Professional, Legal and Ethical Framework

Introduction and context

Auditing is a public-interest activity. An auditor does not merely check arithmetic or reproduce management’s records; the auditor provides an independent conclusion about whether financial statements are prepared, in all material respects, in accordance with an applicable financial reporting framework. That conclusion supports decisions by shareholders, lenders, regulators, employees and other users who may not have direct access to the entity’s internal information.

Because users rely on the auditor’s opinion, auditing is governed by three connected forms of authority:

1. Professional standards, especially the International Standards on Auditing (ISAs), which explain how an audit should be planned, performed, documented and reported.
2. Legal and jurisdictional requirements, including company law, securities regulation, professional licensing rules, corporate governance requirements and anti-money-laundering legislation.
3. Ethical requirements, principally the International Code of Ethics for Professional Accountants issued by the International Ethics Standards Board for Accountants (IESBA).

These sources do different jobs. An ISA establishes an auditing requirement or principle. Law determines what is legally required in a particular country. The ethical Code governs professional conduct and may impose requirements more demanding than the law. Where requirements conflict, the auditor must identify the applicable authority, comply with the more stringent requirement where appropriate, and obtain professional or legal advice when necessary.

Learning objectives

After studying this chapter, you should be able to:

• explain the relationship between ISAs, jurisdictional requirements and ethical rules;
• describe the fundamental principles of professional ethics;
• distinguish independence of mind from independence in appearance;
• identify threats to compliance with ethical requirements;
• evaluate safeguards and decide whether an audit engagement should be accepted or continued;
• apply professional judgment to an independence problem;
• explain the responsibilities of auditors, management and those charged with governance; and
• recognize the effects of technology, confidentiality obligations and public-interest responsibilities.

1. The architecture of the auditing profession

1.1 International Standards on Auditing

The ISAs are issued by the International Auditing and Assurance Standards Board (IAASB). They are principle-based standards designed to be applied across different legal systems and industries. They do not replace professional judgment. Instead, they establish objectives, requirements and application material that guide judgment.

Commonly encountered ISAs include:

An auditor should read a standard as a complete unit. Requirements are often linked: risk assessment under ISA 315 affects the response under ISA 330, which in turn affects evidence under ISA 500 and reporting under ISA 700.

1.2 Reasonable assurance

An audit provides reasonable assurance, not absolute assurance. Reasonable assurance is a high, but not absolute, level of assurance. It is limited by the use of sampling, the nature of evidence, management judgment, the possibility of collusion and the inherent limitations of internal control.

The auditor’s objective is to reduce audit risk to an acceptably low level. Audit risk is commonly expressed conceptually as:

Risk of material misstatement comprises inherent risk and control risk. This relationship is a planning model rather than a mechanically precise calculation. Inherent risk concerns the susceptibility of an assertion to misstatement before considering controls. Control risk concerns the possibility that a misstatement will not be prevented, detected or corrected by internal control. Detection risk concerns the possibility that audit procedures will fail to detect a material misstatement.

The model assists audit planning: when assessed risks of material misstatement are high, the auditor generally designs more persuasive procedures and seeks to reduce detection risk. The model does not permit the auditor to compensate for weak independence, inadequate competence or insufficient evidence by simply doing more testing.

1.3 Jurisdictional requirements

International standards may be adopted directly, modified by a national standard setter, or supplemented by local requirements. Jurisdictional matters may include:

• who is legally permitted to sign an audit report;
• mandatory auditor rotation or tendering;
• prohibited non-audit services;
• reporting to regulators or law-enforcement agencies;
• statutory filing deadlines;
• requirements for public-interest entities;
• data protection and records-retention rules; and
• criminal, civil or professional liability.

An auditor must establish the reporting framework and legal framework applicable to the engagement before accepting it. For example, an audit performed under ISAs may still require a separate report to a securities regulator or a modification to the audit report prescribed by company legislation.

2. Responsibilities and the public-interest role

Management is responsible for preparing the financial statements, selecting and applying appropriate accounting policies, maintaining relevant internal control and providing the auditor with access to records and personnel. Those charged with governance oversee the financial reporting process and, in many entities, appoint or recommend the auditor.

The auditor is responsible for obtaining sufficient appropriate audit evidence and expressing an opinion. The auditor does not guarantee that the financial statements are perfectly accurate, nor does the audit transfer management’s responsibilities to the auditor.

This distinction is essential. If management asks the auditor to design accounting entries, approve transactions or make decisions on behalf of the entity, the auditor may assume a management responsibility and threaten independence. The auditor may explain accounting requirements or evaluate proposed treatments, but management must make the decision and accept responsibility.

