CIA-1 - Ethics and Professionalism (20% of the exam) - Section B.6
Maintain confidentiality and use information appropriately during engagements, applying relevant policies, laws, regulations, audit methodologies, and privacy protections.
Handle engagement information appropriately by respecting its privacy and ownership, applying relevant organisational policies, laws, and regulations, and using approved audit methodologies. Apply appropriate methods to protect information from unauthorised disclosure, recognising that confidentiality obligations continue beyond the end of an engagement and beyond the auditor's tenure.
ConfidentialityData privacyAppropriate use of information
Practice question for this objective
lock_openFree sampleEthics and Professionalismeasy
Under the IIA Code of Ethics, which statement best describes what the principle of confidentiality requires of an internal auditor?
AIt requires the auditor to be straightforward and honest in professional relationships and to avoid knowingly taking part in any unlawful activity.
BIt requires the auditor to stay unbiased and to avoid any relationship that could impair professional judgement about the audited activity.
CIt requires the auditor to apply the knowledge, skills, and experience needed to perform internal audit services proficiently.
DIt requires the auditor to respect the ownership of information received and to protect it from unauthorised disclosure unless there is a legal or professional duty to release it.check_circle Correct
Confidentiality requires respecting the ownership of information and protecting it from unauthorised disclosure absent a duty to release it. The confidentiality principle is about how information is handled: the auditor respects who owns it, uses it prudently, and does not disclose it without proper authority or a legal or professional requirement to do so, which sets it apart from integrity, objectivity, and competency.
Why A is wrong: Honesty is central to ethics, so this is tempting, but it describes the integrity principle rather than confidentiality.
Why B is wrong: Freedom from bias is a genuine ethical duty, but it defines the objectivity principle, not confidentiality.
Why C is wrong: Applying appropriate skill matters, yet this describes the competency principle rather than the handling of information under confidentiality.
Why D is correct: This captures confidentiality: respecting the value and ownership of information and safeguarding it against improper disclosure, subject to any legal or professional obligation to disclose.
Answers that look right on this material and are not. Each one is a distractor from a different question in the CIA-1 bank for this domain.
Copy the full customer database to a personal laptop so the testing can be completed off-site at any time.
errorWhy it is wrong: Off-site convenience is tempting, but moving personal data to an unsecured personal device breaches data-protection obligations and exposes the records to unauthorised disclosure.
Retaining the personal data indefinitely so that it is available for any future engagement that might one day need it.
errorWhy it is wrong: Keeping personal data beyond its purpose raises privacy exposure, so indefinite retention is not the appropriate handling the principle expects.
Provide only the summary figures rather than the full analysis, since summaries are far less sensitive than the detailed records.
errorWhy it is wrong: Summarising the data feels like a lesser breach, but the confidentiality duty covers the information itself, not just its level of detail, so passing any of it to a competitor still violates the principle.