Professional ethics, independence and quality management

An audit is only worth what its independence is worth. If users believe the auditor is too close to management, too dependent on the client's fees, or too eager to sell other services, the opinion loses its value even if the work was technically sound. That is why every auditing framework begins with ethics. This lesson covers the fundamental principles that apply to all professional accountants, the conceptual framework for identifying and responding to threats, the specific independence rules for audit clients, and the firm-level systems of quality management that are meant to make good audits the norm rather than the exception. ACCT-211 and ACCT-212 dealt with professional judgment in applying accounting standards; here the question is whether the person exercising judgment can be trusted to do so objectively.

The fundamental principles

Canadian CPAs are bound by the code of professional conduct of their provincial body; the provincial codes are largely harmonized with one another and closely aligned with the International Ethics Standards Board for Accountants (IESBA) Code. All of them rest on five fundamental principles.

• Integrity: being straightforward and honest in all professional and business relationships.
• Objectivity: not allowing bias, conflict of interest or undue influence to override professional judgment.
• Professional competence and due care: maintaining the knowledge and skill needed for competent service and acting diligently under applicable standards.
• Confidentiality: respecting the confidentiality of information acquired through professional relationships and not using it for personal advantage.
• Professional behaviour: complying with laws and regulations and avoiding conduct that discredits the profession.

Confidentiality has well-known exceptions. A professional accountant may, and sometimes must, disclose confidential information when required by law (for example, under a court order), when permitted by the client, or to respond to a practice inspection or disciplinary investigation. The IESBA Code's provisions on responding to non-compliance with laws and regulations (NOCLAR) go further: when an auditor becomes aware of an illegal act, the auditor must discuss it with management and those charged with governance, and in some cases consider disclosure to an appropriate authority even without client consent.

In Canada, the provincial codes include NOCLAR-type provisions, and securities law adds whistleblower protections at the Ontario Securities Commission.

The conceptual framework: threats and safeguards

No rulebook can list every situation an auditor might face, so the codes use a conceptual framework. The accountant identifies threats to compliance with the fundamental principles, evaluates whether each threat is at an acceptable level, and addresses any threat that is not, by eliminating the circumstance, applying safeguards or declining the engagement. A reasonable and informed third party test applies: would a well-informed outsider, weighing all the facts, conclude that the accountant's objectivity is not compromised?

Safeguards are actions that reduce a threat to an acceptable level. Examples include assigning a partner who was not involved in a non-audit service to review that work, rotating senior staff, having an engagement quality reviewer examine significant judgments, and disclosing fees to the audit committee. Some threats are so significant that no safeguard is enough. Those are where the codes stop relying on judgment and impose outright prohibitions.

Independence of mind and in appearance

Independence has two parts. Independence of mind is the state of mind that lets the auditor form an opinion without being affected by influences that compromise judgment. Independence in appearance means avoiding facts and circumstances so significant that a reasonable and informed third party would conclude that the firm's integrity, objectivity or scepticism had been compromised. Both matter: an auditor who is privately objective but appears conflicted still undermines the value of the opinion.

Independence rules apply to the firm, to members of the engagement team and, for some interests, to close family members and other partners in the office. The main areas are financial interests, loans, business relationships, employment relationships, long association, fees and the provision of non-audit services.

• Financial interests: no member of the engagement team, and no partner in the office where the engagement partner practises, may hold a direct financial interest in an audit client, however small. Material indirect interests are also prohibited.
• Employment: a former engagement team member who joins the client in a key financial reporting role creates a threat; for listed clients there are cooling-off periods before senior audit staff can take such a role.
• Loans and business relationships: loans from the client are prohibited except ordinary loans on normal terms from a lending institution client; joint ventures with the client are prohibited.
• Fees: contingent fees for audits are prohibited, and fee dependence on a single client, overdue fees and fee pressure all create threats.
• Long association: on listed entities, IESBA-based codes limit the engagement partner to seven years, followed by a five-year cooling-off period; the engagement quality reviewer has a three-year cooling-off period (as of October 2026, confirm the current provincial rules).

# Engagement partner rotation for a listed audit client (simplified rules)
def check(history, time_on, cooling):
    # history: years as engagement partner, in order; returns the first year the partner must step off
    run = 0
    for year in history:
        run += 1
        if run > time_on:
            return year
    return None
rules = {"Canada (IESBA-based codes)": (7, 5), "United States (SEC rules)": (5, 5)}
partner_years = list(range(2020, 2028))      # Dana Okafor has led the audit since 2020
for place, (on, off) in rules.items():
    stop = check(partner_years, on, off)
    msg = f"cannot lead the {stop} audit; may return for the {stop + off} audit" if stop else "no rotation needed yet"
    print(f"{place:<28} {on} years on, {off} off: {msg}")

Canada (IESBA-based codes)   7 years on, 5 off: cannot lead the 2027 audit; may return for the 2032 audit
United States (SEC rules)    5 years on, 5 off: cannot lead the 2025 audit; may return for the 2030 audit

Non-audit services

Firms that audit public companies once earned more from consulting than from auditing, and the collapse of Enron in 2001, where Arthur Andersen earned large fees for both, led to strict limits. Today, for listed or public interest entity clients, the codes prohibit services that would create a self-review threat because the firm would audit its own work, or an advocacy or management-responsibility threat because the firm would act as management.

