Privileged and Confidential Information

5 minutes 5 Questions

In the context of the Certified Fraud Examiner (CFE) Code of Professional Ethics, privileged and confidential information refers to sensitive data that fraud examiners obtain during the course of their engagements and which they are ethically and often legally bound to protect. The ACFE Code of Ethics explicitly states that a CFE shall not reveal any confidential information obtained during a professional engagement without proper authorization. This duty is fundamental because fraud examinations routinely expose examiners to trade secrets, financial records, personnel files, legal strategies, and personal details of suspects, witnesses, and victims. Confidential information is any data the client or employer expects to be kept private, whether or not it is protected by law. Privileged information carries a stronger, legally recognized protection, most notably the attorney-client privilege and the attorney work-product doctrine. When a fraud examiner is retained by legal counsel, the examiner's work may fall under these privileges, shielding communications and analyses from disclosure in litigation. CFEs must understand that privilege belongs to the client, not the examiner, and that careless disclosure can waive the privilege, exposing the client to significant harm. Ethical obligations persist beyond the end of an engagement. A CFE may not use confidential information for personal gain, share it with unauthorized third parties, or discuss case details publicly, even anonymously, if identification is possible. Exceptions exist where disclosure is required by law, court order, or a valid subpoena, or where the client consents. In such cases, the examiner should disclose only what is legally compelled and, where appropriate, consult legal counsel first. Practically, protecting privileged and confidential information requires secure document handling, encrypted communications, controlled access to case files, and clear engagement letters defining confidentiality terms. Breaching these duties can result in disciplinary action by the ACFE, civil liability, loss of professional credibility, and compromise of the investigation itself. Maintaining confidentiality thus upholds both client trust and the integrity of the fraud examination profession.

Privileged and Confidential Information: A Complete CFE Exam Guide (Ethics for Fraud Examiners)

Overview
Among the articles of the ACFE Code of Professional Ethics, one of the most frequently tested is the requirement that a Certified Fraud Examiner shall not reveal any confidential information obtained during a professional engagement without proper authorization. This guide explains why the rule exists, what the terms confidential and privileged actually mean (they are not the same thing), how the rule operates in practice, and how to recognize and answer the scenario-style questions the CFE Exam uses to test it.

1. Why This Topic Matters
Fraud examinations are, by nature, intrusive. A CFE gains access to payroll records, bank statements, emails, personnel files, trade secrets, unproven allegations, and the private affairs of suspects, witnesses, and victims. Much of this information is damaging if leaked, and some of it concerns people who turn out to be innocent. If clients could not trust CFEs to keep what they learn private, they would not hire them, would not share records freely, and the profession would lose its credibility.

There are three additional reasons the topic is so important:
• Legal exposure. Improper disclosure can expose the CFE and the client to defamation claims, invasion-of-privacy suits, breach-of-contract claims, and (in the case of privileged material) the loss of legal protections the client was relying on in litigation.
• Integrity of the examination. Premature disclosure can tip off a subject, destroy evidence, or taint witness testimony.
• Exam weight. Ethics questions on the CFE Exam are heavily scenario-based, and confidentiality scenarios are a favorite because they test whether the candidate can apply a rule to messy real-world facts rather than simply recite it.

2. What the Rule Says
The relevant article of the ACFE Code of Professional Ethics states, in substance: A Certified Fraud Examiner shall not reveal any confidential information obtained during a professional engagement without proper authorization.

The ACFE Code of Professional Standards expands on this under its Confidentiality standard: CFEs shall not disclose confidential or privileged information obtained during the course of the fraud examination without the express permission of proper authority or an order of a court. The Standards add that this requirement does not preclude professional practice or investigative body reviews, as long as the reviewing organization agrees to abide by the confidentiality restrictions.

Break the rule into its components, because exam questions tend to turn on one of them:
• "Shall not reveal" – the duty is a prohibition on disclosure, including disclosure to friends, family, colleagues not on the engagement, the media, and even other clients.
• "Confidential information" – information the client or employer expects to remain private; it does not have to be marked secret, and it includes the mere fact that an investigation is taking place.
• "Obtained during a professional engagement" – the duty attaches because of the professional relationship, and it continues after the engagement ends and after the CFE leaves the employer.
• "Without proper authorization" – the two recognized forms are (a) permission from the client or other proper authority and (b) a lawful order of a court or other legal compulsion.

3. Confidential vs. Privileged: The Critical Distinction
Candidates often lose points by treating these words as synonyms. They are related but distinct.

Confidential information is an ethical and contractual concept. The CFE owes a duty to the client not to disclose it voluntarily. However, confidential information is not automatically shielded from compelled disclosure. If a court issues a valid subpoena or order, confidentiality alone does not permit the CFE to refuse.

