Advanced Audit and Assurance (International) · Code of Ethics for Professional Accountants

Threats and Safeguards under the Conceptual Framework

Updated 11 October 2026 · Fact-checked

The Conceptual Framework asks you to identify threats to compliance with the fundamental principles, evaluate whether they are at an acceptable level, and address any that are not. The five threats are self-interest, self-review, advocacy, familiarity and intimidation. You address them by eliminating the cause, applying safeguards, or declining or ending the engagement.

Understand Threats and Safeguards under the Conceptual Framework

The IESBA Code of Ethics does not give you a fixed list of banned situations. It gives you a framework. You apply it to the facts in front of you. The aim is to protect the fundamental principles: integrity, objectivity, professional competence and due care, confidentiality, and professional behaviour.

A threat is a circumstance that could compromise those principles. The Code groups threats into five types. A self-interest threat arises when the firm or a person in it has a financial or other interest that could influence judgement. A self-review threat arises when you must re-evaluate your own earlier work or that of your firm. An advocacy threat arises when you promote a client's position so far that objectivity is compromised. A familiarity threat arises from a close or long relationship that makes you too sympathetic to, or trusting of, the client. An intimidation threat arises when you are deterred from acting objectively by actual or perceived pressure.

The Code then asks a three-part question. Is the threat at an acceptable level? That means a reasonable and informed third party would likely conclude that compliance with the principles is not compromised. If yes, no further action is needed. If no, you must address it.

There are three ways to address a threat. Eliminate the circumstances causing it. Apply safeguards, which are actions that effectively reduce the threat to an acceptable level. Or decline or end the specific engagement or relationship if neither works. For audit clients, the Code's independence provisions add detailed requirements, and in some cases no safeguard can work.

In the exam, the skill is not recalling a list. It is spotting the threat in a scenario, naming it correctly, explaining why it matters, and proposing practical, proportionate responses.

Key rules to remember

Five categories of threat: Self-interest, self-review, advocacy, familiarity, intimidation; Name the category exactly and link it to a fact in the scenario.
Conceptual Framework approach: Identify threats → Evaluate them → Address them; Evaluation asks if the threat is at an acceptable level, using the reasonable and informed third party test.
Ways to address a threat: Eliminate the circumstances, or apply safeguards, or decline or end the engagement; If no safeguard can reduce the threat to an acceptable level, you must decline or end the engagement or relationship.
Reasonable and informed third party test: Would a reasonable and informed third party likely conclude that compliance with the fundamental principles is not compromised?; This is an objective test, not your own opinion.
Fundamental principles: Integrity, objectivity, professional competence and due care, confidentiality, professional behaviour; Say which principle is put at risk by each threat.

How to solve Threats and Safeguards under the Conceptual Framework questions

Use the same sequence for every ethics requirement, whether it asks for threats, safeguards or advice to a partner.

1Read the requirement. Note whether it asks you to identify, evaluate, recommend or advise on a decision.
2Scan the scenario and underline each ethical fact: relationships, fees, shareholdings, extra services, pressure, long tenure, gifts.
3For each fact, name the threat category. Some facts create more than one threat, so say so if justified.
4Explain why it is a threat in this case. Link it to a fundamental principle, usually objectivity or integrity, and to the people or numbers in the scenario.
5Evaluate whether it is at an acceptable level. Consider size, closeness and whether the client is a PIE (which includes listed entities), where the standards are stricter.
6Recommend responses that fit the threat: eliminate it, apply a specific safeguard, or decline or withdraw. Say who does what.
7Reach a clear conclusion on whether the firm can continue, and say what would change your view. Add communication to those charged with governance if relevant.

Quickest way: Fact – Threat – Why – Response

When to use it: Use when time is short and the scenario lists several ethical issues. It fits a mark-per-point answer layout.

List each issue on its own line as a short heading using the scenario's wording.
Write the threat type next to it.
Write one sentence on why it affects objectivity or integrity in this case.
Write one specific response and a conclusion such as acceptable, safeguard needed, or must decline.
Check each issue has a response before moving on.

Common mistakes in Threats and Safeguards under the Conceptual Framework

Listing the five threats with definitions but not applying them to the scenario.
Students memorise the list and treat it as a recall question.
Fix: Quote the scenario fact first, then name the threat. Marks are for application.
Naming the wrong threat, such as calling a long audit tenure self-interest.
Threat labels overlap and students guess.
Fix: Match the cause to the label. Long association is familiarity. Reviewing your own work is self-review. Pressure from a client is intimidation.
Suggesting generic safeguards like 'train staff' for every threat.
Students want a safe answer and do not think about what the threat needs.
Fix: Choose a safeguard that directly reduces that threat, such as a separate team for non-assurance work or an independent review of the audit file.
Assuming a safeguard always fixes the problem.
The word 'safeguards' in the topic title suggests every threat has one.
Fix: State when no safeguard is enough. Then recommend eliminating the cause or declining or ending the engagement.
Skipping the evaluation and jumping to safeguards.
Students rush to the response that feels like the answer.
Fix: Add one line on whether the threat is at an acceptable level, and why, before you recommend action.
Ignoring the status of the client, such as a listed entity.
Students read the numbers but not the entity type.
Fix: Note if the client is a PIE (which includes listed entities), because the independence provisions are stricter and more things may be prohibited.