The public-interest role also explains why an auditor’s duties extend beyond the paying client. Confidentiality is important, but it is not unlimited. Law, regulation, court orders, professional obligations and public-interest considerations may require disclosure.

3. The IESBA fundamental principles

The IESBA Code identifies five fundamental principles. They apply to all professional accountants, although specific independence requirements apply to assurance engagements.

3.1 Integrity

Integrity requires an accountant to be straightforward and honest in professional and business relationships. An accountant must not knowingly be associated with information that is materially false or misleading, is prepared recklessly, or omits or obscures information where omission would be misleading.

Integrity is tested when a client pressures the auditor to accept an aggressive accounting treatment, conceal a related-party transaction or delay recognition of a loss. The appropriate response is not merely to record the disagreement in working papers; the auditor should discuss the matter with management and governance, evaluate materiality and reporting consequences, and consider withdrawal or legal advice where necessary.

3.2 Objectivity

Objectivity requires that professional or business judgment is not compromised by bias, conflict of interest or undue influence. Objectivity differs from independence, but independence supports objectivity in audit engagements.

Examples of threats include a close personal relationship with a finance director, a financial interest in the client, or pressure from a powerful executive. An auditor may believe that personal judgment is unaffected, yet the relationship may reasonably appear to influence the auditor. Ethical evaluation therefore considers both actual influence and the perception of influence.

3.3 Professional competence and due care

Professional competence requires maintaining knowledge and skill at the level needed to provide competent service. Due care requires acting diligently, thoroughly and in accordance with applicable technical and professional standards.

Competence includes knowledge of accounting, auditing, ethics, industry conditions, information systems and relevant law. It also includes recognizing limitations. An audit team lacking valuation expertise may need an appropriately qualified auditor’s expert. Using a software tool without understanding its assumptions is not evidence of competence.

Continuing professional development is therefore a professional obligation, not merely a career advantage. Poor supervision, inadequate review and unrealistic deadlines can produce due-care failures even where the auditor has technical knowledge.

3.4 Confidentiality

Confidentiality requires protecting information acquired through professional relationships. An accountant must not disclose such information outside the firm or use it for personal advantage unless authorized or legally or professionally required.

Confidentiality continues after the engagement ends and after employment with a firm ends. It includes printed files, emails, cloud systems, audit software, conversations and information inferred from client data. Disclosure may be permitted or required for quality reviews, professional consultations, legal proceedings, regulatory inspections, suspected illegal acts or other circumstances recognized by law and the Code.

Confidentiality does not justify ignoring a legal reporting obligation. Conversely, a general belief that information might be useful to another party does not authorize disclosure. The auditor should verify the legal basis, disclose only necessary information and document the decision.

3.5 Professional behaviour

Professional behaviour requires compliance with relevant laws and regulations and avoidance of conduct that discredits the profession. Misleading advertising, improper inducements, abusive treatment of staff, deliberate obstruction of regulators or reckless public statements may breach this principle even if they do not directly affect an audit opinion.

Professional behaviour also includes maintaining a questioning mind, communicating respectfully and preserving the reputation of the profession. Social-media activity can create professional consequences when it reveals confidential information or undermines confidence in the auditor’s impartiality.

4. Independence: a central assurance requirement

Independence has two dimensions:

• Independence of mind: the state that permits an auditor to express a conclusion without being affected by influences that compromise professional judgment, allowing the auditor to act with integrity, objectivity and professional skepticism.
• Independence in appearance: avoiding circumstances that would cause a reasonable and informed third party, having knowledge of relevant facts, to conclude that integrity, objectivity or professional skepticism has been compromised.

Both dimensions matter. An auditor might genuinely remain unbiased while holding shares in a client, but users could reasonably doubt the auditor’s impartiality. That appearance can damage confidence in the report.

4.1 The conceptual framework for threats

The IESBA conceptual framework requires the auditor to identify, evaluate and address threats to compliance with the fundamental principles. The main threat categories are shown below.

The evaluation asks whether the threat is at an acceptable level. An acceptable level is one at which a reasonable and informed third party would likely conclude that the accountant complies with the fundamental principles. If the threat is not at an acceptable level, it must be eliminated, reduced through safeguards, or the engagement must be declined or terminated.