Privileged information is a legal concept. A privilege is a rule of evidence that allows the holder to refuse to disclose, and to prevent others from disclosing, certain communications even in a legal proceeding. Common privileges include:
• Attorney-client privilege
• Attorney work-product protection (documents prepared in anticipation of litigation)
• Physician-patient privilege
• Spousal (marital) privilege
• Clergy-penitent privilege
• In some U.S. states, a limited accountant-client privilege (not recognized under federal common law; a narrow federal tax practitioner privilege exists but does not apply to criminal matters)

Key points about privilege that the exam tests:
• There is no general fraud examiner–client privilege. A CFE working directly for a client has no legal right to refuse a court order on the grounds that the client wants the information kept secret.
• The privilege belongs to the client, not the professional. Only the client (the holder) can waive it. The CFE cannot waive it on the client's behalf, and the CFE should not assume it has been waived.
• Privilege can be lost by disclosure to third parties. If privileged material is shared with someone outside the privileged relationship, the privilege may be waived. This is a major practical reason CFEs must be careful about who receives their reports and work papers.
• The CFE can come under the attorney-client umbrella. When a CFE is retained by an attorney to assist in providing legal advice to the attorney's client (the so-called Kovel arrangement, from United States v. Kovel, 1961), the CFE acts as the attorney's agent, and communications and work product may be protected. For this reason, when litigation is anticipated, counsel often engages the fraud examiner directly rather than having the company do so.
• Privileged information is also confidential. The Standards explicitly cover both, so every privileged item is subject to the ethical duty as well, but not every confidential item is privileged.

4. How the Rule Works in Practice

A. Proper authorization from the client or proper authority
The client, employer, or engaging attorney can authorize disclosure. Best practice is to obtain this permission in writing and to disclose only what has been authorized, to the parties authorized. Authorization to tell the audit committee is not authorization to tell the local newspaper.

B. Legal compulsion
A valid subpoena, court order, or statutory reporting requirement overrides the ethical duty of confidentiality. The Code never requires a CFE to break the law to protect a client. However, the correct response to a subpoena is not simply to hand everything over. The CFE should notify the client (unless legally prohibited), consult legal counsel, and allow the client the opportunity to assert any applicable privilege, because the privilege is the client's to raise.

C. Reviews by professional practice or investigative bodies
Quality reviews and reviews by investigative oversight bodies are permitted, provided the reviewer agrees to maintain the confidentiality restrictions.

D. Information that is not confidential
Information that is already public (e.g., contained in public court filings, published news reports, or public records) is not confidential simply because the CFE encountered it during an engagement. The exam may test whether you can distinguish genuinely confidential facts from publicly available ones.

E. Duration
The duty survives the end of the engagement and the end of employment. A CFE cannot write a memoir, give a conference presentation with identifiable details, or share case specifics with a new employer without authorization.

F. Interaction with other Code articles
Confidentiality must be read together with the rest of the Code:
• The Code also requires a CFE to reveal all material matters discovered during the course of an examination which, if omitted, could cause a distortion of the facts. This duty runs to the client or employer who commissioned the examination, not to the public at large. The two articles are not in conflict: tell the client everything material; tell outsiders nothing without authorization.
• The Code prohibits illegal or unethical conduct. Using confidential information for personal gain (e.g., trading on inside knowledge, using a client's customer list) violates both the confidentiality article and the integrity requirements.
• The Code requires compliance with lawful orders of the courts. This is the explicit basis for the legal-compulsion exception.

G. Practical safeguards
Secure storage of work papers, restricted-distribution reports, need-to-know access within the engagement team, careful email practices, and clear engagement letters describing who owns the work product and who may receive it all operationalize the duty.

5. Common Scenario Patterns on the Exam

Scenario: The curious friend or colleague. A CFE is asked by a friend, spouse, or coworker not on the engagement about the details of a case. Correct answer: the CFE may not disclose. Casual relationships and good intentions do not constitute proper authorization.

Scenario: The reporter. A journalist calls about a high-profile matter the CFE is investigating. Correct answer: the CFE must decline to comment, including declining to confirm or deny that an engagement exists, unless the client has authorized a statement.

Scenario: Law enforcement asks informally. A police officer requests the CFE's file without a subpoena or client consent. Correct answer: an informal request from law enforcement is not a court order. Absent client authorization or legal compulsion (or a specific statutory duty to report), the CFE should not turn over confidential material and should refer the request to the client or counsel.

Scenario: The subpoena. The CFE receives a valid subpoena for work papers; the client objects. Correct answer: a lawful order can override confidentiality, but the CFE should consult counsel and allow the client to assert any privilege. If no privilege applies and the order stands, the CFE must comply. Refusing to comply with a lawful court order violates the Code.

