The Control of Confidential Information in Finance Work

Information is confidential when somebody handed it over for a purpose, and passing it on was not part of that purpose. The duty sits on the information rather than on the person holding it, so it survives a change of role, a change of employer, and a forgotten source. Controlling it is mechanical rather than careful: classify on arrival, wall the teams, and fix a list of what may go into a tool.

Being mechanical rather than careful is the part people skip. Every control described below is built so that a careful person and a careless one produce the same outcome. The design is not an insult to anybody. The design exists because intent is exactly what nobody can audit, and because everybody believes their own intent is good, including at five o'clock on the day something is due. A duty that depends on how conscientious somebody was feeling is not a control, it is a hope, and it fails in precisely the situations it was written for.

One assignment makes all four controls concrete. The Kavery research desk, four people inside Kavery Capital Services Private Limited, an invented lender, was asked whether a borrower called Meenakshi Tubes Private Limited had weakened over the year just reported. Sharada Iyer produced the work, Prakash Nadar reviewed it, and Latha Menon commissioned it and took the decision at the end. The file opened on 3 March, the note went out on 11 March, and the decision followed on 12 March.

The starting point is a working file that has already been sorted. Twenty one documents came in, each one given a sensitivity level and an arrival record when it landed, and that sorting is set out under data classification. The part nobody writes down comes next: those documents now have to be worked with. The documents have to be read alongside colleagues, summarised, argued about, checked by somebody else, and occasionally typed into something. Classification decides what a document is. The four controls below decide what happens to it for the eight days it is live.

None of these controls needs authority. Every one of them is dischargeable by somebody in their first month, and a duty that needed seniority to discharge would not be a duty at all.

What Makes Information Confidential, and Who Decides?

Consider something that has nothing to do with finance. A neighbour stops a person on the stairs and says that her son did not get the college place he was hoping for. She did not say this is confidential. She did not ask for it to be kept quiet. The person hearing it knew anyway, instantly and without effort, that the information came as part of a conversation between the two of them and not as a thing to carry down to the shop. Nothing was stamped. Nothing was signed. The condition was known all the same.

Confidential informationSomething given to a person for a purpose, where passing it on was not part of that purpose. works the same way and the test is the same test, written down so that it can be applied to a spreadsheet by somebody who was not on the stairs. The first question is what purpose the thing was handed over for. The second is whether the use now contemplated is inside that purpose or outside it. Management accounts sent so that a lender can assess a borrowing request were sent for that. The accounts were not sent so that a slide could be built for a different client, and nobody has to have said so.

Now the question people get wrong. Who decides? Not the supplier alone. If a supplier could settle it by declaring it, anybody could stamp a published filing and put it beyond use. Not the receiver alone either. A receiver who gets to decide will decide generously on the day the document is useful. The purpose the material was supplied for decides it, and the receiver's job is to judge that purpose honestly at the moment it arrives rather than at the moment it becomes useful.

Two things sharpen the judgement when it is genuinely unclear. First, would the supplier have handed this to a stranger who walked in and asked? If not, it was routed to a named person and the routing carries a condition. Second, has anybody written a condition down? Three of the twenty one documents on the Kavery file arrived attached to an undertakingA written promise about how received material will be handled, usually naming the people allowed to open it.. The undertaking removes the judgement entirely for those three and replaces it with a list of names. Where a written condition exists it is the answer. Where none exists, the purpose test is the answer.

Why Does the Duty Attach to the Information Rather Than to the Person?

The duty is a property of the information, not a promise made by a person. The duty was created when the material was handed over for a purpose, and it stays attached to the material afterwards regardless of who is currently holding it, what they remember about it, or where they now work.

Four ordinary events show the rule in practice. A move to another team inside the same firm: the duty comes with the information, so a schedule read last month is no less confidential from a different desk. A change of employer: the duty is still on the information, so a person joining a new firm carries obligations from the old one rather than a clean slate. The assignment closes: closure disposes of documents, and it does not release the sentences already held in somebody's head. And the one everybody actually hits, forgetting which document a figure came from.

Forgetting the source feels like an exemption and is not. Six weeks after the file closes, the analyst remembers that the borrower's input costs rose sharply and could not say under any pressure which of the twenty one documents said so. The natural instinct is that an untraceable fact has become ordinary knowledge. Forgetting where a sentence came from removes the reminder, not the duty, and the two feel identical from the inside. The arrival record was written when the document landed for exactly that reason, rather than when it became inconvenient.

