An audit is only worth reading if the reader believes the auditor is independent. Scandals such as Enron showed what happens when an audit firm is too close to its client, and the rules on ethics, non-audit services and rotation have been tightened ever since. This topic covers those rules, and how the profession itself is organised and held liable.
It covers whether ethics is better set by a framework or a rule book, auditor independence and the Sarbanes-Oxley reforms, the non-audit services that impair independence, fee dependence, the rotation of audit firms and partners under the Nigerian rules, the three tiers of the profession, and the problem of auditors’ liability. November 2025 Question 1(a) and (b) tested rotation and fee dependence for 13 of the 30 marks.
The earlier topics on independence and non-audit services give the detail of the threats and safeguards. The next topic covers transnational audits and small company audits.
In 30 seconds
There are two ways to regulate behaviour: a rule book (“you must not do that”) and a framework of principles (“you should understand why it is not acceptable”). A framework is more flexible because no set of rules can cover every case.
After Enron and WorldCom, the United States (US) Sarbanes-Oxley Act 2002 and Securities and Exchange Commission (SEC) rules of January 2003 tightened independence: limits on non-audit services, rotation of audit partners, a one-year cooling-off period before client managers who were on the audit team, audit committee approval of all services in advance, and disclosure of fees.
Nine non-audit services are treated as impairing independence: book-keeping, financial information systems design, valuation, actuarial services, internal audit outsourcing, management or human resources functions, broker or investment banking services, legal services and expert services unrelated to the audit.
For Nigerian public interest entities, the Code of Corporate Governance 2018 and the Audit Regulation 2020 limit an audit firm to ten continuous years with a seven-year gap before reappointment, 15 years in a joint audit, and five years for the engagement partner.
Under the International Ethics Standards Board for Accountants (IESBA) code, fees from one public interest entity client above 15% of a firm’s fee income for two consecutive years call for disclosure to those charged with governance and a review, and the Institute of Chartered Accountants of Nigeria (ICAN) code applies a 25% threshold.
The profession has three tiers, the Big Four, second-tier firms and small firms, and liability has led to insurance, limited liability companies and limited liability partnerships. Companies and Allied Matters Act 2020 (CAMA 2020) sections 401, 403, 404(7)(e), 406 and 408 govern who audits and who decides, and section 91 voids contract terms that exempt auditors from liability.
CAMA 2020: who audits, who decides, and liability
CAMA 2020 sets the legal floor under these ethics rules.
| Provision | What it says | Link to this topic |
|---|---|---|
| s. 401 | The shareholders appoint the auditor at each annual general meeting (AGM), and the auditor holds office until the next one. A retiring auditor is reappointed automatically unless an exception applies | The law allows renewal every year with no limit. That is why ICAN says firm rotation needs a legal change, and why the ten-year limit for public interest entities comes from the Audit Regulation 2020 and the Code |
| s. 403 | Officers, their partners and employees, bodies corporate, debtors over ₦500,000, shareholders and spouses, and recent accounts staff or consultants may not act | This is independence in law. The ethics rules cover threats that the Act does not list, such as long association and fee dependence |
| s. 404(7)(e) | The audit committee recommends to the board on the appointment, removal and remuneration of the external auditors | The committee is the body that should manage rotation, fees and non-audit work for a public company |
| s. 406 | It is an offence for an officer, director or insider to influence, coerce, manipulate or mislead the external auditor so as to make the statements misleading | Pressure on the audit team, as in the whistle-blowing facts of November 2025 Question 1, falls within this offence |
| s. 408(1)(b) | The auditors’ remuneration is fixed by the company in general meeting or as the meeting decides | Fees are set by the client, which is the root of the fee dependence threat |
| s. 91(1) | A provision in the articles or in a contract that exempts an officer or an auditor from liability for negligence, default or breach of trust, or indemnifies him against it, is void | This limits the liability caps and indemnities discussed under liability below. Check whether a fixed monetary cap is caught before relying on one |
| Part C (ss. 746 to 810 cover partnerships) | CAMA 2020 allows limited liability partnerships for the first time | Audit firms can now use an limited liability partnership (LLP) to limit partners’ personal liability |
Regulation: an ethical framework or a rule book?
