MarcusWelcome to Office Hours from VoraPrep Audio. Today we’re talking about the bedrock of the profession: ethics and independence.

AvaAnd Marcus, this isn't just a theoretical topic. The source material starts with a story about a company collapsing. It took people's retirement savings with it. And it happened because the auditors weren't objective. The stakes are incredibly high.

MarcusThey are. Public trust is the only thing our profession has to sell. Without it, an audit opinion is worthless. That's why the A.I.C.P.A. created the Code of Professional Conduct.

AvaOkay, so the A.I.C.P.A. Code. Is it just a big book of rules?

MarcusIt’s more like a pyramid. At the top, you have the Principles. These are broad, aspirational goals. Think Integrity, and serving the Public Interest.

AvaAspirational, meaning you can’t get in trouble for violating a principle?

MarcusExactly. They’re the 'why.' Below them are the Rules. These are the enforceable 'how.' You can be disciplined for violating a rule. And below that are the Interpretations. They give specific guidance on applying the rules.

AvaAnd for auditors, what’s the one rule that matters most?

MarcusIndependence. For any attest engagement—an audit or a review—it is absolutely mandatory. There are no exceptions.

AvaThe Code talks about two types of independence: 'in mind' and 'in appearance.' What’s the difference?

MarcusIndependence in mind is what you actually believe. It's your internal state. Can you make an unbiased decision, even when no one is looking? It’s about integrity.

AvaSo that's what's happening inside your own head. What about 'in appearance'?

MarcusThat’s how it looks to the outside world. Think of a judge. In her own mind, she might be completely impartial when hearing a case involving her cousin. But would a reasonable person believe she's impartial? Probably not. The appearance of a conflict can be just as damaging as an actual one.

AvaSo you have to be impartial, and you have to be seen to be impartial. How do we even begin to manage that? It seems like there could be a million potential conflicts.

MarcusThat’s why the A.I.C.P.A. developed the Conceptual Framework. Instead of a million specific rules, it gives us a process. First, you identify any threats to your independence.

AvaWhat exactly qualifies as a 'threat'?

MarcusIt’s any relationship or circumstance that could compromise your ability to follow the rules. The framework groups them into seven categories.

AvaAnd I see there's a memory aid for these seven threats.

MarcusThere is. It’s: Aunt Sally's Famous Uncle Makes Super Awesome Pies.

AvaOkay, let's break that down. What’s the first 'A' for? Adverse Interest?

MarcusAn Adverse Interest threat is when your interests are directly opposed to your client's. The classic example is when the audit firm is suing the client. Or when the client is suing the firm. You can't be objective about someone you're in a legal battle with.

AvaThat makes sense. The 'S' in Sally is for Self-Interest. What does that look like?

MarcusThis is when you could benefit, usually financially, from your client's success. Owning stock in the company you're auditing is the most obvious example. Another is when fees from a single client become too significant. For instance, if a client's fees make up 25 percent of the firm's total revenue, that could create a threat. Your judgment might be swayed because you're afraid to lose that client.

AvaGot it. Okay, next is 'F' for Familiarity. I think I can guess this one.

MarcusYou probably can. It’s when a long or close relationship with a client makes you too sympathetic. You become too accepting of their work. For example, an audit partner has been on the same engagement for over a decade. He's now close friends with the C.E.O. That's a clear familiarity threat.

AvaRight, you might not want to challenge your friend's work as toughly as you should. What about the 'U' for Undue Influence?

MarcusThis is when the client tries to coerce you or subordinate your judgment. Think of a C.F.O. who threatens to fire your firm if you don't approve their aggressive accounting. That’s the client trying to exert undue influence over your professional judgment.

AvaThat sounds like straight-up bullying. Okay, next is 'M' for Management Participation. This one sounds serious.

MarcusIt is. This is a bright line you can never cross. It’s when you take on the role of client management. This means authorizing transactions, preparing source documents, or having custody of their assets. You can't be management and the auditor. It's an automatic impairment of independence.

AvaSo you can advise, but you can never decide. What about the next 'S', for Self-Review?

MarcusA Self-Review threat happens when you're in a position of auditing your own work. For instance, say your firm's consulting group designed a new accounting system for a client. The audit side of the firm can't then audit the financial statements from that system. You’d basically be grading your own homework.

AvaI see. It's hard to be objective about something you built yourself. And the last one, the 'A' in Awesome Pies? Advocacy.

MarcusAn Advocacy threat is when you promote your client's interests to the point that your objectivity is compromised. This could be acting as their expert witness in a lawsuit. Or promoting their stock to potential investors. You've stopped being an independent auditor and started being part of their team.

AvaOkay, so once you’ve used the mnemonic and identified one of these seven threats, what happens next? Do you just have to resign from the engagement?

MarcusNot necessarily. The next step is to evaluate how significant the threat is. If it's not at an acceptable level, you have to apply safeguards.

AvaSafeguards. Are those like defenses against the threats?

MarcusThat’s a perfect way to think of it. They’re actions or policies that either eliminate the threat or reduce it to an acceptable level. They fall into three categories.

AvaWhat’s the first category?

MarcusThe first are safeguards created by the profession, legislation, or regulation. These are the big, system-wide rules everyone has to follow. For example, there's mandatory continuing education on ethics. There's also the P.C.A.O.B. rule. It requires lead audit partners on public companies to rotate off the engagement every five years.

