The AICPA Code of Professional Conduct is the ethics rulebook for AICPA members. It sets out principles, rules, interpretations and nonauthoritative guidance, and the rules reach every engagement a member performs, from a compilation to an audit. The version in force took effect on December 15, 2014, and AICPA updates it as new interpretations are released. The copy this page was checked against was updated for official releases through July 2026. This page maps the sections, quotes the short rules, and explains the interpretations that most often come up in a CPA firm: independence, nonattest services, fees, confidentiality and using outside providers.
State boards of accountancy adopt their own rules, which may differ from the AICPA Code, and issuer audits are also subject to SEC and PCAOB independence rules. Read the Code itself before relying on a point here.
How is the Code organized?
The Code has a Preface that applies to all members and three Parts, with a shared numbering scheme so that the same topic carries the same number in each part.
| Section | Content |
|---|---|
| Preface 0.100 to 0.700 | Overview, structure and application, principles, definitions, nonauthoritative guidance, new and revised interpretations |
| Part 1: Members in Public Practice | 1.000 introduction and conceptual framework; 1.100 integrity and objectivity; 1.200 independence; 1.300 general standards; 1.310 compliance with standards; 1.320 accounting principles; 1.400 acts discreditable; 1.500 fees and remuneration (1.510 contingent fees, 1.520 commissions and referral fees); 1.600 advertising and solicitation; 1.700 confidential information; 1.800 form of organization and name |
| Part 2: Members in Business | Integrity and objectivity, general standards, compliance with standards, accounting principles, acts discreditable |
| Part 3: Other Members | Introduction and acts discreditable |
The Preface sets out six principles: responsibilities, the public interest, integrity, objectivity and independence, due care, and scope and nature of services. Principles state the ideals. The rules, numbered with a .001 suffix such as 1.200.001, are what a member can be disciplined for violating.
What does the Independence Rule say?
The Independence Rule (1.200.001) requires a member in public practice to be independent in performing professional services as required by standards promulgated by bodies designated by Council. Independence is not required for every service. It is required for attest engagements such as audits, reviews and examinations. A compilation can be performed without independence if the report discloses the lack of it.
When no specific interpretation covers a relationship, the member applies the Conceptual Framework for Independence (1.210.010). The member identifies threats, evaluates their significance, and applies safeguards that eliminate or reduce significant threats to an acceptable level. A member is considered in violation if he or she cannot demonstrate that safeguards were applied (1.200.005). The framework names seven threats:
- adverse interest
- advocacy
- familiarity
- management participation
- self-interest
- self-review
- undue influence
Specific interpretations cover loans, financial interests, immediate family employment, former employees, honorary directorships, litigation, alternative practice structures and nonattest services. Where one exists, apply it first.
How do nonattest services affect independence?
Nonattest services for an attest client create self-review and management participation threats. Under the general requirements interpretation (1.295.040), independence is not impaired when the member meets these safeguards, unless a more specific interpretation says otherwise:
- the client agrees to assume all management responsibilities, oversee the service through a designated individual with suitable skill, knowledge or experience, evaluate the adequacy and results, and accept responsibility for the results
- the member does not assume management responsibilities
- before performing the service, the member establishes and documents in writing an understanding with the client
If the client cannot or will not take on these responsibilities, performing the service would impair independence. Some activities cannot be made acceptable by safeguards. The Code gives preparing source documents used to generate the attest client's financial statements as an example of a self-review threat so significant that no safeguards reduce it to an acceptable level. Specific interpretations cover bookkeeping and payroll (1.295.120), tax services, appraisal and valuation, internal audit, IT systems and others. Use the nonattest services independence evaluation form and the independence confirmation form to document the analysis.
What are the general standards?
The General Standards Rule (1.300.001) says a member shall comply with four standards:
- Professional competence. Undertake only services the member or firm can reasonably expect to complete with professional competence.
- Due professional care. Exercise due professional care in performing services.
- Planning and supervision. Adequately plan and supervise the work.
- Sufficient relevant data. Obtain sufficient relevant data to afford a reasonable basis for conclusions or recommendations.