Behaviour can be regulated in two ways. A rule book sets out what must and must not be done. A framework sets out principles with reasons, so that people understand why something is wrong. Either can be backed by sanctions. There are four reasons to prefer a framework for accountants and auditors:
- It is impossible to write rules for every situation.
- Rules are often read too narrowly, so they stop being useful unless there is a very detailed set of rules.
- A framework is more flexible. It sets out principles and requires accountants to apply them to the facts of each case.
- Accountants are professionals with a code of conduct, so they should not need detailed and strict rules to control their behaviour.
Auditor independence
Independence is fundamental to the credibility of an audit. Much current thinking was developed by the US Securities and Exchange Commission (SEC) after the corporate scandals of 2001 and 2002.
- Enron. False accounting and fraud led to bankruptcy in 2001. Enron was an energy company in Houston with over 20,000 employees. Its auditors, Arthur Andersen, gave it many consultancy services as well as audit, and were accused of not wanting to raise issues for fear of losing that work. The firm was later found to have shredded documents about the audit, lost its clients and broke up, with the loss of 85,000 jobs worldwide.
- WorldCom. A massive fraud found in 2002 also led to bankruptcy and the loss of thousands of jobs.
The US response was the Sarbanes-Oxley Act 2002, and in January 2003 the SEC adopted rules to put it into effect. They aim to strengthen auditor independence and require more disclosure to investors about services an independent accountant provides. The measures were:
- Revised rules on non-audit services, where independence would be impaired if the firm provided them to an audit client.
- Rotation of audit partners after no more than five or seven consecutive years, depending on involvement. Some small firms may be exempt.
- A firm is not independent if certain members of the client’s management were on the firm’s audit team in the year before the audit began.
- A firm is not independent if an audit partner has been paid, for the firm, for services to the client other than audit, review and attestation.
- The auditors must report certain matters to the client’s audit committee, including critical accounting policies.
- The audit committee must approve in advance all audit and non-audit services the auditor provides.
- Shareholders must be told about audit and non-audit services and the fees for them.
Non-audit services to audit clients
The Sarbanes-Oxley rules treat nine non-audit services as impairing independence when a firm provides them to an audit client.
| Service | Why it impairs independence, and the limits |
|---|---|
| Book-keeping and other services related to the accounting records or financial statements | The firm would be auditing its own book-keeping |
| Financial information systems design and implementation | Barred unless the results will not be audited. Work on hardware or software unrelated to the financial statements is allowed if the audit committee approves in advance |
| Appraisal or valuation services, fairness opinions and contribution-in-kind reports | Barred unless the results will not be audited |
| Actuarial services | Barred where the service involves a decision about amounts in the financial statements, for example pension valuations. The firm may help the client understand the methods, models, assumptions and inputs |
| Internal audit outsourcing | Barred where it covers internal accounting controls, financial systems or financial statements. Operational, value for money and compliance audits are allowed |
| Management functions or human resources | The firm may not act, even temporarily, as a director, officer or employee, or make decisions or supervise. It may not recruit or vet senior managers, negotiate for the client, run psychological tests or recommend a candidate |
| Broker, dealer, investment adviser or investment banking services | The firm would act as an advocate for the client |
| Legal services | Any service that only a person qualified to practise law could provide |
| Expert services unrelated to the audit | Opinions that advocate the client’s interests in litigation or in a regulatory or administrative proceeding |
Advantages and disadvantages of non-audit work for audit clients
Advantages. The firm already knows the client, its business and its systems, so it can give the extra service at lower cost and with less disruption than another firm. Non-audit work also makes the firm more attractive to trainees, because it offers wider experience.
Disadvantages. The firm may seem to lack independence because of the large fees it earns from audit and non-audit work together, as critics said of the Houston office of Andersen after Enron. The firm’s people may also end up making management decisions, which impairs independence.
Fee dependence
When the fees from one client are a large share of a firm’s total fee income, the firm faces a self-interest or intimidation threat. The size of the threat depends on the structure of the firm and whether it is established or still growing. The November 2025 solution gives these points:
- Under the IESBA Code of Ethics, for a public interest entity, when recurring fees from one client or a related group of clients are more than 15% of the audit practice’s total fee income for two consecutive years, the firm must disclose that fact to those charged with governance and have a review done, either by an external professional accountant or by a regulatory body.
- Disclosure is necessary but not sufficient. It only informs those charged with governance. It does not remove the financial incentive or the pressure on the audit team.
