Fundamental ethical principles and the conceptual framework

The audit manager of a firm in Abuja gets engaged to the daughter of the managing director of an audit client. Nobody has done anything wrong, and yet every reader of the audit report would ask the same question: can this manager be trusted to challenge the managing director? Professional ethics is the set of rules that answers questions like that before they become scandals.

Every other ethics topic in this course builds on the principles and the threat-and-safeguard method set out here.

This topic covers who the ethics rules bind, the five fundamental principles, due skill and care, and the conceptual framework that identifies, evaluates and addresses threats. It then lists the circumstances that give rise to each of the five threats, the three families of safeguards and a worked example. Independence, confidentiality, conflicts, non-compliance with laws and whistleblowing follow in separate topics.

Key terms in plain English

Syllabus check

This topic is in syllabus area E, professional ethics and public interest (15% of marks). It covers:

• the importance of professional ethics
• the ethical issues under the IFAC and ICAN codes
• the ethical threats and safeguards for an auditor

CAMA 2020 and ethics

The Companies and Allied Matters Act 2020 (CAMA 2020) is the company law of Nigeria. The sections below apply to this topic.

The rules in more depth

Who the ethics rules bind

The law regulates some of auditing, for example the requirement for an external audit, but internal auditing is not normally regulated by statute. Every accountant who belongs to a professional body such as ICAN must follow that body's regulations, so ethical rules reach external auditors, assurance providers and internal auditors alike. The reason is that the accountancy profession accepts that it has a responsibility to act in the public interest.

The Code of Ethics for Professional Accountants is published by the IESBA, part of the International Federation of Accountants. ICAN adopted it as its own localised code, the Professional Code of Conduct and Guide for Members. The substance is largely the same. The ICAN code binds all members, including student members, and the staff of an ICAN practice whether or not they are members.

The examination is mainly about how the rules apply to external auditors and assurance providers. By providing a code, ICAN meets one of its regulatory duties, which is to make sure statutory audits are done only by fit and proper persons who act with professional integrity.

The five fundamental principles

Due skill and care

Members must work with professional competence and due care. This matches the law of contract in many countries, where a service must be performed with reasonable skill and care. Audit work must be fitted to the client's own circumstances, because there is no standard audit. If the auditor fails to take proper care:

1. the auditor may face legal claims in contract or in tort, which means civil wrongdoing;
2. ICAN may take disciplinary proceedings; and
3. the firm may gain a poor reputation in the business community and lose clients.

The conceptual framework

It is impossible to write a rule for every situation, so the Code uses a conceptual framework. The member must identify threats to the fundamental principles, evaluate how significant they are and address them. A threat is at an acceptable level if a reasonable and informed third party would not conclude that compliance with the principles has been compromised. If a threat is not acceptable, the member must:

• eliminate the circumstances that create it; or
• apply safeguards that reduce it to an acceptable level; or
• decline or end the specific professional activity.

The member must then form an overall conclusion on whether the actions taken eliminate the threats or reduce them to an acceptable level. For example, a good safeguard against a familiarity threat is to change the engagement partner, and perhaps the whole team, every few years.

Against an advocacy threat, where the firm has agreed to support the client in a legal case, it may be right not to act in that capacity or to resign from the audit, because no safeguard will reduce the threat enough.

The five threats and the circumstances that create them

An immediate family member is a spouse or equivalent, or a dependant. A close family member is a parent, non-dependent child, brother or sister.

Self-interest

Arises from the financial or other interests of the member or of family. A member holding shares in a client may be unwilling to give an unfavourable report. Circumstances include:

• financial interests, loans or guarantees;
• incentive-based fee arrangements;
• concern over employment security;
• commercial pressure from outside the employing organisation;
• inappropriate personal use of corporate assets;
• close personal or business relationships;
• holding, or jointly holding with a client, a financial interest in a client; and
• undue dependence on fees from a client.

Self-review

Arises when a previous judgement must be re-evaluated by the person who made it. A member who kept a client's accounting records may be unwilling to fault the statements built from them. Circumstances include:

• business decisions or data reviewed by the person who made the decisions or prepared the data;
• being in a position to exert direct and significant influence over the entity's financial reports;
• finding a significant error while re-evaluating the member's own work;
• reporting on the operation of financial systems after helping to design or implement them;
• a member of the assurance team being, or having recently been, employed by the client in a position to influence the subject matter; and
• performing a service for the client that directly affects the subject matter of an assurance engagement.

Advocacy

Arises when a member promotes a client's position so far that objectivity may be compromised. Circumstances include:

• commenting publicly on future events;
• situations where information is incomplete or the argument supported is against the law;
• promoting shares in a listed company that is also an audit client; and
• acting as advocate for an assurance client in litigation or a dispute with third parties.

For example, if a client asks its audit firm to represent it before the tax authorities in a dispute over the tax payable, the firm should refuse.

Familiarity

Arises when a close relationship makes a member too sympathetic to the interests of others. Circumstances include:

• a person in a position to influence reporting or decisions having an immediate family member who could benefit from those decisions;
• long association with business contacts;
• acceptance of gifts or preferential treatment, unless the value is trivial and inconsequential;
• over-familiarity with management; and
• a former partner of the firm being a director or officer of the client, or an employee in a position to influence the subject matter.

