Professionalism in IT

Moira De Roche, Liesbeth Ruoff-van Welzen, Adrian Schofield, Anthony Wong

► To cite this version:

Moira De Roche, Liesbeth Ruoff-van Welzen, Adrian Schofield, Anthony Wong. Professionalism in IT. Leon Strous; Roger Johnson; David Alan Grier; Doron Swade. Unimagined Futures – ICT Opportunities and Challenges: AICT-555, Springer International Publishing, pp.200-219, 2020, IFIP Advances in Information and Communication Technology, 978-3-030-64245-7. 10.1007/978-3-030-64246-4_16. hal-03194540

HAL Id: hal-03194540

https://inria.hal.science/hal-03194540

Submitted on 9 Apr 2021

HAL is a multi-disciplinary open access
archive for the deposit and dissemination of sci-
entific research documents, whether they are pub-
lished or not. The documents may come from
teaching and research institutions in France or
abroad, or from public or private research centers.

L'archive ouverte pluridisciplinaire HAL, est
destinée au dépôt et à la diffusion de documents
scientifiques de niveau recherche, publiés ou non,
émanant des établissements d'enseignement et de
recherche français ou étrangers, des laboratoires
publics ou privés.

<figure><img src="image_1.png" /></figure>

Distributed under a Creative Commons Attribution 4.0 International License
Professionalism in IT

Moira de Roche¹, Liesbeth Ruoff - van Welzen², Adrian Schofield³, Anthony Wong⁴

¹ IFIP IP3, Cape Town, South Africa

² LRWA, Voorburg, The Netherlands

³ IITPSA, Unit 4, Probuild Park, James Crescent, Halfway House, Midrand, South Africa

⁴ AGW Lawyers & Consultants, Sydney, Australia
meroche@ipthree.org, l.ruoff@lrwa.nl,
adrian.schofield@iitpsa.org.za, anthonywong@agwconsult.com

**Abstract.** This chapter considers the history of IFIP and Professionalism in ICT, and why Professionalism in ICT is becoming as critical as for other professions. Examples of the criticality of Professional and Ethical behavior are provided. The founding and work of the International Professional Practice Partnership (IP3) is explained. Requirements for a Profession are provided. The progress in developing Professionalism in different countries is explored.

**Keywords:** Profession, Professionalism, Technology, ICT, Core Body of Knowledge, Ethics, Accreditation, Certification, Skills Framework, Skills, Competencies, Duty of Care, Risk, Liability

# 1 Introduction

Professionalism is, at its heart, a willingness of one professional to subject their work to the critical assessment of their peers. It is now 70 years since the first commercial ICT systems were built. Today, ICT professionals build, maintain and operate systems of unparalleled complexity in comparison with other engineered artefacts. ICT professionals have an excellent record of success despite, with few exceptions, having none of the professional structures of doctors, lawyers, accountants, engineers and other professional disciplines. These professions have themselves acquired their professional status due to the implications of their roles and decisions, legal responsibility for the wellbeing and the interests of society in general including accountability for injuries, death, damage and loss over the course of their development.

The rapid adoption and pervasive use of digital technology in many diverse areas of our personal and business activities—from transport, education, healthcare, telecom- curation through to critical infrastructure, logistics, defence, entertainment and ag- riculture—have accentuated the importance and prominence of ICT skills and knowledge in recent times. It has also led to the use and deployment of digital technol- ogy by these other professions, as tools of their trade and professional work. But as autonomy and self-learning capabilities increase, autonomous and intelligent AI sys- tems feel less and less like machines or tools and will have the ability to interact and work alongside these other professionals to augment their work. They will increasingly
be able to take over functions and roles and, perhaps more significantly, the ability to
make autonomous decisions.

The need to address digital technology risks and challenges has increased in urgency
as the adverse potential impact could be significant in specific critical domains. If not
appropriately addressed, human trust will suffer, impacting on adoption and oversight
and in some cases posing significant risks to humanity and societal values.

Membership of a professional body is generally not a prerequisite for ICT practi-
tioners to practice, unlike practitioners in disciplines such as law and medicine.

Should government and regulators now hold ICT professionals, developers and pro-
viders of these systems to similar professional standards demanded from their profes-
sional counterparts in medicine, law, accounting, engineering, finance and architecture?

IFIP founded IP3 – International Professional Practice Partnership - in the belief that this issue deserved careful consideration. Why are the traditional professional structures largely missing in ICT worldwide? Does it matter? Are there risks with the status quo and the opportunities for pro-active interventions?

## 2 The maturing of the profession

Despite passing away in 1929, Herman Hollerith's name was still attached to electric
tabulating machines in 1960 – a hundred years after his birth. By 1960, computers were
replacing tabulators and companies like International Business Machines and
International Computers & Tabulators were filling up space in "computer centres",
surrounded by "programmers". For a couple of decades, computing was confined to
such centres in medium to large enterprises, serviced by a cohort of skilled people who
acquired much of their learning in academia. Their talents were clearly differentiated
from those of the user community and they usually worked in separate spaces.

It all started to change in the 1980s, when personal computers began to appear on
the desks of managers, administrators and sales staff, replacing the "dumb" terminals
that had previously linked them to the mainframe in the computer centre. Although still
dependent on the programming skills of specialists for the operating system and main
application framework, users were now enabled to decide how to process and see their
data and even to write some programs for themselves.

Fast forward to the 21st century and the computing power has moved from the
desktop to the hand, with more computing power in a small mobile device than was
dreamed of sixty years previously.

But some things have not changed. The way in which the computer is designed, the
way in which the operating system functions, the way in which applications interface
with the operating system, with each other and with the user, are all dependent on the
skills of the people who put it all together. Designers, architects, analysts, programmers,
testers – these roles are all vital in ensuring that the technology delivers output
according to the specifications and expectations.