- If the fees are well above 15%, a pre-issuance review (a review by someone outside the audit team, typically another partner, before the report is issued) is likely to be needed, and not only a post-issuance review.
- The ICAN code of ethics applies a higher threshold of 25%.
Auditor rotation
Corporate collapses have led to a general view that, in many cases, the firm was too close to the client and missed the warning signs. That is what led to rules that force a change of statutory auditor after a time, to protect independence, objectivity, quality and transparency. Long association can create a familiarity threat, which can become an integrity issue. Rotation reduces complacency and protects the interests of shareholders.
The Nigerian rules
The Nigeria Code of Corporate Governance 2018 and the Audit Regulation 2020, issued by the Financial Reporting Council of Nigeria, apply to all public interest entities:
| Rule | Limit |
|---|---|
| Audit firm as statutory auditor | Ten continuous years, and no reappointment until seven years after disengagement |
| Joint audit | No firm on the audit for more than 15 years |
| Engagement partner | A maximum of five years before rotating out |
Two ways to rotate
- Audit partner rotation. The firm may remain as auditor for any number of years, but the lead engagement partner and other key team members rotate regularly. It has been adopted in most countries, but the public cannot see it.
- Audit firm rotation. The firm may remain no longer than a set number of years. It is visible to the public as a sign of independence. In many countries, including Nigeria, it needs a change in law, because auditors are appointed for one year and may be renewed without limit (section 401 of CAMA 2020).
Arguments for and against firm rotation
| For | Against |
|---|---|
| In a long relationship the auditors become too close to management, which weakens scepticism and independence, and they may compromise to keep the audit and the fees | The new auditor may take several years to learn the client, and there is some evidence of more audit failures in the first years after a change |
| Even if it does not protect independence, it improves the public perception and so confidence in audit quality | Changing auditors is costly for the firm and for the client, because management time is needed to teach the new auditor |
| Fresh firms bring new expertise, technology and data analytics to the financial reporting process, and investors see rotation as adding credibility | There is no evidence that compulsory firm rotation improves independence or audit quality. The Big Four dominate listed audits, so it may be hard to change, and other firms may be conflicted by non-audit work or lack resources |
The challenge of a new auditor on a complex audit is the delay in understanding the business and controls, which may cause transition stress for process owners and delay reporting, especially if the new firm is small.
The structure of the auditing profession
Three tiers
Because companies are increasingly global, the profession has three tiers: the “Big Four” (Deloitte, Ernst & Young, KPMG and PricewaterhouseCoopers), second-tier firms with several offices and international resources, and small firms. The Big Four grew through mergers and take-overs. They have the resources, expertise and reach to audit the largest global entities, but this leaves the biggest clients little choice and the firms little competition.
Incorporation and the problem of liability
Accountancy practices were first set up as sole practitioners or partnerships, where the owners have unlimited liability, including for negligent audit work. Their personal assets are at risk if the firm cannot pay. The idea was to promote public confidence and encourage care. As businesses and claims grew, two things followed.
Practising accountants were required to carry professional indemnity insurance, but premiums rose and became a heavy burden, especially for smaller firms. The profession then moved to remove unlimited liability, in four ways:
- Permit practices to trade as limited liability companies.
- Permit practices to trade as limited liability partnerships. This is allowed, for example, in the United Kingdom (UK) and in Nigeria.
- Set a maximum limit on the size of claims against an auditor by statute.
- Agree with the audit client a maximum limit on claims as a term of the audit contract.
Some commentators argue that an LLP could reduce the perceived integrity of the profession. The traditional partnership encourages high standards because partners risk their own assets if found acting dishonestly.
The rules in more depth
Rules, principles and the threats approach
The framework approach is why the ICAN and IESBA codes list threats (self-interest, self-review, advocacy, familiarity, intimidation) and ask the accountant to judge whether safeguards reduce them to an acceptable level. The Sarbanes-Oxley list of nine services is closer to a rule book. A strong answer uses both: the principle first, then the specific rule.
Why disclosure is not enough
Telling those charged with governance that fees are high informs them. It does not change the auditor’s incentive. That is why the IESBA code adds a review, and why a pre-issuance review is better when the dependence is severe, because it can stop a wrong opinion before it is issued.