In audit, the usual case is a senior team member, such as the engagement partner, who has worked on the same audit for several years.

Intimidation

Arises when fear or threats influence the member's conduct. Circumstances include:

• a threat of dismissal or replacement of the member, or a close family member, over a disagreement about an accounting principle or about how information is reported;
• a dominant personality trying to influence the member's decisions;
• a threat of litigation; and
• pressure to cut the work done in order to reduce fees.

The three families of safeguards

Applying the framework: ethical threats and safeguards in a scenario

The May 2026 examination described New Breath Bank Plc, a listed deposit money bank. The audit partner was offered expensive gifts by management during the audit, a whistle-blower alleged that the Finance Director had diverted funds and hidden assets, and there were governance concerns. Candidates were asked to assess the ethical threats and conflicts and to propose safeguards in line with the IESBA and ICAN codes. A good answer follows the framework.

• Gift offer. Accepting a valuable gift is a self-interest threat to objectivity, a familiarity threat because it creates a favour. An intimidation threat if the gift is later used as pressure. A gift is acceptable only if its value is trivial and inconsequential. The safeguard is to decline the gift, record the offer, tell the firm's ethics partner and tell those charged with governance, such as the audit committee, because the offer is itself a concern about management's integrity.
• Whistle-blower allegation. The alleged diversion of funds raises professional behaviour and integrity issues and may be non-compliance with laws and regulations. The auditor must consider the allegation, keep the source confidential, assess the effect on the audit and on the report, and consider whether to report to the right authority, as the topic on non-compliance with laws and whistleblowing sets out.
• Governance concerns. Weak governance raises doubt about the integrity of management, which affects whether the firm should continue as auditor. The safeguards are to increase scepticism, expand testing, escalate to those charged with governance, consult within the firm, and, if the threat cannot be reduced, to resign.

A step-by-step method for any ethics scenario

1. Read for the facts that matter: who is connected to whom, what money, shares, loans, gifts or services are involved, and how long the relationship has lasted.
2. Name each threat from the five categories. One set of facts can create several threats, as the engaged audit manager shows.
3. State the principle at risk: usually objectivity, but integrity, competence and due care, or confidentiality may also be at risk.
4. Judge the significance: would a reasonable and informed third party see the threat as acceptable?
5. Choose the response: remove the cause, apply safeguards, or decline or end the work. Give one specific safeguard per threat, not a general list.
6. Record the decision and who was consulted, because the record is itself a safeguard created by the individual.

Why the principles-based approach matters to a firm

A firm cannot train its people on a rule for every case, but it can train them to ask the same questions every time. Junior staff meet the threats first: a client's accountant who offers a lift home, a director who asks for the work to finish early, a request to look at a friend's company.

The principles give them a way to raise the point with a senior colleague without needing to prove wrongdoing. This is why the Code lists safeguards in the work environment, such as ways to report ethical issues without fear of retribution. A firm that makes it easy to raise the point early removes most threats before they reach the partner.

Competence is an ethical duty, not only a technical one

An accountant who accepts work that he is not competent to do breaches professional competence and due care, even if his motives are honest. Examples are an audit team that has no one who understands a client's complex financial instruments, or a firm that takes on a bank audit without a systems specialist.

The response is to get the skill, whether by training, by hiring or by using an expert, or to decline. The same duty applies to staying current: a firm that audits under old standards, or ignores a change in company law, fails the duty of due care.

Worked examples

1. The pressure to cut work is an intimidation threat.
2. It threatens objectivity and due care.
3. Safeguards: refer the pressure to the partner, keep a record, and refuse to reduce the testing below what the ISAs require.

1. The firm is reviewing its own work: a self-review threat.
2. Safeguards: use different partners and teams for the design work, or decline one of the engagements if the threat cannot be reduced.

1. The threat is familiarity: the partner may stop challenging management.
2. Safeguards: rotate the engagement partner and possibly the team, and add an independent review of the work.

1. Acting as advocate is an advocacy threat to objectivity.
2. No safeguard reduces it to an acceptable level, so the firm declines to act as advocate.

How to score full marks

• Name the threat precisely and say why it arises on the facts.
• Link each threat to the principle it endangers, usually objectivity.
• Match the safeguard to the threat, and say when none will work.
• Finish with the response: eliminate, safeguard, or decline or end the work.

Common mistakes in the exam

• Listing the five principles without applying them.
• Naming a threat without explaining why it is one.
• Offering the same safeguard for every threat.
• Treating the ICAN code as separate from the IESBA Code: the substance is the same.

Quick revision

• Five principles: integrity, objectivity, competence and due care, confidentiality, professional behaviour.
• Five threats: self-interest, self-review, advocacy, familiarity, intimidation.
• Identify, evaluate, address.
• Eliminate, safeguard, decline or end.
• Safeguards: profession and law, work environment, the individual.

Practice questions

Questions 1 to 10 are multiple choice. Questions 11 to 13 are written. Try each before opening the answer.

Model answers

Spotted a mistake? Tell us and we will check it.