7-1
Ethics in Information Technology, Sixth Edition
Chapter 7
Ethical Decisions in Software Development
At a Glance
Instructor’s Manual Table of Contents
• Overview
• Objectives
• Teaching Tips
Lecture Notes
Overview
Chapter 7, “Ethical Decisions in Software Development,” provides a thorough discussion of the
software development process and the importance of software quality. It covers the ethical and
economic issues that software manufacturers must consider when deciding “how good is good
Objectives
As students read this chapter, they should consider the following questions:
• What is meant by software quality, why is it so important, and what potential ethical
issues do software manufacturers face when making decisions that involve trade-offs
between project schedules, project costs, and software quality?
7-2
Ethics in Information Technology, Sixth Edition
• What are some effective strategies for developing quality systems?
Teaching Tips
Organizations Behaving Badly
1. Briefly discuss some of the types of software systems that are used by airlines, and the
I. Software Quality and Why It Is Important
1. Introduce the terms high-quality software systems and software defect.
2. Briefly discuss some notable software bugs that have occurred over the past several years
(see page 266).
6. Another factor that can contribute to poor-quality software is the extreme pressure that
software companies feel to reduce the time to market their products. Emphasize that a
major ethical dilemma for software development organizations is: “How much additional
cost and effort should we expend to ensure that our products and services meet
Teaching
It may not be intuitive to students who have never written a computer program,
or who are new to programming, why professionally developed software would
7-3
Ethics in Information Technology, Sixth Edition
A. The Importance of Software Quality
1. Introduce the term business information system, and note that a common type of
business system is one that captures and records business transactions.
3. Explain that software is used to control many industrial processes in an effort to reduce
4. As a result of the increasing use of computers and software in business, many companies
5. Point out that business executives frequently face ethical questions of how much money
and effort they should invest to ensure the development of high-quality software. Explain
B. Software Product Liability
1. Introduce the terms product liability and strict liability.
2. Defendants in a strict liability action may use several legal defenses, including the
doctrine of supervening event, the government contractor defense, and an expired statute
3. Remind students that negligence is the failure to do what a reasonable person would do,
4. Introduce the terms contributory negligence, warranty, and breach of warranty.
Teaching
Tip
Emphasize that the importance of addressing the ethical implications of decisions
about whether or not to release software with known defects. Discuss how
managers might balance the competing interests involved when making such a
decision.
7-4
Ethics in Information Technology, Sixth Edition
6. Remind students that intentional misrepresentation occurs when a seller or lessor either
Critical Thinking Exercise: Software Warranty
1. In this situation, the software firm must carefully balance its marketing and legal
priorities. While a strong warranty that includes specifics regarding what the software
will and will not do may help sell more software, it also has the potential to put the
company in financial jeopardy if the software fails to live up to the specific warranties. In
II. Strategies for Developing Quality Software
1. As individuals and organizations have come to increasingly rely on software, developers
have identified multiple strategies for ensuring the quality of their software. These
A. Software Development Methodologies
1. Point out that systems analysts, programmers, architects, database specialists, project
managers, documentation specialists, trainers, and testers are all involved in large
software projects.
2. Explain that most software companies have adopted a specific software development
7-5
Ethics in Information Technology, Sixth Edition
help agile project teams make ethical decisions in the development of quality software.
Use Figure 7-3 to aid the discussion.
8. Students should understand how the use of an effective methodology can protect software
manufacturers from legal liability.
Software Testing
1. Explain that software is developed in units called subroutines or programs.
3. Introduce and briefly discuss the terms static testing, unit testing, integration testing,
system testing, and user acceptance testing.
B. Capability Maturity Model Integration
1. Explain that Capability Maturity Model Integration (CMMI) models are collections
2. Point out that CMMI models are developed by product teams with members from
industry, government, and the Carnegie Mellon Software Engineering Institute.
Teaching
Tip
It may be helpful to provide some examples that illustrate why it is more cost
effective to identify defects early, rather than late, in the development cycle.
Students interested in learning more about quality assurance, can read the
https://www.us-cert.gov/bsi/articles/best-practices/white-box-testing.
Teaching
To learn more about white box testing, visit the US-CERT website:
7-6
Ethics in Information Technology, Sixth Edition
3. Introduce the term CMMI-Development (CMMI-Dev)—a specific application of
CMMI frequently used to assess and improve software development practices.
4. Point out that CMMI defines five levels of software development maturity and identifies
Quick Quiz 1
1. _____ is the degree to which a software product meets the needs of its users.
2. The liability of manufacturers, sellers, lessors, and others for injuries caused by defective
products is commonly referred to as _____.
3. A(n) _____ warranty assures buyers or lessees that a product meets certain standards of
quality.
4. Under the _____ methodology, a system is developed in iterations (often called sprints)
lasting from one to four weeks,
5. Black-box testing and white-box testing are both forms of _____ testing.
C. Developing Safety–Critical Systems
1. A safety-critical system is one whose failure may cause injury or death. Explain that the
safe operation of many safety-critical systems relies on the flawless performance of
7-7
Ethics in Information Technology, Sixth Edition
navigation; elevators; and a wide range of medical devices. Use the examples on page
278 to aid the discussion.
