Step 4: Full View

The Board's conclusion implicitly treats the confidentiality agreement as a legitimate and binding professional commitment while simultaneously holding that it cannot override the public safety reporting obligation. This dual treatment, though practically workable, leaves unresolved a deeper structural problem: the confidentiality agreement as designed creates a foreseeable and recurring conflict that the peer review program itself is institutionally responsible for resolving. Because the Code of Ethics imposes non-waivable individual duties on every engineer regardless of the business or programmatic context in which they operate, any confidentiality agreement that purports - even implicitly - to suppress disclosure of active safety code violations is void to that extent as a matter of professional ethics. The peer review program therefore bears an affirmative institutional obligation to include an explicit carve-out provision stating that safety code violations discovered during peer review must be reported to the appropriate authorities notwithstanding the confidentiality agreement. The absence of such a provision does not merely leave individual engineers in an uncomfortable dilemma; it represents a structural ethical failure of the program's design that foreseeably places peer reviewers in the position of appearing to choose between contractual loyalty and public safety - a choice the Code does not permit them to make in favor of confidentiality.

A confidentiality agreement that purports to suppress disclosure of active public safety violations has no valid ethical force under the NSPE Code, and its legal enforceability is similarly suspect. The Code's provision that engineers shall not disclose confidential information without consent (Section III.4) is explicitly bounded by the overriding duty to protect public safety. No contractual instrument can extinguish a duty that the Code imposes on every individual engineer as a non-waivable personal obligation. Engineers should therefore be cautious about signing peer review confidentiality agreements that do not contain explicit carve-outs for safety-critical disclosures. A well-drafted agreement would affirmatively state that nothing in it prevents the reviewer from reporting discovered safety code violations to proper authorities. The absence of such a carve-out does not, however, create an enforceable obligation of silence - it merely creates ambiguity that the engineer must resolve in favor of public safety. Peer review programs that present reviewers with agreements lacking this carve-out are themselves operating with a structural ethical deficiency.

The tension between the Peer Review Confidentiality Agreement Obligation and the Public Welfare Paramount principle was resolved not by eliminating confidentiality but by subordinating it to a threshold condition: once Engineer A discovers work that may violate state and local safety codes and endanger the public, the confidentiality obligation loses its force with respect to that specific finding. The case teaches that confidentiality in professional peer review programs is a conditional, not absolute, duty - it governs ordinary business information and practice observations, but it cannot serve as a legal or ethical shield against the disclosure of active public safety violations. The resolution is not that confidentiality is unimportant, but that it was never intended by the Code to extend to circumstances where silence would make Engineer A complicit in ongoing harm. The practical implication is that engineers entering peer review confidentiality agreements should understand from the outset that those agreements carry an implicit safety-override clause, whether or not the written agreement makes that clause explicit.

The peer review program itself bears significant institutional responsibility for the ethical dilemma Engineer A faces. By establishing a confidentiality agreement without an explicit safety-disclosure carve-out, the program placed individual engineers in a foreseeable conflict between two legitimate duties. This is a structural design failure, not merely an individual ethical challenge. A well-governed peer review program should, before any reviewer enters the field, establish written protocols that (1) define the categories of findings that override confidentiality, (2) specify the escalation sequence and its time parameters, (3) clarify the reviewer's reporting obligations to authorities, and (4) indemnify reviewers who make good-faith safety disclosures from retaliation or breach-of-contract claims. The absence of these protocols does not relieve Engineer A of their individual ethical obligations, but it does mean the program has externalized its ethical risk onto individual reviewers rather than managing it institutionally. Programs that fail to resolve the confidentiality-versus-safety tension in their governing documents are, in effect, asking engineers to improvise solutions to a conflict the program itself created.

Beyond the Board's finding that Engineer A should immediately discuss the violations with Engineer B, the Board's prescribed sequential escalation pathway carries an implicit but critical temporal limitation: the collegial discussion step is only ethically permissible when the risk is uncertain or non-imminent. Where Engineer A assesses the public safety risk as imminent and severe - rather than merely potential - the sequential model collapses, and Engineer A bears an independent obligation to notify the proper authorities without delay, regardless of whether Engineer B has been consulted first. The 'may be in violation' standard the Board employs does not eliminate this distinction; it simply reflects the facts of this particular case. Engineer A must therefore conduct a documented severity-and-imminence assessment at the moment of discovery, because that assessment determines which escalation pathway is ethically required. Failure to make and record that assessment is itself an ethical shortcoming, since it leaves Engineer A unable to demonstrate that the chosen pathway was calibrated to the actual level of risk.

