Confidentiality and Appropriate Use of Information

5 minutes 5 Questions

Confidentiality is a core ethical principle for internal auditors. It was traditionally one of the four principles of the IIA Code of Ethics, alongside integrity, objectivity, and competency, and it is now Principle 5 of the Global Internal Audit Standards (Ethics and Professionalism domain). For the CIA Challenge Exam, candidates should understand both what confidentiality requires and how it supports trust and audit quality. Internal auditors routinely access sensitive records, personnel data, strategic plans, and proprietary information. Stakeholders give this access because they trust that auditors will respect the value and ownership of the information and will not disclose it without appropriate authority unless there is a legal or professional obligation to do so. The principle has two main components. The first is appropriate use of information (Standard 5.1). Auditors must use information only for legitimate audit purposes. They must not use it for personal gain, in any manner contrary to law, or in ways that harm the legitimate and ethical objectives of the organization. Examples of violations include trading shares based on insider knowledge gained during an engagement or sharing findings with unauthorized parties. The second is protection of information (Standard 5.2). Auditors must be prudent in safeguarding information, following organizational policies, laws, and regulations on data privacy, retention, and disclosure. The chief audit executive should establish methodologies for access, storage, and release of engagement records, including requirements for approval before releasing information to external parties. Auditors must also respect confidentiality after leaving an engagement or the organization. Confidentiality is not absolute. Auditors may need to disclose information when required by law, regulation, or professional standards, such as reporting illegal acts to regulators or audit committees, but they should seek guidance from legal counsel and senior management or the board. Breaching confidentiality damages credibility, independence, and the internal audit function's reputation, so exam questions often test ethical judgment about when, how, and to whom information may be disclosed.

Confidentiality and Appropriate Use of Information: A Complete CIA Challenge Exam Guide

Overview
Confidentiality is one of the core ethical principles of the internal audit profession. Internal auditors routinely see payroll data, strategic plans, merger discussions, customer records, investigation files and evidence of misconduct. How they use and protect that information decides whether the organization will trust them with full access. For the CIA Challenge Exam, this topic sits within Internal Audit Professionalism and Quality. It is usually tested through scenario-based questions that ask what an internal auditor should or should not do with information.

1. Why Confidentiality and Appropriate Use of Information Matter
Access depends on trust. The internal audit charter typically grants unrestricted access to records, personnel and property. Management and the board only give that access if they are confident it will not be abused.

Credibility of the function. A single leak, such as sharing preliminary findings with an unauthorized party or gossiping about an investigation, can damage the reputation of the whole internal audit activity.

Legal and regulatory exposure. Mishandling personal data, trade secrets or price-sensitive information can breach privacy laws (for example, GDPR-type regulations), insider trading rules or contractual obligations. This exposes the organization and the auditor to penalties.

Protection of people. Investigations and whistleblower matters involve individuals whose careers and reputations are at stake. Improper disclosure can cause unfair harm and discourage future reporting.

Professional obligation. Under the IIA's Global Internal Audit Standards, confidentiality is a mandatory principle. Breaching it can lead to disciplinary action, including loss of the CIA designation.

2. What It Is: The Framework
Under the Global Internal Audit Standards (2024), Domain II (Ethics and Professionalism) contains Principle 5: Maintain Confidentiality. The principle states that internal auditors use and protect information appropriately. It has two standards.

Standard 5.1 Use of Information
  • Internal auditors must follow relevant policies, procedures, laws and regulations when using information.
  • They must not use information for personal gain.
  • They must not use information in a manner that is contrary to the law or detrimental to the organization's legitimate and ethical objectives.

Standard 5.2 Protection of Information
  • Internal auditors must be aware of their responsibility to protect information.
  • They must respect the confidentiality, privacy and ownership of information acquired during internal audit services or through professional relationships.
  • They must understand and comply with laws, regulations, policies and procedures on confidentiality, information privacy and information security.
  • The chief audit executive (CAE) must establish methods to control access to internal audit information and to govern its dissemination.

Legacy wording you may still see
The former IIA Code of Ethics expressed the same idea in two Rules of Conduct:
  • Rule 3.1: Shall be prudent in the use and protection of information acquired in the course of their duties.
  • Rule 3.2: Shall not use information for any personal gain or in any manner that would be contrary to the law or detrimental to the legitimate and ethical objectives of the organization.
The underlying concepts are identical, so the same reasoning applies whichever wording appears.

Key concepts
  • Confidentiality: not disclosing information without appropriate authority, unless there is a legal or professional obligation to do so.
  • Appropriate use: using information only for legitimate internal audit purposes.
  • Privacy: respecting individuals' rights over their personal data.
  • Ownership: information belongs to the organization (or a third party), not to the auditor.
  • Prudence: applying care and judgment in handling, storing, transmitting and disposing of information.

