Glossary/Fraud and ethics

Conceptual framework (AICPA Code)

The conceptual framework is the AICPA Code's three-step approach for ethics and independence: identify threats, evaluate their significance, and apply safeguards, or decline the work if none suffice.

CORAA TeamUpdated November 5, 2026

Definition

The conceptual framework is the AICPA Code's method for situations the rules do not address directly. It has three steps: identify threats to compliance with the rules, evaluate whether each threat is at an acceptable level, and if it is not, apply safeguards to eliminate it or reduce it to an acceptable level. A separate version in ET 1.210.010 applies to independence.

Why it matters in an audit or review

The Code cannot list every relationship. The framework lets a member reach a defensible conclusion and document it. The member must still follow any specific interpretation that applies, because the framework does not override a rule that prohibits something. For a firm, it is the basis for independence evaluation when a new service, relationship or ownership change comes up.

Example

Illustrative: an audit client asks the firm for a service that the Code's nonattest interpretations do not clearly cover. The firm identifies the threats, such as self-review and management participation, judges whether each is at an acceptable level, applies safeguards where it is not, and documents the conclusion. If no safeguard is enough, the firm declines the work.

Common mistakes

Using the framework to justify a relationship that a specific interpretation prohibits.

Sources

  • AICPA Code of Professional Conduct, ET 1.000.010, Conceptual Framework for Members in Public Practice
  • AICPA Code of Professional Conduct, ET 1.210.010, Conceptual Framework for Independence
  • AICPA Code of Professional Conduct, ET 1.295, Nonattest Services

Definitions paraphrase AICPA and FASB guidance; read the standard itself before relying on a requirement. Example figures are illustrative. This page is guidance, not professional advice. Report an error

Standards

AICPA Code ET 1.000.010AICPA Code ET 1.210.010

Related terms

  • Threats and safeguards
    Threats are circumstances that could compromise compliance with the AICPA Code, and safeguards are actions that reduce them to an acceptable level. If none works, the member declines or stops.
  • Independence
    Independence for an auditor means independence of mind and independence in appearance. It is required for audits and reviews, and under the AICPA Code it is judged using a conceptual framework.
  • Nonattest services
    Nonattest services are services a firm provides to an attest client other than audits, reviews and examinations, such as bookkeeping or tax prep. The AICPA Code allows them if specific requirements are met.
  • Confidentiality
    Confidentiality is the duty of a member not to disclose confidential client information without the client's consent, except in situations the AICPA Code allows, such as a subpoena or peer review.

Go deeper

All glossary terms →

For US CPA firms

Join the CORAA waitlist

CORAA AI drafts audit working papers from your client’s QuickBooks books and does the first pass: lead schedules, tie-out, memos, draft notes and letters. CORAA Network reviewers clear every finding. Your firm reviews and signs.

  • First audit free, so you can judge the quality on a real file
  • Flat fee by entity size; messy books included
  • We work only with CPA firms, never their clients
See how it works →

* required