Clause explained: this guide covers what it means, who it applies to, the step-by-step process, documents required, fees, due dates and penalties in India — so you can stay compliant with confidence and avoid costly mistakes.
Clause (1) of Part I of the Second Schedule makes it professional misconduct for a chartered accountant in practice to disclose information acquired in the course of a professional engagement to anyone other than the client, without the client's consent or otherwise than as required by law.
Why the profession treats this as grave
Clause (1) sits in the Second Schedule — the schedule carrying the more serious categories of professional misconduct. The Code explains the reasoning: an accountant in public practice has access to a great deal of information of a highly confidential character, and it is important both for the work and for the dignity and status of the profession that such information is treated as provided only to facilitate the performance of the professional duties for which he was engaged.
The consequences of a breach are described as potentially most serious, including an action by the client for the loss suffered. And the Code makes a commercial observation that is easy to overlook: but for this confidence, it would not be possible for persons in a similar trade or industry to appoint the same accountant. Confidentiality is what allows a firm to serve competitors.
"The accountant's duty not to disclose continues even after the completion of his assignment." Resigning, being replaced, or completing the engagement changes nothing. Nor does the passage of years. Any policy that treats a former client's file as freely usable — for a case study, a pitch or a training example — is wrong.
The Code also draws attention to the SEBI (Insider Trading) Regulations, 1992 in the context of disclosure, and records one express carve-out: nothing in the clause bars the previous accountant from informing the new accountant of the client's affairs, as he may deem fit.
When consent is implied
Where disclosure is required as part of the performance of the professional duty in relation to a client, the fact that the client required that performance itself amounts to consent to the disclosure. The Code's example is a member submitting information to exchange control authorities while performing professional duties — that is not disclosure without consent.
But there is a condition on this: the request or the initiative for the service that entails the disclosure must come from the client. Implied consent flows from the client having asked for the work.
Who can give express consent
| Client type | Person competent to consent |
|---|---|
| Sole proprietary concern | The proprietor, or his constituted attorney legally empowered to give such consent |
| Partnership firm | Any partner — since every partner has authority to bind the firm by his acts |
| Company | The Board of Directors under section 179 of the Companies Act, 2013; or the Managing Director, but only if the Board's powers are delegated to him comprehensively enough to include this power. Otherwise, a Board resolution is required |
The Code's test is whether the Board's powers have been delegated comprehensively enough to include the power to give such consent. Where they have not, consent must come by Board resolution. In practice, a request for confidential client information routed to a company's MD should be met by asking what delegation exists — not by assuming the MD can speak for the company on this.
Working papers are not the client's
The Code is unambiguous:
- An auditor is not required to provide the client, or other auditors of the same enterprise or a related enterprise such as a parent or subsidiary, access to his audit working papers.
- The main auditors do not have a right of access to the working papers of the branch auditors.
- In a company, the statutory auditor has to consider the branch auditor's report and has a right to seek clarifications and to visit the branch if he considers it necessary — but that is not access to working papers.
- An auditor can rely on the work of another auditor without any right of access to that auditor's working papers.
- For this purpose, "auditor" includes "internal auditor".
- The auditor may, at his discretion, in cases he considers appropriate, make portions of or extracts from his working papers available to the client.
Working papers versus information
The Code draws a distinction that resolves most practical disputes:
"There is a difference between sharing of working papers and sharing of information. So far as the information is concerned, he can provide the same to the client or to a Regulatory body after obtaining the consent of the client."
So a request that is really for information can be met with the client's consent. A request for the working papers themselves can be declined, and access is a matter of the auditor's discretion.
Disclosure required by law
The Code accepts that it is not possible to set out all circumstances in which disclosure may be required by law, and gives this guidance:
- Where there is legal compulsion and it is not legally permissible to claim privilege under section 126 of the Evidence Act, 1872, a disclosure made by a member may not be considered misconduct.
- Such matters involve niceties of law and expert legal advice may be sought prior to disclosure.
- A regulator acting under the lawful exercise of its authority prescribed by the enabling law — the Code's example is the Code of Criminal Procedure, 1973 — may seek client information. Sharing it in such circumstances is permissible and does not require client consent.
- A member is not permitted to submit client information before a court as evidence on his own behest, except where the court requires it through specific directions.
Where the client may have acted unlawfully
The Code identifies this as "the only circumstances in which this duty of confidence may give rise to a difficulty" — where the accountant has reason to believe the client has been guilty of some unlawful act or default, and notes this is of special significance where the client is guilty of tax evasion.
Its recommendations rest on two stated premises:
- No duty is cast on a member — whether by section 39 of the Code of Criminal Procedure, 1973 or by any other enactment — to inform the Income Tax Authorities about taxation frauds by his client of which he comes to know during professional work.
- Under section 126 of the Evidence Act, 1872, a barrister, attorney, pleader or vakil is barred from disclosing, except with the client's express consent, any communication made in the course of and for the purpose of his employment.
Members are also directed to CARO and the Standards on Auditing, which impose their own reporting responsibilities.
The absence of a reporting duty to the tax authorities does not resolve the auditor's position. Reporting obligations under CARO, the Standards on Auditing and, for companies, the fraud reporting provisions of the Companies Act operate independently of Clause (1). The confidentiality clause governs voluntary disclosure; it does not displace a statutory reporting requirement.
Practical checklist
- Treat client information as confidential during and after the engagement, without time limit.
- For express consent, confirm the person giving it is competent — for a company, check the delegation or obtain a Board resolution.
- Distinguish a request for working papers (discretionary, no right of access) from a request for information (shareable with consent).
- Do not give branch auditors' or other auditors' working papers, and do not expect access to theirs.
- For a regulator acting under lawful authority, share without client consent.
- Never volunteer client information to a court; act only on specific directions.
- Where legal compulsion is asserted, take legal advice before disclosing.
- Remember the previous accountant may inform the incoming accountant of the client's affairs.
Common mistakes
- Handing over working papers on a client demand.
- Accepting an MD's consent without checking the delegation.
- Using a former client's matter in marketing or training material.
- Volunteering information to a court or authority without compulsion or directions.
- Assuming confidentiality overrides CARO and the Standards on Auditing.