Advanced Audit and Assurance (International) · Code of Ethics for Professional Accountants

Confidentiality, Conflicts of Interest and Client Acceptance for ACCA AAA

Updated 11 October 2026 · Fact-checked

Confidentiality means you must not disclose or use client information without authority, unless law, professional duty or a right to disclose applies. Conflicts of interest arise when your interests or other clients' interests compete. Before accepting work, you assess threats, check competence, integrity and independence, and apply safeguards or decline.

Understand Confidentiality, Conflicts of Interest and Client Acceptance

The IESBA Code of Ethics sets five fundamental principles: integrity, objectivity, professional competence and due care, confidentiality, and professional behaviour. This topic applies three of them in practice: confidentiality, objectivity (through conflicts of interest) and integrity and competence (through client acceptance).

Confidentiality means you keep information gained through professional work private. You must not disclose it to anyone outside the firm without proper and specific authority. You must not use it for your own or a third party's advantage. You must also keep it confidential from close family and from colleagues who have no need to know. The duty continues after the engagement ends, and when you move to a new firm or employer.

The duty is not absolute. Disclosure is allowed or required when: the client has given consent, and the interests of third parties who might be affected have been considered; the law requires it (for example, reporting money laundering suspicions to the authorities, or producing documents under legal process); or there is a professional right or duty to disclose where law does not prohibit it. Examples are complying with a quality review of the firm, responding to an inquiry from a professional body, or protecting your own professional interests in legal proceedings. Where disclosure is permitted but not required, you use judgement. Consider whether the interests of any party could be harmed, whether the information is known and substantiated, and who the recipient is. Take legal advice if unsure.

A conflict of interest arises when your interests or those of another client or employer compete with the interests of the client you are serving. Examples are acting for two bidders for the same target, or for a company and its major shareholder in a dispute. The Code treats this as a threat to objectivity and, often, to confidentiality. You identify it, evaluate it and take steps. Typical steps are separate teams, information barriers, and disclosure to the affected parties with their consent. If the conflict cannot be managed, you decline or withdraw from the engagement.

Client acceptance and continuance is where these threats are first assessed. Before you accept, you consider the client's integrity, the firm's competence, capacity and resources, whether you can comply with independence rules, and any conflicts. If threats are not at an acceptable level, you apply safeguards or decline. You also review the client again periodically and when something changes. Before accepting an appointment from a predecessor, the proposed auditor communicates with the existing auditor to learn of any professional reasons for not accepting. The proposed auditor needs the client's permission to do this.

Key rules to remember

Fundamental principles: Integrity | Objectivity | Professional competence and due care | Confidentiality | Professional behaviour; Name the principle under threat in every answer. Confidentiality and objectivity are most relevant here.
Permitted or required disclosure of confidential information: Client consent (with third-party interests considered) | Required by law | Professional right or duty where law does not prohibit; Say which category applies. If disclosure is optional, explain the judgement factors and recommend legal advice.
Managing a conflict of interest: Identify → Evaluate → Address (safeguards, disclosure, consent) → Decline or withdraw if unmanageable; Disclosure and consent do not remove the need for separate teams or barriers where confidential information is at risk.
Client acceptance factors: Integrity of client | Competence, capacity and resources | Independence and ethical compliance | Conflicts | Risk and fee considerations; Link each factor to a threat. Continuance uses the same factors.
Communication with the existing auditor: Obtain client permission → Ask about professional reasons for not accepting → Assess the response; If the client refuses permission, consider whether to accept at all.

How to solve Confidentiality, Conflicts of Interest and Client Acceptance questions

Use this approach for any scenario question on confidentiality, conflicts or acceptance. It keeps your answer tied to the requirement and the facts.

1Read the requirement and mark whether it asks you to identify issues, discuss threats, recommend actions or advise whether to accept or disclose.
2Pick out the facts that matter: who the parties are, what information is held, what the law may require, and who benefits.
3Name the fundamental principle at risk, such as confidentiality or objectivity, and the type of threat: self-interest, familiarity, intimidation, advocacy or self-review.
4Test the position against the rule: is there consent, a legal requirement, or a professional right or duty to disclose? Or, for a conflict, can it be managed?
5Evaluate whether the threat is at an acceptable level, using the scenario facts such as the size of the fee, the seniority of staff and the sensitivity of the information.
6Recommend specific safeguards or actions: separate teams, barriers, disclosure with consent, legal advice, consulting the ethics partner, or declining.
7Conclude clearly with what the firm should do and why. State any further steps, such as documenting the decision.
8Check for professional skills: be concise, commercially aware and sceptical, and write to the reader named in the requirement.

Quickest way: Principle, threat, test, action

When to use it: Use when time is short, or for a part-question worth about 5 to 8 marks.

Write the principle at risk in one line.
State the threat type and why it arises in these facts.
Apply the test: consent, law, professional duty, or manageable conflict.
Give two or three specific actions and a clear conclusion.

