An auditor’s skill is worth nothing if the client cannot trust the auditor’s honesty. Professional codes exist to protect that trust. All the major accountancy bodies have codes that are broadly similar, and all of them rest on five fundamental principles. Every ethics question in the exam, from independence to confidentiality to whistle-blowing, is an application of those five principles.
This topic covers the International Ethics Standards Board for Accountants (IESBA) Code and the Institute of Chartered Accountants of Nigeria (ICAN) code, the five principles and what each means, the everyday pressures that test them in audit work and how a firm manages each, how to judge an organisation’s internal audit and code of ethics, and the system a firm needs to protect whistle-blowers.
Examiners give a scenario and ask which principles are at risk and what the firm should do, so practise naming the principle and the response together.
In 30 seconds
The IESBA Code, issued by International Federation of Accountants (IFAC)’s ethics board, gives five fundamental principles: integrity, objectivity, professional competence and due care, confidentiality, and professional behaviour. ICAN adopted the Code as its Professional Code of Conduct and Guide for Members. It binds every member, student members and staff of an ICAN practice, whether or not they are members.
Threats to the principles are mostly threats to independence and objectivity. Common pressures are management pushing for good results, familiarity with relatives or friends, the clash between confidentiality and disclosure, doubts about when to escalate, weak internal audit independence, complex clients and tight deadlines. A good code of ethics has stated values, clear guidance, risk assessment, training, a way to raise concerns, regular testing and tone from the top.
A whistle-blower system needs a written policy, confidential channels, an independent receiver, protection from retaliation, follow-up and monitoring.
The IESBA Code and the ICAN code
Professional bodies set high standards of behaviour for their members, including student members. Each body does so because one of its regulatory functions is to make sure that statutory audits are done only by fit and proper people who act with professional integrity. The detailed rules differ from body to body, but the codes are broadly alike.
This course uses IFAC’s Code of Ethics for Professional Accountants, published by the International Ethics Standards Board for Accountants (IESBA), called “the Code”. ICAN adopted it as its own localised code, the Professional Code of Conduct and Guide for Members. The substance is largely unchanged. The ICAN Code must be followed by all members, including student members, whether they work as external auditors, assurance providers or internal auditors.
It also applies to the staff of an ICAN practice, whether or not they belong to ICAN or any other professional body. The exam is mainly concerned with how the rules apply to an external auditor or assurance provider.
The five fundamental principles
| Principle | What it requires |
|---|---|
| Integrity | Be straightforward and honest in all professional and business relationships |
| Objectivity | Do not let bias, conflict of interest or the undue influence of others override professional or business judgement |
| Professional competence and due care | Keep up professional knowledge and skill at the level needed to give a competent service, based on current technical and professional standards and the law, and act diligently and in line with those standards |
| Confidentiality | Respect the confidentiality of information gained from professional and business relationships. Do not disclose it to third parties without proper and specific authority, unless there is a legal or professional right or duty to disclose. Do not use it for the personal advantage of the accountant or a third party |
| Professional behaviour | Comply with relevant laws and regulations and avoid any conduct that the accountant knows, or should know, might discredit the profession |
You must know the five principles and what each means. An exam question may ask you to discuss how they apply to a particular situation in a case study.
Ethical pressures in audit and assurance work
The auditor is expected to keep to the code of ethics in all work. That means keeping integrity, independence, confidentiality and freedom from conflict, working to technical standards with professional scepticism, acting in the public interest and acting as an unbiased umpire for all stakeholders. Typical unethical behaviour includes hiding information, breaching confidentiality, falsifying records, breaking the law, creative accounting and window dressing. These behaviours create the following pressures.
