Advanced Audit and Assurance (International) · Laws and regulations

Reporting Non-Compliance and Confidentiality: Auditor Duty vs Right

Updated 11 October 2026 · Fact-checked

Auditors owe clients confidentiality, but it gives way when law requires disclosure (a duty) or when the public interest justifies it (a right). Decide what the law requires, consider ISA 250 and the IESBA Code, take legal advice, disclose only what is necessary to the right body, and document the decision.

Understand Reporting Non-Compliance and Confidentiality

Confidentiality is a fundamental principle in the IESBA Code. You must not disclose client information without proper authority, and you must not use it for personal advantage. It protects the client's trust, and trust is what lets management give you full access.

Confidentiality is not absolute. The Code allows or requires disclosure in set situations. Disclosure is required when law or regulation compels it, for example a statutory duty to report to a regulator or a money laundering report. Disclosure is permitted when there is a legal right or professional duty to disclose and it is not prohibited by law, for example to defend yourself in legal proceedings or to respond to a regulator's inquiry. It may also be permitted where it is in the public interest.

The key distinction is duty versus right. A duty to report means you have no choice. Failing to report is itself an offence or a breach. A right to report means you may disclose without breaching confidentiality, but you are not forced to. You then use judgement. The question to ask is whether the matter is serious enough, and the public interest strong enough, to justify breaking confidence.

Under ISA 250 and the NOCLAR provisions of the Code, you first raise suspected non-compliance with management and those charged with governance. If they do not respond appropriately, you consider whether to report to an appropriate authority. Factors include how serious the matter is, whether it is ongoing, whether management is involved, and whether law protects you when you report in good faith.

Money laundering is a special case. Where law imposes reporting duties, you must report suspicions to the designated authority. You must also avoid tipping off, which means alerting the client that a report has been or may be made, or that an investigation may follow. Tipping off is typically an offence under anti-money laundering law. This can clash with your normal duty to communicate with those charged with governance, so you take legal advice and may need to stop communicating on that matter.

Key rules to remember

Duty to report: Law or regulation requires disclosure → you must report; Confidentiality is overridden. Failure to report is itself a breach or offence. Report even without client consent.
Right to report: No legal duty + public interest + disclosure not prohibited → you may report; Judgement is needed. Disclose only what is necessary, to the proper body, and keep records.
Permitted disclosure with consent: Client authorises → disclose within the consent given; Consider the interests of all parties who might be affected.
Tipping off: Report made or investigation likely → do not alert the client; Typically an offence under anti-money laundering law. Take legal advice before any communication on the matter.
NOCLAR response sequence: Understand → discuss with management and TCWG → consider need for further action → report if appropriate → document; Reporting externally is considered if management and TCWG do not respond appropriately.

How to solve Reporting Non-Compliance and Confidentiality questions

Use the same order for any question on reporting non-compliance and confidentiality. It keeps your answer structured and earns professional skills marks.

1Identify the facts: what has happened, who is involved, how serious it is, and whether it is ongoing or finished.
2Identify the law: is there a statutory duty to report, such as money laundering or regulated entity reporting? If so, confidentiality is overridden.
3If there is no duty, ask whether there is a right to disclose in the public interest and whether law prohibits or protects disclosure.
4Apply the escalation steps: discuss with management, then those charged with governance, and consider whether they responded appropriately.
5Check for tipping off risk and restrict communication with the client if a report is required.
6Decide what to disclose, to whom, and how much. Limit it to what is necessary and take legal advice.
7Consider wider consequences: audit report implications, resignation, and the effect on your opinion.
8Document your reasoning, the advice taken and the conclusion.

Quickest way: Duty, right or silence in four questions

When to use it: Use when time is short and the requirement asks what the auditor should do about disclosure.

Is there a legal duty to report? If yes, state you must report and confidentiality does not prevent it.
If no, is there a public interest right? Name the factors: seriousness, ongoing harm, management response, legal protection.
Is there any tipping off risk? If yes, say do not tell the client and take legal advice.
Close with the action: report only what is necessary to the proper authority, document, and consider the effect on the audit report or resignation.