Worked examples

Example 1

Bryant & Co audits Kestrel Ltd, a private company. The audit senior, Dev, has been on the engagement for six years. This year Kestrel's finance director offered Dev a place on a social weekend away and told the audit manager that the audit fee for next year is under review. Identify the ethical threats and recommend responses. (6 marks)

Show the solution

Long involvement of Dev: this is a familiarity threat. After six years Dev may trust management too much and apply less scepticism.
Social weekend offered by the finance director: this is also a familiarity threat, and a possible self-interest threat if Dev feels obliged to the client. A weekend away is not clearly insignificant in value, so the threat is not at an acceptable level.
Fee under review mentioned to the manager: this is an intimidation threat, because the client may be implying that the fee depends on a cooperative audit. It is also a self-interest threat because the firm values the fee.
Evaluate: the gift or hospitality should only be accepted if its value is clearly insignificant. A weekend away is unlikely to be, so the threat is not at an acceptable level as offered.
Responses: decline the weekend away and record the offer under firm policy. Rotate Dev off the team or add a review by a partner not on the engagement.
Respond to the fee comment: the audit partner should tell the finance director that the fee is based on work and risk, not on the outcome. Record the discussion and, if pressure continues, discuss it with those charged with governance.

Answer: There are three issues. Long association and hospitality create familiarity and self-interest threats. The fee comment creates intimidation and self-interest threats. The hospitality should be declined. Dev should be rotated or the work reviewed independently. The partner should state that fees are not linked to audit outcomes and escalate if pressure continues.

Example 2

Harlow LLP audits Orbis plc, a listed company. Harlow's advisory team has been asked to design and implement Orbis's new inventory valuation system. The same firm will audit inventory in the financial statements. Evaluate the threat and advise whether Harlow can accept. (5 marks)

Show the solution

Identify the threat: the firm would design a system and then audit the figures it produces. This is a self-review threat. There is also a management responsibility concern, because designing and implementing the system may mean taking decisions that belong to management. The Code prohibits a firm from taking on management responsibility for any audit client.
Link to the scenario: inventory valuation affects the financial statements, so any error in the design could flow into the numbers Harlow then audits.
Evaluate: Orbis is listed, so it is a PIE. For a PIE audit client, the firm must not provide IT systems services where the system forms a significant part of internal control over financial reporting, or generates information that is significant to the accounting records or financial statements. An inventory valuation system is likely to meet that test. It produces the inventory figures that go into the accounting records and the financial statements, and it is likely to be a significant part of the controls over reporting inventory. So this work is likely to be prohibited.
Consider safeguards: because the service is likely to be prohibited, no safeguard can reduce the threat to an acceptable level. Using a separate team would not change that.
Conclude: Harlow must decline the system design and implementation work. Orbis should use another provider. Harlow should also tell those charged with governance at Orbis about the request and its decision to decline.

Answer: This is a self-review threat, with a risk that Harlow takes on management responsibilities, which the Code prohibits for all audit clients. Orbis is listed, so it is a PIE. An inventory valuation system is likely to be a significant part of internal control over financial reporting and to generate information significant to the accounting records and financial statements, so the Code prohibits Harlow from designing or implementing it. No safeguard can reduce the threat to an acceptable level. Harlow must decline the work, Orbis should use another provider, and Harlow should inform those charged with governance.

Exam tips

Always tie the threat to a fact in the scenario. A bare list of threat names earns little.
Use the exact category labels from the Code. Examiners look for them.
Give a specific safeguard for each threat and say who applies it, such as the engagement partner or the ethics partner.
Say when a threat cannot be safeguarded and recommend declining or withdrawing. That judgement earns professional skills marks.
Check whether the client is a PIE (which includes listed entities). It changes what is acceptable.

Practice questions from Code of Ethics for Professional Accountants

Threats and Safeguards under the Conceptual Framework in other exams

The same ground in other exams, if you are preparing for more than one or want another angle on it.

ACCA Applied SkillsConceptual Framework and Threats to Independence

Threats and Safeguards under the Conceptual Framework: frequently asked questions

What are the five threats in the IESBA Code?

They are self-interest, self-review, advocacy, familiarity and intimidation. Each describes a different way the fundamental principles could be put at risk. In the exam you must match each one to a fact in the scenario.

What is the difference between self-interest and self-review threats?

A self-interest threat comes from a financial or other interest that could influence your judgement, such as a fee dependency. A self-review threat comes from having to evaluate work that you or your firm did earlier. The second is about checking your own work, the first is about benefit.

What counts as a safeguard?

A safeguard is an action that effectively reduces a threat to an acceptable level. Examples are a review by a partner not involved in the engagement, using separate teams, or rotating staff. Safeguards must fit the threat. Some threats cannot be reduced enough and you must decline or end the engagement.

How should I lay out an answer on threats and safeguards?

Use a short block for each issue. State the fact, the threat type, why it matters, and the response. Finish with a conclusion on whether the firm can continue. This makes it easy for the marker to award marks.