Why firm rotation and partner rotation are different
Partner rotation changes the people but keeps the firm. It protects against familiarity at the individual level and costs less. Firm rotation changes everything, which can reduce familiarity but loses the audit knowledge built up. That trade-off is the core of the arguments for and against.
Why liability matters to independence
An auditor who could lose personal wealth for a mistake will take care, but a very large claim can wipe out an entire firm. That makes the firm less willing to take on risky clients and may reduce choice. Limiting liability keeps firms in business, but critics say it weakens the discipline that unlimited liability gave.
Worked example: rotation and fee dependence at a bank
Scenario. Okoro & Partners were first appointed auditors of Savanna Bank Plc, a public interest entity, on 1 January 2016, and have been reappointed every year since. Mr Bello became the engagement partner on 1 January 2019. In each of the last two years the bank paid the firm ₦72 million in recurring fees, and the firm’s total fee income was ₦400 million in each year. The figures are illustrative. Advise on rotation and fee dependence.
- Firm rotation. A firm may be statutory auditor for ten continuous years. From 1 January 2016, the tenth year ends on 31 December 2025. The firm must then step down and may not be reappointed until seven years after disengagement, so the earliest return is 1 January 2033.
- Partner rotation. The engagement partner may serve a maximum of five years. From 1 January 2019, five years ends on 31 December 2023. Mr Bello should already have rotated out, so the audit committee should ask why not.
- Fee dependence.
The bank’s fees are ₦72 million ÷ ₦400 million = 18% of the firm’s fee income, for two consecutive years.
That is above the IESBA 15% threshold for a public interest entity, so the firm must tell those charged with governance and arrange a review by an external professional accountant or a regulator.
Disclosure alone is not enough. - ICAN threshold. 18% is below the 25% ICAN threshold, so the ICAN threshold alone would not trigger the step. The firm should still apply the stricter 15% IESBA rule for this client and consider a pre-issuance review if the share rises.
- CAMA 2020. The audit committee should make recommendations on appointment, removal and remuneration under section 404(7)(e). The shareholders decide under section 401, and any pressure on the audit team would fall under section 406.
How to score full marks
- Give the numbers. Ten years, seven years, 15 years joint, five years for the partner, 15% IESBA, 25% ICAN. Each one is a mark.
- Separate partner rotation from firm rotation. Define each, then give the Nigerian limits.
- Say why disclosure is not enough. This is the sentence that earns the fee dependence marks.
- For non-audit services, name the threat. Self-review for book-keeping, management threat for management functions, advocacy for legal and investment banking.
- Balance arguments. In a for-and-against question, give at least two points each side, with a reason and an effect.
- Link to CAMA 2020. Section 401 explains why firm rotation needs regulation, section 404(7)(e) gives the audit committee its role and section 406 covers pressure.
Common mistakes in the exam
- Writing that firm rotation is required for every company. The Nigerian limits apply to public interest entities.
- Mixing up ten years for the firm with five years for the engagement partner.
- Forgetting the seven-year gap before the firm may be reappointed.
- Giving the 15% threshold without “for two consecutive years”.
- Saying disclosure to those charged with governance fully solves fee dependence.
- Listing non-audit services without saying why each impairs independence.
- Saying CAMA 2020 sets the ten-year rotation limit. It comes from the Audit Regulation 2020 and the Code.
Quick revision
- Framework or rule book: a framework is flexible because rules cannot cover every case.
- Enron, Andersen and WorldCom led to the Sarbanes-Oxley Act 2002 and SEC rules of 2003.
- SEC measures: non-audit services, partner rotation, one-year cooling-off, no partner pay for other services, critical accounting policies reported, advance approval, fee disclosure.
- Nine non-audit services: book-keeping, systems design, valuation, actuarial, internal audit outsourcing, management or human resources (HR), broker or investment banking, legal, expert services.
- Fee dependence: IESBA 15% for two consecutive years (public interest entities), disclosure and review, pre-issuance review if far above, ICAN 25%.
- Rotation: ten years, seven-year gap, 15 years joint, partner five years.
- Profession: Big Four, second tier, small firms. Liability: insurance, limited company, LLP, statutory cap, contract cap.
- CAMA 2020: ss. 401, 403, 404(7)(e), 406, 408(1)(b), 91(1), Part C.