Common mistakes in Confidentiality, Conflicts of Interest and Client Acceptance

Saying confidentiality can never be breached.
Students learn the duty but forget the exceptions.
Fix: State the three categories of permitted or required disclosure and apply the one that fits the facts.
Saying the auditor must always disclose when the law allows it.
Students confuse a right to disclose with a duty to disclose.
Fix: Separate required from permitted disclosure. For permitted cases, discuss judgement factors and recommend legal advice.
Treating disclosure to the client and its consent as a complete answer to a conflict.
Students remember consent but not the need to protect confidential information.
Fix: Add practical safeguards such as separate teams and information barriers, and say when the firm should decline if the conflict cannot be managed.
Listing acceptance factors without linking them to the scenario.
Students recall a checklist and copy it out.
Fix: Tie each factor to a fact in the case, such as a director's reputation, lack of sector expertise or an existing non-audit service.
Forgetting to ask the client's permission before contacting the previous auditor.
Students overlook that this contact is itself a confidentiality matter.
Fix: State that permission is needed and consider the implication if it is refused.
Ending without a clear recommendation.
Students run out of time or fear being wrong.
Fix: Always finish with a decision, for example accept with safeguards, decline, or disclose to the authority, and give the reason.

Worked examples

Example 1

Your firm audits Zenith Ltd. During the audit you find evidence that the finance director has paid bribes to a foreign official to win a contract. Zenith's chairman asks you not to tell anyone outside the company. Discuss whether you may or must disclose this, and what you should do. (8 marks)

Show the solution

Principle at risk: confidentiality, with integrity and professional behaviour also relevant. The duty of confidentiality does not cover concealing illegal acts.
Test the exceptions. First, consent: the chairman is refusing, so this route is unavailable. Second, law: many jurisdictions require reporting of bribery or money laundering suspicions to the authorities, and some prohibit tipping off. The firm must check the local legal position and take legal advice. Third, professional right or duty: the Code allows disclosure to an appropriate authority of suspected non-compliance with laws where the firm has determined it is in the public interest, subject to law.
Immediate action: discuss the matter with management and those charged with governance, other than the finance director if he is implicated, to understand the facts and give them a chance to respond and rectify.
Consider the effect: assess whether the matter is material to the financial statements, for example through fines, loss of contracts or going concern implications. Consider the effect on the audit opinion and on reliance on management representations.
Consult the firm's ethics partner or senior colleagues, document the reasoning, and take legal advice before any disclosure. If law requires reporting, report. If it is optional, weigh the public interest, the seriousness and the risk of harm to others.
Consider withdrawing from the engagement if the entity will not take appropriate action, taking legal advice on any communication with the successor or the authorities.

Answer: The chairman's instruction does not remove your obligations. You must disclose if the law requires it. If disclosure is only permitted, you may disclose to an appropriate authority where it is in the public interest, after legal advice and discussion with those charged with governance. Document your judgement and consider withdrawal if management does not act.

Example 2

Your firm is asked to accept an audit of Brightway Ltd. Your firm already provides advisory services to Crestline Ltd, Brightway's largest competitor, and holds sensitive strategic information about Crestline. Discuss the ethical issues in accepting the audit and how they could be managed. (7 marks)

Show the solution

Identify the issue: a conflict of interest. Acting for two competing clients creates a threat to objectivity, and a risk that confidential information about Crestline could be misused or disclosed. It is a potential advocacy or self-interest threat if the firm favours one client for commercial reasons.
Evaluate: auditing is not the same as advising, but the firm holds sensitive information that could harm Crestline if it reached Brightway. Brightway and Crestline have competing interests, which raises the significance of the threat.
Safeguards: use separate engagement teams with no shared staff, apply information barriers such as restricted file access, and have an independent partner review the work.
Disclosure and consent: inform both clients of the situation and obtain their informed consent to the firm acting for both. If consent cannot be obtained, or the firm cannot protect the information, it should not accept.
Also review acceptance factors: competence in the sector, integrity of Brightway's management, resources, independence, and communication with the existing auditor with Brightway's permission.
Conclude: accept only if the conflict can be managed through safeguards and consent. Otherwise decline the audit.

Answer: There is a conflict of interest that threatens objectivity and confidentiality. The firm can accept only if separate teams, information barriers and independent review reduce the threat to an acceptable level and both clients give informed consent. If not, it should decline.

Exam tips

In ethics questions, name the fundamental principle and the threat type first. Marks are awarded for identification and for applying it to the facts.
Distinguish clearly between a duty to disclose and a right to disclose. Many students lose marks by treating them as the same.
Always end with a specific recommendation, not just a list of threats. Professional skills marks reward a clear, commercially sensible conclusion.
For acceptance questions, tie each factor to a scenario fact and show scepticism about what management tells you.
Write to the reader named in the requirement, such as the engagement partner or ethics committee, and keep the tone professional.

Practice questions from Code of Ethics for Professional Accountants

Confidentiality, Conflicts of Interest and Client Acceptance in other exams

The same ground in other exams, if you are preparing for more than one or want another angle on it.

Confidentiality, Conflicts of Interest and Client Acceptance: frequently asked questions

When can an auditor disclose confidential client information?

When the client has consented and third-party interests have been considered, when the law requires it, or when there is a professional right or duty to disclose and the law does not prohibit it. In optional cases you use judgement and often take legal advice.

How do you manage a conflict of interest under the IESBA Code?

Identify the conflict, evaluate the threat, and apply safeguards such as separate teams, information barriers and disclosure with consent. If the conflict cannot be reduced to an acceptable level, decline or withdraw from the engagement.

What should an auditor consider before accepting a new client?

Consider the integrity of the client and its management, the firm's competence, capacity and resources, compliance with independence rules, any conflicts of interest, and the level of risk. Also communicate with the existing auditor, with the client's permission.

Does the duty of confidentiality continue after an engagement ends?

Yes. The duty continues after the relationship ends, and when you change firms or employers. It still applies unless an exception such as law, consent or a professional duty permits disclosure.