AvaSo those are external rules. What’s the second type of safeguard?

MarcusThose are safeguards implemented by the client. A strong, independent audit committee at the client is a great safeguard. They oversee our work and act as a buffer between the auditors and management. Strong internal controls at the client also help.

AvaThat makes sense. If the client has their own house in order, it reduces risk. What's the third category? The source says this is the one that gets tested the most.

MarcusSafeguards implemented by the C.P.A. firm itself. This is all about the firm’s own internal policies and culture. It starts with the 'tone at the top.' That means firm leadership constantly emphasizes the importance of independence. It also includes things like mandatory internal training, and rotating senior staff off engagements. Another key safeguard is having an objective partner, who is not on the engagement team, review the work for independence issues.

AvaSo there are a lot of potential tools in the toolbox to reduce a threat.

MarcusExactly. The framework is designed to be flexible, not just a checklist.

AvaCould we walk through an example of how this process works?

MarcusLet's do it. Here's the scenario. You’re an audit senior. Your firm audits a nonissuer called TechCorp. The new audit manager assigned to the engagement is Sarah. And you find out that Sarah was the controller at TechCorp. She only left to join your firm 18 months ago.

AvaOkay, my gut reaction is that this is a problem. She was just in charge of the books she’s now supposed to be auditing.

MarcusYour gut is right. Let's apply the framework. Step one: identify threats. What do you see?

AvaWell, she knows everyone there, so there's a Familiarity threat. She might be too trusting. And more importantly, she's reviewing work from a period where she was in charge of the accounting. That sounds like a Self-Review threat.

MarcusPerfect. You've identified both key threats. Now, step two: evaluate their significance. Are these minor issues?

AvaNo, they seem very significant. The controller is a key financial reporting position. A reasonable person would definitely question her objectivity auditing policies she helped create.

MarcusI agree completely. The threats are significant. That takes us to step three: apply safeguards. What can the firm do?

AvaThe most obvious thing seems to be just taking her off the TechCorp audit.

MarcusThat is the single best safeguard here. It completely eliminates the threats. Now, if for some reason that wasn't possible, you could try other things. You could bring in a separate quality control reviewer. Or you could wall her off from auditing anything she used to be responsible for. But the cleanest, safest, and most professional action is to reassign her.

AvaThat makes perfect sense. Now, a question about all these rules, like not owning stock. Does this apply to absolutely everyone who works at a large C.P.A. firm?

MarcusThat's a critical question, and it's a common pitfall. The answer is no. The strictest rules apply to what the A.I.C.P.A. calls a 'Covered Member.'

AvaAnd who is a 'Covered Member'?

MarcusThink of it as the people who can actually influence the audit. The definition has a few parts. First, it includes anyone on the attest engagement team, from the intern up to the partner. Second, it’s anyone in a position to influence the engagement, like the head of the audit practice. Third, it includes any partner or manager who provides more than 10 hours of non-attest services to the client. Fourth, it’s any partner in the same office as the lead engagement partner. And finally, the firm itself is considered a covered member.

AvaSo, what about a tax partner in a different office? Let's say they do no work for the client, but they own a few shares. Is independence impaired?

MarcusBased on those facts, no. That partner is not a covered member. They're not on the team. They can't influence the engagement. And they're not in the same office as the lead partner. The rules are nuanced.

AvaThat distinction is huge. So the rules apply to the covered member. But what about their family? Does my spouse owning stock cause a problem?

MarcusThat's a fantastic question, and it's a major exam topic. The Code splits family into two groups: immediate family and close relatives.

AvaOkay, who counts as immediate family?

MarcusThat's your spouse, spousal equivalent, and any dependents. The rule is simple: their financial interests are treated as your own. So if you are a covered member, and your spouse owns even one share of stock in that audit client, your independence is impaired. It's as if you own the stock yourself.

AvaThat's a very strict rule. What about the other group, close relatives?

MarcusClose relatives are your parents, siblings, and non-dependent children. The rules here are more specific. Your independence is impaired in two main situations.

AvaOkay, what's the first situation?

MarcusFirst, if your close relative holds a key position with the client. A key position is a role where they can influence the client's financial statements. Think C.E.O., C.F.O., or a member of the board of directors.

AvaAnd the second situation?

MarcusThe second situation involves a close relative's financial interest in the client. Your independence is impaired if you know about the interest, and it meets one of two tests.

AvaOkay, what are the two tests?

MarcusThe first test is if the financial interest is material to your relative. The second test is if that interest allows them to exercise significant influence over the client. If either one of those is true, your independence is impaired.

AvaThat's a lot to keep straight. So on the exam, when I see a complex scenario, what's the best way to approach it?

MarcusDon't get overwhelmed. Just break it down using a four-step process. First: Who is involved? A staff auditor? A partner in another office? A spouse? This helps you figure out if they're a covered member and which rules apply.

AvaOkay, first who. What's next?

MarcusSecond: What is the relationship? Is it owning stock, a family relationship, or a job offer? Third: What is the threat? Use that 'Aunt Sally' mnemonic to classify it. Is it Self-Interest? Familiarity?

AvaAnd the final step?

MarcusAnd finally, step four: Evaluate the significance of that threat. Then, determine if any safeguards can reduce it to an acceptable level. This structured approach will lead you right to the answer.

AvaVoraPrep is a full exam-prep app — lessons, practice questions, and an A.I. tutor in one place. Get started at Vora Prep dot com.