How to Manage Confidential Information in Finance: What Are the Four Controls?

Four controls carry the whole load, and each covers a gap the others leave. All four are worth seeing together before any one of them is opened up. Control one is classification on arrival, and it decides what each document is. The Kavery file already carries that sorting. Control two is a wall, and a wall separates people rather than documents. Control three governs what may be typed or pasted into a tool. Control four governs how work proceeds alongside somebody who may not see everything the analyst can.

The shape of the set is worth noticing. One of the four works on documents, and three of them work on people, conversations and habits. The ratio is not an accident, and it shows where the exposure actually sits. Documents almost never leak themselves; they leave through a conversation in a lift, a file forwarded by somebody entitled to open it, or a paste made by a person under a deadline, and none of those is a filing problem. A firm that has classified every document and left the other three controls unbuilt has secured whatever was least likely to move.

What Is a Chinese Wall, and Why Does It Separate People Rather Than Documents?

A property broker in a neighbourhood is showing the same flat to two buyers. Each of them, sitting in his office on separate afternoons, has told him the most they can pay. Both told him because they trust him, and he does. He cannot tell the second buyer what the first one said. He also cannot tell either of them that he is speaking to the other. Knowing there is another bidder changes how each of them bids. His problem is not a filing problem. He cannot solve it by keeping two notebooks. The information is in one head and the duties run to two different people.

A Chinese wallA separation built between two teams in one firm so that information physically cannot cross from one to the other. is the same problem solved at the scale of a firm, and it is built out of the only material that works: distance between people. Inside Kavery Capital Services Private Limited there is a lending desk holding the Meenakshi Tubes assignment, and a separate advisory team of three people on a different floor with a separate file store. The advisory team is acting for a party interested in buying into Meenakshi Tubes Private Limited. The operating margin of 10.8 per cent may not cross from one side to the other.

Most people picture the wrong thing when they picture a wall. Look at the materials. Different floors, so the two teams do not share a corridor or a lunch queue. Separate file stores, so there is no shared drive where a document could be found by somebody browsing. No shared calendar entries: a meeting title can carry a borrower's name. And a rehearsed non-answer, keeping the refusal itself from giving anything away. A wall has to stop a sentence spoken in a lift. No folder permission has ever done that, so a permission is not a wall.

What Does the Wall Cost the Two Teams Inside It?

A wall is expensive. Leaving that out is why walls get worked around. The wall costs real capability, it costs it every day, and the cost falls on the two teams standing on either side rather than on the firm in the abstract.

Make it concrete with the Kavery structure. The advisory team of three is going to form a view on what a stake in Meenakshi Tubes Private Limited is worth. Three floors away sits a desk that has read the year just reported, has worked out that the operating margin came in at 10.8 per cent against an internal floor of 11 per cent, and has watched a lending line fall from Rs 40,00,000 to Rs 25,00,000 on 12 March, a reduction of more than a third, with a review set for 90 days later. Every one of those facts would sharpen the advisory team's work. None of them will be shared. The advice will be formed without them, and it will be a little worse, and it will be theirs.

The second cost is social and it is the one people underestimate. The two teams cannot explain the silence to each other. A colleague who asks a reasonable question and gets a flat no does not receive a reason. The reason is itself the information. So one of them concludes that the other is being unhelpful, or territorial, or self important, and there is no available sentence that fixes that impression. A wall does not merely stop information moving; it obliges two colleagues to look unhelpful to each other and to keep looking that way, and pretending otherwise is why people quietly route around them.

So why accept it? Because the alternative costs more, and it is worth putting the comparison plainly rather than in principle. Information that crossed could not be un-crossed. There would be no way afterwards to show that the advisory team's view was formed independently, no way for either client to be sure whose interest was served, and no way to answer the only question that would then matter: who knew what and when. A wall buys one thing: the ability to say, credibly and to somebody with no reason to trust the firm, that a given fact never arrived. The ability is worth a great deal of friction, and it is still friction.

Why Is a Wall Not a Statement About Trust?

Somebody in their first month, told that a whole floor of the firm cannot be spoken to about their work, reasonably wonders what is being implied about them. Nothing is being implied. Both teams inside Kavery Capital Services Private Limited are trusted, and if either were not, a wall would be a strange remedy for that. The separation exists because a duty follows information rather than following intent.