For public companies, the audit committee must pre-approve every service the auditor provides, audit and non-audit, and the company discloses the fees it paid in its annual proxy materials. These requirements make non-audit fees visible to shareholders. The program below summarizes Bramble Shaw's fees from Fairhaven for the year.

# Fee dependence and non-audit services at Bramble Shaw (illustrative, thousands of dollars)
firm_revenue = 48_000                       # the office's total annual fees
fees = {"audit": 385, "tax compliance": 60, "IT system advice": 240, "valuation for an acquisition": 180}
total = sum(fees.values())
non_audit = total - fees["audit"]
print(f"Total fees from Fairhaven: {total:,}")
print(f"Share of office revenue: {total / firm_revenue:.1%}")
print(f"Non-audit fees as a share of audit fee: {non_audit / fees['audit']:.0%}")
for service, fee in fees.items():
    flag = "review for threats" if service != "audit" else ""
    print(f"  {service:<30}{fee:>6}  {flag}")
limit = 0.15                                 # an illustrative fee-dependence threshold
print("Fee dependence above threshold" if total / firm_revenue > limit else "Fee dependence below threshold")

Total fees from Fairhaven: 865
Share of office revenue: 1.8%
Non-audit fees as a share of audit fee: 125%
  audit                            385  
  tax compliance                    60  review for threats
  IT system advice                 240  review for threats
  valuation for an acquisition     180  review for threats
Fee dependence below threshold

Two of the proposed services need attention. Advice on the design of the IT system that produces the financial statements would create a self-review threat and, for a listed client, is prohibited. A valuation used in the purchase price allocation for an acquisition is also likely prohibited because it would feed directly into the statements and is subjective. Tax compliance is normally permissible with audit committee approval. Fee dependence on Fairhaven is low, at under 2 per cent of the office's revenue.

Professional scepticism

Independence makes objective judgment possible; professional scepticism is the habit of using it. Scepticism is an attitude that includes a questioning mind, alertness to conditions that may indicate misstatement due to error or fraud, and a critical assessment of evidence. It does not mean assuming management is dishonest. It means not accepting less than persuasive evidence because the auditor believes management is honest. Regulators repeatedly cite a lack of scepticism as a root cause of inspection findings, especially in the audit of accounting estimates, where management's assumptions are easy to accept and hard to challenge.

Scepticism is threatened by biases that everyone shares. Anchoring is the tendency to stick too closely to an initial figure, such as management's estimate. Confirmation bias is the tendency to look for evidence that supports a conclusion already reached. Automation bias is the tendency to trust output from a system or tool, including generative AI tools, without enough scrutiny. Good audit practice counters these by asking explicitly what evidence would contradict management's position and by seeking it.

Quality management at the firm

Since December 15, 2022, Canadian firms that perform audits and reviews have been required to design, implement and operate a system of quality management under Canadian Standard on Quality Management 1 (CSQM 1), the Canadian version of ISQM 1. CSQM 2 deals with engagement quality reviews, and CAS 220 (Revised) deals with quality management at the level of each audit. The approach is risk-based: the firm sets quality objectives, identifies risks to achieving them, and designs responses, rather than following a fixed checklist.

The engagement quality review is a key response for higher-risk audits, including all audits of listed entities. An experienced partner who is not part of the engagement team evaluates the significant judgments the team made and the conclusions it reached before the report is released. The reviewer does not redo the audit, but can refuse to concur, in which case the report cannot be issued until the matter is resolved.

CPAB's recent reports credit CSQM 1 with part of the improvement in inspection results, while noting that firms' root cause analysis and monitoring still vary widely in quality (as of October 2026).

Audit committees and governance

The audit committee of the board is the auditor's main point of contact for governance matters. It recommends the appointment of the auditor, pre-approves services, oversees the auditor's work and receives the auditor's communications about significant findings. Its members must be independent directors and financially literate.

In Canada, National Instrument 52-110 Audit Committees sets these requirements for reporting issuers. CAS 260 sets out what the auditor must communicate to those charged with governance, including independence matters, significant risks, significant difficulties and uncorrected misstatements.