The Compliance With Standards Rule (1.310.001) requires a member who performs auditing, review, compilation, management consulting, tax or other professional services to comply with standards promulgated by bodies designated by Council. For audits, that is GAAS. For reviews and compilations, it is SSARS. The Accounting Principles Rule (1.320.001) deals with departures from standards promulgated by the designated accounting standard setters. See GAAS.
What does the Code say about fees?
The Contingent Fees Rule (1.510.001) prohibits a member in public practice from performing, for a contingent fee, any professional services for, or receiving such a fee from, a client for whom the member or firm performs:
- an audit or review of a financial statement
- a compilation of a financial statement, when the member expects or reasonably might expect a third party to use it and the compilation report does not disclose a lack of independence
- an examination of prospective financial information
It also prohibits preparing an original or amended tax return, or a claim for a tax refund, for a contingent fee for any client. The prohibition on attest-client fees applies during the engagement period and the period covered by the historical financial statements involved. Separately, the Code addresses fee dependency and determining fees for an attest engagement (1.230.030 and 1.230.040) and unpaid fees (1.500.008).
Confidential client information and outside providers
The Confidential Client Information Rule (1.700.001) says a member in public practice shall not disclose any confidential client information without the specific consent of the client. The rule does not relieve the member of obligations under the compliance and accounting principles rules, affect the duty to comply with a valid subpoena or summons or applicable law, prohibit practice review under AICPA, state society or board authorization, or preclude responding to inquiries from the AICPA ethics division or a state investigative body.
Two interpretations matter for firms that use outside help, including offshore or technology providers.
- Disclosing information to a third-party service provider (1.700.040). Clients may not expect the member to use one. Before disclosing confidential information, the member should either enter into a contract with the provider that requires confidentiality and obtain reasonable assurance that the provider has procedures to prevent unauthorized release, or obtain the client's specific consent.
- Use of a third-party service provider (1.150.040 for integrity and objectivity and 1.300.040 for general standards). The member remains responsible for meeting the Code's requirements when relying on the provider's work, including planning, supervision and sufficient relevant data.
Neither interpretation removes the member's responsibility for the work. A firm that uses an outside team must be able to show the engagement partner supervised and reviewed it. See outsourced audit support for CPA firms.
How does it change practice?
- Keep an independence confirmation process at the firm level and per engagement, with a clear owner. See the firm independence confirmation tracker.
- Evaluate every nonattest service for each attest client before the engagement letter, and document the client's management-responsibility assumptions in writing.
- Review engagement letters and client portals for provisions on confidentiality and outside providers.
- Update the firm's quality management policies under SQMS 1 for ethics and independence responsibilities.
Common problems
Practice observations, not requirements:
- A bookkeeping or financial statement preparation service for an audit client with no documented management oversight.
- Engagement letters that are silent on outside providers.
- Independence confirmations collected late in busy season.
- Contingent or success-based fee language in a tax engagement letter.
FAQ
Does the AICPA Code apply to a CPA who is not an AICPA member?
The Code binds AICPA members. State boards of accountancy have their own rules, and many reference or follow the AICPA Code, but a nonmember's obligations come from the state.
Can a firm prepare the financial statements and perform the audit?
Under the general nonattest requirements it can in some cases, with documented management responsibility and the other safeguards. Preparing source documents used to generate the financial statements cannot be made acceptable by safeguards.
Is a compilation a service that requires independence?
No. A member can compile without independence, but the compilation report must disclose the lack of independence if that is the case.
Does the Code allow a contingent fee for tax return preparation?
No. The Contingent Fees Rule prohibits preparing an original or amended tax return or refund claim for a contingent fee for any client.
Sources
- AICPA, Code of Professional Conduct (effective December 15, 2014; updated through July 2026), Preface 0.100 to 0.700 and Parts 1 to 3, including 1.000.010, 1.100.001, 1.150.040, 1.200.001, 1.200.005, 1.210.010, 1.230.030, 1.295.040, 1.300.001, 1.300.040, 1.310.001, 1.510.001, 1.700.001, 1.700.040: https://pub.aicpa.org/codeofconduct/ethics.aspx
Related
Part of CORAA University · Evidence and audit procedures: related guides, calculators and templates.
AU-C references are to AICPA Professional Standards, paraphrased here; read the standard itself before relying on a requirement. This page is guidance, not professional advice. Report an error