Chapter 9
Confidentiality
Everyone loves to hear a good secret, and many of us have a deep-seated psychological need to share them. During childhood, for example, you might have shared a secret with a friend or sibling to develop a deeper emotional bond. Then, as you grew up, to release feelings of guilt, you may have told a close friend that you were cheating in a romantic relationship. Anyone who has ever sat on a bus or airplane next to a talkative stranger readily appreciates how intensely some desire to share secrets.
A prominent author once wrote that “secrets press inside a person…the way water presses at a dam. Secrets and water, they both want to get out.”1 This may be true, but no matter how tempting it may be to share client secrets, accountants must resist this urge.
This chapter will examine the Confidential Client Information Rule, which states that an accountant in public practice “shall not disclose any confidential client information without the specific consent of the client.”2 A counterpart provision states that an accountant working in industry “should maintain the confidentiality of his or her employer's confidential information and should not use or disclose any confidential employer information obtained as a result of an employment relationship.…”3
WHY CONFIDENTIAL INFORMATION IS PROTECTED
Members of various professions have long recognized that fully informed decision makers reach the best decisions and that assurances of confidentiality encourage the sharing of information. For instance, doctors have long observed that reluctant patients are more likely to share sensitive personal information after being reassured that their privacy will be protected. Similarly, confidentiality requirements imposed on lawyers, members of the clergy, and accountants encourage frank interactions that improve the quality of professional advice.
But should the duty of confidentiality have limits? In 2015, for instance, several German mental health professionals knew that their patient, a commercial pilot for Lufthansa's Germanwings division, was depressed and unfit to fly a plane. Yet, in accordance with German privacy rules, they said nothing to airline authorities. Due to their silence, the unthinkable happened—co-pilot Andreas Lubitz acted on his suicidal tendencies and deliberately crashed his plane into the mountainous French Alps, instantly killing all 150 passengers on board.
The duty of confidentiality applies to all accountants, without regard to whether they are self-employed, working in public accounting, or employed in industry. This duty even applies to accountants who learn confidential information during the course of performing unpaid volunteer activities.4
As the previous chapter briefly discussed, the improper disclosure or use of confidential client information is a discreditable act that may subject an accountant to disciplinary action under the AICPA Code.5 Confidentiality likewise is a core principle of the IFAC Code.6
WHEN INFORMATION IS CONFIDENTIAL
The General Nature of Confidential Information
Information is considered to be confidential if it is not known to the general public and a client has a reasonable expectation that it will be kept secret. Under most circumstances, information should be treated as confidential if its disclosure might harm a client.
Specific Issues Concerning Confidentiality
Disclosing the Existence of a Client Relationship
Substantive communications with a client usually are confidential, but is the very fact that an accountant performs services for a client itself an item of confidential information?
As a general rule, accountants may disclose the names of their clients because the mere existence of an accountant–client relationship often is known to the general public, and disclosure ordinarily is not harmful to the client. For example, after an auditor signs an audit report on a publicly traded company, the auditor's identity can easily be found in the client's annual report or on the SEC website.
If disclosure of an accountant–client relationship might cause harm, though, an accountant should not disclose a client's name without first obtaining the client's consent.
Using Client Information for Personal Gain
A novelist once wrote, “Secrets aren't secret. They're just hidden treasures, waiting to be exploited.”7 This may be so, but the duty of confidentiality prohibits accountants from exploiting client information for personal financial benefit. This prohibition applies to all accountants, whether they work in industry or public accounting. As the Institute of Management Accountants' Statement of Ethical Professional Practice states, industry accountants must “refrain from using confidential information for unethical or illegal advantage.”
