AICPA Covered Members and Independence Rules for CPA AUD

A covered member is a person or entity included in the AICPA Code’s independence restrictions for a particular attest client. The definition reaches beyond the engagement team: it can include other partners and managers, the firm and certain controlled entities. The six categories below explain who is covered.

For CPA AUD, identify the person’s relationship to the client before evaluating the financial interest or service. Apply the Code’s specific rule when one exists; use the conceptual framework for situations the rules do not address. Issuer audits also require the applicable SEC and PCAOB rules.

How much of AUD this is

Area I, Ethics, Professional Responsibilities and General Principles, is 15 to 25% of AUD, and its first group is ethics, independence and professional responsibilities. Four rule-makers sit inside that group, each with its own scope.

Rule-maker	Applies to	What the Blueprint asks
AICPA Code of Professional Conduct	Attest engagements generally	Apply its rules and interpretations, and its conceptual frameworks for members in public practice, members in business, and independence
SEC and PCAOB	Audits of issuers	Apply their ethical and independence requirements to situations arising in an issuer audit
GAO Government Auditing Standards	Government entities and recipients of federal awards	Apply the ethical requirements and independence rules
Department of Labor	Audits of employee benefit plans	Identify when an accountant would not be independent

Two structural facts make Area I cheaper than its weight suggests. The Blueprint puts Analysis and Evaluation in Areas II and III, so nothing here is examined above Application, and most independence questions are decidable: a relationship either impairs independence or it does not. One representative task now applies the Code to confidentiality "when using automated or third-party tools and techniques including artificial intelligence".

The Code, and who it binds

Independence is required for attest work and nothing else. In the AICPA's words, if you are engaged to perform only nonattest services, professional standards do not require you or your firm to be independent. A compilation is an attest engagement, yet a firm that is not independent may perform one if its report says so.

Independence has two halves and the Code treats both as real. Independence of mind lets you work without being affected by influences that compromise professional judgement. Independence in appearance means avoiding circumstances that would cause a third party to conclude otherwise, and that third party is not any observer: the test is a reasonable and informed third party who knows all the relevant information, including the safeguards you applied. That phrase is the one AUD hides in stems.

The conceptual framework: identify the threat, then look for a safeguard

The framework is the fallback, not the first move. Where the Code addresses your circumstance you follow it; the "Conceptual Framework for Independence" (ET section 1.210.010) is for what the Code does not reach. Identify threats, evaluate whether each is at an acceptable level, apply safeguards, then evaluate whether the safeguards worked. If they cannot, you change the circumstance, decline the engagement or resign.

The framework names seven threats: adverse interest, advocacy, familiarity, management participation, self-interest, self-review and undue influence. Safeguards come from three places: the profession, legislation or regulation; the attest client; and the firm. Threats are evaluated individually and in the aggregate, which is why a chain of small facts can add up to an impairment none causes alone.

One requirement is easy to forget and easy to examine: using the framework obliges you to document the threats identified and the safeguards applied. Fail to document and you have breached not the Independence Rule but the "Compliance With Standards Rule". AUD likes distinctions of that shape.

Covered member, and why that definition does most of the work

The rules do not apply uniformly to everyone in a firm. A covered member, in the AICPA's enumeration, is anyone on the attest engagement team; anyone in a position to influence it; a partner, partner equivalent or manager providing 10 or more hours of nonattest services to the attest client within any fiscal year; a partner or partner equivalent in the office where the lead attest engagement partner primarily practises on the engagement; the firm itself, including its employee benefit plans; and an entity controlled by any of those, alone or together.

Read the third and fourth limbs again: that is where the questions live. A tax partner who provides exactly 10 hours of nonattest work for an audit client in a fiscal year meets this covered-member threshold, and so does a partner who never touches the engagement but sits in the office where the lead partner practises. Neither has opened the audit file.

Two prohibitions bind every partner and professional employee, covered member or not: serving as a director, officer or employee of the client or in any capacity equivalent to management, as its promoter, underwriter or voting trustee, or as trustee of any of its employee benefit plans; and owning more than 5% of its equity, a limit extending to immediate family.

Family follows the covered member. Immediate family, meaning spouse or spousal equivalent and dependants, is held to the same rules you are, and where materiality matters their interests combine with yours. Close relatives, meaning parents, siblings and non-dependent children, are treated more loosely: if you are on the engagement team, independence is impaired where you are aware the relative holds an interest material to their net worth or giving significant influence over the client; if you are a covered member only through influence or the lead partner's office, it takes both.

Financial interests, loans, gifts and employment

These are the rules where materiality does not save you.