4.2 Safeguards

Safeguards may arise from the profession, legislation, governance arrangements or the firm’s systems. Examples include:

• removing the affected person from the engagement team;
• using an independent engagement-quality reviewer;
• obtaining a second professional opinion;
• separating advisory and audit personnel;
• rotating senior personnel where required;
• strengthening governance oversight;
• refusing gifts or hospitality;
• correcting or withdrawing a misleading communication; and
• ending a financial interest or relationship.

A safeguard must address the particular threat. A written policy alone does not cure a direct financial interest. Similarly, rotating a junior team member may not address a threat created by a partner’s close family relationship with a client executive.

4.3 Financial interests, loans and fees

Direct financial interests in an audit client generally create an unacceptable self-interest threat for covered persons. Indirect interests may also be problematic when they are material to the individual or firm. Loans, guarantees, unpaid fees and contingent fees require careful evaluation because they may create financial dependence or pressure.

Long-outstanding fees can resemble a loan to the client and may threaten independence. Before accepting or continuing an engagement, the firm should assess whether fees are commercially reasonable, whether any overdue balance is significant and whether governance has been informed.

4.4 Non-audit services

Non-audit services can create self-review, management participation or advocacy threats. Examples include bookkeeping, preparing accounting records, designing internal controls, valuation, tax services, legal services, recruitment and corporate finance assistance.

The acceptability of a service depends on the nature of the service, the client’s status, applicable law and whether management retains responsibility. Some services may be prohibited for public-interest entities even if safeguards appear possible. The auditor must consult current ethical and jurisdictional requirements rather than relying on a general assumption that a service is acceptable.

4.5 Gifts, hospitality and employment relationships

Gifts or hospitality may create self-interest, familiarity or intimidation threats. Their value, frequency, purpose and timing matter. A modest working meal may be acceptable in some circumstances, whereas expensive travel offered during a contentious audit issue is likely unacceptable.

Employment discussions with an audit client also create threats. A team member who is negotiating employment with the client should promptly notify the firm, be removed where required, and have relevant work independently reviewed.

5. Professional judgment, skepticism and documentation

Professional judgment is the application of relevant training, knowledge and experience within the context of auditing, accounting and ethical standards. It is not personal preference. A judgment should be supported by facts, relevant standards, evidence and documented reasoning.

Professional skepticism is an attitude that includes a questioning mind and a critical assessment of audit evidence. It is especially important where evidence is contradictory, management estimates are subjective, transactions are unusual or fraud risk is elevated. Skepticism does not mean assuming that management is dishonest; it means neither accepting unsupported explanations nor treating management as inherently untrustworthy.

Documentation should allow an experienced auditor with no previous connection to the engagement to understand the procedures performed, evidence obtained, significant judgments and conclusions reached. Ethical consultations, independence evaluations and safeguards should be documented because an undocumented safeguard is difficult to demonstrate and review.

6. Applied case: Northstar Manufacturing Ltd.

The following is an illustrative case.

Background

Northstar Manufacturing Ltd. is audited by Meridian Assurance. The engagement partner has served for seven years. Northstar’s finance director is a former senior manager of Meridian and remains a close personal friend of the partner. Northstar has not paid a substantial portion of last year’s audit fee. During the current audit, management asks Meridian’s tax department to design a restructuring transaction and asks the audit team to record the resulting entries. Management also offers the partner hospitality at a major sporting event.

The audit team discovers that inventory includes obsolete components. Management refuses to write down the inventory, arguing that a new customer may eventually purchase it. The unadjusted amount is material in relation to profit.

Problem

Several threats exist simultaneously:

• the friendship creates a familiarity threat;
• the former-firm relationship may create an additional familiarity threat;
• overdue fees create a self-interest threat and may resemble a loan;
• the restructuring advice may create self-review and management-participation threats;
• hospitality may create self-interest or familiarity threats; and
• pressure to retain an unsupported inventory valuation creates intimidation and integrity risks.

Analysis and approach

The engagement partner should not treat the threats in isolation. The firm should apply the current IESBA requirements and local law, identify whether Northstar is a public-interest entity, and consult the firm’s ethics and independence function.

Possible actions include:

1. removing the engagement partner or replacing the affected team member;
2. obtaining an independent engagement-quality review;
3. refusing to make management decisions or prepare entries on management’s behalf;
4. separating and independently reviewing any permitted tax work;
5. addressing overdue fees before continuing, or declining continuation;
6. refusing or returning inappropriate hospitality;
7. communicating the independence issues to those charged with governance; and
8. requiring management to evaluate the inventory and record an adjustment if appropriate.