WHEN DISCLOSURE OCCURS
Internal Disclosures
Disclosure occurs when information is shared outside the accountant–client relationship. Internal discussions with colleagues and assistants generally are permitted, but accountants must vigilantly protect against outsiders overhearing or intercepting confidential client information. Outside the workplace, accountants should be “alert to the possibility of inadvertent disclosure, particularly to a close business associate or a close relative or immediate family member.”8
Due to the specialized knowledge that often is required in the practice of accounting, it is quite common for an accountant to provide services to several clients in the same industry. In this situation, an accountant must be careful to not reveal confidential information to a client's competitors, suppliers, or customers. However, in serving clients, an accountant is not precluded from utilizing general industry knowledge and sophistication acquired from past experiences.
External Disclosures
If information needs to be shared with third-party service providers, an accountant customarily should obtain client approval, preferably in writing, For example, if a CPA firm wishes to outsource professional services to lower-paid professionals in other countries, client consent should be obtained.
Client approval is not required, however, if outside vendors merely provide administrative services, such as document delivery, data processing, or record storage, as long as the vendor agrees to protect the confidentiality of client information and takes appropriate precautions to prevent unauthorized disclosures.
CLIENT CONSENT
The Nature of Specific Consent
The Code of Conduct usually requires an accountant to obtain specific consent before disclosing confidential client information. This consent may be oral or written, and it must identify the particular transaction or situation in which information may be disclosed. A generalized, all-encompassing authorization is unacceptable.
Situations in Which Disclosure Is Required Without Client Consent
Despite the customary requirement of client consent, accountants must disclose client information in certain situations, even without the client's consent.
First, an accountant always must comply with a valid court subpoena. If a judge says talk, you must indeed talk.
Also, a CPA must disclose confidential client information to a peer-review inquiry. As an example, a state licensing board might request client information during the course of investigating a complaint filed against an accountant.
Moreover, a law or regulation may require an accountant to disclose information to government authorities. Under the Private Securities Litigation Reform Act of 1995, for instance, an accountant who discovers an illegal client act during the course of auditing a publicly traded company generally may be required to inform the SEC if the company does not undertake appropriate remedial actions. Auditors also may be obligated to make disclosures to the SEC if illegal client acts cause the auditor to lose faith in the integrity of the client's management team.9
Finally, an accountant must ensure that a client's financial statements contain all disclosures required by GAAP. Therefore, for example, if SEC reporting requirements mandate that a client's default on a major loan obligation be disclosed in its audited financial statements, an auditor could insist that this confidential client information be disclosed, despite the client's objection.
Situations in Which Disclosure Is Permitted Without Client Consent
In addition to situations where disclosure is mandatory, accountants have the discretion to disclose client information in specialized situations without consent.
Selling an Accounting Practice
When accountants want to sell their professional practices, potential buyers need to familiarize themselves with the profitability and growth potential of the seller's client base. This poses a dilemma for the seller because sharing this kind of information with a potential acquirer seemingly compromises client confidentiality.
In balancing these concerns, the Code of Conduct allows client information to be disclosed without consent as long as a selling accountant takes reasonable precautions to prevent the prospective acquirer from subsequently disclosing this information. Customarily, this is accomplished by redacting, or “crossing out,” extraneous information and requiring the prospective acquirer to sign a nondisclosure agreement. The Confidential Client Information Rule further fortifies client protections by forbidding prospective acquirers from using “to their own advantage” any information learned during the course of reviewing the seller's accounting practice.
Litigation-Related Disclosures
When accountants are sued for malpractice, it would be inequitable for them to be denied the opportunity to present relevant client information in their defense. Similarly, if an accountant is pursuing a legal action to collect outstanding fees, it would be unfair for the accountant to be precluded from explaining the complexity and time-consuming nature of the work that was performed. As a result, the Confidential Client Information Rule permits accountants to disclose confidential client information “to protect…professional interests in legal proceedings.”10 If the client thereafter wishes to shield its confidential information from broader public disclosure, it can petition the court to issue a protective order.
IDENTIFYING WHO IS A CLIENT
Current Clients
A current client is any person or entity for whom an accountant presently performs professional services. Special issues arise when an accountant provides services to a corporation or other large organization. Because the entity itself technically is the client, an accountant must carefully decide whether to disclose an entity's confidential information to certain members of the client's management team.