Think about what would have to be true for trust to be a sufficient control. Somebody would have to be able to hold a fact and reliably not let it shape a judgement they make later, without noticing, in a document about something else. Nobody can demonstrate that, about themselves, to a stranger. The separation is not a character question at all. A wall exists because a fact that cannot be unlearned will influence work not yet started, and no amount of good faith is inspectable by the person who has to rely on it.

Saying this out loud matters more than it sounds. A wall explained as a trust measure produces resentment and quiet leakage. A person who knows they are trustworthy will treat the rule as insulting and therefore optional. A wall explained as a duty that follows information produces the opposite: people on both sides start protecting each other from finding things out, and a functioning wall looks exactly like that from the inside.

What Does Prompt Hygiene Allow Into a Tool, and What May Never Go In?

Prompt hygieneThe rule governing what may be typed or pasted into a tool, decided before the moment of typing arrives. is the newest of the four controls and the only one with no equivalent in older practice. Prompt hygiene answers one question and refuses the rest: what may go in. On the Kavery assignment a drafting tool was used for one narrow job, and the rule about what could be shown to it was fixed before the job started.

The rule has exactly two gates, applied in order. Gate one asks whether the material is public. On the Kavery file that means one of the twelve documents anybody could have gone and fetched without asking a soul. If the answer is no, it stops there, and the six confidential and three restricted documents stop there. Gate two asks whether the provenance of that public document is known, meaning whether the file records where this particular copy actually came from. Four of the twelve public documents could not be traced to an origin, so they stop at gate two.

Eight documents out of twenty one are left. Two gates applied in order to an ordinary working file left eight documents eligible and thirteen out of bounds. The majority of what a desk holds may not be shown to a tool at all. Most people, asked to guess, expect the restriction to catch only the tightest material. The rule catches nearly two thirds of the file, and it catches it before anybody has considered whether the paste would be useful.

Why Must the Rule Be a List Rather Than a Judgement?

Every instinct says the rule should be sensible. Judge each case, weigh the sensitivity against the need, use common sense. The sensible version sounds mature and it does not survive contact with a Thursday evening.

Where the judgement would actually be made is the part to see. Not calmly, at the start of an assignment, with a colleague to talk it over with. The judgement is made at the moment a person is holding a supplied schedule of six printed sides, is behind, knows exactly how long the manual version takes, and can see a faster route sitting in front of them. At that moment the benefit of the paste is vivid and measurable in minutes, and the cost is invisible, deferred, probabilistic and owed to somebody who is not in the room. A judgement asked for under those conditions does not produce a balanced decision, it produces a reason, and the reason is always available.

So the rule is moved out of the moment. A list, decided in advance, applied mechanically, with no field on the form for how urgent this is. The list is not there because people cannot be trusted with a judgement. The list is there because a judgement made under a deadline is made by a different person from the one who wrote the policy, and that person is tired, at the end of the day the work is due.

What Did the Twenty One Documents on This File Actually Allow?

The whole working file, run through every control at once. Twenty one documents arrived between 3 March and 11 March: twelve public, six confidential, and three restricted under a written undertaking. The counts add to twenty one, and the table below shows what each level permitted and how differently the same document is treated depending on which of the four controls is asking.

Work down the fourth column, the one that surprises people. Twelve pass the sensitivity gate. Four of those twelve fall at the provenance gate. Nobody recorded where those particular copies came from. Eight are left. Thirteen of twenty one, close to two thirds of the working file, may not be shown to a tool at all, and none of that arithmetic changed because the work was urgent.

How Does Secure Collaboration Work With Somebody Who May Not See Everything?

Every wedding in the country runs this problem. Two sides are splitting the costs, each side has told the same planner what it can afford, and neither wants the other to know. The planner has to produce one arrangement that works, using both numbers and giving neither number away. The planner's answer is not secrecy but a working method, and the method is built on sending outputs rather than inputs.

Secure collaborationWorking with somebody who may not see everything the analyst can, by sharing the conclusion rather than the material it was drawn from. is the same method inside a working file, and it has three moves. The first is to send the finding rather than the document: input costs rose across the year, with the source log item number beside it, not the supplier price list. The second is to ask a question that does not carry its own answer. Asking whether a fall of this size is normal for a pipe maker is a very different question from asking whether 10.8 per cent is normal. The third is that when a colleague must see something, the derived figure is shared with its item number so the review has something to trace. Tracing of that kind is what a need-to-know basisAccess decided by what somebody needs in order to do their part of the work, rather than by how senior they are. means in practice.