This is where professionalism becomes a vital component in the creation,
construction, and operation of ICTs. When humans began to construct homes, they
were single storey and made of local available materials. Trial and error would lead to
homes that were weather-proof and durable, with much copying of the more successful
techniques. As buildings became larger, the trial and error had to be abandoned in
favour of design that took account of all the factors required to create a durable and fit-
for-purpose edifice. Registered, professional architects and artisans could be relied
upon to deliver the quality of durable buildings that would satisfy the needs of their
occupiers.

It is no different when it comes to acquiring fit-for-purpose technology systems that are durable and meet the needs of their users. The same roles of architects, designers, engineers, and the systems equivalent of artisans (programmers, testers, operators and technicians) are relied on to deliver the quality of system expected of them. But, unlike the construction industry, the ICT sector has not demanded such rigorous evaluation of its key role-players, to the extent that a significant proportion of its products and services are purchased with no knowledge of the skills of the people who created them.

This can lead to disaster on a scale that varies from wasting personal money on an
“app” that does not work to endangering the lives of hundreds of airline passengers.

3 Why we need professionalism

Professionals often overlook and neglect their ethical and fiduciary responsibilities re-
sulting in reputational damage, legal consequences, and ongoing repercussions. Profes-
sionalism has long held strong linkages with ethics. The “professional is someone who,
amongst other things, behaves ethically with respect to his or her occupation.” [20].
The following case studies illustrate why we need ICT professionalism.

**3.1 Volkswagen (‘Dieselgate’) case study**

In 2017, a Volkswagen software engineer was convicted and sentenced in the USA, for his role in a 10-year conspiracy to defraud regulators and customers by implementing software specifically designed to cheat environmental emission tests in diesel vehicles [25]. The Volkswagen engineer and his co-conspirators designed and implemented software to recognize whether a vehicle was undergoing emissions testing, versus being driven on the road under normal driving conditions, to cheat the emission tests. The ‘Dieselgate’ software installed in Volkswagen and Audi diesel vehicles “ran the engine cleanly during tests and switched off emissions control during normal driving conditions, allowing the car to spew up to 40 times the U.S. Environmental Protection Agency’s maximum allowed level of nitrogen oxides, air pollutants that cause respiratory problems and smog.” [22]. The co-conspirators fraudulently certified to regulators that Volkswagen diesel vehicles met environmental emissions standards and complied with legislation.

Did the software engineer and co-conspirators collaborate with management of the
organization to advance the ‘green status’ of the diesel vehicles, meet aggressive sale
targets or as a strategy to compete with less polluting gas or electric powered vehicles?
Or did management instruct the software engineer and co-conspirators to design and
implement software specifically to cheat environmental emission tests?
Darden Professor Lynch submits that “the presence of three factors contributed to the catastrophic decision made by the engineers—pressure, opportunity and rationalization. When those three factors (known by some as a ‘dangerous triad’ or a ‘fraud triangle’) are present simultaneously, we often see employees act unethically.” [21].

By August 2020, the scandal has not only tarnished Volkswagen's reputation but has also wiped billions of euros from its market valuation. Fraud charges have also been filed against former board members, including the former CEOs of Audi and Volkswagen [4]. Dieselgate has been reported to cost the Volkswagen group more than €30bn in compensation, fines and costs after numerous legal actions in relation to the 11 million vehicles worldwide including in the USA, Australia, Germany and UK [5].

## 3.2 Boeing 737 Max case study

While not every technology shortcoming or failure, is life threatening or leads to economic loss, many critical infrastructures, including water, energy, transportation, and hospitals, are increasingly dependent on software, AI and autonomous systems. Failure of these systems can potentially lead to injury or damage—or worse death. In addition, automation introduces new vulnerabilities—as a point of error or failure could potentially create catastrophic results and, widespread damage and loss.

This is epitomized by the recent saga with the Boeing 737 Max aircraft. In October 2018, Lion Air crashed shortly after takeoff killing all 189 followed by the Ethiopian Airlines in March 2019, with the loss of 157 lives. These have led to the worldwide grounding of the Boeing 737 Max aircrafts.

To counteract competitive threat, and instead of a major redesign of the previous 737 airframe, the 737 MAX includes an augmentation flight software called the Maneuvering Characteristics Augmentation System (MCAS), which was designed to compensate for the aerodynamic pitch effects associated with the changes in placement and size of the 737 MAX's larger, more efficient engines. The MCAS was designed to activate automatically without any pilot command. The existence on the MCAS was not disclosed to most pilots, and Boeing sought to diminish focus on MCAS as a 'new function' in order to avoid increased costs, and 'greater certification and training impact.'" [28] The investigations have implicated the automated software MCAS in both crashes and disclosed documents have highlighted company employees' safety concerns about the 737 Max.

“Boeing’s economic incentives led the company to a significant lack of transparency with the FAA, its customers, and 737 MAX pilots regarding pilot training requirements and negatively compromised safety.” [29].

Should Boeing deploy software to automatically compensate for changes to the hardware design in this instance? Should the existence of the new piece of software be withheld from pilots?

The US Committee on Transportation and Infrastructure report also point to a company culture “where safety was sacrificed to production pressures.” [30] and that “the FAA’s current oversight structure with respect to Boeing creates inherent conflicts of interest that have jeopardized the safety of the flying public.” [31].
The various investigations and reports on the incidents illustrate the complex inter-
play, and the importance of ensuring that any changes to the automated software is
holistically integrated for the proper functioning of the entire aviation system, and not
in an incremental and fragmented manner. Should the programmer foresee the potential
loss or damage even when it may be difficult to anticipate—particularly with the com-
plex interactions and actions at play?

The U.S. Department of Transportation Special Committee has also recommended "that the FAA should update existing guidance to highlight the vulnerabilities that can develop around multiple adaptations of existing systems, where transfer of historical assumptions may not be appropriate or may require specific validation." [27].

Due to the complexity of these digital technologies and their integration with physi-
cal systems, it may be very difficult to discern the boundaries and responsibilities of
different stakeholders and actors, and to identify who is responsible for the problems
arising and in connection with the design, use and shortcomings of digital technology.