When an accountant receives information from someone acting on behalf of a client, the communication is treated as if it originated from the client itself. For instance, client information shared by a corporate director, officer, or key employee is considered to have been shared by the corporation itself.
Prospective and Past Clients
When a potential new client enters into preliminary discussions with an accountant, proprietary client information often is discussed. To ensure that sensitive issues can be discussed freely, an accountant must preserve secrets learned from near-clients, even if an actual professional relationship never is created.
An accountant may never disclose confidential client information, even after a client relationship has ended. Thus, the duty of confidentiality continues indefinitely.
Figure 9-3 What Is the Duration of the Duty of Confidentiality?
THE ACCOUNTANT–CLIENT PRIVILEGE
States That Treat Client Communications as Privileged
The accountant–client privilege is a state law concept that is related to the duty of confidentiality. Both the accountant–client privilege and the Code of Conduct's confidentiality rules are designed to facilitate open communications between accountants and their clients. However, unlike the duty of confidentiality, the accountant–client privilege usually bars an accountant from ever disclosing client communications to state government authorities, even if a state court or other official demands disclosure.11 Therefore, from one viewpoint, the accountant–client privilege is broader in scope than the duty of confidentiality because it makes client communications sacrosanct and grants virtually absolute protection against disclosure.
| Duty of Confidentiality | State Accountant–Client Privilege | Federal Accountant–Client Privilege | |
| Scope | Applies to all accounting engagements | Only applies in states that have enacted this privilege | Only applies to accounting engagements in which routine federal tax advice is provided |
| What Is Covered | All information that a client reasonably expects will remain confidential, including communications, documents, and facts observed by an accountant | Only the content of communications between an accountant and client | Only the content of communications between an accountant and client concerning routine tax advice. Matters involving tax fraud or crimes are not covered |
| Can a court nonetheless compel disclosure? | Yes | No* | No |
*The state court must honor this privilege, but a federal court may disregard it.
Figure 9-4 Confidentiality Summary.
From another perspective, however, the accountant–client privilege is narrower in focus than the duty of confidentiality because it only protects communications between an accountant and a client from being revealed. That is, the accountant–client privilege essentially only protects freedom of speech between accountants and clients, whether expressed orally or in writing. The duty of confidentiality, in contrast, shields accountants from disclosing confidential client information. Thus, the duty of confidentiality protects from disclosure all client information, including documents, factual observations, and communications.
The accountant–client privilege generally is a matter of state law. At present, about one-third of all states have enacted an accountant–client privilege law.12
Federal Rules That Treat Client Communications as Privileged
In general, federal law does not shield communications between an accountant and client from disclosure. Therefore, an accountant typically can be compelled to testify about client communications in a federal court matter. This is true even if the accountant and client reside in a state that recognizes the accountant–client privilege.
As a limited exception, however, federal tax law establishes a privilege that protects CPAs and Enrolled Agents from having to reveal client communications involving routine tax advice. For example, if a client asks a CPA or Enrolled Agent for tax advice about the deductibility of mortgage interest payments, the tax adviser cannot be compelled by the IRS to reveal this routine tax communication.13
This federal tax privilege, though, does not shield communications that relate to criminal matters, such as tax fraud. Accordingly, if this client had instead told his adviser about how he has been claiming phony home mortgage interest deductions without even owning a home, this discussion would not be protected against disclosure.
Because the federal tax privilege is so limited in scope, if a client potentially has committed tax fraud or some other crime, an accountant should insist that its client only confer with a lawyer. In contrast to the accountant–client privilege, the attorney–client privilege is expansive in scope and applies in all state and federal matters.
CONFIDENTIALITY IN TAX PRACTICE
Taxpayer Self-Disclosure
The success of our income tax system depends on citizens voluntarily filing truthful tax returns. Consequently, as a general rule, our legal system protects taxpayers from having to divulge their tax returns to anyone.