Practice questions
These are original questions written in the style of the Institute of Chartered Accountants of Nigeria (ICAN) exam. Try each one before you open the answer. Full model answers follow the written questions.
Recall check: multiple choice
The real ICAN paper has no multiple-choice section. These questions are for quick recall. The written questions that follow are closer to the exam.
Question 1. Which of the following is an advantage of an ethical framework over a rule book?
- It is more detailed
- It is more flexible and applies general principles to each case
- It removes the need for sanctions
- It applies only to large firms
Show the answer
B. Rules cannot cover every situation, and narrow rules lose practical value.
Question 2. The firm that audited Enron was:
- KPMG
- Deloitte
- Arthur Andersen
- PwC
Show the answer
C. It lost its clients and broke up, with the loss of 85,000 jobs worldwide.
Question 3. Under the SEC measures after Sarbanes-Oxley, the audit committee of the client must:
- Approve in advance all audit and non-audit services provided by the auditor
- Reject all non-audit services
- Appoint the engagement partner
- Set the auditor’s fee only
Show the answer
A. Shareholders must also be told of audit and non-audit fees.
Question 4. Which of the following is a non-audit service that impairs independence because the firm would audit its own work?
- Attending a general meeting
- Book-keeping for the audit client
- Reading the annual report
- Sending an engagement letter
Show the answer
B. Others include systems design and valuation where the results are audited.
Question 5. Under the Audit Regulation 2020 for public interest entities, an audit firm may be statutory auditor for a continuous period of:
- Three years
- Five years
- Seven years
- Ten years
Show the answer
D. It may not be reappointed until seven years after disengagement.
Question 6. The maximum period for an engagement partner on the same public interest entity audit is:
- Five years
- Seven years
- Ten years
- Fifteen years
Show the answer
A. In a joint audit, no firm may serve more than fifteen years.
Question 7. Under the IESBA code, recurring fees from one public interest entity client above what share of the firm’s fees for two consecutive years require disclosure and a review?
- 5%
- 10%
- 15%
- 25%
Show the answer
C. The ICAN code applies a higher threshold of 25%.
Question 8. Why is disclosure to those charged with governance not a sufficient safeguard against fee dependence?
- It is illegal
- It is too expensive
- It is never read
- It informs them but does not remove the financial incentive
Show the answer
D. A review, and a pre-issuance review where fees are far above the threshold, is also needed.
Question 9. Which of the following is an argument AGAINST a limited liability partnership as the structure of an audit firm?
- It protects partners’ personal assets
- Loss of perceived integrity
- It lowers insurance costs
- It is permitted in Nigeria
Show the answer
B. Unlimited liability is said to encourage high standards of behaviour among partners.
Question 10. Which section of CAMA 2020 makes it an offence to influence, coerce, manipulate or mislead the external auditor?
- Section 401
- Section 403
- Section 406
- Section 409
Show the answer
C. Section 403 is qualification of auditors and section 409 is removal.
Written questions
Question 11 (10 marks). Discuss the arguments for and against the rotation of audit firms.
Question 12 (20 marks). (a) Explain the measures adopted by the US SEC to strengthen auditor independence following the Sarbanes-Oxley Act 2002. (7 marks) (b) Name the non-audit services that the Sarbanes-Oxley rules treat as impairing independence. (5 marks) (c) Discuss the advantages and disadvantages of an auditor providing non-audit services to an audit client. (4 marks) (d) State the rotation requirements for public interest entities in Nigeria. (4 marks)
Question 13 (10 marks). Adewale & Co is a partnership whose partners have unlimited personal liability. A large claim for negligent audit work has frightened the partners. (a) Explain four ways in which the liability of an audit firm may be limited. (4 marks) (b) Discuss why the profession has moved away from unlimited liability. (6 marks)
Model answers
Show the model answer to Question 11
In favour (4 marks, any two at 2). In a long relationship the auditors may become too close to management, which weakens professional scepticism and independence. They may compromise in disagreements to keep the audit and the fees. (2) Even if rotation does not protect independence, it improves public perception and so confidence in the quality of audit.
(2) A new firm can also bring new expertise and technology, and investors see rotation as adding credibility. (2)
Against (6 marks, any three at 2). Audit quality and effectiveness may fall in the first years after a change, because the new auditor takes time to learn the client. There is some evidence of more audit failures then. (2) Changing auditors is costly for the firm and for the client, because management time is needed to teach the new auditor.