| Pressure | How the firm should deal with it |
|---|---|
| Management presses for impressive results by not following accounting standards, for example by under-providing for impairment of loans, receivables, inventories and investments. The short-term picture looks good but the long-term effect is harmful, and there may be pressure to alter figures and overlook findings | Agree the audit objectives clearly with the client and explain what non-conformity with the standards would mean. Train the team to cope with pressure and to communicate well, in speech and in writing |
| Familiarity threat from auditing a relative or close friend, which may lead to a conflict of interest | Require disclosure of any interest or link with the entity, and keep anyone who could be compromised off the engagement team |
| Dilemma between confidentiality and disclosure of unethical behaviour, where ISAs or local law may require the auditor to disclose contraventions | Give a proper whistle-blowing channel that protects confidentiality, and make management aware of the legal requirement and of the consequences of suppressing information |
| Doubt about the threshold for escalation, where qualitative or quantitative judgement decides what to disclose or escalate | Assess the effect on users of the financial statements and keep objectivity when deciding what to disclose |
| Internal auditor independence is weak where there is no clear line of responsibility and the unit is not shielded from management. For example, internal audit reports to a managing director who may be fraudulent or domineering, and the internal auditor risks intimidation and removal after a disagreement | Adhere to the professional code so that independence and objectivity are protected, and give internal audit a protected reporting line |
| Complex audit environment: transactions are hard to understand and the client’s management may be hostile or confusing | Train the team continuously in current standards. State the scope and the status of the audit clearly throughout. Train staff in dealing with difficult people and cultural differences. Communicate verbally and in writing, and use checklists and open-ended questions |
| Preparing audit schedules and records is slow, and a client that is not committed to good reporting makes deadlines hard to meet in busy seasons | Plan and manage time, focus on the risk areas and agree only realistic deadlines. Give the client the audit requirements at planning meetings with a timetable for deliverables. If new risks arise, assess the effect on the objective and tell the client what is needed, without lowering quality |
Judging an organisation’s internal audit and code of ethics
Internal audit is an independent, objective monitoring and control activity set up inside an organisation to help safeguard assets and make sure rules are followed. For it to work, it needs four qualities.
- Integrity. Practitioners must be trustworthy, disciplined and responsible, and must not do anything that dents the organisation’s image.
- Objectivity. They should be professional, fair and transparent in their work and reports, act as unbiased umpires and follow the profession’s code of ethics.
- Confidentiality. They disclose findings only officially, unless a legal or professional duty requires otherwise.
- Competence. Their knowledge, skill and experience must match the work. They must not do work they are not competent to do, must keep learning, and must work to an internal audit charter that guides their duties.
For an organisation’s internal audit unit or code of ethics to succeed, the syllabus lists these needs:
- stated organisational values that form part of everyday work ethics and define the culture;
- those values written into a Code of Ethics and Conduct that covers compliance risk areas, for example gifts and entertainment from customers, is available to all employees and is explained to them;
- a risk assessment of the code to make sure it complies with the law, considering current business risks, changing practices, and changes in laws and government policy;
- coverage of the organisation’s risks, such as money laundering, bribery and corruption, with employee interviews to test awareness and procedures that tell employees their responsibilities;
- training that draws attention to the parts of the code that employees do not know, especially likely sanctions, with flexible delivery (virtual or physical), attendance records or a quiz;
- a way for stakeholders, employees, customers and suppliers to give feedback and raise concerns, with procedures to record and investigate concerns and to act to prevent repeats;
- constant communication of the code, for example short videos and FAQs in newsletters, with employees encouraged to raise doubts without fear of punishment;
- a communication plan that uses a variety of media to show that the code matters;
- regular internal and external testing and re-examination, including a survey of employees’ views on internal audit, the code and the compliance culture; and
- tone at the top: the chief executive stressing directors’ commitment to the code, possibly an ethics and compliance committee of the board, and the head of audit or a chief ethics officer reporting directly to the board.
A system to protect whistle-blowers
Items 6, 7 and 10 above are the heart of a whistle-blowing system, and a firm should build them into a framework that protects people who report misconduct from retaliation. This protects the principle of integrity. The building blocks are:
- A written policy. It is available to all staff, says what can be reported and to whom, and describes the procedure.
- Confidential channels. Secure routes, such as an outside hotline or a dedicated email address, that allow anonymous reporting without immediate identification.
- An independent receiver. A person or committee outside the normal line of management, such as the compliance officer or the audit committee, to receive and investigate reports.
- A promise of non-retaliation. An explicit guarantee, backed by discipline for anyone who victimises a reporter, which holds even if the concern proves unfounded, provided it was made in good faith.