The standard of 'may be in violation' articulated in the Board's conclusion imposes essentially the same escalation obligations as a confirmed violation, because the Code's public safety duty is triggered by a good-faith belief of risk, not by certainty of harm. Engineer A is not required to conduct a definitive legal or technical adjudication before acting. The appropriate standard is whether a reasonable, competent engineer in Engineer A's position would have a genuine, professionally grounded concern that the work poses a risk to public health, safety, or welfare. If that threshold is met, Engineer A must document the specific findings - the nature of the apparent code discrepancy, the design elements involved, the applicable state and local safety code provisions, and the potential harm pathway - and proceed with the escalation sequence. Documentation serves two purposes: it provides Engineer B with a precise basis for response during the collegial discussion phase, and it creates a record that Engineer A acted in good faith if the matter later requires regulatory reporting. The severity and imminence of the risk should calibrate the pace of escalation, not the decision to escalate.

The Board's conclusion that Engineer A should first discuss the violations with Engineer B before escalating to authorities is ethically sound as a general rule, but it carries a latent risk that the Board does not address: the collegial notification step could itself become a vehicle for aiding or abetting unlawful engineering practice if Engineer A, having notified Engineer B, then fails to follow through with regulatory reporting when Engineer B does not take prompt and verifiable corrective action. Engineer A's obligation does not terminate at the moment of collegial notification. Rather, notification of Engineer B triggers a secondary, time-bounded obligation to monitor whether corrective action is actually undertaken. If Engineer B acknowledges the violations but delays correction, disputes Engineer A's findings without credible technical justification, or takes no action, Engineer A's continued silence would cross the threshold from collegial deference into complicity with ongoing unlawful practice. This means Engineer A must establish - at the time of the collegial discussion - a clear and documented understanding of what corrective action is expected, by when, and what Engineer A will do if that action is not taken. The absence of such a follow-through framework renders the collegial discussion step ethically incomplete, regardless of how constructively it is conducted.

Engineer A's continued silence about Engineer B's violations - even during the collegial discussion phase - risks crossing into aiding or abetting unlawful engineering practice under Code Section II.1.e if that silence is prolonged, if Engineer B is unresponsive, or if the risk to the public is ongoing and concrete. The collegial notification step prescribed by the Board is not a license for indefinite delay. It is a first step in a time-bounded sequential escalation, not an open-ended courtesy period. If Engineer A notifies Engineer B and Engineer B fails to acknowledge the problem, disputes the finding without credible technical basis, or commits to corrective action but takes no meaningful steps, Engineer A's continued inaction would shift from collegial patience to complicit silence. The threshold at which silence becomes aiding and abetting is crossed when Engineer A possesses a good-faith belief that a violation exists, has given Engineer B a reasonable opportunity to respond, and yet takes no further action while the public remains exposed. The Code does not permit Engineer A to treat the collegial discussion as a substitute for escalation - it is only a precursor to it.

A confidentiality agreement that purports to suppress disclosure of active public safety violations has no valid ethical force under the NSPE Code, and its legal enforceability is similarly suspect. The Code's provision that engineers shall not disclose confidential information without consent (Section III.4) is explicitly bounded by the overriding duty to protect public safety. No contractual instrument can extinguish a duty that the Code imposes on every individual engineer as a non-waivable personal obligation. Engineers should therefore be cautious about signing peer review confidentiality agreements that do not contain explicit carve-outs for safety-critical disclosures. A well-drafted agreement would affirmatively state that nothing in it prevents the reviewer from reporting discovered safety code violations to proper authorities. The absence of such a carve-out does not, however, create an enforceable obligation of silence - it merely creates ambiguity that the engineer must resolve in favor of public safety. Peer review programs that present reviewers with agreements lacking this carve-out are themselves operating with a structural ethical deficiency.

