The AICPA and SEC independence rules cover the same core idea — an auditor cannot audit their own work or act as management of the client — but they apply to different audits, use different methods, and produce very different answers in specific situations. The AICPA Code of Professional Conduct governs every AICPA member performing attest services and relies on a principles-based framework of threats and safeguards. The SEC’s rules under 17 CFR 210.2-01 apply specifically to auditors of public companies (issuers) and draw bright lines that no safeguard can cure.1eCFR. 17 CFR 210.2-01 – Qualifications of Accountants When both apply to the same engagement, the more restrictive rule controls, which in practice means the SEC rule.
Which Rules Apply to Which Audits
The AICPA Code binds every AICPA member performing professional services, regardless of the client’s form — private companies, nonprofits, government entities, sole proprietorships.2AICPA & CIMA. Professional Responsibilities For most non-public audits, the AICPA rules are the primary independence standard, and state boards of accountancy typically adopt the AICPA Code as the ethical baseline for licensed CPAs.
The SEC rules attach whenever the audit client is an issuer required to file reports with the Commission. The PCAOB adds another layer on top of the SEC’s requirements, including specific rules on audit committee communications and tax services. Auditors of public companies therefore navigate three frameworks at once, with the strictest of the three winning any conflict.
Principles-Based Framework vs. Bright-Line Prohibitions
The methodological gap between the two regimes is bigger than the rule-by-rule differences that flow from it.
The AICPA operates on a conceptual framework. A CPA identifies threats to independence — self-interest, self-review, advocacy, familiarity, undue influence, adverse interest, and management participation — evaluates their significance, and applies safeguards to bring the threats down to an acceptable level. Safeguards might include bringing in a separate review partner, walling off audit and consulting teams, or restructuring the engagement team. Nothing is categorically banned. Everything runs through a threat-and-safeguard analysis that depends heavily on the auditor’s judgment.
The SEC works the opposite way. Rule 2-01 draws specific prohibitions that cannot be cured with safeguards. Either the firm complies with the prohibition or independence is impaired. The SEC’s two guiding principles behind those specific rules are simple: the auditor cannot function as management or an employee of the client, and the auditor cannot audit its own work.1eCFR. 17 CFR 210.2-01 – Qualifications of Accountants
Who Counts as a Covered Person
The two frameworks also define the population of people bound by the rules differently, and this matters for large firms with multiple offices and service lines.
The AICPA’s “covered member” includes anyone on the attest engagement team, anyone in a position to influence the engagement, and partners in the office where the lead engagement partner practices.3Public Company Accounting Oversight Board. ET Section 101 – Independence
The SEC’s “covered person in the firm” reaches further. It captures the engagement team, the chain of command above it, all partners in the lead engagement partner’s office, and any partner or employee who provides ten or more hours of non-audit services to the audit client. That last category is where the SEC pulls in people the AICPA rule would not. A tax partner in another office who logs a few hours on a consulting engagement for the same issuer becomes a covered person, with all the financial-interest restrictions that follow.4eCFR. 17 CFR 210.2-01 – Qualifications of Accountants
Financial Interests and Loans
Both regimes prohibit direct financial interests in an audit client, but the details diverge.
Under the AICPA rules, a covered member holding any direct financial interest in a client — even one share of stock — is impaired regardless of dollar amount. An indirect interest, such as a mutual fund that happens to hold the client’s stock, impairs independence only if it is material to the covered member, assessed against that person’s own financial situation.3Public Company Accounting Oversight Board. ET Section 101 – Independence
The SEC prohibits any direct investment in an audit client by the firm, any covered person, or their immediate family — no materiality analysis, no exceptions. Material indirect investments are also prohibited, but the SEC provides a specific safe harbor: owning 5% or less of the outstanding shares of a diversified mutual fund that happens to invest in the audit client does not impair independence. The SEC also specifically prohibits derivatives and hedging arrangements tied to an audit client’s securities.4eCFR. 17 CFR 210.2-01 – Qualifications of Accountants
On lending, the AICPA generally prohibits loans between a covered member and an audit client but carves out routine consumer lending — mortgages, car loans, and similar credit obtained under the client’s normal lending terms — provided the loans are fully collateralized. The SEC prohibits loans to or from an audit client, its officers or directors with decision-making authority, and significant beneficial owners of the client’s equity, with only limited consumer-loan exceptions. Firms auditing financial institutions need to be especially careful about existing lending relationships.1eCFR. 17 CFR 210.2-01 – Qualifications of Accountants
Business, Employment, and Family Relationships
The SEC prohibits any direct or material indirect business relationship between the firm or a covered person and the audit client, or with the client’s officers, directors, or significant shareholders. Joint ventures, limited partnerships, and co-investments fall within this prohibition. The only exceptions are for professional services the firm provides and ordinary consumer transactions.