In some legal disputes, however, a litigant's earnings are an important factor in measuring damages. For example, in a personal injury dispute, an injured plaintiff's historical earnings, as reported on past income tax returns, often provides the best evidence of his lost future earnings potential.
In balancing privacy and evidentiary considerations, most courts allow a legal adversary to review an opponent's tax return only if information reflected in the tax return is highly relevant and intrusions on taxpayer privacy are minimized.
Preparer Disclosure of Client Tax Information
A paid preparer may not disclose client tax return information, unless it is ordered to do so by a court or certain government agencies. This prohibition encompasses disclosures of administrative information, such as a taxpayer's name, address, and Social Security number, as well as numerical information relating to the calculation of income. An inadvertent disclosure may result in a civil penalty of $250 per violation, and a reckless or intentional disclosure can result in a fine of $1,000 per violation and imprisonment for up to one year.14
IRS Disclosure of Taxpayer Information
The IRS generally must keep taxpayer information confidential. However, the IRS is permitted to share information with state taxing authorities and other government agencies if important public policies, such as child support enforcement or criminal fugitive identification, are at issue.15
EXERCISES
Identifying Confidential Information
- Your client is a gun manufacturer. Due to the tragic nature of gun violence, many citizens have threatened to protest against your client. However, your client's manufacturing plant is located in rural Montana, so protesters cannot conveniently get there to stage a public protest.
In preparing an SEC filing for this client, you disclosed the addresses of its Montana manufacturing plant and its company headquarters in downtown Seattle. Over 80 top company executives work at company headquarters. Your disclosure led to a large protest rally in downtown Seattle that created adverse publicity for your client. Your client now is upset because, historically, it only disclosed the address of its rural Montana plant in public filings. The SEC form, however, clearly required that a company's “principal places of business” be disclosed.
Did you violate the duty of confidentiality?
- A manufacturing client hired you to prepare a property tax report. During the course of your discussions, the client told you that it made certain improvements to its production facilities without obtaining required construction permits. In valuing the client's property, you disclosed in your report that the property deserved a lower valuation for tax purposes because “substantial sums would have to be spent to bring the property in compliance with local Construction Code requirements.” Did you violate the duty of confidentiality?
- Your former accounting professor recently contacted you because she knows that you currently work for an accounting firm that performs compilation services for several privately held mining companies. The professor requested data concerning whether your firm's clients capitalize or expense certain environmental clean-up costs. Your clients discuss their accounting policies openly with you, but do not disclose these policies to outsiders. Your professor has agreed in writing to keep your clients' accounting policies confidential. The professor is a member of the AICPA, and she will not achieve any financial gain. May you disclose the requested information to the professor?
- Your client, a French pharmaceutical manufacturer, is about to release a blockbuster new drug that inhibits the growth of certain tumors. While auditing this company, you happened to overhear research scientists openly discussing with marketing personnel this drug's benefits and anticipated sales revenues. You are aware that this pharmaceutical manufacturer carefully guards this information from competitors as well as the general public.
Based on the information you overheard, you believe that pharmaceutical patents held by an unrelated U.S. client will now become worthless. Under generally accepted accounting principles, intangible assets must be recorded at “lower of cost or market” when an impairment of value occurs. Should you consider the impact of this new French drug in valuing the patents of your U.S. client?
- During his lifetime, a famous pop star was rumored to have abused his children by repeatedly spanking them with a hard leather belt.
In a recent TV interview, this celebrity's accountant stated on a TV interview that she had “kept her mouth shut while Mr. Bigshot Superstar was alive, but now that he is dead, I want you to know that he confided in me on two occasions that he physically struck his children.”
Did this accountant violate her duty of confidentiality?
- The Commodities Futures Trading Commission, or CFTC, is a respected federal agency that oversees trades in futures contracts for commodities such as wheat and cotton. You have several clients in Iowa that hedge their production costs by trading futures contracts.
