Relevant ethical requirements and independence in the quality system

In this lesson you will

Identify what “relevant ethical requirements” includes for a firm
Apply the quality objectives for ethics in QM 10.30
Implement the specified responses on threats, breaches and annual confirmations
Extend ethics responses to network firms and service providers

What counts as relevant ethical requirements

QM 10.17 defines relevant ethical requirements as the principles and rules of professional ethics to which the firm, engagement teams, engagement quality reviewers and other personnel are subject, consisting of the AICPA Code of Professional Conduct together with the rules of applicable state boards of accountancy and applicable regulatory agencies that are more restrictive. For a firm with government clients, that brings in the GAGAS independence rules; for SEC-registered broker-dealer or issuer work, SEC and PCAOB rules. The firm needs to know which sets apply to which engagements.

The quality objectives

QM 10.30 sets two groups of objectives:

The firm and its personnel understand the relevant ethical requirements to which the firm and its engagements are subject, and fulfill their responsibilities under them.
Others subject to those requirements, including the network, network firms and their people, and service providers, understand the requirements that apply to them and fulfill their responsibilities.

The second objective matters more than it used to. An offshore service provider preparing workpapers, a staffing firm's contract auditors, or a network firm performing component work must meet the independence and confidentiality rules that apply to the engagement.

The specified responses

QM 10.35 requires every firm to include these responses:

Threats. Policies or procedures for identifying, evaluating and addressing threats to compliance with relevant ethical requirements (QM 10.35a(i)). This is the AICPA conceptual framework applied at firm level: adverse interest, advocacy, familiarity, management participation, self-interest, self-review and undue influence threats.
Breaches. Policies or procedures for identifying, communicating, evaluating and reporting breaches, and responding to their causes and consequences in a timely manner (QM 10.35a(ii)).
Annual confirmation. At least annually, a documented confirmation of compliance with independence requirements from all personnel required to be independent (QM 10.35b).

Building responses beyond the minimum

Typical additional responses:

a restricted entity list kept current and checked before personnel buy investments or accept new clients;
a nonattest services evaluation for every engagement where the firm also prepares financial statements, tax returns or bookkeeping, documenting management's skills, knowledge or experience to oversee the services;
tracking of partner and senior personnel tenure on attest clients where familiarity threats arise;
contract terms that require service providers to comply with confidentiality and independence rules, with periodic confirmations; and
training when the Code is amended.

The independence threats and safeguards worksheet and the nonattest services guide cover the engagement-level side.

Linking to the engagement

SAS 146 makes the engagement partner responsible for understanding the relevant ethical requirements, for making the engagement team aware of them and of the firm's policies, and for determining, before dating the auditor's report, whether relevant ethical requirements, including independence, have been fulfilled (SAS 146, paragraphs 16, 17 and 21). The firm's system supplies the tools; the partner applies them on each engagement.

Common implementation problems

Annual confirmations collected from partners and staff but not from contractors or the engagement quality reviewer.
No breach log, so nobody can show how a breach was evaluated and reported.
Restricted entity list updated once a year.
Service providers with access to client data but no confidentiality terms.

Worked example

Morrow Bay CPAs: a breach and the firm’s response

In March 2026, a senior associate at Morrow Bay CPAs discloses that she has held 200 shares of an audit client's parent company since January 2026. She worked 30 hours on the client's 2025 audit in February 2026. The audit report was dated March 2, 2026.

The firm's breach procedures (QM 10.35a(ii)) run as follows:

Identify and communicate: the associate reports to the independence partner, who logs the breach on the day of disclosure.
Evaluate: the parent controls the client and the client is material to the parent, so the parent is an affiliate under the Code, and a direct financial interest in it held by a member of the attest engagement team is a breach of the independence rules. The partner evaluates its significance: the senior's role (fieldwork on receivables, reviewed by a manager), the size of the holding and the timing.
Address consequences: the associate sells the shares within a week. The engagement partner re-reviews the receivables work she performed, with a manager who had no involvement, and documents that the work and conclusions stand.
Report: the firm applies the Code's breach provisions, including whether and how to communicate the breach and the actions taken to those charged with governance of the client, and documents the result.
Respond to causes: the root cause is that the restricted entity list showed the client but not its parent. The firm updates its list to include parents and affiliates and adds a pre-assignment check.

The breach, evaluation and corrective action are inputs to the firm's monitoring and remediation process.

Self-check

Answer each question before you open the answer.

What does “relevant ethical requirements” include under SQMS No. 1?
Show answer
The AICPA Code of Professional Conduct together with rules of applicable state boards of accountancy and applicable regulatory agencies that are more restrictive (QM 10.17).
How often must the firm obtain documented independence confirmations, and from whom?
Show answer
At least annually, from all personnel required by relevant ethical requirements to be independent (QM 10.35b).
Does the ethics component reach service providers?
Show answer
Yes. QM 10.30b sets an objective that others subject to the firm’s relevant ethical requirements, including service providers, understand and fulfill their responsibilities under them.

Sources

Back to the syllabus

Standards are paraphrased from the primary sources listed above; read the source before relying on a requirement. This lesson is training material, not professional advice. Report an error