Ethical threats, safeguards and the third-party test
How to identify, evaluate and address threats under the IESBA Code's conceptual framework, with practice examples and where to record the evaluation.
By Achekam · · 4 min read · For Accountants & audit firms in South Africa, Nigeria, Kenya
Most ethical problems in a practice do not arrive labelled as ethical problems. They arrive as ordinary requests: the audit client who would also like the firm to keep its books, the manager who has looked after the same family business for as long as anyone can remember, the client who mentions over coffee that another firm quoted less.
The IESBA Code's conceptual framework exists for exactly these situations. It does not try to list every forbidden arrangement. It asks the accountant to identify threats, evaluate them and deal with them, and it gives a test for the evaluation.
Five kinds of threat
Under the IESBA Code's conceptual framework, threats to compliance with the fundamental principles fall into five categories: self-interest, self-review, advocacy, familiarity and intimidation. In a small practice they tend to look like this:
| Threat | How it shows up in a small firm |
|---|---|
| Self-interest | A large share of fee income from one client; a staff member holding shares in a client |
| Self-review | Auditing figures the firm itself prepared, valued or computed |
| Advocacy | Arguing a client's side in a dispute while also reporting on its statements |
| Familiarity | The same partner on the same client for many years; a family tie to the client's finance head |
| Intimidation | A client threatening to move firms unless an adjustment is dropped |
The IESBA describes a self-review threat as one that occurs when a professional evaluates or relies on work previously performed by themselves or their firm. That reaches further than many firms assume. A tax computation the firm prepared and later relies on during the audit sits squarely inside it.
The reasonable and informed third-party test
Spotting a threat is only the start. Under the IESBA Code, accountants evaluate threats using the reasonable and informed third-party test: would a knowledgeable and objective third party be likely to conclude that compliance with the fundamental principles, and independence where relevant, is maintained at an acceptable level?
The value of the test is that it moves the question out of the accountant's own head. "I know I'm objective" is not the standard. The question is how the arrangement would look to a well-informed outsider who knows all the facts, including the ones that do not flatter the firm.
Eliminate, safeguard or decline
Under the IESBA Code, if a threat is not at an acceptable level, the accountant must do one of three things:
- Eliminate the circumstance creating it: the staff member sells the shares, or the firm stops providing the conflicting service.
- Apply safeguards that bring the threat down to an acceptable level.
- Decline or end the activity or engagement where no appropriate safeguard can bring the threat down far enough.
The order matters in practice. Safeguards are not a way of keeping everything. Some threats cannot be reduced by any safeguard, and then only the first or third answer is available.
Safeguards such as an extra reviewer
The IESBA gives involving additional reviewers and restructuring responsibilities as examples of safeguards. Both translate directly into decisions a partner makes:
- an engagement quality reviewer, or a second partner's review, where self-review or familiarity is a concern;
- moving preparation work to a team separate from the audit team;
- rotating the manager or partner off a long-standing client.
Achekam supports the first of these directly. A partner can name an engagement quality reviewer for an engagement, who must be a partner or senior manager not on the engagement team, and that person must clear the audit report before it can be issued. For a South African firm Achekam does not require a reviewer for any engagement type; naming one is the firm's call.
Recording the evaluation in Achekam
An evaluation that lives only in someone's memory cannot be reviewed or inspected. Achekam gives the firm two places to write it down:
- Independence & Conflicts (Quality & Governance). Staff record annual independence declarations and any interest, relationship or gift involving a client, and anyone can check whether a person has an active independence exception for a client.
- Technical Consultations and Differences of Opinion. Staff can take a consultation on an engagement from question to conclusion and closure, and record a difference of opinion with each party's position, the escalation and the resolution.
A useful record names the threat, the facts, the third-party conclusion, the action taken and who approved it. Where the evaluation was finely balanced, a consultation entry captures the reasoning far better than a tick in a checklist.
Two worked examples in words
The bookkeeping and audit client. The firm writes up a client's ledger and is then asked to audit the statements. The threat is self-review. A reasonable third party would ask whether the audit team can test, with an open mind, entries the firm itself posted. The firm considers separating the teams and adding a reviewer, records its evaluation, and asks the prior question of whether the service is permitted at all for this kind of entity, which is covered in non-audit services for audit clients.
The partner's brother-in-law. A partner's brother-in-law becomes the client's financial director. The threat is familiarity. The response is to take that partner off the engagement and record the relationship in the independence register, where anyone assigning staff can see it.
The IESBA's page on its International Code of Ethics introduces the five fundamental principles and the conceptual framework for addressing threats. For the principles in daily work, see the five fundamental principles.
The framework works best as a habit rather than an event: name the threat when it first appears, apply the test, act, and write it down while the facts are fresh.
General guidance only, not advice on your own circumstances. Tax and payroll rules change: check the current position with the authority or your adviser.
