Firm ethics policies stricter than the Code
Why breaching a firm's own ethics policy is a quality management failure under ISQM 1 even when the IESBA Code allows the act, and what to do next.
By Achekam · · 4 min read · For Accountants & audit firms in South Africa, Nigeria, Kenya
A senior manager accepts a bottle of whisky from an audit client at year end. Under the ethics code that applies to the firm, a gift of that kind may well be acceptable if it is trivial and inconsequential. Under the firm's own policy, which prohibits accepting any gift from an audit client, it is not. Is that a problem worth recording, or just a technicality?
Under ISQM 1, it is a problem worth recording. The firm chose a stricter rule, so the firm's system of quality management has to make that rule work. When it does not, the system has failed, whatever the Code says about the gift itself.
What ACCA says about firm policies
ACCA's article on ISQM 1 explains that a firm's own ethical policies that go beyond the IESBA Code and local regulation must be captured by its system of quality management. Failing to follow those policies is therefore a failure of the system, even if it is not a breach of the Code. ACCA gives the example of firms or jurisdictions that prohibit accepting gifts, even of trivial value.
ACCA also lists "relevant ethical requirements" as one of the eight components a system of quality management must address, alongside the firm's risk assessment process, governance and leadership, acceptance and continuance, engagement performance, resources, information and communication, and monitoring and remediation. A firm's own stricter rules sit inside that component.
Where the Code ends and the firm begins
The IESBA Code's five fundamental principles are integrity, objectivity, professional competence and due care, confidentiality, and professional behaviour. The IESBA explains on its Code of Ethics page that the Code may be adopted through legislation or regulation, issued or converged with by national standard setters, or implemented by professional bodies as local standards based on or aligned with it, and that the degree and type of enforcement depend on each jurisdiction's legal and regulatory framework.
So a firm in South Africa, Nigeria or Kenya works within the Code as adopted by its own regulator or professional body. Above that floor, the firm may set its own rules, for good reasons: to protect its reputation, to keep things simple for staff, or to meet a client's or network's expectations.
Common stricter policies
Typical examples of policies that go further than the Code:
- Gifts and hospitality. No gifts from audit clients at all, or a low limit with every gift declared.
- Financial interests. Staff may not hold shares in any client of the firm, not only those they work on.
- Relationships. Close family relationships with any client's senior management must be declared, whatever the staff member's role.
- Outside work. Directorships, trusteeships and paid work outside the firm need prior approval.
- Social media. No public comment about clients or engagements, even in general terms.
Each policy creates an obligation the system must support: staff must know it, declare against it, and someone must check.
Recording interests and gifts against clients
Achekam lets staff record annual independence declarations and any interest, relationship or gift involving a client, and anyone can check whether a person has an active independence exception for a client. For a firm with a stricter gifts or investments policy, that is where declarations belong: against the client, with the person's name and the date.
Two limits to plan for. Achekam has no way to approve an independence declaration, and assigning a person to an engagement does not check the independence register. If the firm's policy requires approval, say for an outside directorship, the approval happens outside Achekam and should be recorded with the declaration. And before staff are assigned to a client, someone should check the register for that client.
Logging a breach as a quality incident
When a policy is breached, treat it as the system failure ISQM 1 says it is. The firm's quality registers in Achekam, which include professional judgements, quality incidents, complaints and inspection progress, are kept on the server with every version and who changed it. A breach of the firm's own ethics policy belongs in the incidents register, with:
- what happened, when, and who was involved;
- which policy was breached, and whether the Code was also breached;
- the immediate action taken, such as returning the gift or removing the person from the engagement;
- the assessment of the effect on the engagement and the client.
Recording a breach that the Code would have allowed may feel excessive. It is not. A pattern of small breaches is exactly the information the firm's monitoring needs.
Root cause and remediation
Under ISQM 1's monitoring and remediation component, the firm looks beyond the individual breach to why it happened. Common root causes for ethics-policy breaches:
- Staff did not know the policy existed, or misunderstood it.
- The policy was known but impractical, for example a gift that could not be refused without offence.
- Nobody checked declarations against assignments.
- Senior people modelled a looser standard.
Each cause points to a different fix: training, a clearer policy, a process step or a conversation at partner level. Root cause analysis covers the method in more depth.
Keeping the policy short and known
A stricter policy only works if people remember it. Keep it to a page, use examples rather than abstractions, repeat it at the start of each busy season, and ask for an annual confirmation alongside the independence declaration. If the firm finds itself recording the same breach repeatedly, consider whether the policy itself needs to change rather than simply reminding people again.
For the declaration process that underpins all of this, see independence declarations today. At the next partners' meeting, read the firm's gifts policy aloud and ask whether everyone in the room has followed it this year.
General guidance only, not advice on your own circumstances. Tax and payroll rules change: check the current position with the authority or your adviser.