Two traps sit inside this, and both look like solutions. The first is the instruction not to look: sending the whole file with a note asking the recipient to ignore the third tab. A control that depends on the restraint of the person who now holds the file is not a control, it is a request, and it has already failed at the moment of sending. The second is redaction by deletion: sending the supplied schedule with the sensitive rows removed. The remainder is still the supplied document, its structure still shows how many rows were taken out, and the remaining rows are still material somebody handed over for one purpose.

One more habit, small and worth building early. Anything sent out carries its level with it. A document that arrives with no level attached forces the receiver to guess, and a guess made by somebody who did not see it arrive is a guess made without the one fact that decides the answer. Naming the level costs four words and removes the whole question.

Information Security vs Confidentiality: Which One Fails When a File Is Forwarded?

Security and confidentiality get used as though they were the same duty in different clothes, and treating them that way is how a firm ends up spending heavily on one while the other goes unmanaged. Information securityStopping people who should not have access from getting in. is about keeping the wrong people out. Confidentiality is about stopping the right people passing it on. The two are separate problems, they fail separately, and the second one has no technical solution at all.

Take the case the whole distinction turns on. An encrypted document sits in a controlled store. A person with legitimate access opens it, entirely properly, and forwards it to somebody who has no business receiving it. Now ask which control failed. Every security control worked exactly as designed: the encryption held, the access rights were correct, the person who opened it was entitled to. An encrypted file forwarded by somebody entitled to open it has passed every security control in the building and breached the confidentiality duty completely. One of the two duties cannot be bought.

The failure runs the other way too, and the quieter direction is more common than the dramatic version. A confidential schedule left in the printer tray at six o'clock is a security failure first, in that a physical control did not hold. The schedule becomes a confidentiality failure the moment somebody picks it up and reads it. One failure created the other, and the two controls are still worth keeping distinct: fixing the printer habit does nothing about the forwarded file, and fixing the forwarding habit does nothing about the printer.

What Happens After Seeing Something That Should Not Have Been Seen?

Accidental exposure happens sooner or later, probably in a way that is nobody's fault. A shared folder is misconfigured for an hour. An attachment goes to the wrong distribution list. Somebody two seats away leaves a document open on a screen in a walkway. Nothing was done wrong at any point, and somebody now holds something from the other side of a wall.

The response is a fixed sequence and the first step is the one people skip. Say what was seen, in plain words, the same day. Say it to whoever manages the wall rather than to the person who sent it. The sender has an obvious reason to want the matter closed quietly and no authority to close it. Use of the information stops, including the use that would sharpen a sentence already being written. Then somebody else decides whether the analyst stays on the work, and nobody should make that decision about themselves.

Trying to unsee it is not a step, and silence is what converts an accident somebody else caused into a problem belonging to whoever stayed quiet. Reporting it in the first hour costs nothing and reflects on nobody. The same fact surfacing in ninety days, when somebody is reconstructing who knew what, is a different matter entirely, and the difference between the two is not what happened but whether it was written down at the time.

How Does a Lender, an Analyst or Somebody Working Alone Use Any of This?

A lender uses it every time a monitoring note circulates. A credit file is mostly supplied material: management accounts nobody publishes, order books, a schedule of what a customer owes. The note that goes round the committee has to be built entirely out of conclusions drawn from that material rather than out of the material itself, and the practical test on a Friday is whether the note would still make sense with every attachment removed. If it would not, the note is leaning on documents that are about to travel further than the people who supplied them expected.

An analyst uses it in the corridor. A plant visit produces two kinds of information: what anybody on a tour would have seen, and the sentence somebody said on the walk to the gate. The second one is the one to write down carefully and treat as supplied. The person who said it was being helpful rather than making an announcement. The discipline that protects both parties is naming which kind is being held before it is used, not after somebody asks where a number came from.

And somebody working alone uses it hardest of all, with no structure to lean on. A consultant with two clients in the same trade has no floors, no separate stores and no compliance team maintaining anything. The sole practitioner is the entire wall, and what actually works is boringly physical: separate folders, separate notebooks, separate devices where affordable, and a rehearsed sentence that declines to answer without explaining why. The household version is the same discipline in a smaller room. If a relative works at a bank and hears something at the dinner table, the duty that arrived with the sentence did not stop at the door, and the only control available in that room is the one available in a firm: not repeating it.

The Kavery research desk, Kavery Capital Services Private Limited, Meenakshi Tubes Private Limited, Sharada Iyer, Prakash Nadar and Latha Menon are invented.
Educational material. Not advice on any investment, tax, budget or market position.