The grounding of Boeing's top-selling aircraft has cost the company billions of dol-
lars. Additionally, Boeing also faces several ongoing criminal and civil investigations
[12].

3.3 Equifax Case Study

Equifax, one of the three largest credit reporting agencies in the USA, collects and ag-
gregates credit and demographic information on over 800 million individual consumers
and more than 88 million businesses worldwide. In September 2017, they announced a
data breach, which impacted the personal information of approximately 147 million
people. Also affected were some 693,665 UK consumers and 8,000 Canadian consum-
ers. The sensitivity of the personal information held by Equifax and the scale of the
problem was unique at the time.

The data breached included names, home addresses, phone numbers, date of birth, social security numbers, and driver's license numbers. The credit card numbers of approximately 209,000 consumers were also breached. Identity theft can completely derail a person's financial future. Criminals who have gained access to others' personally identifiable information can open bank accounts and credit cards, take out loans, and conduct other financial activities using someone else's identity. Equifax took several weeks to officially announce the data breach, putting millions of people at risk of identity theft.

"We at Equifax clearly understood that the collection of American consumer information and data carries with it enormous responsibility to protect that data. We did not live up to that responsibility." Richard F. Smith, Equifax's former CEO 3 October 2017 [26].

In December 2016, a security researcher examined Equifax's servers and alerted the
company that its system was vulnerable to hacks. In May of 2017, the company was
first hacked via a consumer complaint web portal, with the attackers using a widely
known vulnerability in Apache Struts Software, for which a patch was available in early
March. The patch was redistributed by US Department of Homeland Security's Com-
puter Emergency Response Team (CERT) emphasizing the importance of its immedi-
ate installation [13]. Due to failures in the company's internal processes, the patches
were not successfully applied until late May.

Ten days after the warning, Equifax installed the patch and ran a scan to see if the
patch was installed correctly, but they did not scan all of their servers that were using
the Apache Toolkit and in some cases did not apply the patch correctly, leaving several
servers vulnerable to an attack that had been widely publicized.

On 29 July 2017, the Equifax security department discovered “suspicious network traffic” associated with its online dispute portal. From 13 May to 30 July 2017, hackers were able to utilize simple commands to determine the credentials of network accounts at Equifax to access and infiltrate sensitive personal information. The attackers were able to move from the web portal to other servers because the systems weren't adequately segmented from one another, and they were able to find usernames and passwords stored in plain text that then allowed them to access further systems. The attackers also pulled data out of the network in encrypted form undetected for months because the company had crucially failed to renew an encryption certificate on one of their internal security tools. Equifax eventually patched this vulnerability.

After the discovery on 29 July, the company did not inform the public of the breach. Weeks were spent hiring cybersecurity experts informing select groups of the breach, purchasing an identity protection company so they could sell its services to consumers who had their data stolen.

It is with the intention of mitigating the risk of such outcomes that IFIP's Interna-
tional Professional Practice Partnership (IP3) came into being, to raise the profile of
practitioners at all levels, to encourage them to build their careers and skill levels and
to register their validated abilities through professional recognition schemes of national
professional bodies.

4 Developments around the world

But not only IFIP / IP3 started initiatives, also other organizations showed work with
respect to professionalism, skills and competencies. In the following subsections exam-
bles from around the world are listed.

4.1 Africa

The Institute of IT Professionals South Africa (IITPSA) is accredited by the South Af-
rican Qualifications Authority (SAQA). IITPSAs Professional Membership Grade
(SFIA Level 5) was accredited by IP3 in 2015. In 2019, IITSA introduced a new Pro-
fessional certification Pr.CIO aimed at Chief Information Officers (CIOs) and other
officials at a similar level. Pr.CIO is targeted for IP3 accreditation in 2020.

Other African countries that are committed to professionalism in ICT include Zim-
babwe, Tanzania, and Botswana.
## 4.2 Australia

In 2000, the Australian Computer Society (ACS) was admitted to the Australian Council of Professions—now Professions Australia, making the ACS, one of the first computer societies in the world to achieve this status. Professions Australia is the peak body for all professions in Australia including doctors, lawyers, accountants, engineers, and other professions.

ACS' contribution to promoting global standards for professionalism in ICT is long and distinguished. ACS is one of the founding partners of IP3 and was the first computer society to have their certification program accredited by IP3. The accreditation applies to the Certified Professional (CP) at SFIA Level 5 and Certified Technologist (CT) at SFIA Level 3 [1].

In addition, ACS has been able to advocate for the establishment of professional ICT benchmarks through legislation in Australia including the:

1. Professional Standards Legislation: The IP3 accredited certification is recognised under the Professional Standards legislation [3]. This recognition is administered by the Professional Standards Councils in Australia. Certified Professionals are protected by a special ACS member insurance policy and capped liabilities under Professional Standards legislation.

2. Professional Employees Award 2010: which defines minimum wages and employment conditions for ICT professionals [23].

## 4.3 Asia

IPSJ, Information Processing Society of Japan, founded a certification system named Certified IT Professional (CITP) from 2014. The CITP system was accredited by IP3 in February 2018. The system is operating in two methods: the direct method and the indirect method.

In the direct method, IPSJ certifies individuals by examining application documents that describe the applicant's knowledge level and the demonstration of skill and competency in business experiences.

In the indirect method, IPSJ accredits internal certification systems of companies if they are comparable to the direct method explained above. Once accredited, IPSJ issues the certificates of CITP to the professionals certified within the companies based on the requests from the companies.

As of March 2020, 9853 CITPs have been certified including the ones certified through the indirect method. By the indirect method, nine internal certification systems of companies have been accredited. CITPs had established a professional community called “CITP Community” and held meetings every two months.