2. Introduce the terms system safety engineer and hazard log.
D. Risk Management
1. Introduce the term risk—the potential of gaining or losing something of value.
2. Highlight the three elements by which risk can be quantified: a risk event, the probability
of the event happening, and the impact (positive or negative) on the business outcome if
the risk does actually occur.
5. Introduce the following strategies for addressing a particular risk: acceptance,
avoidance, mitigation, redundancy, and transference.
6. Explain that N-version programming is a mitigation technique used to minimize the
7. Explain that after an organization determines all pertinent risks to a system, it must
decide what level of risk is acceptable. This decision is extremely difficult and
8. Introduce the term reliability—a measure of the rate of failure that would render it
Ask students to read and then discuss the following Forbes article about alleged
failures in Tesla’s autopilot software, “Tesla Customers Sue Over ‘Dangerous’
7-8
Ethics in Information Technology, Sixth Edition
9. Point out that one of the most important and difficult areas of safety-critical system
E. Quality Management Standards
1. The International Organization for Standardization (ISO), founded in 1947, is a
2. The ISO 9001 family of standards serves as a guide to quality products, services, and
3. Discuss the steps involved in becoming ISO 9001 certified.
Failure Mode and Effects Analysis
1. Explain that the failure mode and effects analysis (FMEA) is an important technique
used to develop ISO 9000-compliant quality systems by both evaluating reliability and
determining the effects of system and equipment failures.
Critical Thinking Exercise: Faulty Airbag Software
1. Students’ answers to these questions may vary. A company making such decisions may
undertake an analysis to come up with the estimated loss from this particular risk. The
Teaching
More information on ISO 9001 can be found at the ISO website:
7-9
Ethics in Information Technology, Sixth Edition
Quick Quiz 2
1. What is a safety-critical system?
2. _____ is the potential of gaining or losing something of value.
3. _____ is an approach to minimizing the impact of software errors by independently
implementing the same set of user requirements N times.
4. A common way for an individual or an organization to accomplish risk _____ is to
purchase auto or business liability insurance.
5. The _____ serves as a guide to quality products, services, and management.
Discussion Questions
1. Would you choose to use the waterfall system development model or the agile
2. Is it possible to make a safety-critical system 100 percent reliable and 100 percent safe?
Should there be legal standards for reliability and safety for such systems? If so, should
3. Are the maturity levels in the CMMI in part representative of how long a product has
been on the market? For example, if a product is new, is it more likely to be in the first
7-10
Ethics in Information Technology, Sixth Edition
Additional Projects
1. Write a paper that compares black-box testing to white-box testing, including an analysis
of when each type of test is most appropriate.
Additional Resources
1. Software QA and Testing Resource Center (www.softwareqatest.com)
Key Terms
acceptance: When an organization decides to accept a risk because the cost of avoiding the risk
outweighs the potential loss of the risk. A decision to accept a risk can be extremely difficult and
controversial when dealing with safety-critical systems because making that determination
annualized loss expectancy (ALE): The estimated loss from a potential risk event over the
course of a year. The following equation is used to calculate the annual loss expectancy: ARO ×
SLE = ALE. Where ARO is the annualized rate of occurrence, an estimate of the probability that
this event will occur over the course of a year and SLE is the single loss expectancy, the
estimated loss that would be incurred if the event happens.
7-11
Ethics in Information Technology, Sixth Edition
organizational requirements and factors beyond an organization’s control.
best practice: A method or technique that has consistently shown results superior to those
achieved with other means, and that is used as a benchmark within a particular industry.
Capability Maturity Model Integration (CMMI) models: A collection of best practices that
help organizations improve their processes
CMMI-Development (CMMI-DEV): A specific application of CMMI frequently used to assess
and improve software development practices.
dynamic testing: A QA process that tests the code for a completed unit of software by actually
entering test data and comparing the results to the expected results.
failure mode: A description of how a product or process could fail to perform the desired
functions described by the customer.
failure mode and effects analysis (FMEA): An important technique used to develop ISO 9000-
compliant quality systems by both evaluating reliability and determining the effects of system
and equipment failures.
7-12
Ethics in Information Technology, Sixth Edition
linkages among the various subsystems work successfully.
ISO 9001 family of standards: A set of standards written to be served as a guide to quality
products, services, and management. It provides a set of standardized requirements for a quality
management system.
quality assurance (QA): Methods within the development process that are designed to
guarantee reliable operation of a product.
quality management: The defining, measuring, and refining of the quality of the development
process and the products developed during its various stages. The objective of quality
management is to help developers deliver high-quality systems that meet the needs of their users.
risk management: The process of identifying, monitoring, and limiting risks to a level that an
organization is willing to accept.
safety-critical system: A system whose failure may cause human injury or death.
single loss expectancy (SLE): The estimated loss that would be incurred if a risk event occurs.
7-13
Ethics in Information Technology, Sixth Edition
static testing: A software-testing technique in which software is tested without actually
executing the code. It consists of two steps—review and static analysis.
transference: A risk management strategy in which the risk, should it happen, does not rest
solely on one individual or organization. For example, a common way to accomplish risk
transference is for an individual or an organization to purchase insurance, such as auto or
business liability insurance. Another way to transfer risk is to outsource the risk by contracting
with a third party to manage the risk.