Confidentiality in audit and assurance engagements

At a wedding, an audit senior hears a friend say that her company is about to win a big contract. The senior knows from last week's audit that the company is near insolvency. A guest asks, "Is it true they are doing well?" What the senior says next is a test of confidentiality. Clients tell auditors things they would tell nobody else, because the audit cannot work without open access.

In return the auditor must keep that information secret, except in a few cases where the law or the public interest says otherwise.

This topic covers the duty of confidentiality, practical guidelines for keeping it, and the situations in which disclosure is required or allowed. The next topic covers conflicts of interest and how ethical conflicts are resolved.

Key terms in plain English

Syllabus check

This topic is in syllabus area E, professional ethics and public interest (15% of marks). It covers:

• the fundamental principle of confidentiality
• the exceptions to the duty of confidentiality
• the ethical issues under the IFAC and ICAN codes

CAMA 2020 and confidentiality

The Companies and Allied Matters Act 2020 (CAMA 2020) is the company law of Nigeria. The sections below apply to this topic.

The rules in more depth

The duty of confidentiality

Confidentiality is one of the five fundamental principles. Information obtained in the course of professional work must not be disclosed to others except where:

• consent has been obtained from the person or entity the information relates to; or
• there is a legal or professional right or duty to disclose.

Information gained when acting in a professional capacity must also not be used to gain a personal advantage or an advantage for another party. Auditors need full and open disclosure from the client to do their work. If the client could not trust the auditor to keep the information secret, it might hold back what the auditor needs.

Practical guidelines

• Social settings. A chartered accountant must keep confidences even in a social setting and must watch for inadvertent disclosure, especially in a long association with a business associate or with a close or immediate family member. Most breaches are accidental, and it is easy to forget the duty in a relaxed setting, particularly among colleagues.
• Who is covered. The duty covers existing clients, and also information given by a prospective client or employer.
• Inside the firm. The accountant must also consider the need for confidentiality within the firm. If the firm audits two competing clients, each may fear that confidential information will reach its rival through the auditor. The firm should use separately staffed teams and other safeguards to prevent the information moving internally.
• Staff and advisers. The accountant must take all reasonable steps to make sure that staff under his control, and anyone he gets advice or help from, respect the duty.
• After the relationship ends. The duty continues. On changing job or acquiring a new client, the accountant may use his experience, but must not use or disclose confidential information obtained from the earlier relationship.

When management asks for confidentiality

The May 2026 examination described auditors of Royal Bank Plc who found loan approvals made without proper documentation, in breach of regulations, and who intended to escalate them to the regulators. Management insisted that the matter be kept confidential, and the team debated whether that conflicted with the duty to act in the public interest. The answer is that the duty of confidentiality is not absolute.

A client cannot waive the exceptions below by asking for secrecy. Where the law requires disclosure, or where the Code permits disclosure in the public interest, the auditor follows the framework in the topic on non-compliance with laws and regulations: first raise the matter with management and those charged with governance, then judge whether disclosure to an authority is needed, and document every step.

Management's request is a reason for the auditor to treat management's integrity with more doubt, not less.

Obligatory disclosure

An ICAN member must:

• disclose relevant information to the proper authority if he knows or suspects that a client has committed treason, terrorism, drug trafficking or money laundering;
• disclose information when forced to do so by legal process, for example when a court requires the production of audit working papers; and
• disclose information to state agents such as the EFCC and the ICPC when they act with specific authority in the interest of the state.

In these cases the requirements of the law override the duty of confidentiality.

Voluntary disclosure

Disclosure of confidential information is allowed:

• to protect the member's own interests, for example in defending an accusation of professional negligence;
• in the public interest, for example by telling the tax authority about a client's non-compliance with tax rules;
• when a local statute authorises it; and
• to non-governmental bodies that have the power to compel disclosure.

Before a voluntary disclosure the member should weigh whether the facts are established, how serious the harm is, who the right authority is, and whether legal advice should be taken first. The disclosure must be no wider than necessary.

The channels of lawful disclosure in company audit

Some disclosure is part of the audit itself and is not a breach. The auditor reports to the members under section 404(1) of the Companies and Allied Matters Act 2020 (CAMA 2020), and in a public company reports to the audit committee under section 404(2). The auditor uses the right of access in section 407(3) to obtain information and must use it only for the audit.

The auditor may also be required to report to a regulator in a regulated sector such as banking.

Worked examples

1. That is a disclosure of confidential information without consent, a breach of the principle.
2. It is no defence that the friend is trustworthy or that the remark was casual.

1. Each client may fear that its information reaches its competitor.
2. Safeguards: separate teams, secure filing, confidentiality agreements and regular review. If the engagement would materially prejudice either client, decline it.

1. The auditor knows or suspects money laundering.
2. An ICAN member must report it to the proper authority, and the law overrides the duty of confidentiality.

1. The firm may use confidential information as needed to defend itself: a voluntary disclosure to protect its own interests.
2. The disclosure is no wider than necessary for the defence.

How to score full marks

• Give the rule, then the two exceptions: consent, and a legal or professional right or duty.
• Separate obligatory from voluntary disclosure.
• Name the Nigerian bodies: the EFCC and the ICPC.
• Apply to the facts and say what the auditor should do first.

Common mistakes in the exam

• Saying confidentiality ends when the engagement ends.
• Saying the client can forbid disclosure to a regulator.
• Forgetting prospective clients and the firm's other teams.
• Writing that any disclosure is allowed if it is in the public interest, without weighing it.

Quick revision

• Consent or a legal or professional right or duty.
• Never use information for personal gain or for others.
• Applies inside the firm and after the engagement.
• Must disclose: treason, terrorism, drug trafficking, money laundering, legal process, state agents.
• May disclose: own interests, public interest, statute, bodies with compulsion powers.

Practice questions

Questions 1 to 10 are multiple choice. Questions 11 to 13 are written. Try each before opening the answer.

Model answers

Spotted a mistake? Tell us and we will check it.