- Follow-up. Prompt investigation and, where possible, feedback to the reporter on the action taken.
- Tone from the top. Visible leadership commitment to a culture in which concerns are valued.
- Monitoring. Regular checks on how well the programme and the anti-retaliation rules work.
- Training for managers. They learn how to respond, what counts as retaliation, and not to discourage reporting.
Background: The syllabus does not set out a whistle-blowing system as such. Points 1, 3, 5 and 8 apply the earlier items on feedback, training and communication, and the audit committee’s duty to review whistle-blowing procedures, to the firm’s own case.
The principles in more depth
Why threats to the principles are mostly threats to independence
Of the five principles, objectivity is the one most easily lost, because it depends on the absence of pressure and conflict. The next topics list the general threats: self-interest, self-review, advocacy, intimidation and familiarity. They matter because each one pushes an auditor away from an impartial judgement. Integrity and professional behaviour are broader. They are about honesty and reputation, and a breach of either can discredit the whole profession.
Confidentiality has limits
The duty is to respect confidential information and not to use it for personal gain. It is not absolute. A legal duty, a legal right and a professional right or duty to disclose all override it. The later topic on confidentiality sets these out.
Scepticism is part of competence
Professional competence and due care include working to technical standards with an attitude of professional scepticism, and not deciding anything without reasonable and adequate information. An auditor who accepts management’s explanation without evidence breaches this principle, even if no one is dishonest.
Worked example: applying the principles
Scenario. You are the audit senior on Ola Foods Ltd. The managing director tells your manager that results must show a profit this year or the company will move its audit and consulting work to another firm. He wants no extra allowance against receivables that are more than a year old. Separately, you learn that a junior on your team is the nephew of the company’s finance director.
A staff member in Ola’s internal audit unit tells you privately that the unit reports to the managing director and that its reports on receivables have been changed. Advise on the principles at stake and what the firm should do.
- The pressure on results. The managing director is exerting undue influence and a threat to move work. This threatens objectivity (undue influence, intimidation) and integrity if the firm gave way. The firm should explain that the standards require an adequate allowance, remind management of the audit objectives and the effect of non-conformity, and not alter its judgement.
- The nephew. A family link to the finance director is a familiarity threat to objectivity. The junior should be taken off the team, and any interest should be disclosed.
- Internal audit. The unit has no protected line of responsibility, so its independence and objectivity are weak and its reports may be altered. The auditor should treat the receivables report with caution and test the underlying data directly. A channel to the audit committee should be recommended.
- Disclosure. The staff member’s information is confidential. The firm should protect the source and use a proper channel, and take legal advice if there is doubt about a duty to disclose.
- Conclusion. Hold the line on the allowance, remove the nephew, test internal audit evidence independently, and document each step. Be ready to resign if the pressure continues.
How to score full marks
- Name the principle for every fact. Use the exact five terms. A discussion of a scenario that does not name integrity, objectivity, competence and due care, confidentiality or professional behaviour loses most of its marks.
- Use a three-part pattern per fact: threat, principle, response. “The MD’s threat to move work is an intimidation threat to objectivity. The firm should hold its judgement and tell the audit committee.”
- Give the response the facts call for. Remove the person, refuse the gift, tell those charged with governance, take legal advice, or resign as a last resort.
- For whistle-blowing questions, list the building blocks with a reason. Policy, confidential channel, independent receiver, non-retaliation, follow-up, tone, monitoring and training. Five well-explained blocks earn five marks.
- For “evaluate the code of ethics” questions, work from the ten needs. Group them: values and code, risk assessment, training and communication, raising concerns, testing, and tone from the top.
- Time. Spend time in proportion to marks. A 6-mark requirement needs about six explained points. Use short headings that repeat the question.
Common mistakes in the exam
- Listing the five principles without applying them to the facts.
- Confusing objectivity (freedom from bias) with independence (the state that makes objectivity possible and visible).
- Writing “professional ethics” as the fifth principle instead of professional behaviour.
- Saying confidentiality is absolute.
- Forgetting that the ICAN code covers student members and all practice staff.
- Suggesting resignation as the first response. It is the last.
