Corporate Reporting Ethics: Where Confidentiality Actually Bites

This topic is covered as ETH.5 in our Corporate Reporting Model Answer Notes, which are built entirely from ICAEW Question Bank model answers: https://learn.paradigmshift.training/course/cr-man-2026

The principle is easy to state. Information about a client may not be disclosed without proper authority, nor used for personal advantage. Almost every candidate can write that sentence. The marks are not in stating it. They are in spotting the situations where it applies and most people assume it does not.

The breach students walk straight past

In the SSD scenario, a trainee passed information from one client's audit to a colleague working on another client's audit. Same firm, both parties employed by it, no outsider involved, and no obvious harm intended.

That is a breach.

The fact that both companies are clients of the firm does not help, because each client's information belongs to that client and not to the firm at large. A perfectly proper motive does not help either. The trainee may have been trying to be useful, or may have spotted something that genuinely mattered to the other engagement, and the answer is the same. Confidentiality operates between engagement teams inside the same firm, not merely at the firm's front door.

This is the single most commonly missed point in the topic, and it is worth training yourself to notice. If a scenario has information travelling sideways between two audits, that is the issue being tested, however casually it is described.

Two related distinctions come up regularly and are easy marks once you know them.

Information already in the public domain, such as a press article about the client, can be shared. The client's board's own view of that article cannot. The distinction is between the fact, which anyone could read, and the client's reaction to it, which came to you only through the engagement.

Where a retired partner asks for information about a former client, the answer is to decline, whatever reason is offered and however senior the person asking. Having once had access to the information does not create a continuing entitlement to it.

The director who wants a private word

This one recurs across several papers, and strictly it is not a confidentiality problem at all, which is why it is so often answered badly. Candidates recognise something is wrong and reach for the nearest principle rather than analysing what is actually happening.

The reasoning runs in three steps. The information belongs to the company. A director is entitled to it, so refusing outright is not the right answer either. But the firm is appointed by, and reports to, the company as a whole.

It follows that the firm cannot act for, or report privately to, one board member, however legitimate that member's concerns appear to be, and however sympathetic you are to them. Doing so would put the firm in the position of serving one faction of a board rather than the company, and would compromise its position with the rest of the board when the matter surfaced later, as these things do.

The action is to tell the director this, and to direct them to raise the matter through the board or through the audit committee. Notice that this is not a refusal to engage with the substance of what they have raised. The concern may be entirely well founded, and the firm may need to act on it through its own channels. It is a redirection to the proper route, and that distinction is one examiners reward.

Where wrongdoing is suspected, confidentiality does not prevent you from acting. But the route matters enormously. Where money laundering is in point, the reporting obligations and the tipping off restrictions govern who you may speak to and in what order, including inside your own firm, and they override the escalation route you would otherwise follow.

Four points to carry into the exam

Confidentiality applies between teams within a single firm, and the shared employer is not a defence.

A good motive is not a defence either.

Public domain facts can be shared, but the client's private view of those facts cannot.

And one director does not get a private report, however reasonable their concerns.

Each of those is a sentence or two in an answer, which is the appeal of this topic under time pressure. It is not conceptually difficult and it does not require long explanation. It simply requires you to notice that the trainee chatting to a colleague about another engagement, or the non-executive asking for a quiet word, is the ethical issue rather than background colour in the scenario.