Risk-allocation clauses sit at the end of an engagement letter, and they decide whether independence survives it. The AICPA Code of Professional Conduct treats indemnification, alternative dispute resolution and regulated-entity restrictions in three separate interpretations. A single indemnity sentence in an audit letter can break the Independence Rule. This post sets out what each interpretation says, using the Code's text as updated through September 2026, and where the Code is silent.
For the required content of the letter itself, see the audit engagement letter guide. For the wider independence framework, see independence and nonattest services for small firms.
Where these rules live
The Code places the independence rules on engagement contract terms in subtopic ET 1.228. It has three interpretations:
- ET 1.228.010, Indemnification of a Covered Member
- ET 1.228.020, Indemnification of an Attest Client
- ET 1.228.030, Alternative Dispute Resolution
A fourth interpretation, ET 1.400.060, Indemnification and Limitation of Liability Provisions, sits under the Acts Discreditable Rule and cross-references the other three. Independence applies to audits, reviews and other attest services. These rules matter whenever the same client receives attest services from the firm.
ET 1.228.020: the firm cannot indemnify the attest client
The prohibition is short. Under the interpretation, threats to compliance with the Independence Rule are not at an acceptable level, and safeguards cannot reduce them to one, if the covered member enters into an agreement providing, among other things, that the covered member indemnifies the attest client for damages, losses or costs arising from lawsuits, claims or settlements that relate, directly or indirectly, to the attest client's acts. The Code's conclusion is stated plainly: the covered member's independence would be impaired.
Three features of that text matter:
- No safeguard cures it. The Code does not offer disclosure, consent or partner review as a fix.
- "Directly or indirectly" widens the clause. A promise to hold the client harmless for third-party claims that relate to the client's own acts falls inside the prohibition.
- It applies to the agreement, not to a payout. The impairment exists when the firm signs the clause, whether or not a claim ever arises.
Check every hold-harmless, defense or reimbursement clause in an attest letter against that text, including clauses in agreements the client's counsel supplies.
ET 1.228.010: the client can indemnify the firm for knowing misrepresentations
The reverse direction is permitted in one defined case. A covered member's independence is not impaired if the engagement letter includes a clause that provides that the attest client releases, indemnifies, defends and holds harmless the covered member, and its partners, heirs, executors, personal representatives, successors and assigns, from any liability and costs resulting from knowing misrepresentations by management.
The scope is "knowing misrepresentations by management." The interpretation does not clear a general indemnity from the client for every claim against the firm. Draft the clause to track the Code: knowing misrepresentations by management, with the same release, indemnify, defend and hold harmless verbs.
Paragraph .02 of this interpretation sends the reader to ET 1.400.060, and that cross-reference is the next constraint.
ET 1.400.060: regulators can prohibit more
Certain governmental bodies and regulators set requirements that prohibit regulated entities from including certain indemnification and limitation of liability provisions in agreements for audit or other attest services the regulator requires, or provide that such provisions disqualify the member from performing the services. The Code names federal banking regulators, state insurance commissions and the SEC as examples.
For a member who enters into, directs, or knowingly permits another individual to enter into such a contract, the Code states the consequence directly. The member does not include or permit a provision that would put the regulated entity or the member in violation of the regulator's requirements or disqualify the member. A member who does so "would be considered in violation of the Acts Discreditable Rule."
The practical result is a two-step test. Step one: does ET 1.228.020 or 1.228.010 permit the clause for independence purposes? Step two: does a regulator that governs this client prohibit the clause? A clause can pass step one and fail step two. Identify regulators at acceptance. A bank client, an insurance company, and any entity audited under SEC rules each trigger step two. See client acceptance and continuance for where to record that.
ET 1.228.030: alternative dispute resolution
An engagement letter can include a provision to use alternative dispute resolution (ADR) techniques to resolve disputes relating to past services, in place of litigation. The Code concludes that threats would be at an acceptable level and independence would not be impaired, because the covered member and the attest client would not be in positions of material adverse interests due to threatened or actual litigation. It adds that the covered member exercises professional judgment when rendering current services regardless of the provision.
