Ethical decision-making in practice

Lesson 4 set out the code of ethics, the common issues it addresses and a structured way to work through a dilemma. Knowing the rules is not the hard part. Almost every engineer involved in a major disaster knew the code, and most were decent people who did not set out to harm anyone. The harder questions are why capable, well-meaning engineers and organizations drift into decisions that later look indefensible, how to recognize the drift while it is happening, and how to act effectively when you see something wrong. This lesson examines the psychology and organizational pressures behind ethical failures, practical tools for grey-area decisions, the law and practice of raising concerns, ethics in international work, and three modern cases: the Boeing 737 MAX, the Volkswagen emissions scandal and the Grenfell Tower fire.

Why good engineers make bad decisions

Investigations of engineering disasters rarely find villains. They find ordinary people making a series of decisions, each of which seemed reasonable at the time, under pressure of schedule, cost and loyalty. Researchers have identified several recurring patterns:

• Normalization of deviance. The sociologist Diane Vaughan, studying the Challenger disaster (Lesson 4), described how NASA engineers saw O-ring erosion on flight after flight. Because nothing catastrophic happened, each instance was accepted as within experience, and the acceptable level of damage crept upward until a launch in record cold destroyed the shuttle. An anomaly that is tolerated often enough comes to be seen as normal.
• Incrementalism. Large wrongs are reached in small steps: rounding a test result, then omitting an awkward data point, then signing a report that the data do not support. Each step makes the next one easier and makes it harder to admit the earlier ones.
• Groupthink. Cohesive teams under pressure suppress doubts to maintain agreement. Members assume silence means consent, and dissenters are seen as disloyal.
• Obedience and diffusion of responsibility. People defer to authority and assume someone else, a manager, a checker or a regulator, is responsible for catching problems. When everyone thinks someone else will act, no one does.
• Moral disengagement. People reframe harmful actions in comfortable language ("optimizing the test procedure", "managing the regulator"), compare them with worse conduct, or blame the victims or the system.
• Conflicts of goals. Organizations reward schedule and cost performance visibly and immediately; safety is rewarded only by the absence of accidents, which nobody notices.

Knowing these patterns helps you notice them in yourself and your team. Signs of trouble include euphemisms for problems, an "us versus the regulator" attitude, punishment of people who raise concerns, data that are always just good enough, and the phrase "we have always done it this way".

Organizational culture and psychological safety

Ethical behaviour depends heavily on the environment. In organizations with a strong safety culture, leaders make clear that bad news is welcome, people are thanked for stopping work they believe is unsafe, near misses are reported and studied rather than hidden, and engineering judgement is not overruled by schedule without a documented decision by someone with authority. Researchers call the underlying condition psychological safety: team members believe they can speak up, admit mistakes and ask questions without being punished or humiliated. Teams with high psychological safety catch more errors early.

Engineers help build that culture at every level. Junior engineers can ask "how do we know?" and "what would have to be true for this to be safe?" Senior engineers can model admitting their own mistakes and can respond to concerns with curiosity rather than defensiveness. Managers can separate the people who make schedule decisions from those who certify technical acceptability, so that the two pressures do not fall on one person.

Tools for grey areas

Many ethical questions are not clear-cut. Besides the step-by-step approach of Lesson 4 and the newspaper test, three tools help:

• Line drawing. Place the case on a spectrum between a clearly acceptable paradigm (a positive example) and a clearly unacceptable one (a negative example), feature by feature. If the case sits much closer to the negative paradigm, treat it as unacceptable.
• Stakeholder analysis. List everyone affected (users, workers, neighbours, future generations, the client, your employer, yourself) and what each stands to gain or lose under each option. Options that impose serious risks on people who have no say and receive no benefit deserve particular scrutiny.
• Creative middle ways. Dilemmas often look like a choice between two bad options because no one has looked for a third. A better option might meet the legitimate interest of each party: a temporary operating restriction instead of either a full shutdown or business as usual, or a quick independent review instead of either signing or refusing.

Raising concerns and whistleblowing in practice

Lesson 4 described the path for raising a concern: internally first, in writing, then to the owner, authority or regulator if the danger remains. In practice, how you raise a concern affects whether it is heard. Experienced engineers advise:

• Be sure of your facts. Check your calculations, get a second opinion from a colleague you trust, and separate what you know from what you suspect.
• Focus on the hazard and the evidence, not on people's motives. "The measured wall thickness is below code minimum; here are the readings" is harder to dismiss than "management is putting profits ahead of safety".
• Propose solutions. Offer options that address the risk at the lowest reasonable cost.
• Write it down. Send a short, factual memo or email, keep copies, and record responses. Written records protect the public and you.
• Use the channels that exist: ethics hotlines, safety committees, quality systems, the regulator's practice advisors.
• Escalate when necessary, and do not stop because the first person says no. If a real danger to the public remains, the code requires you to go further.

