In the context of a third-party certification audit, confidentiality is an issue in an audit programme. Select two options which correctly state the function of confidentiality in an audit

Confidentiality is a cornerstone of professional auditing conduct. It is explicitly listed as a fundamental principle in ISO 19011, requiring auditors to handle sensitive or proprietary information with discretion (C). A practical application of this principle is ensuring the auditee's privacy and control over their information and premises. Therefore, an auditor must obtain explicit permission before using any recording equipment, such as a camera, during the audit (D). This respects the auditee's ownership of information and prevents unauthorized capture of confidential data.

A. The primary driver for confidentiality is professional ethics and auditing standards, not necessarily specific regulatory requirements.
B. Observers are also bound by confidentiality agreements and may access confidential information with the auditee's consent.
E. Using confidential audit information for personal competence improvement without explicit permission is a breach of confidentiality.
F. A guide facilitates the audit but does not absolve the auditor of their responsibility to maintain confidentiality.

1. ISO 19011:2018

Guidelines for auditing management systems

Clause 4

"Principles of auditing

" lists "Confidentiality - security of information" as one of the seven core principles.

2. ISO/IEC 17021-1:2015

Conformity assessment — Requirements for bodies providing audit and certification of management systems — Part 1: Requirements

Clause 8.5

"Confidentiality

" mandates that certification bodies have legally enforceable commitments to maintain the confidentiality of all information obtained.

3. PECB

Code of Ethics

(an example of a certification body's official documentation)

Section 2.4

"Confidentiality

" requires professionals to "respect the confidentiality of information acquired in the course of their work" and not disclose it without proper and specific authority.