Advanced Audit and Assurance (International) · Professional and ethical developments

IESBA Code of Ethics: Fundamental Principles and Threats

Updated 11 October 2026 · Fact-checked

The IESBA Code sets five fundamental principles: integrity, objectivity, professional competence and due care, confidentiality, and professional behaviour. You apply a conceptual framework: identify threats to compliance, evaluate whether they are at an acceptable level, and address unacceptable threats with safeguards, or by declining or ending the engagement.

Understand IESBA Code of Ethics: Fundamental Principles and Threats

The IESBA Code of Ethics for Professional Accountants is the international ethics standard that ACCA's AAA International paper examines. It does not try to list a rule for every situation. Instead it gives you principles and a method for reasoning through any situation.

The five fundamental principles are:

Integrity: be straightforward and honest in all professional and business relationships.
Objectivity: do not let bias, conflict of interest or undue influence override your professional judgement.
Professional competence and due care: keep your knowledge and skill at the level needed, and act diligently in line with technical and professional standards.
Confidentiality: respect the confidentiality of information you acquire, and do not disclose or use it without proper authority, unless there is a legal or professional right or duty to disclose.
Professional behaviour: comply with relevant laws and regulations and avoid conduct that you know, or should know, might discredit the profession.

The method is the conceptual framework. You must identify threats to compliance with the fundamental principles, evaluate whether each threat is at an acceptable level, and address any threat that is not acceptable. A threat is at an acceptable level when a reasonable and informed third party would likely conclude that compliance with the principles is not compromised.

There are five categories of threat: self-interest, self-review, advocacy, familiarity and intimidation. A safeguard is an action, or a combination of actions, that effectively reduces a threat to an acceptable level. The Code also speaks of eliminating the circumstances that create the threat. If no action can address the threat, you decline or end the specific engagement, or the relationship.

The key distinction for the exam: a threat is the risk to your compliance with a principle. A safeguard is what you do about it. Do not mix them up.

Key rules to remember

Five fundamental principles: Integrity, Objectivity, Professional competence and due care, Confidentiality, Professional behaviour; Memory aid: I-O-P-C-P. Name the principle that is at risk in every answer.
Five categories of threat: Self-interest, Self-review, Advocacy, Familiarity, Intimidation; Each threat must be tied to a fact in the scenario, not just named.
Conceptual framework steps: Identify threats → Evaluate (acceptable level?) → Address (eliminate, safeguard, or decline/end); Use this order for every ethics requirement.
Acceptable level test: Reasonable and informed third party would likely conclude compliance with the principles is not compromised; Judge from the view of a neutral outsider with the relevant facts, not from your own view.

How to solve IESBA Code of Ethics: Fundamental Principles and Threats questions

Use the same structure for any ethics requirement. It keeps your answer organised and earns both technical and professional skills marks.

1Read the requirement. Note whether it asks for threats, safeguards, or whether to accept or continue the engagement.
2Pick out each ethical fact in the scenario: fees, relationships, shareholdings, services, pressure, gifts, information held.
3For each fact, name the threat category and the fundamental principle at risk. Explain why in one sentence using scenario detail.
4Evaluate the significance. Consider size of the fee, closeness of the relationship, seniority of the people involved and whether the matter is quantitative or qualitative. State whether a reasonable and informed third party would see it as acceptable.
5Address unacceptable threats. Give specific safeguards that fit the facts, such as a different team, a second partner review or disclosure to those charged with governance. If nothing works, say decline or withdraw.
6Link to the wider context where relevant, such as public interest entity status or firm policies, and then give a clear recommendation.
7Conclude with a decision. Professional skills marks reward a clear, justified conclusion.

Quickest way: Threat, principle, action

When to use it: Use this when time is short and the scenario lists many ethical issues in a short paragraph.

Underline each ethical fact as you read.
Next to each, write the threat letter: SI, SR, A, F or I.
Write the principle at risk, usually objectivity or integrity.
Write one fitting safeguard, or write decline if the threat is too serious.
In the answer, use one short paragraph per issue: Issue, Threat, Why, Action.

Common mistakes in IESBA Code of Ethics: Fundamental Principles and Threats

Listing threats without linking them to scenario facts.
You memorise the five names and write them down as a definition list.
Fix: Quote the fact, then name the threat and explain the link in one sentence.
Treating a safeguard as if it were a threat, or the reverse.
The words sound similar and students rush.
Fix: Remember: threat = what could compromise the principle; safeguard = what reduces it.
Proposing a safeguard that does not match the threat.
You use a standard safeguard such as an independent review for every issue.
Fix: Ask whether the safeguard actually removes the cause. A review will not fix a financial interest in the client, which needs the interest to be disposed of.
Assuming safeguards always work.
You think every threat can be managed.
Fix: Say when a threat is too significant and the right action is to decline or end the engagement.
Confusing the fundamental principles with the threats, for example calling self-review a principle.
Both lists are short and memorised together.
Fix: Principles are what you must comply with. Threats are what endanger compliance.
Giving a long theoretical answer without a recommendation.
You run out of time or forget the professional skills element.
Fix: End each issue with a decision and a final overall conclusion.

Worked examples

Example 1

Your audit firm audits Kestrel Ltd. The audit senior, Priya, owns shares in Kestrel that are material to her personal wealth. The audit manager has also been asked by Kestrel's finance director to accept a large gift of hospitality tickets. Identify the threats and recommend actions.