The AICPA runs the same question through its conceptual framework. A joint venture with a private-company audit client would be evaluated for self-interest or adverse-interest threats and safeguards. In practice a close business tie would usually fail that analysis, but the AICPA at least permits the analysis rather than imposing an automatic ban.
On family, the AICPA divides relatives into “immediate family” (spouse, spousal equivalent, dependents), whose interests and employment are treated as the covered member’s own, and “close relatives” (parents, nondependent children, siblings), who trigger impairment only under narrower conditions — chiefly if they hold a key position at the client or a material financial interest that gives them significant influence.5AICPA. AICPA Code of Professional Conduct
The SEC reaches wider. It prohibits certain family members of covered persons from holding an accounting or “financial reporting oversight role” at the audit client. That role is defined broadly to include anyone in a position to influence the contents of the accounting records or financial statements, not just CFOs and controllers.
The One-Year Cooling-Off Period
Section 206 of the Sarbanes-Oxley Act created a cooling-off rule that has no AICPA equivalent for private audits. A firm is not independent if anyone in a financial reporting oversight role at the client served as the lead partner, the concurring review partner, or any other engagement team member who provided more than ten hours of audit, review, or attest services within the one-year period before the current audit began.6U.S. Securities and Exchange Commission. Commission Adopts Rules Strengthening Auditor Independence A senior associate who leaves the firm to become controller at a former audit client can therefore trigger a firm-wide independence violation unless a full year has passed.
Non-Audit Services the Auditor Can and Cannot Provide
Non-audit services are where the two regimes diverge most sharply. The SEC flatly prohibits an issuer’s auditor from providing any of the following during the audit and professional engagement period:1eCFR. 17 CFR 210.2-01 – Qualifications of Accountants
- Bookkeeping, preparing financial statements, or originating source data underlying them
- Designing or implementing financial information systems that generate information significant to the financial statements
- Appraisal, valuation, fairness opinions, or contribution-in-kind reports where results are likely to be material
- Actuarial services involving insurance reserves or related accounts
- Internal audit outsourcing
- Management functions, including acting as a director, officer, or employee
- Human resources services, including searching for or recommending candidates for management positions
- Broker-dealer, investment adviser, or investment banking services
- Legal services
- Expert services unrelated to the audit
No safeguard cures a violation of these prohibitions. Provide the service and independence is impaired.
The AICPA takes a fundamentally different approach for non-attest services to a private client. Most of these services are permissible if three conditions are met: the client’s management assumes responsibility for the results, management agrees to oversee the service and evaluate its adequacy, and the firm does not assume a management role. The firm documents the client’s understanding of those boundaries. A CPA can, for example, help a private company implement a new accounting system if client management directs the design choices and owns the final configuration.
Tax Services on Public Company Audits
General tax compliance and planning services are not on the SEC’s prohibited list, but the PCAOB adds restrictions of its own. Under PCAOB Rule 3522, a firm’s independence is impaired if it provides any service to an audit client related to marketing, planning, or supporting the tax treatment of a confidential transaction or an aggressive tax position transaction.7PCAOB. Ethics and Independence Rules Concerning Independence, Tax Services, and Contingent Fees An aggressive tax position is one the auditor initially recommended where a significant purpose is tax avoidance, unless the proposed treatment is at least “more likely than not” to be allowable. The AICPA framework has no equivalent categorical prohibition for private-client tax work; conflicts are evaluated through the threat-and-safeguard model.
Partner Rotation
The SEC mandates rotation. The lead engagement partner and the engagement quality reviewer must rotate off after five consecutive years and sit out for five full years before returning to the same client. Other audit partners covered by the rule can serve up to seven consecutive years and then must observe a two-year cooling-off period.4eCFR. 17 CFR 210.2-01 – Qualifications of Accountants A limited exception exists for small firms with fewer than five issuer clients and fewer than ten partners, if the PCAOB reviews those engagements at least once every three years.
