AICPA Independence for Small Firms: Nonattest Services, Threats, Safeguards and a Decision Process

Small firms often serve the same client in several ways: bookkeeping during the year, tax return at the end, and an audit or review of the financial statements. The AICPA Code of Professional Conduct allows many of these combinations, but only when the firm meets specific requirements. A firm that misses one has an independence impairment on the attest engagement, and the audit or review report cannot be issued as written.

This guide explains when independence is required, the general requirements for nonattest services in ET 1.295, how the threats and safeguards approach fits, and a decision process a small firm can apply at acceptance. It paraphrases the Code; read the interpretations in the current AICPA Code before relying on any point.

When is independence required?

Independence is required for attest engagements: audits and reviews of financial statements, and examinations under the attestation standards. It is not required for a compilation or a preparation engagement. A firm that is not independent can still perform a compilation, but its report must say that it is not independent. See compilation, review and audit compared and compilation engagements under AR-C 80.

Independence covers both independence of mind, an attitude that permits an opinion without being affected by influences that compromise professional judgment, and independence in appearance, avoiding circumstances in which a reasonable and informed third party would conclude that integrity, objectivity or professional skepticism has been compromised. See independence and objectivity and integrity.

The framework: threats and safeguards

The Code uses a conceptual framework approach. The member identifies threats to compliance with the rules, evaluates their significance and applies safeguards to eliminate or reduce them to an acceptable level. If safeguards cannot do that, the member declines the engagement or ends the relationship that creates the threat. The categories of threat are:

• Self-review: the firm audits its own work, such as entries it posted.
• Management participation: the firm acts like management.
• Advocacy: the firm promotes the client's position.
• Familiarity: a close relationship makes the firm too sympathetic.
• Undue influence: the client pressures the firm.
• Self-interest: a financial or other interest in the client.
• Adverse interest: a dispute or other adversarial relationship.

See threats and safeguards and the conceptual framework. For some situations the Code does not allow safeguards at all, such as a member taking on a management role, which impairs independence outright.

The general requirements for nonattest services (ET 1.295.040)

ET 1.295 covers services a firm provides to an attest client other than attest services: bookkeeping, payroll, tax, financial statement drafting, IT, internal audit assistance and others. The general requirements apply to all of them. Under ET 1.295.040, the firm does not impair independence if it meets these conditions, paraphrased:

1. The firm does not assume management responsibilities. It does not make management decisions, hold client assets, approve transactions or supervise client employees.
2. The client agrees to take on its own responsibilities. The client assumes all management responsibilities, oversees the service by designating an individual with suitable skill, knowledge and experience (SKE), evaluates the adequacy and results of the service, and accepts responsibility for the results.
3. The firm documents its understanding with the client before performing the service: the objectives of the engagement, the services to be performed, the client's acceptance of its responsibilities, the firm's responsibilities and any limitations.
4. The firm evaluates the cumulative effect of all the nonattest services it performs for the client, and any additional threats created.

Written documentation of the understanding is a requirement of the interpretation, not a courtesy. The nonattest services independence evaluation form and the engagement letter templates can carry it.

The Code also contains specific interpretations on particular services, such as bookkeeping, tax, internal audit assistance, IT and valuation. A service that meets the general requirements can still be restricted by its specific interpretation, so read the one for each service before accepting.

Can a firm draft the financial statements it audits?

Yes, provided the firm follows the general requirements. Journal of Accountancy reporting on the Code notes that a member may prepare the financial statements that the member audits, as long as all the safeguards in the general requirements interpretation are followed. The client must still have someone with SKE to review the statements and accept responsibility. The firm does not decide which accounting policies to adopt; the client does.

SKE does not mean the person has to be able to do the work. It means they can understand the service, the results and the implications well enough to make informed decisions. An owner who signs without reading the statements does not have SKE for this purpose. See nonattest services.

Worked scenario

Illustrative. A two-partner firm is asked to audit a family-owned distributor. For years the firm has prepared its monthly financial statements from a trial balance exported from QuickBooks Online, posted adjusting entries and prepared its tax return. The company's controller reconciles accounts, and the owner reads the statements and discusses them with the firm each quarter.

Step 1: Is independence required? Yes, for an audit.

Step 2: List the nonattest services. Financial statement drafting, posting of adjusting entries and tax return preparation.

Step 3: Apply the general requirements.

• Management responsibilities. The firm proposes adjusting entries, but the controller approves each one and the company's books reflect them. The firm does not approve invoices, sign checks or have access to the bank account. The firm meets the first requirement.
• Client responsibilities and SKE. The controller oversees the work, and the owner evaluates and accepts the results. The firm confirms in a meeting that the controller can explain the major entries and the owner can describe the statements, and documents the conclusion.
• Documentation. The firm updates the engagement letter to state the nonattest services, the client's responsibilities, the firm's responsibilities and the limits.
• Cumulative effect. The firm considers whether drafting the statements, posting entries and preparing the return together create a self-review threat on balances it will audit, and whether staffing the audit with people who did not do the nonattest work is a sufficient safeguard.

Step 4: Decide and document. The firm concludes the services can be provided with independence preserved, and records the analysis. If the controller leaves mid-year and no one with SKE replaces the role, the firm reassesses, since requirement 2 would not be met.

The same facts become a problem if the firm decides which expenses to capitalize, or if it determines the allowance for credit losses without the client's input, because those are management decisions. The decision belongs to the client, and the firm can assist.

Practical documentation checklist

• Independence evaluation at acceptance and annually, signed
• Written understanding for each nonattest service
• Identity and qualifications of the client's SKE person
• Cumulative effect analysis and any safeguards applied
• Staff independence confirmations. See the independence confirmation form and the firm independence tracker
• A record of non-audit fees if the firm tracks them for the audit committee or governance

Common mistakes

• Treating a compilation-level relationship as if it were an audit relationship, or the reverse.
• No documented SKE evaluation for the client's oversight person.
• Posting entries and approving them in the client's system without a client sign-off.
• Skipping the cumulative effect analysis once each service looks acceptable alone.
• Letting engagement letters for the nonattest service lapse while the service continues.

Frequently asked questions

Can a CPA firm do the bookkeeping and the audit for the same client?

It can if it meets the general requirements for nonattest services and any specific interpretation for bookkeeping, and does not take on management responsibilities.

What is SKE?

Suitable skill, knowledge and experience: the client's designated person must be able to oversee the service and evaluate its results.

Is independence required for a compilation?

No. If the firm is not independent, the compilation report must say so.

What happens if independence is impaired?

The firm cannot issue an audit or review report without addressing the impairment. Depending on the facts, it may need to withdraw from the engagement or end the nonattest relationship that created the impairment. Seek advice from the firm's ethics resources.

Does a firm need to document nonattest services for tax work?

The general requirements apply to nonattest services for attest clients, including tax services, along with any specific interpretation.

Sources

• AICPA, Code of Professional Conduct, ET 1.200 (Independence) and ET 1.295 (Nonattest Services), including ET 1.295.040, pub.aicpa.org
• AICPA, Plain English Guide to Independence, pub.aicpa.org
• Journal of Accountancy, Maintaining independence with nonattest services (November 2016) and How auditors can stay independent while advising on revenue recognition (December 2019), journalofaccountancy.com

AU-C references are to AICPA Professional Standards, paraphrased here; read the standard itself before relying on a requirement. This page is guidance, not professional advice. Report an error