Definition
Under the Confidential Client Information Rule, a member in public practice must not disclose confidential client information without the client's specific consent. The Code lists exceptions: compliance with laws and subpoenas, disciplinary investigations, quality or peer review, and certain professional obligations. It also applies to information gained during the engagement, not only documents.
Why it matters in an audit or review
Auditors handle payroll data, tax records, trade secrets and personal information. Controls on access, storage and transfer matter in every engagement, including when outsourcing or using third-party tools. Before an outside provider sees client information, the firm confirms that a confidentiality agreement or the client's consent is in place, and that data handling is secure. Tax return information has its own consent rules under Internal Revenue Code section 7216. Peer reviewers are bound by confidentiality, so reviews do not need client consent for access to the file.
Example
A firm wants to send a client's trial balance to a contract preparer working remotely. Before sharing, the firm checks that the engagement letter permits the use of outside parties, signs a confidentiality agreement with the preparer, and shares the file through an encrypted portal that logs access.
Common mistakes
Assuming confidentiality ends when the engagement ends. The duty continues after the relationship.
Sources
- AICPA Code of Professional Conduct, ET 1.700.001, Confidential Client Information Rule, and related interpretations on third-party service providers
- Internal Revenue Code Section 7216 and 26 CFR 301.7216-1 to 301.7216-3 (disclosure or use of tax return information)
Definitions paraphrase AICPA and FASB guidance; read the standard itself before relying on a requirement. Example figures are illustrative. This page is guidance, not professional advice. Report an error