The auditor should obtain evidence about subsequent sales, demand, condition, expected selling prices and costs of completion. Management’s optimism is not sufficient evidence. If the inventory remains materially misstated and management refuses adjustment, the auditor must consider the effect on the audit opinion under the applicable reporting standard.

Outcome

Suppose the firm determines that the combined threats cannot be reduced to an acceptable level because of the partner’s close relationship and the overdue fees. Meridian should decline or withdraw from the engagement, subject to legal and regulatory requirements. If, alternatively, the partner is replaced, fees are settled, prohibited services are refused, an independent review is completed and the remaining threats are acceptable, the audit may continue. The inventory disagreement must still be resolved through evidence and appropriate reporting.

Learning points

The case demonstrates that independence is not a form completed once a year. It is an ongoing evaluation. A safeguard must be proportionate to the threat, and commercial pressure cannot override ethical or reporting responsibilities.

7. Technology, data and contemporary practice

Audits increasingly use data analytics, automated controls testing, cloud platforms and artificial intelligence. These tools can improve coverage and identify unusual transactions, but they do not eliminate professional judgment. The auditor must understand data completeness, accuracy, relevance, access rights, model assumptions and the risk of biased or opaque outputs.

Confidential client data should not be entered into an external generative-AI system unless authorization, security, contractual and legal requirements have been evaluated. AI-generated explanations are not audit evidence merely because they are plausible. The auditor remains responsible for conclusions, documentation, confidentiality and compliance with applicable standards.

Remote work also increases risks involving access controls, unauthorized copying, insecure communication and inadequate supervision. Firms should use secure systems, maintain audit trails, restrict access according to role and ensure that review evidence is retained.

8. Limitations, governance and best practices

No ethical framework can anticipate every fact pattern. Rules may be unclear, jurisdictions may differ, and threats may interact. A technically compliant decision can still undermine public confidence if it ignores the reasonable perception of users.

Strong practice includes:

• performing independence checks before acceptance and throughout the engagement;
• identifying the reporting, legal and ethical frameworks early;
• consulting specialists when law, valuation, tax or technology issues are complex;
• communicating significant matters to those charged with governance;
• documenting facts, threats, safeguards and conclusions;
• maintaining professional skepticism under deadline pressure;
• refusing management responsibilities; and
• escalating unresolved disagreements rather than suppressing them.

Ultimately, professional judgment is constrained by standards, evidence, ethics and the public interest. The auditor’s license to operate depends not only on technical skill but also on trust.

Chapter Summary

Auditing operates within an integrated professional, legal and ethical framework. ISAs establish internationally recognized principles for planning, performing, documenting and reporting audits, while national law determines statutory authority, reporting duties and additional restrictions. Reasonable assurance is high but not absolute, and audit risk is managed through professional judgment rather than mechanical calculation.

The IESBA fundamental principles are integrity, objectivity, professional competence and due care, confidentiality, and professional behaviour. Independence requires both independence of mind and independence in appearance. Threats are commonly classified as self-interest, self-review, advocacy, familiarity and intimidation. They must be eliminated, reduced by effective safeguards, or lead to refusal or withdrawal from the engagement.

Management remains responsible for the financial statements and decisions. Auditors must obtain sufficient appropriate evidence, maintain skepticism, protect confidential information and communicate significant matters. Technology creates opportunities for better analysis but also introduces risks involving data quality, privacy, cybersecurity and overreliance on automated outputs. Ethical compliance is a continuing process supported by consultation, documentation, governance and willingness to place the public interest above commercial pressure.

Key Terms

Applicable financial reporting framework: The accounting framework used to prepare the financial statements.

Audit risk: The risk that the auditor expresses an inappropriate opinion when the financial statements are materially misstated.

Confidentiality: The duty to protect information obtained through professional relationships.

Control risk: The risk that internal control fails to prevent, detect or correct a material misstatement.

Due care: Diligent and thorough performance in accordance with professional standards.

Ethical safeguard: An action or arrangement that eliminates or reduces an ethical threat.

Familiarity threat: A threat arising from a close or lengthy relationship that causes excessive sympathy or trust.

Fundamental principles: The five IESBA principles governing professional conduct.

Independence in appearance: The avoidance of circumstances that would cause an informed third party to doubt the auditor’s impartiality.

Independence of mind: The ability to make an unbiased professional judgment.

Integrity: Being straightforward and honest in professional relationships.

International Standards on Auditing (ISAs): Standards issued by the IAASB for audits of historical financial information.

Intimidation threat: A threat arising from actual or perceived pressure.