- Treating a whistle-blower system as a hotline only, and missing non-retaliation and follow-up.
- Ignoring the tone at the top in questions about a code of ethics.
Quick revision
- The IESBA Code, localised by ICAN. It covers all members, student members and practice staff.
- Five principles: integrity, objectivity, professional competence and due care, confidentiality, professional behaviour.
- Pressures: results pressure, familiarity, confidentiality versus disclosure, escalation threshold, internal audit independence, complex clients, deadlines. Each has a standard response.
- Internal audit qualities: integrity, objectivity, confidentiality, competence, and a charter.
- Code of ethics: values, written code, risk assessment, risk coverage, training, feedback channel, communication, testing, tone at the top.
- Whistle-blower system: policy, confidential channel, independent receiver, non-retaliation, follow-up, tone, monitoring, manager training.
Practice questions
These are original questions written in the style of the ICAN exam. Try each one before you open the answer. Full model answers follow the written questions.
Recall check: multiple choice
The real ICAN paper has no multiple-choice section. These questions are for quick recall. The written questions that follow are closer to the exam.
Question 1. Which one of the following is NOT a fundamental principle of the IESBA Code?
- Integrity
- Objectivity
- Profitability
- Professional behaviour
Show the answer
C. The five are integrity, objectivity, professional competence and due care, confidentiality and professional behaviour.
Question 2. The ICAN Code applies to:
- Only external auditors
- Only fellows of ICAN
- All members, student members and the staff of an ICAN practice
- Only the firm’s partners
Show the answer
C. It applies even to practice staff who are not ICAN members.
Question 3. Not letting bias, conflict of interest or undue influence override judgement describes:
- Integrity
- Objectivity
- Confidentiality
- Competence
Show the answer
B. This is the definition of objectivity.
Question 4. An auditor who audits a close friend’s company faces mainly a:
- Self-review threat
- Familiarity threat
- Advocacy threat
- None
Show the answer
B. Close relationships create familiarity.
Question 5. Management’s pressure to avoid an allowance for doubtful receivables is best handled by:
- Agreeing to avoid conflict
- Agreeing the audit objectives clearly and explaining the effect of non-conformity
- Resigning at once
- Telling the press
Show the answer
B. Training the team to cope with pressure also helps.
Question 6. Which is a reason for weak internal audit independence?
- It reports to the audit committee
- It reports to a managing director who may be domineering
- It has a charter
- It has trained staff
Show the answer
B. The unit faces intimidation and the threat of removal.
Question 7. Professional behaviour requires an accountant to:
- Comply with laws and avoid conduct that might discredit the profession
- Keep all information secret in all cases
- Accept every client
- Charge minimum fees
Show the answer
A. That is the definition.
Question 8. Which is part of an effective whistle-blower system?
- Punishing reporters whose concern proves unfounded
- An independent receiver outside normal line management
- Revealing the reporter’s name to the accused
- No follow-up
Show the answer
B. Good-faith reporters must be protected even if the concern is unfounded.
Question 9. In an organisation’s code of ethics, “tone at the top” means:
- The chief executive stresses directors’ commitment to the code
- Staff wear uniforms
- Only junior staff follow the code
- The code is kept secret
Show the answer
A. A board ethics committee and a head of audit reporting to the board support it.
Question 10. A team member is the nephew of the client’s finance director. The best response is to:
- Keep him on the team and say nothing
- Remove him from the team and disclose the interest
- Promote him
- Make him team leader
Show the answer
B. Those who could be compromised should be kept off the team.
Written questions
Question 11 (10 marks). State the five fundamental principles of the IESBA Code, explaining what each requires, and say to whom the ICAN Code applies.