The CFTC has asked you to voluntarily attend a hearing that they are conducting concerning allegedly improper futures contract trades by one of your clients. You have no information or knowledge about any of these trades, and you believe that your public reputation will be tarnished if the business community discovers that you refused to attend the hearing of a respected governmental agency.
Should you attend the hearing?
- A CPA wants to entice a small cable television company to become a client. During the course of their discussions, the CPA mentioned that he is very familiar with the communications industry because his firm is the auditor for a well-known, publicly traded cable television company. Did the CPA violate his duty of confidentiality?
- During the course of auditing a telecommunication hardware company, you learned a great deal about typical credit terms and profit margins in that industry. You now have been hired by a small supplier of component parts to the telecommunications industry. This supplier has asked you to prepare its financial projections. In preparing these projections, you intend to assume that credit terms and projected profit margins will be similar to others in the same industry. By doing so, are you violating your duty of confidentiality to the large telecommunications hardware company?
Required Disclosures
- During the course of preparing budgeting projections in a consulting engagement, you learned that your client might be engaged in illegal price-fixing with its distributors and franchisees. The client is a closely held family-run corporation, and you are not the client's auditor. Do you have a duty to disclose this activity to government authorities?
- Your audit client recently suffered a huge loss when a large customer discontinued doing business with your client after receiving defective merchandise. Due to this loss, your client is struggling to survive.
Your client does not want other customers to find out about its production and financial difficulties. However, in accordance with accounting standards, you are required to disclose that you have a substantial doubt about this client remaining a viable going concern.
Your client has threatened to hold you responsible if you base your “going concern” disclosure on confidential information about its liquidity that you learned during the course of the audit. Would disclosure of this client's financial condition violate your duty of confidentiality?
- Your tax advisory client is an active securities trader. She just told you she intends to spread a rumor that a Middle Eastern sheik is planning to buy a controlling interest in Technotrilogy stock. Your client believes that if she spreads this false rumor, the stock price will increase, and she will “make a fortune.”
- May you disclose her plans to government authorities?
- May you disclose her plans to news reporters?
- If a court issues a subpoena for you to testify about this conversation, may you refuse to testify based on the duty of confidentiality?
- You work for a CPA firm that sends tax returns to India for processing. The Indian company to which these processing duties are outsourced solely employs Chartered Accountants, and its personnel have extensive training in U.S. taxation. The CPA firm does not tell its clients that portions of their tax returns are being processed in India. None of the information contained in these tax returns has ever been disclosed to the public. Does your CPA firm violate the Confidential Client Information Rule?
- At your high school reunion, you saw someone you used to date, who dumped you for someone else. While chatting with him and two of his old football teammates, you tried to impress him by telling him you “made partner” at a prestigious CPA firm. You also mentioned that you specialize in personal financial planning for several prominent clients in the entertainment industry, including a well-known movie actor whose name you practically shouted at him.
Did you violate the duty of confidentiality?
- You recently become a partner in a local CPA firm. Your firm provides a wide range of professional services, but your firm is best known in the business community for its expertise in loan workouts, debt restructuring, and bankruptcy accounting. The general public, including most of your family and friends, is not aware of your firm's expertise in these areas.
The firm wants to grow, and they think that you are the right person to help because you have an excellent commitment to marketing. As part of your marketing efforts, you are giving speeches on the accounting profession to various industry groups. You also want to mention during your introduction that your CPA firm represents some well-known members of the local business community, including two prominent banks.
May you reveal the names of your clients during the course of giving these presentations?
- Under GAAP, contingent liabilities have to be accrued on a company's balance sheet if they are “probable” and “can be reasonably estimated.” During the course of performing a company's annual audit, you discovered a critical fact that makes it highly likely that a pending lawsuit against the company will be successful. You estimate that the company will lose $30 million. The client is attempting to settle this case for a small amount. They also have told you that their adversary has not discovered this vital fact and the company “wants to keep it that way.”