Scenario: Engaged by counsel. The CFE is hired by the company's outside attorney in anticipation of litigation. Correct answer: the CFE's communications and work product may be protected by attorney-client privilege and the work-product doctrine, and the CFE should take care not to waive that protection through disclosure to third parties. The privilege belongs to the client.

Scenario: After the engagement. A former client's case is over, and the CFE wants to use it as a detailed case study with identifying facts. Correct answer: still prohibited without authorization; the duty does not expire.

Scenario: The new client with similar problems. A CFE learns something on Engagement A that would help Client B. Correct answer: the information belongs to Client A and may not be shared.

Scenario: Public information. The CFE repeats facts contained in a publicly filed indictment. Correct answer: publicly available information is not confidential, though prudence and the client relationship still warrant discretion.

6. Exam Tips: Answering Questions on Privileged and Confidential Information

Tip 1 – Look for the two magic exceptions. Before selecting any answer that permits disclosure, ask: is there (a) proper authorization from the client/proper authority, or (b) a lawful order or legal requirement? If neither is present in the fact pattern, disclosure is wrong.

Tip 2 – Do not confuse "confidential" with "privileged." If a question asks whether a CFE can refuse a court order because the information is confidential, the answer is no. Only a legally recognized privilege supports refusal, and there is no general fraud examiner privilege.

Tip 3 – Remember who owns the privilege. Any answer choice suggesting the CFE may waive, assert, or decide the privilege on his or her own is a distractor. The privilege belongs to the client.

Tip 4 – "Consult legal counsel" is frequently the best procedural answer. When a subpoena, law enforcement request, or ambiguous legal demand appears, the most defensible course is to notify the client and seek legal advice rather than to disclose immediately or refuse outright.

Tip 5 – Watch for distractors based on good intentions. Options such as "because the information would help law enforcement," "because the friend is also a CFE," or "because the public has a right to know" are classic wrong answers. The Code does not contain a public-interest exception to confidentiality.

Tip 6 – The duty is permanent. Any answer that treats the end of the engagement, the end of employment, or the passage of time as releasing the CFE from the duty is incorrect.

Tip 7 – Distinguish internal reporting from external disclosure. Reporting all material findings to the client or employer is required by the Code. Disclosing those same findings to outsiders is prohibited without authorization. If an answer choice conflates the two, it is a trap.

Tip 8 – Recognize the Kovel pattern. When a fact pattern mentions that an attorney retained the CFE to assist in rendering legal advice or in anticipation of litigation, expect the correct answer to involve attorney-client privilege or work-product protection extending to the CFE's work.

Tip 9 – Recognize when information is not confidential. Publicly available information, or information the client has expressly authorized for release, falls outside the prohibition. Read carefully for words like "publicly filed," "press release," or "with the client's written consent."

Tip 10 – Choose the most conservative compliant option. When two answers both seem acceptable, the CFE Exam generally rewards the choice that protects confidentiality to the fullest extent consistent with the law. Discretion is almost never the wrong answer; voluntary disclosure almost always is.

7. Quick Reference Summary
• Rule: Do not reveal confidential information obtained during an engagement without proper authorization.
• Proper authorization: express permission of the client/proper authority, or a lawful court order or legal requirement.
• Confidential: ethical/contractual duty; does not defeat a valid subpoena.
• Privileged: legal protection from compelled disclosure; belongs to the client; no general CFE privilege; may attach when the CFE works under an attorney.
• Permitted: disclosure with authorization, under legal compulsion, to professional practice or investigative reviewers bound by confidentiality, and of genuinely public information.
• Duration: indefinite; survives the engagement.
• Companion duty: reveal all material matters to the client; never use confidential information for personal gain.

Master these distinctions, apply the two-exception test to every scenario, and you will handle confidentiality and privilege questions on the CFE Exam with confidence.
Test mode:

CFE - Privileged and Confidential Information Example Questions

Test your knowledge of Privileged and Confidential Information

Question 1

Which of the following BEST describes the scope of protection offered by the attorney work-product doctrine, as distinct from the attorney-client privilege?

Question 2

Legal counsel retains a fraud examiner to investigate suspected inventory larceny in anticipation of litigation. The examiner's report and interview memoranda name the employee whistleblower who made the original tip. The company's fidelity insurer asks the examiner for copies of both documents to process the company's claim. The examiner knows that releasing these materials to an outside party could affect their protected status. Which of the following is the BEST course of action for the examiner?

Question 3

Reports a fraud examiner prepares at the direction of legal counsel in anticipation of litigation can be protected by the work-product doctrine even when the examiner is a non-attorney.

More Privileged and Confidential Information questions
16 questions (total)