts, balances and overdraft needs recalculate instantly; cheap and fast to build; charts communicate the cash profile to non-specialists; supports scenario comparison (best/base/worst) for management decisions. Risks: silent formula errors propagate to every balance and can misstate the funding requirement; no audit trail - who changed which cell, when, is unrecorded; version control chaos across emailed copies leads to decisions on stale data; no validation unless built in - a typed 50000 instead of 5000 corrupts the model. Controls (any three, explained): separate an inputs/assumptions sheet from locked formula cells with cell protection; data validation on input cells; single master file with version control and change log; independent review/reconciliation of the first budget against a manual calculation; documented formulas. Mark logic: benefits developed not listed (3); risks developed (3); three specific controls (3); fitness-for-purpose judgement (1).
A customer database holding 40,000 names, addresses and purchase histories has been encrypted by ransomware. Evaluate the data security failures and recommend a response plan, with reference to UK GDPR. (12 marks)
Answer: AO1: UK GDPR principles engaged - security (integrity and confidentiality), accountability, and breach reporting duties. Failures to evaluate: no (or unrecoverable) offline backups - ransomware works only when the only copy is encrypted; weak access controls or credential theft (phishing is the common entry); no network segmentation or patching regime; no tested incident response plan. Response plan: isolate infected systems immediately; restore from clean offline backups (this is why backups are the recovery route, not payment); notify the Information Commissioner's Office within 72 hours if individuals are at risk, and inform affected individuals where the risk is high; investigate entry route and close it; review and test backups and access controls afterwards. Evaluation: paying ransoms funds crime and guarantees nothing; fines scale with turnover but reputational damage to customer trust usually costs more; security investment (backups, MFA, training) is cheap relative to the downside. Mark logic: failures identified against named safeguards (4); response sequenced sensibly (4); GDPR reporting duties accurate (2); justified judgement (2).
Explain the difference between window dressing and creative accounting, and evaluate whether window dressing is ethical. Support your answer with a numerical example. (12 marks)
Answer: Distinction: window dressing is the legal timing of genuine transactions near the year end to improve reported figures or ratios (delaying payables, a bulk year-end sale on easy terms) - substance unchanged; creative accounting manipulates the representation of reality itself (overstating revenue or inventory, hiding debt) - misleading regardless of legality. Numerical example: current assets £200,000 (cash £50,000), current liabilities £150,000 - current ratio 1.33:1; paying £20,000 of payables two days before year end moves it to 180/130 = 1.38:1, while the acid test falls from 0.83:1 to 0.81:1 as cash leaves. Evaluation: against - it misleads users who rely on ratios for decisions; the improvement reverses within weeks; deliberate presentation management breaches integrity even if legal; comparing current and acid ratios exposes it, so its purpose is concealment. For - it is lawful, within the directors' judgmental space, common practice, and users know year-end figures are snapshots; the answer lies in disclosure, not prohibition. Judgement: lawful but ethically fragile - the more the intent is to mislead rather than inform, the closer it moves to the dishonesty that integrity prohibits; the test is whether management would be comfortable explaining the timing to a sceptical user.