(2) There is no evidence that compulsory rotation improves independence or audit quality. (2) The market for listed audits is dominated by the Big Four, so it may be hard to change. Other large firms may lack resources or may not be independent because of other services they provide. (2)
Show the model answer to Question 12
(a) SEC measures (7 marks, 1 each). Revised rules on non-audit services that impair independence. Rotation of certain audit partners after five or seven consecutive years, with possible exemption for some small firms. A firm is not independent if certain client managers were on its audit team in the one year before the audit began.
A firm is not independent if an audit partner has been paid for the firm for services to the client other than audit, review and attestation. The auditors must report critical accounting policies and other matters to the audit committee. The audit committee must approve all audit and non-audit services in advance. Shareholders must be told about the services and fees.
(b) Non-audit services (5 marks, any five at 1). Book-keeping and other services related to the accounting records or financial statements. Financial information systems design and implementation. Appraisal or valuation services, fairness opinions and contribution-in-kind reports. Actuarial services. Internal audit outsourcing. Management functions or human resources. Broker, dealer, investment adviser or investment banking services. Legal services. Expert services unrelated to the audit.
(c) Advantages and disadvantages (4 marks, 1 each). Advantages: the firm already knows the client, so it can give the service at lower cost and with less disruption (1), and non-audit work makes the firm more attractive to trainees (1). Disadvantages: the firm may seem to lack independence because of the large fees (1), and its staff may end up making management decisions (1).
(d) Rotation in Nigeria (4 marks, 1 each). An audit firm may be statutory auditor of a public interest entity for a continuous period of ten years. It may not be reappointed until seven years after disengagement. In a joint audit, no firm may be on the audit for more than fifteen years. An engagement partner may serve a maximum of five years before rotating out.
These come from the Nigeria Code of Corporate Governance 2018 and the Audit Regulation 2020.
Show the model answer to Question 13
(a) Ways to limit liability (4 marks, 1 each). Practices may be permitted by law to trade as limited liability companies. They may be permitted to trade as limited liability partnerships, as in the UK and Nigeria. A statute may set a maximum limit on the size of claims against an auditor. The auditor may agree a maximum limit on claims with the client as a term of the audit contract.
Note: section 91(1) of CAMA 2020 voids provisions that exempt an auditor from liability, so check whether a contractual cap is allowed.
(b) Why the profession has moved (6 marks). Unlimited liability put the owners’ personal assets at risk, and the idea was to promote public confidence and encourage care. (1.5) As businesses grew, so did the size of claims against auditors. (1.5) Practitioners were required to carry professional indemnity insurance so that claims could be met from a policy.
(1) Premiums then rose with the size of claims, which was a growing burden, particularly for smaller firms. (1) This led to a move away from unlimited liability through limited companies, LLPs, statutory caps and contract caps. (1) Critics say LLPs may lower the perceived integrity of the profession. (Credit for this balance within the marks above)
Pathfinder on ethics, independence and rotation
These are the ICAN Pathfinder questions that test this topic. ICAN owns the questions and the suggested solutions, so we point you to them and do not copy them. Open your Pathfinder, attempt each question under exam conditions, then check your answer against the notes above.
The marking guide gives 1 mark each for any 3 points on the rotation process and 1.5 marks each for any 4 suggestions on how rotation should be achieved. The solution uses the Nigerian limits of ten years, a seven-year gap, 15 years for a joint audit and five years for the engagement partner, and the two forms of rotation. All of these are in the rotation section of this topic.
Revise first: Auditor rotation
The solution gives the IESBA 15% test for two consecutive years for public interest entities, says disclosure to those charged with governance is necessary but not sufficient, adds a pre-issuance review where fees are far above the threshold, and notes the higher ICAN threshold of 25%.
Revise first: Fee dependence
The Question 3 solution recommends a policy on the rotation of auditors. The Question 7 facts include tax computations and book-keeping alongside the audit, which is a non-audit services threat. Use the non-audit services section if a case contains facts like these.
Revise first: Non-audit services to audit clients
Source: ICAN Pathfinder, Advanced Audit, Assurance and Forensics. Diets covered: May Diet, 2026 and November Diet, 2025.
Spotted a mistake? Tell us and we will check it.