The interpretation also covers ADR that is initiated against an attest client:
- When the ADR technique is designed to facilitate negotiation, and the conduct of the negotiation does not place the member and the client in positions of material adverse interests, independence is not impaired.
- When the proceedings are "sufficiently similar to litigation (as in the case of binding arbitration)," an adverse interest threat exists and can place the parties in positions of material adverse interests. The member then applies the "Actual or Threatened Litigation" interpretation, ET 1.290.010.
ET 1.290.010 is the interpretation to know. It states that threatened or actual litigation that puts the member and the attest client or its management in positions of material adverse interests can impair independence. Among its examples of impairment: the client's present management commences litigation alleging deficiencies in the attest engagement, or expresses an intention to, and the member concludes it is probable the claim will be filed.
Read together, a mediation clause for disputes about past services is a clean ADR provision, and a binding arbitration clause is the version that needs ET 1.290.010 analysis if a dispute materializes. The Journal of Accountancy's 2021 article on risk allocation provisions names mediation as the preferred ADR method, notes that it is confidential and non-binding, and cautions that prevailing-party fee awards can amount to accepting liability that did not otherwise exist, which raises insurance coverage questions.
Liability caps: what the Code says and does not say
ET 1.228 contains no interpretation on liability caps or damages exclusions. The Code speaks to limitation of liability only in ET 1.400.060, which makes the clause a violation when a regulator prohibits it. That leaves two types of clause for the firm to distinguish:
- A limitation of liability clause caps the dollar amount of the firm's liability, for example as a multiple of fees.
- A limitation of damages clause excludes categories such as lost profits and punitive or consequential damages.
The Journal of Accountancy article treats both as permissible loss-limiting provisions only where no law, regulation or ethics rule prohibits them, and states that specific requirements and case law on the enforceability of risk-allocation provisions vary by jurisdiction. Enforceability is therefore a question of the law of the state whose law governs the contract, and a clause that works in one state is not portable to another by copying it. The same article recommends making the clause conspicuous: a separate section with a clear heading, bold or capitalized text, and placement near the signature block.
Keep those two questions apart in the file. Independence is governed by the Code; enforceability is governed by state law and case law. Each needs its own answer before the letter goes out.
A clause-by-clause checklist
- Client indemnifies firm, limited to knowing misrepresentations by management: permitted by ET 1.228.010 for independence.
- Client indemnifies firm for all claims, regardless of cause: not covered by ET 1.228.010; confine the attest-letter clause to knowing misrepresentations.
- Firm indemnifies client, for any claim relating to client acts: impairs independence under ET 1.228.020; strike it.
- Mediation for disputes about past services: permitted by ET 1.228.030.
- Binding arbitration: ET 1.228.030 flags it as similar to litigation if a dispute is initiated; run ET 1.290.010 at that point.
- Liability cap or damages exclusion: no ET 1.228 interpretation; check regulator restrictions under ET 1.400.060 and state law on enforceability.
- Regulated client: confirm the regulator's rules before including item 1 or 6.
Keep the file clean
Store the clause analysis in the acceptance file with the regulator check. CORAA assembles the audit file from the client's records; the engagement letter and its risk-allocation terms are the partner's decision.
Sources
- AICPA Code of Professional Conduct, ET 1.228.010, 1.228.020, 1.228.030, 1.290.010 and 1.400.060 (updated for all official releases through September 2026), https://pub.aicpa.org/codeofconduct/ethicsresources/et-cod.pdf
- Journal of Accountancy, "How risk allocation provisions can mitigate risk" (November 2021), https://www.journalofaccountancy.com/issues/2021/nov/how-risk-allocation-provisions-can-mitigate-risk/
CORAA prepares ready-to-review audit files for US CPA firms from client books; you review and sign. See /us.
Part of CORAA University · Quality management and practice: related guides, calculators and templates.
AU-C references are to AICPA Professional Standards, paraphrased here; read the standard itself before relying on a requirement. This page is guidance, not professional advice. Report an error