CIA-1 - Ethics and Professionalism - Section B.6

Maintain confidentiality and use information appropriately during engagements, applying relevant policies, laws, regulations, audit methodologies, and privacy protections.

Handle engagement information appropriately by respecting its privacy and ownership, applying relevant organisational policies, laws, and regulations, and using approved audit methodologies. Apply appropriate methods to protect information from unauthorised disclosure, recognising that confidentiality obligations continue beyond the end of an engagement and beyond the auditor's tenure.

ConfidentialityData privacyAppropriate use of information

Practice question for this objective

Free sampleEthics and Professionalismeasy

Under the IIA Code of Ethics, which statement best describes what the principle of confidentiality requires of an internal auditor?

  • AIt requires the auditor to be straightforward and honest in professional relationships and to avoid knowingly taking part in any unlawful activity.
  • BIt requires the auditor to stay unbiased and to avoid any relationship that could impair professional judgement about the audited activity.
  • CIt requires the auditor to apply the knowledge, skills, and experience needed to perform internal audit services proficiently.
  • DIt requires the auditor to respect the ownership of information received and to protect it from unauthorised disclosure unless there is a legal or professional duty to release it. Correct
Confidentiality requires respecting the ownership of information and protecting it from unauthorised disclosure absent a duty to release it. The confidentiality principle is about how information is handled: the auditor respects who owns it, uses it prudently, and does not disclose it without proper authority or a legal or professional requirement to do so, which sets it apart from integrity, objectivity, and competency.

Why A is wrong: Honesty is central to ethics, so this is tempting, but it describes the integrity principle rather than confidentiality.

Why B is wrong: Freedom from bias is a genuine ethical duty, but it defines the objectivity principle, not confidentiality.

Why C is wrong: Applying appropriate skill matters, yet this describes the competency principle rather than the handling of information under confidentiality.

Why D is correct: This captures confidentiality: respecting the value and ownership of information and safeguarding it against improper disclosure, subject to any legal or professional obligation to disclose.

See more CIA-1 practice questions, answers explained.

More in this domain

Back to all Ethics and Professionalism objectives, or the CIA-1 cert hub.

Examworthy is not affiliated with or endorsed by The Institute of Internal Auditors. Original, blueprint-aligned practice material only.