What should you do?
- You discovered material errors in your client's audited statements for prior years. The CPA firm that performed the audit was reckless, in your opinion. You would like to disclose this other firm's incompetence to the state board of accountancy and to the AICPA Professional Ethics Division. Your client is concerned that, if the investment community learns of these errors, the investing public will lose faith in the accuracy of its financial statements. What should you do?
- A former client just sued you for malpractice. Fortunately, you have malpractice insurance, so the costs of defending this legal action and any possible costs of settlement or liability will be borne by the insurance company.
According to your malpractice policy, you have a duty to “promptly notify” them about any actual or threatened lawsuit. Further, you must “fully assist” them in aggressively defending you in the lawsuit. The insurance company now has asked you to provide to them all documents that relate to your professional engagement with this former client. You are concerned that some of these documents contain information that the former client considers to be confidential and, indeed, is marked in bold red letters “HIGHLY CONFIDENTIAL.” You certainly do not want to face another lawsuit from this same client for breaching your duty of confidentiality. What should you do?
- Toby, CPA is representing his client in a critical, time-sensitive negotiation. Toby had expected his client to attend a meeting with Dunbart, the opposing party, but Toby's client called him to say that he could not make the meeting due to a sudden illness. When Toby canceled the meeting at the last minute, Toby sensed that Dunbar was disturbed by the last-minute cancellation and doubted that Toby's client had any interest in finishing this deal. To reassure Dunbar of his client's strong commitment to the negotiation, Toby truthfully told Dunbar that his client was “deathly ill, vomiting with horrible diarrhea” and “could not get out of bed” to attend the meeting.
Did Toby breach his duty of confidentiality?
- A 19-year-old staff member at your accounting firm went into your computer system and copied the names, addresses, and identifying numbers of clients who pay your firm by credit card. As a result of this identity theft, your clients lost thousands of dollars.
When you first hired this young staff member, you did not investigate whether this staff member had a criminal record. If you had, you would have learned that this staff member had been arrested once in the past when he was younger for “Driving Under the Influence.” Some of your clients who suffered losses now claim that you violated your duty of confidentiality. Did you?
Accountant–Client Privilege
- Should there be an accountant–client privilege in every state? Discuss the pros and cons.
- You are a skilled and experienced tax advisor. Under what circumstances, if any, should you encourage a client to utilize the services of a tax attorney?
Tax Return Disclosure
- Your clients applied to the Portland Housing Authority to obtain a government-subsidized apartment and were approved. As part of the approval process, your clients submitted a statement of income and personal expenses. The Portland Housing Authority now has requested that the couple supply a copy of their last two years' tax returns. Your clients did not respond. The Housing Authority decided to obtain a subpoena for their tax return after receiving an anonymous tip that your clients' income was much higher than they originally reported. Your clients do not want to have to submit their tax returns. Do they have to produce these tax returns to the Housing Authority?
Comprehensive Problems
- Injured workers have filed numerous workers' compensation claims against your audit client. In reviewing medical exams filed in connection with these claims, you noticed that one of these former employees has a life-threating disease. This disease can be cured by surgery, but the former employee does not know about his disease or about his need for surgery.
You asked your client for permission to inform this former employee about his life-threatening condition, but your client refused. During the course of your discussion, the client told you bluntly that “we will save a small fortune if the former employee has a short life span because, frankly, we will pay out fewer workers' compensation checks.”
Should you reveal information to this former employee concerning his life-threatening disease?
- While you were at client's production facility, you noticed that factory personnel were taking hazardous chemicals and dumping them in a forest area behind the facility. Based on a microbiology class you took in college, you strongly suspect that these chemicals will seep into the groundwater and eventually cause severe neurological damage to those who drink that water. According to your Internet research, these chemicals will not necessarily affect everyone who drinks the poisoned water, and the adverse effects, although extreme, will not be observable for many years into the future.
What should you do?