From April 2019, IPSJ also recognizes a Professional Engineer, Japan (P. E. Jp) where the technical discipline is Information Engineering (Computer Engineering, Software Engineering, Information Systems & Data Engineering, Information Network Engineering). The qualification will be registered as a CITP, while the registered P. E. Jp is required to fulfill CPD requirement and periodical recertification.
The CITP certification system is designed to conform to ISO/IEC 24773, Certifica-
tion of software and systems engineering professionals, which is under development at
ISO/IEC JTC1/SC7/WG20.

4.4 Europe

In Europe attention for and activities around the IT profession were locally organized
in the first years. One of the earliest local initiatives was in the UK. The British Com-
puter Society (BCS) took the lead in 1957. Currently the emphasis is on joint European
efforts, resulting in 1989 in the Council of European Professional Informatics Societies
(CEPIS) but also in CEN TC 428 ICT Professionalism and Digital Competences, offi-
cially launched in 2014 [6].

Most of the activities in the digital skills and professionalism areas are now initiated,
financed, and accomplished in the EU context. Within the European Commission 2009-
2014 Neelie Kroes as a Vice-President was the first Commissioner to have responsibil-
ities in the digital domain. From that period on a boost of activities was created resulting
among other things in The EU Digital Single Market Strategy adopted in May 2015
[11]. Three pillars were mentioned:

* Better access for consumers and businesses to digital goods and services;

* Creating the right conditions and a level playing field for digital networks and innovative services to flourish;

* Maximizing the growth potential of the digital economy.

For IFIP and specially IP3 the report Development and Implementation of a Euro-
pean Framework for IT Professionalism in January 2017 is important [14]. In this re-
port the following was written “Standardizing is a means to further mature a profes-
sion. This is also the direction that the European Commission and key stakeholders
are following: the European e-Competence Framework (e-CF) evolved in April 2016
into a European Standard (EN 16234-1). The ambition is to do more. A European
framework for IT professionalism – as described in this report – would provide a
standard that includes not only IT competences, but also other essentials for any IT
professional: foundational body of knowledge, education and training qualification
and certification, and finally ethics and code of conduct”. Indeed in 2018 the Euro-
pean Commission promoted a standardization request to develop standards for the
ICT profession in the form of a comprehensive European framework by 2025 [8].

This push was taken serious by CEN TC 428. The first results are visible in 2020:

* A new release of the basic Framework e-CF has been made public. 41 competences are distinguished, divided over the dimensions Plan, Build, Run, Enable and Manage. Important change in this release is the addition of transversal aspects. Those aspects, 7 in total, recognize the relevance of several cross-cutting aspects that are important in the ICT workplace, like accessibility, ICT legal issues and sustainability [7].

* Expert teams are selected and are currently working on different topics within the ecosystem around the e-CF, like Ethics, the Body of Knowledge, Educational and
certification aspects and how standards like e-CF can be used in practice. Final products and thus standards are expected to be released in the coming 2 years [19].

In the meantime, a new commission is in place in Europe reacting on the rapidly changing world. That is also seen in the new policies of the European Union. Next to the fact that technology has to work for people and that Europe strives to create a fair and competitive digital economy, Europe's Digital Future is also linked to the climate-neutral by 2050 task. These priorities have as a result that the digital transformation monitor is transformed into the Advanced Technologies for Industry monitor. [10]. This monitor is looking at sixteen advanced technologies, that are a priority for European industrial policy and that enable process, product and service innovation throughout the economy, and hence foster industrial modernization. Interesting is the fact that what we formerly called new digital technologies are combined with engineering technologies. Advanced technologies are defined as recent or future technologies that are expected to substantially alter the business and social environment and include Advanced materials, Advanced manufacturing, Artificial Intelligence, Augmented and Virtual Reality, Big data, Blockchain, Cloud technologies, Connectivity, Industrial biotechnology, the Internet of Things, Micro- and nanoelectronics, IT for Mobility, Nanotechnology, Photonics, Robotics and Security. A first report on technology trends, technology uptake, investment and skills in advanced technologies has been published in July 2020 [9]. Also so called "softer skills" are considered in the research about the advanced technologies (see figure 1).

Still one element needs to be mentioned. Industry must have access to the relevant technical and digital skills, in order to respond to the disruptive force of today's technological advances. However, in Europe, the number of tech-savvy professionals does not meet the exponentially increasing current demand. The World Economic Forum (WEF) estimated that more than half of all employees will require significant reskilling by 2022 while around 37% of workers in Europe do not even have basic digital skills.

In conclusion we observe that in Europe the importance of having professionalism in the digital environment is on the agenda. It took a long time, perhaps even too long, to realize the importance of a digitally skilled workforce. A combination of the IT sector with other sectors is now seen as the opportunity to accelerate the growth of trained professionals in advanced technologies. Those other sectors have a longer history and a broader experience with standardization, regulation and setting up professional institutes and societies and a positive track record of implementing those skills in business environment.
<figure><img src="image_2.png" /><figcaption>**Fig. 1.** Which skills are most needed in the organization to implement advanced technology-based products and projects? Fig. 44 from the ATI General Findings Report [9]</figcaption></figure>

**4.5 North America**

The ACM, an international member of IFIP, engages in global support for IT profes-
sionalism. In terms of supporting policy decisions, the ACM's Global Policy Council
coordinates the work of the European and US Technical Policy committees. The ACM
European Technology Policy Committee promotes dialogue and the exchange of ideas
on technology and computing policy issues with the European Commission and other
governmental bodies in Europe, and the informatics and computing communities.
Recognizing the ubiquity of algorithms in our daily lives, as well as their far-reach-
ing impact, the ACM Europe Technology Policy Committee and the ACM US Tech-
nology Policy Committee, have issued a statement and a list of seven principles de-
signed to address potential harmful bias. The US ACM committee approved a statement
on automated decision making with Informatics Europe. ACM Europe Policy Commit-
tee and ACM Europe Council joined with Informatics Europe to produce a white paper
for policymakers and industry that outlined the technical, ethical, legal, economic, so-
cietal, and educational ramifications of automated decision making (ADM). When
Computers Decide: European Recommendations on Machine Learned Automated De-
cision Making presents 10 specific recommendations addressing the challenges posed
by the increased presence of machine learning and ADM.

