C07 — Đạo đức nghề nghiệp

# Ethics-policy-audit.ps1 — Lab 1: Shared Account & Ethics Training Check
# Requires: ActiveDirectory module, Read access to AD

Import-Module ActiveDirectory

$reportDate = Get-Date -Format "yyyy-MM-dd"
$reportPath = "C:\Audit\ethics-compliance-$reportDate.csv"
$findings = @()
$passCount = 0
$failCount = 0

# --- CHECK 1: Shared/generic accounts that should not exist in security roles ---
Write-Host "[CHECK 1] Scanning for generic shared accounts..." -ForegroundColor Cyan
$genericPatterns = @("^svc_", "^admin_", "^shared_", "^test_", "^temp_", "^generic_")
$allUsers = Get-ADUser -Filter {Enabled -eq $true} -Properties SamAccountName, MemberOf, Description

foreach ($user in $allUsers) {
    foreach ($pattern in $genericPatterns) {
        if ($user.SamAccountName -match $pattern) {
            $findings += [PSCustomObject]@{
                CheckID    = "ETHICS-01"
                Category   = "Shared Account"
                User       = $user.SamAccountName
                Status     = "FAIL"
                Detail     = "Generic account name pattern — potential account sharing violation"
                Risk       = "HIGH"
                Policy     = "Code of Conduct §4.2 — Individual Accountability"
                Remediation = "Convert to service account or assign named owner"
            }
            $failCount++
        }
    }
}

# --- CHECK 2: Privileged groups — members without approved justification ---
Write-Host "[CHECK 2] Checking Domain Admins membership..." -ForegroundColor Cyan
$approvedDomainAdmins = @("svc.domain.admin", "IT.Admin.Primary", "IT.Admin.Secondary")  # Define approved list
$domainAdmins = Get-ADGroupMember -Identity "Domain Admins" | Where-Object {$_.objectClass -eq "user"}

foreach ($member in $domainAdmins) {
    if ($member.SamAccountName -notin $approvedDomainAdmins) {
        $findings += [PSCustomObject]@{
            CheckID    = "ETHICS-02"
            Category   = "Unauthorized Privilege"
            User       = $member.SamAccountName
            Status     = "FAIL"
            Detail     = "Domain Admin — not in approved list. Potential unauthorized privilege escalation."
            Risk       = "CRITICAL"
            Policy     = "Code of Conduct §5.1 — No unauthorized access"
            Remediation = "Verify approval record or remove from Domain Admins immediately"
        }
        $failCount++
    } else {
        $passCount++
    }
}

# --- CHECK 3: Ethics training completion (stored in extensionAttribute2) ---
Write-Host "[CHECK 3] Checking ethics training completion..." -ForegroundColor Cyan
$allActiveUsers = Get-ADUser -Filter {Enabled -eq $true} -Properties extensionAttribute2, Department
$currentYear = (Get-Date).Year.ToString()
$overdue = @()

foreach ($user in $allActiveUsers) {
    $trainingYear = $user.extensionAttribute2  # e.g., "2026" or null
    if ($trainingYear -ne $currentYear) {
        $overdue += $user.SamAccountName
        $findings += [PSCustomObject]@{
            CheckID    = "ETHICS-03"
            Category   = "Training Non-Compliance"
            User       = $user.SamAccountName
            Status     = "FAIL"
            Detail     = "Annual ethics training not completed for $currentYear (last: $trainingYear)"
            Risk       = "MEDIUM"
            Policy     = "Ethics Program Policy §2 — Annual Training Mandatory"
            Remediation = "Complete ethics training by end of Q1 or access may be suspended"
        }
        $failCount++
    } else {
        $passCount++
    }
}

# --- CHECK 4: COI Annual Disclosure (stored in extensionAttribute3) ---
Write-Host "[CHECK 4] Checking COI disclosure submissions..." -ForegroundColor Cyan
$seniorRoles = Get-ADUser -Filter {Enabled -eq $true} -Properties extensionAttribute3, Title |
    Where-Object { $_.Title -match "Manager|Director|CISO|VP|Chief|Senior" }

foreach ($user in $seniorRoles) {
    $coiDisclosed = $user.extensionAttribute3  # "2026-COI-SUBMITTED" or null
    if ($coiDisclosed -notlike "*$currentYear*") {
        $findings += [PSCustomObject]@{
            CheckID    = "ETHICS-04"
            Category   = "COI Disclosure Overdue"
            User       = $user.SamAccountName
            Status     = "FAIL"
            Detail     = "Title: $($user.Title) — Annual COI disclosure not submitted for $currentYear"
            Risk       = "HIGH"
            Policy     = "COI Policy §3 — Annual Declaration Required for Senior Roles"
            Remediation = "Submit COI Annual Disclosure Form to Ethics Office within 7 days"
        }
        $failCount++
    } else {
        $passCount++
    }
}

# --- GENERATE REPORT ---
$findings | Export-Csv -Path $reportPath -NoTypeInformation -Encoding UTF8

# Summary dashboard
Write-Host "`n=========================================" -ForegroundColor Yellow
Write-Host "  ETHICS POLICY COMPLIANCE AUDIT REPORT" -ForegroundColor Yellow
Write-Host "=========================================" -ForegroundColor Yellow
Write-Host "Date: $reportDate"
Write-Host "Report: $reportPath"
Write-Host "PASS: $passCount  |  FAIL: $failCount" -ForegroundColor $(if($failCount -gt 0){"Red"}else{"Green"})
Write-Host "`nTop Findings:"
$findings | Group-Object Category | Sort-Object Count -Descending |
    Format-Table -AutoSize @{L="Category";E={$_.Name}}, @{L="Count";E={$_.Count}}, @{L="Max Risk";E={($_.Group.Risk | Sort-Object -Unique) -join "/"}}
Write-Host "Report saved to: $reportPath" -ForegroundColor Green

