Classifying Firm Information

1Three classes, one rule each

Sort the firm's information into three classes by sensitivity. Attach one clear rule to each class.

The purpose is practical. Published standards do not need the same controls as a client's tax file. Classification helps staff make that distinction consistently.

Green: firm knowledge. Non-confidential material that can be shared across the firm. Examples include accounting and auditing standards, published tax legislation, public rulings, approved templates, checklists, standing treatments and verified research notes. Each item should record its source, verifier and date.

Amber: client and engagement data. This includes ledgers, trial balances, tax computations, working papers, management accounts and correspondence. It may be used with Secure Accounting on premises, under the firm's control. Access should be limited to authorised staff assigned to the engagement.

Red: excluded. This material must not enter the AI path. It includes KYC packs, facts relating to a suspicion under the anti-money-laundering regime, trust and client-account records, and material subject to a confidentiality undertaking or ethical wall. Mixed documents should be treated as Red until the excluded content is separated.

2Why Red is genuinely different here

The Red class is particularly important where anti-money-laundering duties apply.

Accountants carrying out specified activities, such as company formation, nominee, shareholder or trustee services, or handling client money, are reporting institutions under Malaysia's AMLA. Where the regime applies, suspicious-transaction reporting and the tipping-off offence place strict limits on disclosure. Facts relating to a suspicion should therefore remain outside the AI path.

A clear exclusion is easier for staff to apply than a general warning to be careful. It also creates a straightforward basis for technical controls and review.

3The two rules that make it work

A classification scheme also needs controls over what the system can access. Two rules are central.

The first is allow-list, default-deny. The firm names the document libraries, template banks or finalised working-paper sets that may be indexed. Anything not explicitly approved is excluded.

The second is no pooled client index. Putting files from every client into one searchable store creates an avoidable risk that one client's material could appear in another client's work.

Engagement data should remain in separate client areas with permissions inherited from the relevant source system. The next paper examines that retrieval design.

4The edge cases an accountant will recognise

Some documents need additional judgement.

Audit working papers carry retention duties and independence considerations. They are Amber and restricted to the engagement, even when a previous file could be useful as a reference. Trust and client-account records are Red because Secure Accounting is not their system of record. A mixed document is treated at its most sensitive level until the content is separated.

5Judgement still required

Classification reduces risk. It does not remove the need for judgement.

The scheme handles common cases and routes uncertain material for review. It does not replace professional judgement. The firm should name who can decide edge cases and record those decisions.

With information classified, the firm can decide which deployment model fits each class (C4), and how retrieval should enforce client separation (C5).