3. How It Works in Practice
a) Need-to-know access
Auditors request and view only the information needed for the engagement. Within the audit team, sensitive data (for example, a fraud investigation) is restricted to those assigned.

b) Secure handling of engagement records
Workpapers are stored in secured systems with access controls, encryption and retention schedules. The CAE sets policies on who may access engagement records and on how long they are kept. These policies are aligned with legal and organizational requirements.

c) Controlled dissemination of results
Final communications go to parties who can ensure results receive due consideration. Before results are released outside the organization, the CAE typically should:
  • assess the potential risk to the organization;
  • consult senior management and/or legal counsel as appropriate;
  • control dissemination, for example by restricting how the results may be used.

d) Requests from external parties
Requests from regulators, external auditors, law enforcement or the media should be routed through established protocols. This usually means the CAE, legal counsel and senior management. An individual auditor should not respond independently.

e) Legal or professional obligations to disclose
Confidentiality is not absolute. Information may need to be disclosed in these situations:
  • a subpoena, court order or regulatory requirement;
  • whistleblower protection laws;
  • professional duties, such as reporting significant matters to the board.
In such cases, auditors should seek legal advice and follow organizational policy. They should disclose only what is required.

f) No personal gain
Auditors must never act on information acquired at work for their own benefit. Examples of prohibited conduct:
  • trading shares on knowledge of an unannounced acquisition;
  • tipping off a friend about an upcoming contract award;
  • using customer lists after leaving the organization.

g) Ongoing obligation
The duty of confidentiality continues after the engagement ends and after the auditor leaves the organization.

h) Everyday risks
Auditors should take care with:
  • conversations in public places;
  • social media posts;
  • personal email or cloud storage;
  • unattended laptops;
  • sharing anonymized cases at conferences without approval.
Using real engagement examples in training or presentations requires appropriate permission and anonymization.

i) Confidentiality vs. other ethical duties
Confidentiality must not be used to hide wrongdoing. Principle 1 (Integrity) requires honesty and professional courage, and auditors must not be party to illegal activity. If confidentiality and the duty to report illegal or unethical acts appear to conflict, the auditor's course is to escalate through proper channels. These channels are the CAE, then senior management and the board, then legal counsel. Silence is not the answer, and neither is public disclosure.

4. Common Scenario Types on the Exam
  • An auditor learns of a pending merger and considers buying stock. Violation: personal gain.
  • A friend in another department asks about audit findings concerning her manager. Must not disclose: no authority or need to know.
  • A journalist or vendor requests audit results. Refer to the CAE and established protocols.
  • An external regulator requests workpapers. The CAE, with legal counsel and senior management, determines what is provided.
  • An auditor takes workpapers home on a personal USB drive. Violation of prudence and protection.
  • A former employer's confidential data is useful in a new job. Cannot be used: the duty continues.
  • An auditor discovers fraud and wonders whether confidentiality prevents reporting. No. Report through proper internal channels.
  • A subpoena demands audit records. Consult legal counsel. Disclosure required by law is not a breach.

Exam Tips: Answering Questions on Confidentiality and Appropriate Use of Information
1. Identify the core issue first. Ask yourself which of three questions the scenario is really about:
  • Is it about using information (personal gain, detrimental use)?
  • Is it about protecting information (security, unauthorized disclosure)?
  • Is it about authorized disclosure (legal obligation, reporting to the board)?

2. Personal gain is always wrong. Any option where the auditor benefits personally from information obtained at work is a violation. This holds even if the organization suffers no loss and the information later becomes public.

3. Confidential does not mean secret from the board. Reporting significant issues to senior management and the board is part of the job, not a breach. Be wary of answers suggesting the auditor withhold findings from the board for confidentiality reasons.

4. Legal obligations override confidentiality. When the law requires disclosure, as with a subpoena or regulatory mandate, complying is appropriate. The best answer usually includes consulting legal counsel and disclosing only what is required.

5. Prefer escalation through proper channels. The best answers typically involve the CAE, legal counsel, senior management or the board. Answers involving the media, external parties, personal judgment or acting alone are rarely correct.

6. Watch for 'best' vs. 'acceptable' wording. Several options may seem reasonable. The 'best' answer is the most complete and protective. It follows policy, involves the right authority and limits disclosure to need-to-know.

7. Recognize that good intentions do not excuse breaches. An auditor who shares information 'to help' a colleague, or posts an anonymized story online without approval, still violates the principle.

8. Remember the duty never expires. Questions about former employees or completed engagements are testing whether you know that confidentiality continues indefinitely.

9. Distinguish confidentiality from objectivity and integrity. Some questions combine principles. Match the scenario to the right one:
  • Accepting a gift points to objectivity.
  • Lying in a report points to integrity.
  • Leaking or misusing data points to confidentiality.

10. Look for policy and law references. Standard 5.1 and Standard 5.2 both emphasize following relevant policies, procedures, laws and regulations. An option grounded in organizational policy or applicable privacy law is usually stronger than one based on personal opinion.

11. External release of results requires CAE control. If a question asks who decides whether results go outside the organization, the answer centers on the CAE. The CAE considers the risk and consults senior management and/or legal counsel.

12. Eliminate extreme answers. Discard options at either extreme:
  • never disclose anything to anyone;
  • disclose everything immediately to everyone.
Correct answers reflect balanced, authorized, need-to-know handling.