Legal protection for employees who report wrongdoing in Canada is a patchwork. Section 425.1 of the Criminal Code makes it an offence for an employer to retaliate against an employee who provides information about an offence to law enforcement. Federal public servants are protected by the Public Servants Disclosure Protection Act; several provinces have similar laws for their public sectors; occupational health and safety laws prohibit reprisals against workers who raise safety concerns or refuse unsafe work; and securities regulators protect some reports of corporate wrongdoing. Engineering regulators expect members to report dangers, and APEGA and other regulators offer confidential advice on how to proceed.

Whistleblowers have often paid a heavy personal price, in careers, relationships and health, even when they were right. Roger Boisjoly, the Thiokol engineer who warned against launching Challenger, was shunned by colleagues afterwards. That is a reason for organizations to protect people who speak up, and for engineers to raise concerns early, when they are easier to resolve, rather than a reason to stay silent.

Ethics in international practice

Engineers increasingly work across borders, for multinational firms, on projects financed by development banks, or with suppliers around the world. Practices that are illegal or unethical at home, such as paying officials to win contracts or speed approvals, may be common elsewhere. The law is clear that this is no excuse.

Canada's Corruption of Foreign Public Officials Act makes it a crime for Canadian individuals and companies to bribe foreign officials, with penalties of up to 14 years in prison, and since 2017 even small "facilitation payments" to speed routine services are prohibited. In 2019 a subsidiary of the engineering firm SNC-Lavalin pleaded guilty to fraud over payments made to obtain contracts in Libya, and the World Bank had earlier barred the firm from its projects for ten years over a bridge project in Bangladesh. Such cases damage the reputation of the whole profession.

Other international issues include respecting local laws and communities while upholding safety and environmental standards no lower than you would accept at home, avoiding exploitative labour practices in supply chains, and recognizing that a design that works in one climate, culture or regulatory system may not transfer directly to another.

Case: the Boeing 737 MAX

In October 2018 a Lion Air 737 MAX crashed in Indonesia, and in March 2019 an Ethiopian Airlines 737 MAX crashed near Addis Ababa, killing 346 people in all. Both crashes involved the Maneuvering Characteristics Augmentation System (MCAS), software added to make the MAX, with its larger, more forward-mounted engines, handle like earlier 737s. MCAS could repeatedly push the aircraft's nose down based on a single angle-of-attack sensor; when that sensor failed, pilots fought the system without understanding what was happening, because MCAS had been left out of pilot manuals and training to avoid costly simulator training requirements.

Investigations by US Congress and others found that Boeing had expanded MCAS's authority late in development without fully reassessing the hazard, that much of the safety certification had been delegated to Boeing employees acting on behalf of the regulator, and that commercial pressure to compete with the Airbus A320neo shaped key decisions. The MAX was grounded worldwide for about 20 months, Boeing paid more than $2.5 billion (US) under a 2021 agreement with the US Department of Justice, and certification rules were changed. Lessons include the danger of single points of failure in safety-critical systems (Lesson 6), the need to reassess safety after design changes, and the conflicts that arise when a manufacturer certifies its own product.

Case: the Volkswagen emissions scandal

In September 2015 the US Environmental Protection Agency announced that Volkswagen had installed software in about 11 million diesel cars worldwide that detected when a car was being tested and switched on full emissions controls, then reduced them in normal driving, when the cars emitted up to 40 times the permitted nitrogen oxides (CHEM-103). The "defeat device" let the company market clean diesels without the cost of more effective emissions hardware. The scandal cost Volkswagen more than 30 billion US dollars in fines, settlements and buybacks; several executives were charged, and one VW engineer was sentenced to prison in the United States. Unlike most disasters, this was deliberate deception designed and maintained by engineers over years, a vivid example of incrementalism and moral disengagement, and a reminder that the duty of honesty applies to the regulator as much as to anyone.

Case: the Grenfell Tower fire

On June 14, 2017, a fire that began in a refrigerator in a flat in Grenfell Tower, a 24-storey residential building in London, spread up the outside of the building in minutes through combustible aluminium composite cladding and insulation installed during a recent refurbishment, killing 72 people. The public inquiry's final report in 2024 found decades of failures by government, regulators and the industry to act on known risks of combustible cladding; that manufacturers of the cladding and insulation had engaged in what it called systematic dishonesty, manipulating fire tests and misrepresenting results; and that designers, contractors, building control and the building's managers each relied on others to ensure safety. Residents' warnings about fire safety had been ignored. The inquiry highlighted the danger of a system in which "everyone assumed someone else was responsible", and countries including Canada and the United States reviewed their own rules on combustible cladding.

Lesson 6 turns to the technical side of safety and risk, and Lesson 7 shows how engineers investigate failures like these to find their root causes.