Common mistakes in Reporting Non-Compliance and Confidentiality

Saying confidentiality always prevents the auditor from reporting to anyone outside the client.
Students remember confidentiality as a fundamental principle and forget its exceptions.
Fix: State that confidentiality is overridden by a legal duty and can be set aside where disclosure is permitted, including in the public interest.
Confusing a duty to report with a right to report.
Both lead to disclosure, so they look alike.
Fix: Label each point explicitly. Duty means mandatory by law. Right means permitted, requires judgement, and has no penalty for staying silent.
Telling the client or management that a money laundering report has been made.
Students apply the normal rule of communicating with those charged with governance.
Fix: Warn against tipping off, explain it is typically an offence, and recommend legal advice and restrained communication.
Reporting externally immediately without first raising the matter with management or those charged with governance.
Students jump to the dramatic outcome.
Fix: Show the sequence: understand, discuss internally, assess response, then consider external reporting. The exception is where law requires reporting or tipping off risk makes internal discussion unsafe.
Disclosing everything about the client, not just what is relevant.
Students treat disclosure as all or nothing.
Fix: Say the disclosure should be limited to the matter and to the appropriate authority, and that legal advice should be taken first.
Listing rules without applying them to the scenario.
Students recall theory but skip the case facts.
Fix: Quote the facts, such as the amount, the people involved or management's reaction, and say what each means for the decision.

Worked examples

Example 1

You are the audit manager of Zenith Foods, a $40 million revenue client. During the audit you find that the finance director has paid $300,000 to a local official to speed up an import licence. The finance director says it is a normal cost of business and asks you not to raise it with the board. Explain how you should respond, referring to confidentiality.

Show the solution

Facts: the payment looks like bribery, an illegal act. It is material to the integrity of management, and the finance director is involved, so management's response is not reliable.
Duty or right: check whether local law requires auditors to report this. If it does, you must report and confidentiality does not stop you. If it does not, consider the public interest right.
Escalation: do not accept the request for silence. Raise the matter with those charged with governance, such as the audit committee or board members not involved, because the finance director is implicated.
Assess their response: if they do not take appropriate action, consider reporting to the proper authority. Seriousness is high because bribery is deliberate and may be ongoing.
Confidentiality: it is a fundamental principle but not absolute. Disclosure would be limited to the facts needed and made to the correct authority after legal advice.
Other consequences: consider the effect on the audit report, the reliability of management representations, and whether resignation is appropriate. Check also for money laundering reporting duties.
Document the evidence, discussions, advice and the decision.

Answer: Do not agree to stay silent. Report to those charged with governance first. If law requires reporting you must do so. If not, you may report in the public interest if they fail to act, disclosing only what is necessary after legal advice. Document everything and consider the effect on the audit opinion and your continued appointment.

Example 2

During an audit you suspect that a client's customer deposits of $2 million are proceeds of crime. Your engagement partner wants to ask the client's finance director to explain the source of funds. Advise the partner.

Show the solution

Facts: the suspicion comes from unusual deposits. Money laundering law typically requires a report of a suspicion, not proof.
Duty: as the matter falls under anti-money laundering law, there is a mandatory duty to report the suspicion to the designated authority, usually through the firm's nominated officer. Client consent is not needed and confidentiality does not prevent it.
Tipping off: asking the finance director directly about the suspected source could alert the client that a report may follow. This is typically an offence.
Advice: do not make the enquiry. Pass the suspicion to the firm's nominated officer, who decides on the external report. Limit who in the team knows.
Continue the audit carefully, avoiding comments to the client that reveal the suspicion. Take legal advice on what may be communicated, and whether to continue the engagement.
Document the reasons for suspicion and the actions taken, keeping the file restricted.

Answer: Advise the partner not to ask the finance director, because of tipping off risk. Report the suspicion internally to the nominated officer, who will report to the authority. Confidentiality is overridden by the legal duty. Take legal advice and document the matter on a restricted file.

Exam tips

Always label each disclosure as a duty or a right, and justify the label with the facts. Markers look for this distinction.
Use the scenario facts, such as who is involved and how serious the act is, to decide whether to escalate externally.
For money laundering questions, mention tipping off and say what the auditor should not do, as well as what to do.
Recommend legal advice and documentation in your conclusion. These are easy professional skills marks.
If asked to evaluate, give both sides: the harm of breaching confidentiality against the harm of staying silent.

Practice questions from Laws and regulations

Reporting Non-Compliance and Confidentiality: frequently asked questions

What is the difference between a duty and a right to report?

A duty is required by law, so you must report and confidentiality does not stop you. A right means you are allowed to disclose, usually in the public interest, but you use judgement and are not forced to. Say which applies in your answer.

Can an auditor breach confidentiality without client consent?

Yes, where law requires disclosure or where disclosure is permitted, such as in the public interest or to defend the auditor in legal proceedings. The disclosure should be limited to what is necessary and made to the right body. Take legal advice first.

What is tipping off in the AAA exam?

Tipping off means alerting the client or others that a money laundering report has been made or that an investigation may follow. It is typically an offence under anti-money laundering law. You avoid it by restricting communication and taking legal advice.

Should the auditor always report to management first?

Usually yes. Under ISA 250 and the Code you discuss the matter with management and those charged with governance. The exceptions are where management is involved, where law requires reporting, or where telling the client risks tipping off.