#!/usr/bin/env python3
"""ethics_compliance_kpi.py — Ethics Program KPI Tracker"""

import json
import statistics
from datetime import date, datetime

# ---- Simulated Ethics Program Data ----
total_employees = 850
training_data = {
    "completed_current_year": 812,
    "total_employees": 850,
    "overdue_by_dept": {
        "IT": 8,
        "Finance": 12,
        "Operations": 18
    }
}

coi_data = {
    "senior_employees_required": 140,
    "coi_submitted": 127,
    "coi_with_disclosed_conflict": 14,
    "pending_review": 3
}

hotline_data = {
    "reports_received": 42,
    "by_channel": {
        "anonymous_hotline": 18,
        "web_portal": 16,
        "direct_to_manager": 8
    },
    "by_category": {
        "conflict_of_interest": 9,
        "gifts_hospitality": 7,
        "harassment": 11,
        "data_misuse": 8,
        "accounting_fraud": 4,
        "other": 3
    },
    "substantiated": 28,
    "not_substantiated": 11,
    "under_investigation": 3
}

investigation_data = {
    "resolution_times_days": [12, 18, 7, 25, 14, 9, 31, 21, 16, 11, 28, 8,
                               19, 22, 6, 35, 13, 24, 10, 17, 29, 15, 20, 23],
    "target_days": 30
}

retaliation_complaints = 2
coi_violations_actioned = 5

# ---- KPI Calculations ----
def calculate_kpis():
    report_date = date.today().isoformat()

    # Training KPIs
    training_completion_rate = (
        training_data["completed_current_year"] / training_data["total_employees"] * 100
    )
    overdue_total = sum(training_data["overdue_by_dept"].values())

    # COI KPIs
    coi_submission_rate = (
        coi_data["coi_submitted"] / coi_data["senior_employees_required"] * 100
    )
    coi_conflict_rate = (
        coi_data["coi_with_disclosed_conflict"] / coi_data["coi_submitted"] * 100
    )

    # Hotline KPIs
    total_reports = hotline_data["reports_received"]
    reports_per_1000 = total_reports / total_employees * 1000
    substantiation_rate = (
        hotline_data["substantiated"] / (hotline_data["substantiated"] + hotline_data["not_substantiated"]) * 100
    )

    # Investigation KPIs
    avg_resolution = statistics.mean(investigation_data["resolution_times_days"])
    median_resolution = statistics.median(investigation_data["resolution_times_days"])
    pct_within_target = (
        sum(1 for d in investigation_data["resolution_times_days"]
            if d <= investigation_data["target_days"]) /
        len(investigation_data["resolution_times_days"]) * 100
    )

    # Rating helper
    def rate(value, good_threshold, warn_threshold, higher_is_better=True):
        if higher_is_better:
            if value >= good_threshold: return "GREEN"
            if value >= warn_threshold: return "AMBER"
            return "RED"
        else:
            if value <= good_threshold: return "GREEN"
            if value <= warn_threshold: return "AMBER"
            return "RED"

    kpis = {
        "report_metadata": {
            "generated_at": report_date,
            "reporting_period": f"YTD {datetime.now().year}",
            "total_employees": total_employees
        },
        "training_kpis": {
            "completion_rate_pct": round(training_completion_rate, 1),
            "target_pct": 98.0,
            "overdue_employees": overdue_total,
            "overdue_by_dept": training_data["overdue_by_dept"],
            "status": rate(training_completion_rate, 98, 95)
        },
        "coi_kpis": {
            "submission_rate_pct": round(coi_submission_rate, 1),
            "target_pct": 100.0,
            "disclosed_conflicts": coi_data["coi_with_disclosed_conflict"],
            "conflict_rate_pct": round(coi_conflict_rate, 1),
            "pending_review": coi_data["pending_review"],
            "violations_actioned": coi_violations_actioned,
            "status": rate(coi_submission_rate, 98, 90)
        },
        "hotline_kpis": {
            "total_reports": total_reports,
            "reports_per_1000_employees": round(reports_per_1000, 1),
            "benchmark_per_1000": 40.0,
            "substantiation_rate_pct": round(substantiation_rate, 1),
            "reports_by_channel": hotline_data["by_channel"],
            "reports_by_category": hotline_data["by_category"],
            "under_investigation": hotline_data["under_investigation"],
            "status": "GREEN" if total_reports > 20 else "AMBER"  # Low reporting = red flag
        },
        "investigation_kpis": {
            "avg_resolution_days": round(avg_resolution, 1),
            "median_resolution_days": round(median_resolution, 1),
            "target_days": investigation_data["target_days"],
            "pct_within_target": round(pct_within_target, 1),
            "retaliation_complaints": retaliation_complaints,
            "status": rate(pct_within_target, 90, 75)
        },
        "executive_summary": {
            "overall_health": "AMBER",
            "key_concerns": [
                f"Training overdue: {overdue_total} employees not yet completed ({overdue_total/total_employees*100:.1f}%)",
                f"COI submissions: {coi_data['senior_employees_required'] - coi_data['coi_submitted']} senior employees pending",
                f"Retaliation complaints: {retaliation_complaints} (investigate immediately)"
            ],
            "strengths": [
                f"Hotline reporting rate {round(reports_per_1000, 1)}/1000 — healthy speak-up culture",
                f"Substantiation rate {round(substantiation_rate, 1)}% — effective triage",
                f"Investigation avg {round(avg_resolution, 1)} days — within 30-day target"
            ]
        }
    }
    return kpis

result = calculate_kpis()
print(json.dumps(result, indent=2, ensure_ascii=False))