The tension between the Peer Review Confidentiality Agreement Obligation and the Public Welfare Paramount principle was resolved not by eliminating confidentiality but by subordinating it to a threshold condition: once Engineer A discovers work that may violate state and local safety codes and endanger the public, the confidentiality obligation loses its force with respect to that specific finding. The case teaches that confidentiality in professional peer review programs is a conditional, not absolute, duty - it governs ordinary business information and practice observations, but it cannot serve as a legal or ethical shield against the disclosure of active public safety violations. The resolution is not that confidentiality is unimportant, but that it was never intended by the Code to extend to circumstances where silence would make Engineer A complicit in ongoing harm. The practical implication is that engineers entering peer review confidentiality agreements should understand from the outset that those agreements carry an implicit safety-override clause, whether or not the written agreement makes that clause explicit.

Engineer A's continued silence about Engineer B's violations - even during the collegial discussion phase - risks crossing into aiding or abetting unlawful engineering practice under Code Section II.1.e if that silence is prolonged, if Engineer B is unresponsive, or if the risk to the public is ongoing and concrete. The collegial notification step prescribed by the Board is not a license for indefinite delay. It is a first step in a time-bounded sequential escalation, not an open-ended courtesy period. If Engineer A notifies Engineer B and Engineer B fails to acknowledge the problem, disputes the finding without credible technical basis, or commits to corrective action but takes no meaningful steps, Engineer A's continued inaction would shift from collegial patience to complicit silence. The threshold at which silence becomes aiding and abetting is crossed when Engineer A possesses a good-faith belief that a violation exists, has given Engineer B a reasonable opportunity to respond, and yet takes no further action while the public remains exposed. The Code does not permit Engineer A to treat the collegial discussion as a substitute for escalation - it is only a precursor to it.

The interaction between the Peer Review Program Integrity and Collegial Improvement Purpose and the Engineering Self-Policing Obligation reveals a structural hierarchy in which the program's collegial improvement goal is preserved as the first-step mechanism, but is ultimately subordinate to the profession's self-policing duty when collegial resolution fails or is unavailable. The Board's prescribed sequential escalation pathway - notify Engineer B first, then escalate to authorities if necessary - represents an attempt to honor both principles simultaneously rather than treating them as mutually exclusive. This synthesis teaches that professional program design and individual ethical duty are not inherently in conflict: a well-functioning peer review program can serve both collegial improvement and public safety simultaneously, precisely because the collegial notification step gives Engineer B the opportunity to self-correct before external reporting becomes necessary. However, the synthesis also reveals a limit: when the collegial improvement purpose is used as a reason to delay or avoid mandatory safety reporting indefinitely, it crosses from a legitimate first step into an ethical violation in its own right, effectively converting a program designed to improve practice into a mechanism for suppressing safety disclosures.

The peer review program itself bears significant institutional responsibility for the ethical dilemma Engineer A faces. By establishing a confidentiality agreement without an explicit safety-disclosure carve-out, the program placed individual engineers in a foreseeable conflict between two legitimate duties. This is a structural design failure, not merely an individual ethical challenge. A well-governed peer review program should, before any reviewer enters the field, establish written protocols that (1) define the categories of findings that override confidentiality, (2) specify the escalation sequence and its time parameters, (3) clarify the reviewer's reporting obligations to authorities, and (4) indemnify reviewers who make good-faith safety disclosures from retaliation or breach-of-contract claims. The absence of these protocols does not relieve Engineer A of their individual ethical obligations, but it does mean the program has externalized its ethical risk onto individual reviewers rather than managing it institutionally. Programs that fail to resolve the confidentiality-versus-safety tension in their governing documents are, in effect, asking engineers to improvise solutions to a conflict the program itself created.

