Independence under the AICPA Code and nonattest services

In this lesson you will

Apply the threats and safeguards approach in the conceptual framework.
List the conditions the Code places on nonattest services for an attest client.
Evaluate whether a designated client individual has suitable skill, knowledge and experience.
Identify the written documentation the Code requires before nonattest work starts.

Why independence comes first

AU-C 200.15 states that the auditor must be independent of the entity when performing an engagement under GAAS, unless GAAS provides otherwise or law or regulation requires the auditor to accept the engagement. If you are not independent and neither exception applies, you are precluded from issuing a report under GAAS. "Must" makes this unconditional.

The rules for what independence means come from the AICPA Code of Professional Conduct (and, for issuers, the SEC's rule in 17 CFR 210.2-01; for Yellow Book audits, GAGAS). This lesson covers the AICPA Code for private-company audits.

The conceptual framework

The Independence Rule (ET 1.200.001) is supported by specific interpretations and by the Conceptual Framework for Independence (ET 1.210.010). When a situation is not covered by a specific interpretation, you use the framework:

Identify threats. The framework names seven: adverse interest, advocacy, familiarity, management participation, self-interest, self-review and undue influence.
Evaluate significance. Is the threat at an acceptable level, meaning a reasonable and informed third party would conclude independence is not compromised?
Apply safeguards when it is not acceptable. Safeguards can be created by the profession, the client or the firm.
Conclude. If no safeguard reduces the threat to an acceptable level, independence is impaired and you decline or withdraw.

Document the threat, the evaluation and any safeguard. A one-line "independence OK" does not show the analysis.

Nonattest services

Small-firm audits often come bundled with bookkeeping, tax returns, payroll or drafting the financial statements. The Nonattest Services subtopic (ET 1.295) allows these services only when its conditions are met.

Under the general requirements (ET 1.295.040), you must not assume management responsibilities, and you must be satisfied that client management will:

Assume all management responsibilities.
Oversee the service by designating an individual, preferably within senior management, who possesses suitable skill, knowledge and/or experience.
Evaluate the adequacy and results of the services performed.
Accept responsibility for the results of the services.

The designated individual does not need to be able to perform the service. They need to understand it well enough to oversee it and evaluate the results. A controller who could not tell whether a depreciation schedule is reasonable does not meet that bar for a fixed asset service.

Before you perform the service, ET 1.295.040 requires you to establish and document in writing an understanding with the client covering the objectives of the engagement, the services to be performed, the client's acceptance of its responsibilities, your responsibilities and any limitations of the engagement. ET 1.295.050 repeats the documentation requirement: a missing document does not by itself impair independence if the understanding was established, but it violates the Compliance With Standards Rule. Firms also record who the designated individual is and the basis for concluding that person has suitable skill, knowledge and experience; reviewers look for that evidence because the condition is otherwise unsupported. Our nonattest services evaluation form captures both.

The Code also requires you to consider the cumulative effect of multiple nonattest services. Three services that each look manageable can together create a self-review or management participation threat that safeguards cannot address.

Common file failures

No written understanding of nonattest services, or one signed after the work started.
A designated individual named with no evaluation of their skill, knowledge and experience.
The firm posting journal entries it proposed without client review and approval of each one.
No evaluation of the cumulative effect of all services.
Independence confirmations from staff collected after fieldwork began.

The independence and nonattest services guide has more scenarios.

Worked example

Evaluating a designated individual

Maple Ridge Physical Therapy, P.C. asks its audit firm to prepare the financial statements, compute depreciation and prepare the corporate tax return. The owner, a physical therapist, proposes himself as the designated individual.

The engagement partner interviews him. He can explain each revenue stream, reviews the monthly payer reports and reads the draft statements line by line. He cannot explain straight-line depreciation or why the firm uses a seven-year life for equipment.

The partner concludes he has suitable skill, knowledge and experience for financial statement preparation and tax return preparation after a walkthrough, but not for the depreciation service. The client hires an outside bookkeeper with fixed asset experience, who becomes the designated individual for that service.

The file contains: the written understanding signed before work began, listing three services; the partner's memo on each designated individual and the basis for the conclusion; an evaluation of the self-review threat from all three services combined, with the safeguard that a professional not on the audit team reviews the depreciation computation. The partner concludes threats are at an acceptable level.

Self-check

Answer each question before you open the answer.

What happens under AU-C 200.15 if the auditor is not independent and no exception applies?
Show answer
The auditor is precluded from issuing a report under GAAS. The requirement uses "must," so it is unconditional.
Name the seven threats in the AICPA Conceptual Framework for Independence.
Show answer
Adverse interest, advocacy, familiarity, management participation, self-interest, self-review and undue influence.
Does the designated individual need to be able to perform the nonattest service?
Show answer
No. They need suitable skill, knowledge and/or experience to oversee the service and evaluate its results. The test is understanding and oversight, not the ability to do the work.
When must the written understanding for nonattest services exist?
Show answer
Before the member performs the nonattest service. It covers objectives, services, the client’s acceptance of its responsibilities, the member’s responsibilities and limitations of the engagement.

Sources

Back to the syllabus

Standards are paraphrased from the primary sources listed above; read the source before relying on a requirement. This lesson is training material, not professional advice. Report an error