# Keep a data referral apart from an audit | SourceX

Canonical: https://refer.sourcex.si/guides/how-to-keep-a-data-introduction-separate-from-an-audit-engagement
Last updated: 2026-11-04

Treat the audit engagement and any data introduction as two files that never merge. Nothing learned through engagement access or audit evidence may be used to pick out a company or describe its records; an introduction can rest only on public facts or on something the CEO raised outside the work. Before pay is even considered, the rules that bind you for this client decide whether you may take part at all. Ask your board, society or counsel, because nothing on this page is legal or professional-conduct advice.

It is written for audit partners, managers and staff, and for colleagues at a firm that audits the company, who see a client's operating history from closer than almost anyone and may wonder whether an introduction to SourceX is theirs to make. The question of whether an accountant may accept a reward at all has its own checklist in [the applicable-rules guide for accountants](/guides/before-an-accountant-accepts-a-referral-reward-check-the-applicable-rules). A partner who stands outside the audit and is timing a question around it should read [the process audit boundary guide](/guides/the-referral-conversation-around-a-major-process-audit).

## What the engagement shows you, and why none of it travels

An audit shows a firm things a company rarely shows outsiders: walkthroughs of how transactions move through its systems, testing of IT controls, lists of documents prepared by the client, data extracts pulled for sampling and the management letter. Together they tell an auditor how many years of records a company keeps, in which systems and in what condition. That is exactly the knowledge a data introduction might seem to want, and exactly the knowledge it may not use.

The AICPA Code defines confidential client information as "Any information obtained from the client that is not available to the public," and the Code contains a Confidential Client Information Rule, numbered 1.700.001. What that rule requires of you, for this client, is a question for your own adviser. The working position this page takes is simpler: if you know it because of the engagement, it stays in the engagement file.

SourceX does not need it either. A partner's role ends with an introduction the CEO asked for. SourceX's sample partner agreement gives a partner "no authority to share a supplier's inventory, records, raw data or personal information" (section 4.2) and says SourceX may deal with a referred company directly, with the partner not required to "join every call, email or negotiation" (section 2.2). The company describes its own history in its own application, and SourceX's review decides relevance and rights.

## The advisory role, and what the client actually gains

Four people at a firm can stand near this question, and their positions differ:

- **The engagement partner and the engagement team**, who hold the access and the evidence.
- **A colleague in another service line** serving the same client, such as tax or advisory.
- **A firm partner outside the engagement** who knows the CEO from elsewhere.
- **A former engagement team member** who has moved to another firm or into industry.

The Code's principle on objectivity and independence draws the first line: "Such a member who provides auditing and other attestation services should be independent in fact and appearance. In providing all other services, a member should maintain objectivity and avoid conflicts of interest." Which obligations reach which of the four people, and through which rules, is for the firm's ethics function and each person's board, society or counsel to say.

The client's gain is modest and real: its CEO hears that an option exists. Under section 4 of SourceX's terms the reward "is paid separately by SourceX and is never deducted from the supplier's agreed compensation," so the company receives the same amount whether or not anyone introduced it. That benefit never settles whether a member of the audit firm may take part.

## The engagement separation review map

Five lanes, run in order. A stop in any lane ends the exercise for this client until its facts change. The CEO's decision sits after all five: even a clean map only earns the right to ask.

| Lane | The test | Clears when | Stops when | Who settles it |
|---|---|---|---|---|
| 1. Source of the idea | Can you say why this company might want a conversation using only public facts or the CEO's own words outside the engagement? | You can name the public source, or the date and setting in which the CEO raised it | Any part of the reason comes from walkthroughs, workpapers, client-prepared lists, data extracts or the management letter | You first, then your firm's ethics or independence function |
| 2. People | Who at the firm would speak to the CEO? | Someone your firm has cleared, acting outside the engagement | An engagement team member during the engagement, or anyone not yet cleared | Your firm, under the rules that bind it |
| 3. Channel and timing | Where and when would the mention happen? | In a separate message, outside engagement meetings, email threads and deliverables | In a fieldwork meeting, a closing meeting, the management letter or an engagement thread | You and your firm |
| 4. Pay | May anyone at the firm receive anything from SourceX for this company? | A dated written answer from your board, society or counsel covers your facts | No answer yet, or an answer that rules pay out | Your board, society or counsel; SourceX for how it treats an unpaid introduction |
| 5. Records | Will anyone at the firm describe, count, sample or vouch for the company's data? | Never; the company applies and SourceX reviews | Any description, estimate, sample or comment on data quality | Not open to judgment |

Lane 1 carries the weight. Write the source down before anything else: "the CEO's remarks on an industry panel, 12 June" clears; "we saw the claims system during IT testing" does not, and no later fact can launder it. Lane 5 has no clearing condition by design. Even when every other lane clears, nobody at the firm tells SourceX what the records contain or whether they are any good.

One outcome is always available and needs no map: the firm does nothing, and the CEO, who can find SourceX's public pages like anyone else, decides whether the company applies on its own.

## Which restrictions follow your role and which follow your license

Two kinds of restriction can reach the same person, and they fail in different ways.

**Role-specific.** These depend on what your firm does for this client and where you sit. The services matter (audit, review, compilation, tax, advisory), as do the periods they cover, and whether you are on the engagement, in another service line or outside the firm altogether. A firm can give different answers for two clients on the same day.