The interaction between the Imminent Harm Threshold for Mandatory Peer-Review Safety Escalation and the Confidentiality-Bounded Public Safety Escalation Sequence reveals that the sequential escalation model is not a rigid procedural rule but a risk-calibrated framework. The Board's conclusion prescribes collegial discussion as the appropriate first step under the facts presented - where the violation 'may be' rather than certainly is a safety threat - but this prescription implicitly encodes a variable: as the severity and imminence of harm increases, the permissible delay before bypassing the collegial step and reporting directly to authorities decreases, and at the extreme of imminent catastrophic harm, the sequential model collapses entirely into an immediate reporting obligation. This teaches a broader principle about how the Code resolves tensions between process-oriented duties and outcome-oriented duties: process obligations (notify Engineer B first) are ethically valid when they do not themselves generate harm through delay, but they become ethically impermissible when adherence to the process is itself the mechanism by which harm materializes. The Ethics Code Individual-Person Applicability Non-Waivability principle reinforces this conclusion by establishing that no programmatic structure - including a peer review confidentiality agreement - can contractually override Engineer A's individual duty to protect the public when that duty is triggered by a sufficiently serious risk.

The interaction between the Imminent Harm Threshold for Mandatory Peer-Review Safety Escalation and the Confidentiality-Bounded Public Safety Escalation Sequence reveals that the sequential escalation model is not a rigid procedural rule but a risk-calibrated framework. The Board's conclusion prescribes collegial discussion as the appropriate first step under the facts presented - where the violation 'may be' rather than certainly is a safety threat - but this prescription implicitly encodes a variable: as the severity and imminence of harm increases, the permissible delay before bypassing the collegial step and reporting directly to authorities decreases, and at the extreme of imminent catastrophic harm, the sequential model collapses entirely into an immediate reporting obligation. This teaches a broader principle about how the Code resolves tensions between process-oriented duties and outcome-oriented duties: process obligations (notify Engineer B first) are ethically valid when they do not themselves generate harm through delay, but they become ethically impermissible when adherence to the process is itself the mechanism by which harm materializes. The Ethics Code Individual-Person Applicability Non-Waivability principle reinforces this conclusion by establishing that no programmatic structure - including a peer review confidentiality agreement - can contractually override Engineer A's individual duty to protect the public when that duty is triggered by a sufficiently serious risk.

From a deontological perspective, Engineer A's categorical duty to protect public safety is not diminished by the prior voluntary acceptance of a confidentiality agreement. A Kantian analysis would hold that the maxim 'engineers may contractually suppress disclosure of safety violations' cannot be universalized without destroying the very foundation of public trust in engineering licensure. The confidentiality agreement, to the extent it purports to override the safety reporting duty, is not a morally binding commitment because it asks Engineer A to act on a principle that, if universalized, would be self-defeating and harmful. The prior contractual commitment therefore does not eliminate the categorical duty - it merely creates a competing obligation of lesser moral weight. Engineer A's duty to disclose is not contingent on the absence of a confidentiality agreement; it exists independently of and hierarchically above that agreement. The deontological framework thus supports the conclusion that Engineer A must report, and that the confidentiality agreement provides no moral shelter from that obligation.

From a virtue ethics perspective, Engineer A demonstrates the professional virtues of courage and integrity most fully by engaging Engineer B directly and honestly about the discovered violations rather than either remaining silent to preserve the collegial relationship or bypassing Engineer B entirely to report immediately to regulators. Courage is required because confronting a peer about potential professional failures risks damaging the relationship, inviting defensiveness, and creating professional friction. Integrity is demonstrated by refusing to allow the confidentiality agreement to function as a shield for conduct that endangers the public. However, the virtue ethics analysis also recognizes that Engineer A's acceptance of the peer reviewer role and the confidentiality agreement creates a relational obligation of good faith toward the program and toward Engineer B - and that acting with integrity means honoring that obligation by giving Engineer B a genuine opportunity to respond before escalating externally. The virtuous engineer is neither a passive bystander nor a reflexive regulator; they are a professional who exercises practical wisdom to navigate competing obligations in a way that serves both the immediate relationship and the broader public interest. This analysis supports the Board's sequential escalation model as the virtuous pathway in the typical case.

From a consequentialist perspective, the Board's sequential escalation pathway - notify Engineer B first, then escalate to authorities - produces better overall outcomes in the typical case but may produce worse outcomes in scenarios involving imminent harm or an uncooperative Engineer B. The collegial first step has genuine consequentialist value: it allows for rapid private correction without the reputational, legal, and programmatic costs of immediate regulatory involvement, and it preserves the peer review program's effectiveness as a voluntary improvement mechanism. However, the consequentialist calculus shifts decisively when the probability of harm is high, the harm is severe and irreversible, or Engineer B's response signals bad faith. In those scenarios, the delay inherent in the collegial step produces a net negative outcome by allowing continued public exposure. A consequentialist framework therefore supports a conditional sequential model: the collegial step is appropriate when the risk is uncertain or moderate and Engineer B appears cooperative, but direct regulatory reporting is required when the risk is imminent, severe, or Engineer B is unresponsive. The Board's conclusion implicitly acknowledges this by framing the obligation as calibrated to the circumstances, but a fully consequentialist analysis would make the conditionality more explicit.