ACM's US Technology Policy Committee (USTPC) serves as the focal point for ACM's interaction with all branches of the US government, the computing community, and the public on policy matters related to information technology. The USTPC established a subcommittee to provide guidance on issues of Algorithmic accountability and worked to guiding how professionals can address Data Privacy Risks and harms revealed by Facebook/Cambridge Analytica Inquiries

The ACM revitalized Code of Ethics reflecting the conscience of the computing pro-
fessional is one of the foundations for most policy documents. ACM is working on
support materials for its updated Code of Ethics fortifying its role in contributing to
articulating what it means to be a computing professional (https://www.acm.org/code-
of-ethics). The ACM Committee on Professional Ethics has presented multiple work-
shops on using the Code of Ethics in decision making and has produced webinars. They
are also developing support materials to support people and organizations who want to
use the Code. These documents address: a general ethical reasoning strategy- Proactive
CARE, Case studies, techniques to identify potential ethical problems, and examples
of the consequences of failure to address the needs of a broad range of stakeholders.

The ACM also models for professional behavior working on several projects for social good: partnering with the UN AI for Good Summit, is a partner of the Partnership on AI, that works with industry to use AI to benefit society. Various ACM Special Interest groups have awards for social impact.

The ACM Continues to contribute to shaping technical ethics policy worldwide. ACM's Computing Curriculum 2020 (CC2020) is a worldwide project to chart the future of computing education on a global scale that was produced by a task force of thirty-six professionals from sixteen countries and six continents.

5 Characteristics of the IT profession and IT professionals

The aims of the IP3 Professionalism in IT program are to improve the ability to exploit
the potential of information and communication technologies effectively and consist-
ently in all fields of human endeavor and to develop a profession which is respected,
trusted and valued. The recognition of the importance of professionalism in IT neces-
sitates a clear and concise understanding of the attributes and obligations that are re-
quired of IT professionals. In turn this demands a description of the profession of which
its members are the professionals. The IP3 Application and Assessment Guideline (IP3
2020) describes the criteria for the profession, the bodies which govern it and the pro-
fessionals who belong to it [15]. It serves to define the essence of professionalism upon
which all the building blocks of the profession are constructed.

**5.1 Profession**

The Australian Council of Professions defines a ‘Profession’ as: “a disciplined group of individuals who adhere to ethical standards and who hold themselves out as, and are accepted by the public as possessing special knowledge and skills in a widely recognised body of learning derived from research, education and training at a high level, and who are prepared to apply this knowledge and exercise these skills in the interest of others.” [2].

A profession must:

* be a community controlled by regulation or by a governing body/bodies (most usually professional institutions or associations) which directs the behavior of members of the community in professional matters;

* determine the knowledge, skills, attributes and experience required by professionals;

* give leadership to the public it serves in its specific field of activity;

* adhere to the general standards of professional communities and define those specific attributes and characteristics that distinguish a specific profession from others;

* be valued for its contribution to society.

**5.2 Regulated Professional Community**

A regulated professional community, e.g. a professional institution or society, must
have a means to:

* ensure that members of the community obtain and maintain an acceptable standard of professional competence;

* define the profession's core body of knowledge and competences;

* set appropriate minimum codes of conduct and professional standards set and enforce rules and standards which recognize and protect the public interest;

* take disciplinary action should the rules and standards not be observed or should a member be guilty of unprofessional work;

* support members in their commitment to adhere to the rules and professional standards

* provide enough capacity to implement and manage the above conditions.

Professional communities also undertake other activities (e.g. providing services to members, advising government) but the criteria listed above are the core requirements for a regulated professional community. Figure 2 shows this in a graphical way.
<figure><img src="image_3.png" /><figcaption>Fig. 2. Key elements of a professional society [17]</figcaption></figure>

5.3 Professional

An ICT professional, “is someone who has full accountability for their own technical work and responsibilities; whose decisions can impact on the success of projects; who develops business relationships with customers; who must apply fundamental principles in a wide and often unpredictable range of contexts; and, who can analyze, diagnose, design, plan, execute and evaluate work to time, cost and quality targets. In addition, they can communicate effectively, demonstrate leadership, and keep their skills up to date. They are creative, innovative, and aware of their impact on social, business, and ecological environments. Their knowledge and actions are able to influence direction within the organization, their peers and industry.” [20].

“A fully established professional is a practitioner who has specific skills rooted in a broad base and appropriate qualifications, belongs to a regulated body, undergoes continuous development, operates to a code of conduct and recognizes personal accountability.” [24].

“Given the reach of ICT in our lives, it is important for an ICT professional to be technically strong (in order to use the right technology for the relevant problem), ethically grounded (to ensure that technology is put to the right use), socially conscious (so that the technical solution takes into consideration elements of sustainability) and business savvy (to ensure commercial viability which is required for social prosperity and funding of new developments).” [16].

And, as with professionals working in other professions, the IT professional must:
* conform to a published code of conduct;

* know, and work within, the limits of their capabilities;

* be accountable for and submit to peer review of their actions;

* undertake continuous professional development;

* have their competence to practice re-assessed on a regular basis;

* explain the implications of their work to stakeholders;

* recognize obligations to the profession as well as to their employer;

* have regard to the public good;

* contribute to the development of the profession;

* support other professionals in maintaining professional standards and developing professional competence.

## 5.4 National variations

Implementations of professionalism vary from country to country and discipline to discipline. In some there are autonomous professional institutions while in others there are combinations of nationally approved qualifications and statutory regulation. This guideline does not seek to advance any model but is concerned only that, whatever the model, the professional community meets the minimum standards identified.

