Ownership and confidentiality

Ownership concerns who owns the records. Confidentiality concerns who may see or use the information. The audit firm generally owns its working papers, subject to applicable law or regulation. The client retains ownership of its original accounting records. For example, the company owns its sales ledger, while the firm owns the audit schedule documenting which sales it tested and what it found. micpa.com.my

The auditor must protect confidential information during and after the engagement. Disclosure requires proper authority, such as valid client authorisation where legally permitted, or an applicable legal or professional right or duty. mia.org.my

Situation	Appropriate treatment
A bank officer asks the auditor to email the client’s loan working papers.	The bank’s interest in the client does not itself authorise disclosure. The auditor checks whether a valid basis exists before releasing information.
An audit regulator lawfully requests specified working papers for an inspection.	The firm verifies the request and provides the required records through an authorised, secure channel.
An audit assistant wants to use a client’s payroll schedule in a class presentation.	The assistant can create a fictional example. Removing the company name alone may still leave employees identifiable from salaries or job titles.