From a virtue ethics perspective, Engineer A demonstrates the professional virtues of courage and integrity most fully by engaging Engineer B directly and honestly about the discovered violations rather than either remaining silent to preserve the collegial relationship or bypassing Engineer B entirely to report immediately to regulators. Courage is required because confronting a peer about potential professional failures risks damaging the relationship, inviting defensiveness, and creating professional friction. Integrity is demonstrated by refusing to allow the confidentiality agreement to function as a shield for conduct that endangers the public. However, the virtue ethics analysis also recognizes that Engineer A's acceptance of the peer reviewer role and the confidentiality agreement creates a relational obligation of good faith toward the program and toward Engineer B - and that acting with integrity means honoring that obligation by giving Engineer B a genuine opportunity to respond before escalating externally. The virtuous engineer is neither a passive bystander nor a reflexive regulator; they are a professional who exercises practical wisdom to navigate competing obligations in a way that serves both the immediate relationship and the broader public interest. This analysis supports the Board's sequential escalation model as the virtuous pathway in the typical case.

Beyond the Board's finding that Engineer A should immediately discuss the violations with Engineer B, the Board's prescribed sequential escalation pathway carries an implicit but critical temporal limitation: the collegial discussion step is only ethically permissible when the risk is uncertain or non-imminent. Where Engineer A assesses the public safety risk as imminent and severe - rather than merely potential - the sequential model collapses, and Engineer A bears an independent obligation to notify the proper authorities without delay, regardless of whether Engineer B has been consulted first. The 'may be in violation' standard the Board employs does not eliminate this distinction; it simply reflects the facts of this particular case. Engineer A must therefore conduct a documented severity-and-imminence assessment at the moment of discovery, because that assessment determines which escalation pathway is ethically required. Failure to make and record that assessment is itself an ethical shortcoming, since it leaves Engineer A unable to demonstrate that the chosen pathway was calibrated to the actual level of risk.

If Engineer A had determined that the safety violations posed an imminent and severe risk of harm, the Board's sequential escalation pathway would not apply in its standard form. The collegial notification step is appropriate when the risk is uncertain, moderate, or capable of being remediated before harm materializes. When harm is imminent - meaning the public is currently exposed to a concrete and serious risk from structures or systems already in use or under construction - the delay inherent in awaiting Engineer B's response is itself an ethical violation. In that scenario, Engineer A would be obligated to report directly and immediately to the proper authorities, potentially concurrent with or even before notifying Engineer B. This conclusion is supported by the constraint that imminent harm triggers an immediate escalation bypass, and by the general principle that the public safety duty is paramount. The Board's conclusion implicitly preserves this distinction by framing the sequential pathway as appropriate to the facts of the case - which involve a potential rather than confirmed imminent risk - but a more explicit articulation of the imminent harm exception would strengthen the ethical framework.

If Engineer A had refused to sign the confidentiality agreement as a precondition of serving as a peer reviewer, Engineer A would have been ethically justified in declining the role on those grounds, particularly if the agreement lacked a safety-disclosure carve-out. An engineer cannot be ethically required to accept a contractual constraint that would, in foreseeable circumstances, prevent them from fulfilling their paramount duty to protect public safety. Refusing to sign would not have been an act of bad faith toward the program - it would have been an act of professional integrity. The absence of a confidentiality agreement would have simplified Engineer A's subsequent obligations considerably: without the agreement, the only competing consideration would be the general professional norm of collegial courtesy, which is far weaker than a formal contractual commitment. Engineer A would still have been well-advised to notify Engineer B before escalating to authorities, as a matter of professional courtesy and to allow for rapid private correction, but the ethical weight of that step would have been advisory rather than obligatory. The confidentiality agreement thus adds ethical complexity without adding ethical legitimacy to the suppression of safety disclosures.