# 6 IFIP / IP3

## 6.1 Start and goal of IP3

One of IFIP's strategic aims is to "Advance professionalism in ICT" by:

1. Promoting appropriate bodies of knowledge for ICT practitioners;

2. Promoting common skills and competencies frameworks;

3. Promoting accreditation and certification;

4. Promoting high quality ICT education;

5. Promoting life long learning.

At the IFIP World Computer Congress 2006 in Santiago de Chile a decision was made to "initiate a vigorous program of activity to promote professionalism worldwide". This was the result of a workshop with representatives of IFIP member societies, some of them already having a professional scheme.

IFIP General Assembly (GA) in 2007 confirmed the intention for IFIP to create and launch a global IT Professional Practice Program. IP3 as International Professional Practice Partnership was approved in 2009 and in 2015 formally recognized by incorporating it into the IFIP Statutes.

IP3's primary focus is on the professional behavior of practitioners through the accreditation of association schemes. We also endeavor to influence global policy on Professionalism in ICT through partnerships with companies and other bodies.
**Mission**

The IP3 mission is to establish a global partnership that will strengthen the ICT pro-
fession and contribute to the development of strong international economies by creating
an infrastructure that will:

* encourage and support the development of both ICT practitioners and employer organizations;

* give recognition to those who meet and maintain the required standards for knowledge, experience, competence and integrity;

* define international standards of professionalism in ICT.

To carry out this mission, IP3 works closely with its partners who share a commitment to creating a sound global ICT profession.

**Vision**

A vigorous program to promote professionalism in the IT profession equal to the
older and longer established professions; define international standards and create a
global infrastructure that will encourage and support the development of both practi-
tioners and employer organizations in the developed and developing world through the
creation of a worldwide set of professional certification schemes recognized as the hall-
mark of true IT professionalism, delivered through independent national member soci-
eties and supported by development frameworks for both individuals and organizations.

**6.2 Activities – Accreditation**

Much of IFIP's focus is on knowledge development and knowledge sharing, through technical committees and working groups. IP3's focus is on the standards applied by the practitioners when using that knowledge to deliver products and services. Many of the bodies representing practitioners around the world had already developed processes for recognizing certain classes of members and IP3 seeks to bring together best practice to enable registered practitioners to be recognized wherever they may be.

To this end, IP3 developed its Accreditation of Professional Member Schemes. The following extracts from the IP3 Application and Assessment Guidelines (2020 edition) set the scene for the Accreditation process [17].

The Accreditation Process followed by the IP3 Standards & Accreditation Council is essentially an audit of the professional body's own process for certifying the professional status of its members, applying the IP3 criteria in measuring performance. For example, the association shall produce a certification scheme (the Scheme) that contains a description of the IT practitioners to be certified. The Scheme should include the following:

* a list of the tasks, jobs, and positions that the certified IT practitioner would be ex-
expected to undertake (the Scope);
* a description of the level of accountability, responsibility, autonomy, authority and complexity of the work expected that is easily understood (Professional Competences) and that is compared with the relevant IP3 standard;

* a description of the appropriate Technical Competences expressed in relation to a framework, the body of knowledge, cognitive levels, skills, and performance levels;

* minimum qualifications;

* a description of how competences are evaluated;

* Codes of Ethics and professional Practices, along with disciplinary processes.

The assessment used by the Scheme should be based on a body of knowledge (BoK). For each component of this body of knowledge, the Scheme should state the cognitive level expected of a successful candidate for certification. The Scheme should describe processes for maintaining currency and relevance of the body of knowledge.

The Scheme shall identify those generic practitioner skills expected of a practitioner in the environment in which the candidate will operate.

## Mutual Recognition

An important element for a global profession is mutual recognition. It is a requirement of IP3 that all accredited organizations must be prepared to 'recognize' the IP3 accredited certifications of other member organizations when considering transfer applications.

The requirement for such 'recognition' does not mean that transferees have an automatic right of entry to all other IP3 member organisations. But it does imply that each accredited body must attach a value to an IP3 accredited certification - irrespective of which membership body awarded that certification – and that such value must be clear and consistent. It also means that any 'top-up' requirements - i.e. any requirements over and above the IP3 accredited certification - are equally clear and consistent.

Top-up requirements are intended to bridge the gap between the standards evidenced by the IP3 accredited certification and the standards required generally by the receiving organisation and/or to meet specific local requirements. However, it is essential that these gaps or local requirements must be both real and reasonable.

It is an essential principle that any agreed top up requirements must be applied consistently to transfer applicants from all other IP3 member bodies unless such transfers are governed by an overriding mutual recognition agreement. It is open to any accredited body to enter a formal written mutual recognition agreement with another body and this will then set the terms of transfer between the parties to the agreement. In the absence of such agreement all top requirements must be imposed on all transfer applicants without variation or exemption, irrespective of their home association.

In the territories where the IP3 Accreditation has been achieved, there is general agreement that the Scheme is beneficial to both the professional body and to its member practitioners. At its core is the achievement of IP3's goal of "Partnering for Trust in Digital".
## 6.3 Activities – Other

### Conferences

The 20th IFIP World Computer Congress (WCC 2008) took place in Milan, Italy. A specific conference was dedicated to ICT Professionalism and Competences. At the conclusion of this conference, representatives of IP3 and several Computer Societies formally recognized the importance of the ICT Profession: "We recognize that information and communication technologies (ICT) now impact almost every facet of personal and business life. Such technologies are key drivers of innovation and of both economic and social progress, making enormous contributions to prosperity and to the creation of a more open world, enabling pluralism, freedom of expression, and allowing people and organizations to share their culture, interests and undertakings worldwide. We believe that such powerful technologies, and their application, must be driven by competent and reliable professionals who can demonstrate the necessary Competences (including knowledge), Integrity, Responsibility and Accountability, and Public Obligation." [18].

ICT is recognized as a global profession. Several undertakings and recommendations were agreed to by the signatories. This Milan declaration [18] was a serious undertaking that all parties would work towards the same goal, albeit through different structures.