**Jurisdiction-specific.** These depend on who licenses you and which bodies you belong to. The AICPA Code contains a rule numbered 1.520 and titled Commissions and Referral Fees; read its current text and interpretations, not a summary. State boards write their own rules. California's Accountancy Act, as published by the state's Board of Accountancy, says in section 5061(a) that, except as that section expressly permits, a person in public accountancy shall not "accept a fee or commission for referring a client to the products or services of a third party." The board's consumer page on commissions adds that commission-based pay for defined services is allowed only with written disclosure and only where certain prohibited services are not performed for the client (our paraphrase); the Act's list of those services opens with "An audit or review of a financial statement." If you audit public companies or practice outside the United States, other rule-makers apply; ask your own.

Three questions to put to your board, society or counsel, with your facts attached:

- Given my firm's services for this client, may I or anyone at the firm take any part in introducing it to a third party?
- How would my rules classify a reward a third party pays for that introduction, and does the classification matter here?
- If no pay is allowed, does any rule still reach an unpaid introduction?

A written disclosure is one kind of rule among several. Do not assume that telling the client makes pay acceptable; ask. For networks where people other than accountants could be paid, the [jurisdiction review issue register](/guides/when-local-professional-rules-affect-referral-compensation) sorts who asks which adviser.

## A route the client approves, paid or unpaid

Whatever your rules allow, the CEO decides whether the company talks to SourceX, and the CEO should know before agreeing who, if anyone, could be paid.

**No pay.** If your rules rule pay out, or you would rather not be paid, the published terms do not cover a partner declining a reward. SourceX decides how an unpaid introduction is handled, so ask SourceX in writing before submitting anything and keep its reply. [The unpaid introduction path for finance professionals](/guides/the-unpaid-introduction-path-for-a-finance-professional) lays out the messages in order.

**Pay.** Only where a dated written answer from your rule-makers allows it for this client, with every disclosure those rules require made before the CEO agrees. Whoever submits holds an approved partner account and signs the SourceX Channel Partner Agreement first, and credit goes to the first valid introduction within the 90-day attribution window once the company files a verified application.

On either path the firm sends SourceX the company's name and the CEO's agreement, nothing about the records.

## Two firms, two outcomes (Illustrative)

Illustrative. Invented firms and companies; neither case describes what any rule says.

**A. The CEO speaks in public.** The CEO of a 300-person freight operator, an audit client, tells an industry panel that the company is "looking at whether our dispatch history has outside value." A tax partner at the audit firm, not on the engagement, hears it. Lane 1 clears on a dated public source. The firm's ethics partner, after checking the rules that bind the firm, allows one reply from the tax partner pointing the CEO to SourceX's public pages, with no introduction submitted and no pay. Lanes 4 and 5 never open. The CEO decides whether the company applies on its own.

**B. The idea comes from fieldwork.** An audit senior testing IT controls at a 180-person claims administrator notices twelve years of adjuster notes in a legacy system and suggests the engagement partner "put them in touch with one of those data licensing programs." Lane 1 stops: the idea came from engagement access. Lane 5 would stop too, because the suggestion already describes the records. Nothing is said to the client, and the firm records in its own independence file that the idea was raised and stopped. If the CEO ever raises licensing independently, the firm starts again at lane 1 with that new, dated source.

## Where separation still breaks down

- **Appearance.** Even a clean source can make a mention from the audit firm sound like the auditor's recommendation. Some firms will decide that no one should speak at all.
- **Small firms.** Where one person runs the engagement, the tax work and the relationship, lane 2 may have no one to clear.
- **Changing services.** A new review or compilation engagement mid-year changes the facts behind lanes 2 and 4. Run the map again.
- **Memory.** Knowledge from fieldwork does not expire when the engagement ends. Lane 1 asks where the reason came from, not when.
- **Fit.** SourceX decides fit in review; material that belongs to clients, and introductions the decision maker never knew about, usually fall outside what SourceX takes on, and nothing the firm could say changes that.
- **Nothing measured.** No figures have been published on how audit firms handle data introductions. A firm that wants evidence can log, per client, each idea raised, the lane where it stopped and who settled it.

## Next step

> **Refer a company. No cap on rewards.** Default reward on a company's first qualifying transaction: the greater of $50,000 plus 5% and 15% of Actual Supplier Payout, with no cap; further qualifying transactions first agreed within 12 months of the first Closing pay 15%. Eligibility and payment conditions apply, including the USD 100,000 Minimum Transaction, and a signed Schedule A or addendum can differ. A lead, meeting or signature alone does not trigger payment.

When every lane clears, your rule-makers have answered in writing and the CEO wants the conversation, [register as a partner](/register) and sign before submitting, check the company's public facts against [who qualifies](/who-qualifies) and read the [program terms](/terms); related workflows for finance advisers are in the [guides library](/guides).

## Sources

- https://pub.aicpa.org/codeofconduct/ethicsresources/et-cod.pdf
- https://www.dca.ca.gov/cba/about/acct_act.pdf
- https://www.dca.ca.gov/cba/consumers/commission-fees.shtml
- https://refer.sourcex.si/terms
- https://refer.sourcex.si/who-qualifies
- https://sourcex.si/documents/partner/SourceX_Channel_Partner_Agreement_Sample.pdf