The AICPA does not mandate partner rotation on private-company audits. Rotation of senior engagement personnel appears in the Code as one possible safeguard within the conceptual framework, not as a requirement.5AICPA. AICPA Code of Professional Conduct The same partner can lead a private-company audit for decades, provided the firm evaluates familiarity threats and applies appropriate safeguards. Some state boards impose rotation rules for particular engagements, so check the state level as well.
Contingent Fees and Internal Compensation
Both regimes prohibit contingent fees from audit clients, but the details diverge again.
The AICPA prohibits a member from performing any professional service for a contingent fee when the member’s firm also audits, reviews, or compiles that client’s financial statements. A separate prohibition bars contingent fees for preparing original or amended tax returns. An exception applies for tax matters where the fee is determined based on the findings of a government agency, if the member can show a reasonable expectation of substantive agency review at the time the fee arrangement was made.5AICPA. AICPA Code of Professional Conduct
The SEC prohibits any fee arrangement where the amount depends on the outcome of the service, including commissions and arrangements tied to metrics like tax credits generated. “Value added” bonuses are permitted only if the client determines the amount entirely at its own discretion, with no prior agreement linking the fee to results.8U.S. Securities and Exchange Commission. Revision of the Commission’s Auditor Independence Requirements
The SEC also reaches inside the firm’s compensation practices. Under Rule 2-01(c)(8), independence is impaired if any audit partner earns compensation based on selling non-audit services to that partner’s own audit client. The AICPA has no equivalent rule on internal compensation structures.
The Independence Time Period
The SEC defines an “audit and professional engagement period” that covers both the fiscal year being audited and the professional engagement period itself. The professional engagement period begins when the auditor signs the initial engagement letter or starts audit procedures, whichever comes first, and it does not end until either the firm or the client notifies the Commission that the relationship has terminated. A firm remains subject to SEC independence rules even during the gap between issuing one year’s report and beginning the next year’s fieldwork.4eCFR. 17 CFR 210.2-01 – Qualifications of Accountants
The AICPA applies independence during the “period of the professional engagement” and the “period covered by the financial statements” but does not extend the engagement period indefinitely. The obligation attaches to the specific engagement rather than running continuously until formal notice to a regulator.
Audit Committee Pre-Approval and Communications
Sarbanes-Oxley added a gatekeeping layer to public-company audits with no private-company parallel. Section 202 requires the issuer’s audit committee to pre-approve all audit and permitted non-audit services before work begins.6U.S. Securities and Exchange Commission. Commission Adopts Rules Strengthening Auditor Independence After-the-fact ratification is not enough.
PCAOB Rule 3526 adds a separate communication requirement. Before accepting an initial engagement, the firm must describe in writing to the audit committee all relationships between the firm and the potential client that could reasonably bear on independence, discuss the potential effects, and document the substance of the discussion. The firm must repeat these communications at least annually for ongoing audit clients and provide a written affirmation of its independence each year.9PCAOB. Section 3 – Auditing and Related Professional Practice Standards
Private-company audits under the AICPA framework have no formal pre-approval or audit committee communication mandate. Many private companies lack an audit committee at all. The AICPA relies instead on engagement letters, management representation letters, and the firm’s own quality-control systems.
What Happens When the Rules Are Broken
The consequences of an independence failure vary as much as the rules themselves. The SEC can pursue enforcement actions that carry substantial financial penalties, censures, and required overhauls of quality controls. In one action, PricewaterhouseCoopers agreed to pay more than $7.9 million in disgorgement, prejudgment interest, and civil penalties for independence violations tied to non-audit services, and was required to overhaul its independence monitoring controls.10U.S. Securities and Exchange Commission. SEC Charges PwC LLP With Violating Auditor Independence Rules and Engaging in Improper Professional Conduct An independence violation can also force the issuer to restate its financial statements and re-engage a different auditor.
The AICPA’s professional ethics division cannot impose monetary penalties. It can expel or suspend members for up to two years, publicly admonish them, or require corrective actions such as continuing professional education or outside review of workpapers.11AICPA & CIMA. Definitions of Ethics Sanctions/Disposition Expulsions and public admonishments are published. State boards of accountancy often take parallel action when the AICPA or SEC finds an independence violation, and a state board can revoke the CPA license itself.
The through-line for CPAs working across both regimes is straightforward: for issuer engagements, treat every SEC and PCAOB rule as the floor, then check whether AICPA guidance adds anything the SEC rule does not already cover. For private-company work, run the AICPA’s threat-and-safeguard analysis, document it, and confirm state-board rules haven’t imported a stricter requirement.