Show the solution

Priya's shareholding: this is a self-interest threat to objectivity, because she benefits financially from the client's performance and may be reluctant to challenge the numbers.
Significance: the holding is material to her, so a reasonable and informed third party would likely see it as unacceptable.
Action for the shareholding: the interest must be eliminated by disposing of the shares, or Priya must be removed from the audit team. A review by a colleague would not remove the interest itself.
Hospitality tickets: the Code says an accountant must not accept an inducement if the intent is, or is perceived to be, improper. Otherwise the manager must evaluate the threats. If the gift is not clearly insignificant, the threat is likely to be unacceptable, so the manager should decline it. Large tickets offered by the finance director are clearly not insignificant.
Because the finance director is responsible for the numbers the firm audits, the offer could influence the manager's behaviour, or be seen to. We do not know the finance director's actual intent, but the perception matters. It is mainly a self-interest threat, and it may also create a familiarity threat or an intimidation threat if the manager feels pressure to return the favour. Integrity and objectivity are the principles at risk.
Action for the gift: large hospitality from the finance director would very likely be an unacceptable threat, so decline the tickets, report the offer to the engagement partner and record it under firm policy. Consider whether those charged with governance should be told.

Answer: Priya's shares create a self-interest threat to objectivity that is not acceptable, so she must dispose of them or leave the team. The manager must not accept the hospitality if the intent is, or is perceived to be, improper. Even if not, the tickets are not clearly insignificant, so the threat is likely unacceptable. The manager should decline them and report the offer to the engagement partner.

Example 2

Harbour & Co, an audit firm, has audited Zenith plc for eight years. The firm's tax team prepared Zenith's tax computations, and the same audit team now audits the tax balances in the financial statements. The audit partner has also had lunch with the chairman every month for years. Explain the threats and how they may be addressed.

Show the solution

Tax computations then audited by the same firm: this is a self-review threat to objectivity, because the firm reviews work it prepared itself.
First establish whether Zenith is a public interest entity (PIE). As a plc it may well be listed, so this must be checked.
If Zenith is a PIE: R604.10 prohibits the firm from providing tax calculation services for current and deferred tax liabilities or assets where the effect is material to the financial statements. Where it applies, no safeguard can address the threat. If the effect is not material, evaluate the threat as for a non-PIE.
If Zenith is not a PIE: the firm must evaluate the self-review threat. It may apply safeguards, such as using professionals who are not on the audit team to provide the service, or having another professional review the audit work, but only if they reduce the threat to an acceptable level.
If the threat cannot be reduced to an acceptable level, the firm must decline or stop the tax service. If that is not possible, it must end the audit.
Monthly lunches with the chairman: this is a familiarity threat to objectivity, because close personal contact may make the partner too sympathetic to the chairman's views. Evaluate how often the contact occurs and what it involves. Eight years of audit by the firm is not unacceptable in itself.
If Zenith is a PIE: the engagement partner's time on the engagement is limited to seven years, followed by a five-year cooling-off period. The scenario gives the firm's tenure of eight years, not the partner's own. Check how long the partner has actually served. The firm's eight-year tenure does not by itself trigger rotation.
If Zenith is not a PIE: rotation is just one possible safeguard for a long association. Other safeguards are a second partner or engagement quality review and a firm policy on social contact. If the relationship continues unchanged and the threat stays significant, the partner should leave the engagement.

Answer: The tax work gives a self-review threat. If Zenith is a PIE, R604.10 prohibits tax calculation services for current and deferred tax where the effect is material to the financial statements. If it is not a PIE, or the effect is not material, the firm must evaluate the threat and apply safeguards, such as staff outside the audit team or review by another professional, only if they reduce it to an acceptable level. Otherwise the firm must decline the tax service or end the audit. The lunches give a familiarity threat. If Zenith is a PIE, the engagement partner is limited to seven years on the engagement, followed by a five-year cooling-off period. The firm's eight-year tenure does not by itself trigger rotation, so check the partner's own time on the engagement. If Zenith is not a PIE, rotation is one safeguard alongside a second review and limits on social contact.

Exam tips

Always tie each threat to a named fact in the scenario. A bare list of the five threats earns very little.
Name the principle at risk as well as the threat. Examiners look for both.
Match safeguards to the threat, and say plainly when a threat cannot be addressed and the firm must decline or withdraw.
Finish with a clear recommendation. This supports the professional skills marks for judgement and communication.
Write short paragraphs, one per ethical issue, so the marker can find each point quickly.

Practice questions from Professional and ethical developments

IESBA Code of Ethics: Fundamental Principles and Threats in other exams

The same ground in other exams, if you are preparing for more than one or want another angle on it.

IESBA Code of Ethics: Fundamental Principles and Threats: frequently asked questions

What are the five fundamental principles in the IESBA Code?

They are integrity, objectivity, professional competence and due care, confidentiality, and professional behaviour. Every ethics answer should refer to the principle that is at risk.

What is the difference between a threat and a safeguard?

A threat is a circumstance that could compromise your compliance with a fundamental principle. A safeguard is an action, or set of actions, that effectively reduces that threat to an acceptable level.

What are the five categories of threat with examples?

Self-interest: owning shares in a client. Self-review: auditing work your firm prepared. Advocacy: promoting a client's shares. Familiarity: a long, close relationship with the client's management. Intimidation: a client threatening to remove the firm unless it agrees to an accounting treatment.

What if no safeguard can reduce the threat?

If the threat cannot be eliminated or reduced to an acceptable level, you must decline or end the specific engagement, or the relationship, where that is permitted. Say this clearly in your answer.