The Board's conclusion that Engineer A should first discuss the violations with Engineer B before escalating to authorities is ethically sound as a general rule, but it carries a latent risk that the Board does not address: the collegial notification step could itself become a vehicle for aiding or abetting unlawful engineering practice if Engineer A, having notified Engineer B, then fails to follow through with regulatory reporting when Engineer B does not take prompt and verifiable corrective action. Engineer A's obligation does not terminate at the moment of collegial notification. Rather, notification of Engineer B triggers a secondary, time-bounded obligation to monitor whether corrective action is actually undertaken. If Engineer B acknowledges the violations but delays correction, disputes Engineer A's findings without credible technical justification, or takes no action, Engineer A's continued silence would cross the threshold from collegial deference into complicity with ongoing unlawful practice. This means Engineer A must establish - at the time of the collegial discussion - a clear and documented understanding of what corrective action is expected, by when, and what Engineer A will do if that action is not taken. The absence of such a follow-through framework renders the collegial discussion step ethically incomplete, regardless of how constructively it is conducted.

If Engineer B, upon being notified, acknowledged the problem and committed to immediate corrective action, Engineer A's obligation to report to proper authorities would not be fully discharged by that private resolution alone. The public may already have been exposed to risk from non-compliant designs that are in use, under construction, or submitted for permit approval. Engineer A must assess whether the corrective commitment is credible, specific, and timely - and whether the existing exposure to risk requires regulatory notification independent of Engineer B's future remediation. If the non-compliant designs have already been implemented in structures accessible to the public, the regulatory authorities may need to be informed so that they can independently assess whether interim protective measures are required. Engineer A's duty runs to the public, not merely to securing Engineer B's promise of future compliance. A private resolution that leaves the public unaware of a past exposure to risk, and leaves regulators without the information needed to verify remediation, does not fully satisfy Engineer A's ethical obligations under the Code. The appropriate outcome of a successful collegial discussion is not silence but a jointly agreed disclosure to the relevant authorities, or at minimum Engineer A's independent verification that the risk has been fully remediated before concluding that no further action is required.

The Board's conclusion implicitly treats the confidentiality agreement as a legitimate and binding professional commitment while simultaneously holding that it cannot override the public safety reporting obligation. This dual treatment, though practically workable, leaves unresolved a deeper structural problem: the confidentiality agreement as designed creates a foreseeable and recurring conflict that the peer review program itself is institutionally responsible for resolving. Because the Code of Ethics imposes non-waivable individual duties on every engineer regardless of the business or programmatic context in which they operate, any confidentiality agreement that purports - even implicitly - to suppress disclosure of active safety code violations is void to that extent as a matter of professional ethics. The peer review program therefore bears an affirmative institutional obligation to include an explicit carve-out provision stating that safety code violations discovered during peer review must be reported to the appropriate authorities notwithstanding the confidentiality agreement. The absence of such a provision does not merely leave individual engineers in an uncomfortable dilemma; it represents a structural ethical failure of the program's design that foreseeably places peer reviewers in the position of appearing to choose between contractual loyalty and public safety - a choice the Code does not permit them to make in favor of confidentiality.

If the peer review program had included an explicit provision requiring that safety code violations discovered during peer review be reported to authorities regardless of the confidentiality agreement, such a provision would have substantially reduced - though not entirely eliminated - Engineer A's ethical dilemma. It would have eliminated the tension between the confidentiality agreement and the safety reporting duty by making the safety exception part of the agreement itself, giving Engineer A clear contractual and ethical authority to report. However, it would not have eliminated all judgment: Engineer A would still need to assess the severity and imminence of the risk, determine the appropriate escalation sequence, and decide whether to notify Engineer B before or concurrently with reporting to authorities. The absence of such a provision in the program's design does represent a structural ethical failure. The program's designers could reasonably have foreseen that peer reviewers might discover safety violations, and the failure to address this foreseeable scenario in the program's governing documents reflects either an oversight or an implicit - and ethically indefensible - preference for confidentiality over safety. Programs that rely on individual engineers to improvise solutions to conflicts the program itself created are not operating with the institutional integrity that the engineering profession demands.