IP3 has held conferences or workshops at all IFIP World Computer Congresses since 2008. We have also held Thematic Workshops at the World Summit for Information Society (WSIS), held in Geneva, every year since 2012. In the first few years, we promoted the Professionalism in ICT, and its importance to the Knowledge and Information Society. Since the launch of the iDOCED campaign (see below), our workshops have explored the Duty of Care the digital landscape requires from all – producers of digital products and systems, consumers, end-users and institutions that procure these services.

### iDOCED

IP3 launched iDOCED, the IFIP Duty of Care for Everything Digital Initiative in Sydney on 2 December 2016. iDOCED aims to promote Trust in Digital and the duty of care that everyone including governments; organizations, and other actors and stakeholders have in a digital world. It is designed to remind and support both providers and consumers of digital products and services that they have a duty of care in ensuring that they act responsibly.

Past IP3 Chair, the late Brenda Aynsley, said iDOCED was developed in response to numerous instances of poor ethical behaviour by companies, low quality or underperforming products, or a lack of care by digital consumers in how they use social media or access the Internet – all of which create negative impacts for the community.

Users can be compromised by the way they access the Internet or use software or various online tools. iDOCED seeks to raise awareness of what users can and should do to protect themselves in today's digitally connected world. We often liken it to keeping oneself and our families as safe as possible, only calling on the police and security forces when things go wrong. We need to adopt the same attitude with digital products
and services and not leave it to someone else to keep us safe – hence everyone has a
duty of care.

IP3 also advocates the need for companies to act responsibly and ethically in the
development and implementation of commercial products and services.

Individuals and companies buying digital products and services must apply due dil-
igence and demand that suppliers demonstrate Honour, Integrity and Trust in all their
dealings with them. This supports the need for those who produce digital products and
services to be professional. The best way for them to demonstrate this is to partner with
their local ICT bodies and Computer Societies to become IP3 accredited.

As a global body with members all over the world, IP3 works proactively with pro-
fessional bodies and other stakeholders in industry and government to raise awareness
of iDOCED and encourage its wide adoption. As this happens more widely, consumers
will be able to rely on the AI of Everything and the Internet of Everything as being
trustworthy and safe for them and their families to engage with and rely upon for com-
munication, transactions and more.

In December 2017, IP3 presented a workshop on Trust and the Duty of Care at the
Internet Governance Forum (IGF) in Geneva.

Global Industry Council (GIC)

The support of the international employer community is critical to IP3's goal of build-
ing ICT professionalism globally. Recognizing this criticality, IP3 established its
Global Industry Council as the principal forum within which ICT employers can engage
with IP3 and influence the development of the global profession.

It is the intention that IP3-GIC is a prestigious organization comprised of recognized
thought leaders from major organizations (both private and public sector) with
acknowledged experience and expertise in information and communication
technologies and that a seat at the Council reflects the global third-party validation that
is only possible through a 50+ year old body with UN roots.

Global Industry Council Directors are specially nominated and invited to serve as internationally recognized luminary executives, thought leaders, and visionaries and for their strong history of providing substantive contributions to global business, industry, society, education, and governments. The IP3-GIC is a first of its kind focusing on computing as a profession, which will further align computing with organizational strategy and business agility driving sustainability, education, risk management and security, skills development, professional standards, innovation, entrepreneurship, business growth, regional GDP growth, high yield investment opportunities, and regional economic development.

One of the significant achievements of the Global Industry Council was the
development and online publication of the Skills2020 guide in 2015 [16]. This work
considered what the ICT skills requirements were likely to be in 2020, with the
objective of providing employers with a blueprint for planning the development and
acquisition of human capital. It can also be used by an individual to plan their careers.
## Developing Relationships

IP3 continually seeks to develop partnerships and engage broadly with industry, government, education and other influencers of ICT professional practice and particularly with other associations such as ISACA, ICCP, FEAPO, ITU, UNESCO, ICC, to name but a few.

IP3 supports the work done by other organisations who are developing ICT as a Profession, most especially the EU. We believe our work is synergistic, and best practice must be shared.

## 7 Towards the future

Although a lot has been achieved in the last decade, there is still a lot to be achieved in establishing a true global multi-stakeholder partnership in order to achieve a global profession that benefits everybody. Professionals and professional societies have to increase the efforts because developments in the ICT world continue to go at a speed that gives reason for concern if not done and managed in a professional way. IP3 will continue to work towards ICT as a Global Profession, and partner with organizations who embrace the same goals.

We are developing a project "Digital Skills for Everyone, Everywhere" (working title). both within and across countries. To reap the full benefits of new technologies, investments are needed in education and skills.

The goals and deliverables for this project are:

* Make a repository of best practices, frameworks and use cases worldwide round the development and the usage of frontline digital technology.

* Create a body of knowledge and education program around how to behave in the global professional ICT world.

* Formulate practical recommendations based on findings.

* Start a platform of experts based on the inventory of best practices and use cases around the development of the ICT profession.

* Provide recommendations and platforms for Digital Skills aimed at end-users and consumers, as well as ICT Professionals.

We hold the conviction that any program must address real-world needs and should promote the "FAIR" Principles: Findable, Accessible, Interoperable, and Re-usable.

It is envisaged that the project will partner with UN organisations, Academic Institutes (for research), and global non-profit organisations whose goal is community upliftment. We are confident that the work will align, to a lesser or greater extent, with the UNs Sustainable Development Goals. For example, SDG 9 – Decent work and Economic Growth – for economic growth and sustainability, digital transformation is essential. 21st Century Digital Skills are essential for decent work, and to counteract the negative effects of Automation and Robotics.
References

1. Australian Computer Society (ACS) Certification, https://www.acs.org.au/profession-alrecognition/certification-landing-page.html, last accessed 2020/7/8

2. Australian Council of Professions, https://www.professions.org.au/what-is-a-professional, last accessed 2020/7/8

3. Australian Professional Standards Councils, https://www.psc.gov.au/professional-standards-schemes/what-are-schemes, last accessed 2020/7/8