Question 12 (20 marks). (a) Explain four ethical pressures that an audit team may face and how a firm should manage each. (8 marks) (b) Describe the qualities needed for an effective internal audit unit. (4 marks) (c) Describe what an organisation needs in place for its code of ethics to succeed. (8 marks)
Question 13 (10 marks). A senior audit assistant at Crest Auditors reported to her manager that the client’s management was pressing the team to limit testing of an automated system. When nothing happened, she fears victimisation and has told the professional body. Explain the system the firm should have so that staff in her position are protected, and the principles of the Code at stake. (10 marks)
Model answers
Show the model answer to Question 11
Principles. Integrity: be straightforward and honest in all professional and business relationships. (1.5) Objectivity: do not allow bias, conflict of interest or undue influence to override professional or business judgement. (1.5) Professional competence and due care: maintain the knowledge and skill needed to give a competent service, based on current standards and law, and act diligently.
(2) Confidentiality: respect confidential information, do not disclose it without proper authority unless there is a legal or professional right or duty, and do not use it for personal advantage. (2) Professional behaviour: comply with law and avoid conduct that might discredit the profession. (1.5)
Application. ICAN has adopted the IESBA Code as its Professional Code of Conduct and Guide for Members. It applies to all members, including students, whether they are external auditors, assurance providers or internal auditors, and to the staff of an ICAN practice whether or not they are members. (1.5)
Show the model answer to Question 12
(a) Pressures (8 marks, any four). Pressure for good results: management presses to avoid proper allowances; agree audit objectives, explain the effect of non-conformity, train staff to cope. (2) Familiarity: auditing a relative or friend; require disclosure and keep compromised people off the team. (2) Confidentiality versus disclosure: law or ISAs may require disclosure; provide a whistle-blowing channel and make management aware of the law.
(2) Weak internal audit independence: reports to a domineering managing director; protect the reporting line and adhere to the code. (2) Complex clients: train continuously, communicate scope and status clearly. (2, only four pressures count)
(b) Internal audit qualities (4 marks). Integrity: trustworthy and responsible (1). Objectivity: fair, unbiased and working to the code (1). Confidentiality: disclose findings only officially (1). Competence: skills fit the work, continuing education and an internal audit charter (1).
(c) Code of ethics (8 marks, 1 each for any eight). Stated values that shape culture; a written code with guidance on compliance risk areas, accessible to all; a risk assessment of the code against law and business change; coverage of money laundering, bribery and corruption, tested by interviews; training with attendance records or a quiz; a way for stakeholders to raise concerns, with procedures to investigate and prevent repeats; constant communication using varied media; encouragement to raise doubts without fear; regular testing and employee surveys; and tone at the top, with a board ethics committee and a head of audit or chief ethics officer reporting to the board.
Show the model answer to Question 13
Principles at stake (3 marks). Integrity: the assistant acted honestly, and the firm must not punish her. (1) Objectivity: management pressure to limit testing is undue influence. (1) Professional competence and due care: limiting testing breaches standards and scepticism. (1)
The system (7 marks). A written, accessible policy saying what can be reported and to whom (1). Confidential and, if wanted, anonymous channels such as an outside hotline (1). An independent receiver, such as a compliance officer or the audit committee, outside normal management (1). A promise of non-retaliation with discipline for anyone who victimises a reporter, even if the concern proves unfounded, provided it was made in good faith (1.5).
Prompt investigation with feedback to the reporter (1). Visible tone from the top (0.5). Monitoring of the programme and training for managers on responding and on what counts as retaliation (1).
Pathfinder on the fundamental ethical principles
These are the ICAN Pathfinder questions that test this topic. ICAN owns the questions and the suggested solutions, so we point you to them and do not copy them. Open your Pathfinder, attempt each question under exam conditions, then check your answer against the notes above.
The firm needs a system to protect a staff member who reported management pressure and feared victimisation. This topic gives the building blocks of a whistle-blower system.
Revise first: A system to protect whistle-blowers
Showing that the firm acts professionally and ethically, including the situations that threaten integrity, objectivity and independence and how the firm manages them. This topic gives the principles and pressures; the next topics give the threats.
Revise first: Ethical pressures in audit and assurance work
Section A is a single compulsory case with several requirements. It has drawn on ethics, quality management, group audits and reporting. Practise the scenario method in this topic before you attempt it.
Revise first: How to score full marks
Source: ICAN Pathfinder, Advanced Audit, Assurance and Forensics. Diets covered: May Diet, 2026 and November Diet, 2025.
Spotted a mistake? Tell us and we will check it.