Practice Example
An internal auditor reviewing treasury discovers the organization will soon announce a major acquisition. The auditor's spouse holds shares in the target company. What should the auditor do?
  • A. Tell the spouse to hold the shares.
  • B. Say nothing to anyone, including the spouse, and handle any potential conflict according to organizational policy.
  • C. Disclose the acquisition to the spouse because it is a family matter.
  • D. Post a general hint on social media.
Answer: B. Using or sharing the information for personal or family benefit violates Standard 5.1. The auditor must protect the information under Standard 5.2. Any potential conflict of interest should be disclosed through appropriate channels.

Quick Summary
  • Use information only for legitimate purposes, never for personal gain.
  • Protect it from unauthorized access and disclosure.
  • Respect privacy and ownership.
  • Follow laws and policies.
  • Escalate through the CAE and legal counsel.
  • Disclose only when authorized or legally required.
Master these points and you will be able to answer most confidentiality questions on the CIA Challenge Exam with confidence.
Test mode:
Start practice test

CIA Challenge - Confidentiality and Appropriate Use of Information Example Questions

Test your knowledge of Confidentiality and Appropriate Use of Information

Question 1

An internal auditor evaluates a highly confidential acquisition target for their organization. Recognizing this upcoming acquisition will severely impact the target's primary competitor, the auditor purchases financial options against the competitor's market stock. The auditor believes this action is permissible since the transaction involves an external entity's securities, rather than the organization's own stock or a specific engagement stakeholder. How should this professional behavior be evaluated under the ethics and professionalism principles of the Standards?

Correct Answer: The action violates professional principles because leveraging proprietary knowledge for personal financial advantage constitutes an improper use of privileged data regardless of the targeted entity.

The action is a violation because Principle 5, Maintain Confidentiality, applies to it. Standard 5.1, Use of Information, prohibits internal auditors from using information obtained in the course of their duties for personal benefit. That prohibition covers trading any securities whose value is affected by the privileged knowledge, whoever issued them. Calling the trade acceptable because the securities belong to an external entity outside the engagement scope is wrong: the prohibition attaches to the source of the information, not to the identity of the issuer. Making the trade permissible by declaring the investments to the chief audit executive and protecting working papers is also wrong. Disclosure does not make the personal use of confidential information legitimate. Blaming the breach on a lack of legal authorization misses the point. Exploiting confidential organizational information for personal gain is improper whether or not any authorization is obtained.
Key concept: Under Principle 5 (Maintain Confidentiality), Standard 5.1 Use of Information prohibits using information obtained during internal audit work for personal benefit.

Question 2

How do the Standards restrict the use of privileged information obtained during assurance activities?

Correct Answer: Practitioners are prohibited from leveraging acquired intelligence for personal gain or in ways detrimental to the enterprise's ethical objectives.

Under Principle 5, Maintain Confidentiality, Standard 5.1 Use of Information requires internal auditors not to use information for personal gain or in a manner contrary or detrimental to the organization's legitimate and ethical objectives. Using information only to maximize financial returns is not the test the Standards set, and it ignores the ethical limits on use. A rule that sharing across departments needs operational approval is not what the Standards require, and it would undercut the internal audit function's independent reporting lines. Limiting information strictly to the current engagement is wrong because information may properly inform later risk assessments and engagements, provided it is used and protected appropriately. Key concept: Standard 5.1 Use of Information (Principle 5, Maintain Confidentiality) and the proper use of information obtained during engagements.

Question 3

Under the Global Internal Audit Standards' principle of Maintain Confidentiality, what specific restriction applies to an internal auditor's use of information obtained during professional engagements?

Correct Answer: The auditor must not use the acquired information for personal benefit, for any unlawful purpose, or in ways detrimental to the organization.

Under Principle 5, Maintain Confidentiality, Standard 5.1 Use of Information requires internal auditors not to use information obtained during their work for any unlawful purpose, for personal benefit, or in a manner contrary or detrimental to the organization's legitimate and ethical objectives. Restricting distribution solely to the board and regulators is incorrect because engagement results are routinely communicated to appropriate management and other stakeholders. Prohibiting retention of records contradicts the engagement documentation requirements of Standard 14.6, which call for records to be retained in line with the function's policies. Requiring written consent from the chief executive officer to share conclusions with stakeholders is an artificial restriction that the Standards do not impose.
Key concept: Standard 5.1 Use of Information under the Maintain Confidentiality principle of the Global Internal Audit Standards.

More Confidentiality and Appropriate Use of Information questions
59 questions (total)
Start 59 question test

Other Internal Audit Professionalism and Quality concepts

Disclosing Nonconformance with the StandardsImpairments to Individual ObjectivityImpairments to Internal Audit IndependenceInternal Audit KPIs and Scorecard MetricsInternal Audit Mandate and Board and CAE ResponsibilitiesInternal Audit's Role in Risk Management and the Three LinesQuality Assurance and Improvement Program
All Internal Audit Professionalism and Quality questions · CIA Challenge practice test