4. BBC News - a, Volkswagen loses landmark German 'dieselgate' case, 25 May 2020, https://www.bbc.com/news/business-52795376?intl_from_url=https://www.bbc.com/news/top-ics/ck3nz6nm8lqt/diesel-emissions-scandal&link_location=live-reporting-story, last accessed 2020/08/07

5. BBC News - b, https://www.bbc.com/news/business-53676205, last accessed 2020/08/07

6. CEN TC 428, https://stand-ards.cen.eu/dyn/www/f?p=204:7:0:::FSP_ORG_ID:1218399&cs=1600F0DD849DA04F3E3B900863CB58F72, last accessed 2020/9/5

7. e-CF, European e-Competence Framework, https://www.ecompetences.eu/

8. European Commission, 2018 Rolling plan ICT standardization, https://ec.europa.eu/growth/content/2018-rolling-plan-ict-standardisation-released_en, last accessed 2020/9/5

9. European Commission, ATI General Findings Report 2020, https://ati.ec.europa.eu/reports/eu-reports/report-technology-trends-technology-uptake-investment-and-skills-advanced. Last accessed 2020/9/5,

10. European Commission, Digital Transformation Monitor, https://ec.europa.eu/growth/tools-databases/dem/monitor/content/welcome, last accessed 2020/9/5

11. European Commission, Shaping the Digital Single Market, https://ec.europa.eu/digital-single-market/en/policies/shaping-digital-single-market, last accessed 2020/9/5

12. Forbes, https://www.forbes.com/sites/siladityaray/2020/08/04/faa-proposes-changes-that-would-allow-boeings-737-max-to-resume-flying/#7fbe306420f2, last accessed 2020/08/08

13. Franceschi-Bicchierai, Lorenzo: Equifax Was Warned, VICE, 26 October 2017, https://www.vice.com/en_us/article/ne3bv7/equifax-breach-social-security-numbers-researcher-warning, last accessed 2020/09/12

14. ICT Professionalism, http://ictprofessionalism.eu/documents/, last accessed 2020/9/5

15. IFIP IP3 Application and Assessment Guidelines 2020, https://www.ipthree.org/wp-content/uploads/IP3-Application-Accreditation-Guidelines-v8.pdf, last accessed 2020/9/5

16. IFIP IP3 GIC 2015, GIC 2020 Skills Assessment, IFIP / IP3 GIC Directors, 2015, https://www.ipthree.org/ifipip3-global-industry-council/gic-2020-skills/, last accessed 2020/9/5

17. IFIP IP3 Key elements of a profession, https://www.ipthree.org/knowledge-portal/best-practice/, last accessed 2020/9/5

18. IFIP WCC 2008, Declaration on ICT Professionalism and Competences, IFIP WCC 2008, Milan, http://www.ifip.org/images/stories/ifip/public/Announcements/wcc08-ict-p&c-declaration.pdf, last accessed 2020/9/5

19. IT Professionalism Europe, Body of Knowledge, https://itprofessionalism.org/about-it-professionalism/body-of-knowledge/, last accessed 2020/9/5

20. Lindley, David., Aynsley, Brenda., Driver, Michael., Godfrey, Hart, Robert., Heinrich, Glen., Unhelkar, Bhuvan. and Wilkinson, Kim.: Educating for professionalism in ICT: Is
learning ethics professional development? In: Weckert, John., Lucas, Richard. (eds.) Professionalism in the Information and Communication Technology Industry ch 11, ANU E Press, The Australian National University Australia (2013), http://press-files.anu.edu.au/downloads/press/p223541/html/intro05.xhtml?Referer=&page=24, last accessed 2020/08/07

21. Lynch, Luann., VW emissions and the 3 factors that drive ethical breakdown, Business, Ethics & Society, University of Virginia, https://ideas.darden.virginia.edu/vw-emissions-and-the-3-factors-that-drive-ethical-breakdown, last accessed 2020/08/07

22. Patel, Prachi., Engineers, Ethics, and the VW Scandal, IEEE Spectrum, 25 Sep 2015, https://spectrum.ieee.org/cars-that-think/at-work/education/vw-scandal-shocking-but-not-surprising-ethicists-say, last accessed 2020/08/07

23. Professional Employees Award 2020, https://www.fwc.gov.au/documents/documents/modern_awards/pdf/ma000065.pdf, last accessed 2020/7/8

24. Thompson C. (2008) IT Professional role today and tomorrow. In: Mazzeo A., Bellini R., Motta G. (eds) E-Government Ict Professionalism and Competences Service Science. IFIP International Federation for Information Processing, vol 280. Springer, Boston, MA

25. US Department of Justice, Office of Public Affairs, Friday, August 25, 2017, https://www.justice.gov/opa/pr/volkswagen-engineer-sentenced-his-role-conspiracy-cheat-us-emissions-tests, last accessed 2020/08/07

26. US District Court for the Northern District of Georgia, Atlanta Division, Consolidated consumer class action complaint, Case 1:17-md-02800-TWT Document 374 Filed 05/14/18, https://www.equifaxbreachsettlement.com/admin/services/connectedapps.cms. extensions/1.0.0.0/ed93e6d9-c6b0-4829-994c-a7687661917f_1033_Consolidated-Consumer-Class-Action-Complaint-20180514.pdf, last accessed 2020/09/12

27. US Federal Aviation Administration, Recommendation No 8, Joint Authorities Technical Review (JATR), US Federal Aviation Administration, Preliminary Summary of the FAA's Review of the Boeing 737 MAX, August 3, 2020, p 71, https://www.faa.gov/news/me dia/attachments/737-MAX-RTS-Preliminary-Summary-v-1.pdf, last accessed 2020/08/08

28. US House of Representatives, Committee on Transportation and Infrastructure, Final Report: The Design, Development and Certification of the Boeing 737 MAX, p 19, https://transportation.house.gov/committee-activity/boeing-737-max-investigation, last accessed 2020/09/21

29. Ibid p 24

30. Ibid p 238

31. Ibid p 14