Material misstatement: A misstatement capable of influencing users’ decisions.

Objectivity: Freedom from bias, conflicts of interest and undue influence.

Professional competence: Maintaining the knowledge and skill necessary to provide competent service.

Professional skepticism: A questioning mind and critical assessment of audit evidence.

Reasonable assurance: A high, but not absolute, level of assurance.

Self-review threat: A threat arising when an auditor evaluates work previously performed by the auditor or the firm.

Those charged with governance: The persons responsible for overseeing an entity’s strategic direction and financial reporting responsibilities.

Review Questions

Short Answer Questions

1. What is the relationship between ISAs and jurisdictional legal requirements?
2. List the five fundamental principles in the IESBA Code.
3. Distinguish independence of mind from independence in appearance.
4. What is a self-review threat? Give one example.
5. Why does an audit provide reasonable rather than absolute assurance?

Long Answer Questions

1. Explain the responsibilities of management, those charged with governance and the independent auditor.
2. Describe the five categories of threats to compliance with ethical principles and provide an example of each.
3. Discuss how an auditor should evaluate and address a close personal relationship with a client executive.
4. Explain the importance of confidentiality and identify circumstances in which disclosure may be permitted or required.
5. Evaluate the role of professional skepticism and documentation in supporting audit quality.

Analytical / Application Questions

1. An audit senior owns shares in an audit client through a family investment account. Identify the threat, assess whether safeguards are likely to be sufficient, and recommend an action.
2. A client asks its auditor to design an internal control system and then audit that system. Analyze the ethical threats and explain what facts would affect the decision.
3. During an audit, management refuses to correct a material inventory misstatement and threatens to replace the auditor. Explain the auditor’s ethical, professional and reporting responses.

Multiple Choice Questions with Answers

Question 1

Which body issues the International Standards on Auditing?

A. International Auditing and Assurance Standards Board

B. International Ethics Standards Board for Accountants

C. International Accounting Standards Board

D. Financial Stability Board

Correct Answer: A. International Auditing and Assurance Standards Board

Question 2

Which fundamental principle requires freedom from bias, conflicts of interest and undue influence?

A. Integrity

B. Objectivity

C. Confidentiality

D. Professional behaviour

Correct Answer: B. Objectivity

Question 3

An auditor evaluates a valuation model previously prepared by the auditor’s own consulting team. What threat is most directly involved?

A. Advocacy threat

B. Intimidation threat

C. Self-review threat

D. Familiarity threat

Correct Answer: C. Self-review threat

Question 4

What does independence in appearance primarily address?

A. Whether the auditor has completed continuing education

B. Whether the auditor’s files are stored securely

C. Whether the auditor has detected every error

D. Whether an informed third party would perceive impartiality as compromised

Correct Answer: D. Whether an informed third party would perceive impartiality as compromised

Question 5

Which party is responsible for preparing the financial statements?

A. The external auditor

B. Management

C. The audit committee alone

D. The securities regulator

Correct Answer: B. Management

Question 6

A threat caused by pressure from a client to accept an unsupported accounting treatment is usually classified as what type?

A. Intimidation threat

B. Self-review threat

C. Advocacy threat

D. Familiarity threat

Correct Answer: A. Intimidation threat

Question 7

Which statement about reasonable assurance is correct?

A. It guarantees that no misstatement exists.

B. It is a low level of confidence based only on inquiry.

C. It is high assurance subject to the inherent limitations of an audit.

D. It applies only to internal audits.

Correct Answer: C. It is high assurance subject to the inherent limitations of an audit.

Question 8

Why can long-outstanding audit fees threaten independence?

A. They automatically improve audit quality.

B. They may create financial dependence and resemble a loan to the client.

C. They eliminate the need for audit evidence.

D. They are always prohibited by every jurisdiction.

Correct Answer: B. They may create financial dependence and resemble a loan to the client.

Question 9

Which action best addresses a team member negotiating employment with an audit client?

A. Increase the client’s audit fee

B. Ignore the matter unless employment is accepted

C. Remove or appropriately replace the person and review affected work

D. Allow the person to approve the financial statements

Correct Answer: C. Remove or appropriately replace the person and review affected work

Question 10

What is the auditor’s appropriate response when management refuses to correct a material misstatement?

A. Suppress the matter to preserve the client relationship

B. Consider the effect on the audit opinion and communicate with governance

C. Automatically issue an unmodified opinion

D. Transfer management’s responsibility to the audit team

Correct Answer: B. Consider the effect on the audit opinion and communicate with governance