CRISC Certified in Risk and Information Systems ControlGovernanceHard

A healthcare provider is migrating its patient records to a cloud-based Electronic Health Record (EHR) system. A key project stakeholder, who also holds a significant investment in the chosen cloud vendor, consistently advocates for the vendor's solutions, sometimes downplaying identified risks. From a professional ethics standpoint, what is the MOST appropriate action for the project manager to take?

  1. ARequest the stakeholder to divest their investment in the cloud vendor.
  2. BDocument the stakeholder's advocacy but proceed with the vendor if their solution is technically superior.
  3. CExclude the stakeholder from further vendor selection discussions to avoid bias.
  4. DRaise the issue of potential conflict of interest to the appropriate governance body or senior management.
Show answer & explanation

Correct answer: D. Raise the issue of potential conflict of interest to the appropriate governance body or senior management.

The project manager has a professional ethical obligation to ensure fair and unbiased decision-making, especially when patient data is involved. A stakeholder advocating for a vendor in which they have a financial interest represents a clear conflict of interest. The MOST appropriate action is to formally raise this issue to the relevant governance body or senior management for resolution, as they have the authority to address such conflicts and ensure proper oversight. Excluding the stakeholder or demanding divestment are not within the project manager's direct authority and may not fully resolve the underlying governance issue.

Why the other options are wrong

  • A. Requesting divestment is outside the project manager's authority and could lead to legal or HR issues.
  • B. Documenting is insufficient; the conflict needs active resolution, especially when risks are being downplayed.
  • C. Excluding the stakeholder unilaterally might be seen as insubordination or could lead to resentment, and it doesn't formally address the conflict of interest with the appropriate authority.

Conflict of Interest Management

The process of identifying, disclosing, and resolving situations where an individual's personal interests could improperly influence their professional judgment or actions, particularly in decision-making.

  • Requires transparency and disclosure.
  • Escalation to appropriate authority for resolution is key.
  • Aims to protect organizational integrity and fairness.

Memory trick: When interests clash, shine a light and call for backup.

More Governance questions