Relationship	The rule for a covered member
Direct financial interest	Impairs independence however immaterial, and a commitment to acquire one impairs it from the day it is signed.
Indirect financial interest	Impairs independence only if material, and the Code does not define materiality.
Loans	None to or from the client, its officers, its directors, or an owner with significant influence.
Loans from a lending institution client	Four are permitted: vehicle-collateralised loans and leases; credit card and overdraft balances kept current and not over US$10,000 by the payment due date; passbook loans fully collateralised by deposits there; loans fully collateralised by an insurance policy.
Gifts and entertainment	Accepting a gift that is not clearly insignificant impairs independence. Giving one is acceptable if reasonable in the circumstances, as is entertainment either way.
Employment with the client	A key position, one that prepares or can influence the statements or records, affects the firm unless your capital balance and retirement benefits are fixed and immaterial to it and you cannot influence the firm.
Unpaid fees	Since 2022 a threats and safeguards question, not a bright line: significant fees for services provided more than a year before the report date must be assessed.

Non-audit services, and the issuer overlay

For a private attest client the AICPA does not ban bookkeeping, valuation or internal audit assistance outright. It conditions them. Before the work starts the client must agree to assume all management responsibilities, to designate an individual with suitable skill, knowledge and experience to oversee the service, to evaluate its results, and to accept responsibility for it. You may not assume management responsibilities or appear to, and the understanding must be documented.

Make the client an issuer and the answer changes. During the audit and professional engagement period the SEC prohibits ten categories of service outright: bookkeeping, financial information systems design and implementation, appraisal or valuation services and fairness opinions, actuarial services, internal audit outsourcing, management functions, human resources, broker-dealer, investment adviser or investment banking services, legal services, and expert services unrelated to the audit. It bans any service supplied for a contingent fee or commission, and requires the audit committee to pre-approve everything else.

The SEC also counts years, which the Code does not. A lead partner or engagement quality reviewer may serve an issuer for no more than five consecutive years and must then stay off it for five; other audit partners are capped at seven years followed by two off. An engagement team member who moves into a financial reporting oversight role at the issuer breaks independence unless they were off the team for the year preceding the start of audit procedures for the period covering the hire. Four SEC rules apply only to issuer audits: that cooling-off rule, rotation, pre-approval, and the bar on paying an audit partner for selling other services.

PCAOB rules stack on top rather than replace. Rule 3520 requires independence throughout the audit and professional engagement period; 3521 bans contingent fees without the exception the SEC allows for fees fixed by judicial or agency outcomes; 3522 and 3523 restrict aggressive or confidential tax transactions and personal tax services for people in financial reporting oversight roles; 3524 and 3525 add pre-approval requirements; 3526 requires the firm to discuss independence with the audit committee. Where regimes overlap, the more restrictive governs.

Two smaller regimes finish Area I. GAO Government Auditing Standards cover government entities and recipients of federal awards, with their own framework and nonaudit services rules, and were rewritten in the 2024 revision (GAO-24-106786), effective for financial audits and attestation engagements for periods beginning on or after 15 December 2025; read its chapter 3 rather than assume the AICPA answer carries across. Department of Labor rules govern benefit plan audits and are blunt where the AICPA rules are conditional: a direct or material indirect interest in the plan or the plan sponsor disqualifies, as does serving as its promoter, underwriter, investment adviser, voting trustee, director, officer or employee, and so does maintaining the plan's records, with no safeguard available. An actuary associated with the firm may still provide actuarial services to the plan, which the SEC would not allow for an issuer.

A footnote worth carrying: the Blueprint still cites the Labor bulletin as 29 CFR 2509.75-9, a section removed on 6 September 2022 and replaced by Interpretive Bulletin 2022-01, at 29 CFR 2509.2022-01, which relaxed the rule for an incoming auditor who disposes of the sponsor's publicly traded securities before the engagement begins. Study the current text.

Where an internationally trained instinct goes wrong

The instinct	What AUD wants
Ask whether the entity is a public interest entity	Ask whether it is an issuer. That word decides whether SEC and PCAOB rules apply at all.
Apply the rules to the audit team and the firm	Apply them to covered members, which reaches the 10-hour nonattest partner and the lead partner's office but excludes much of the firm.
Reach for a fee dependency percentage	There is none. The AICPA says that unlike other standard-setters it does not specify a level, asking for a principles-based assessment instead.
Assume partner rotation is universal	The Code imposes no rotation. Long association is a familiarity threat handled through the framework; the year counts are an SEC rule for issuers.
Assume a small shareholding is fine if immaterial	A direct interest impairs independence at any amount. Materiality rescues only indirect interests.
Treat bookkeeping as always prohibited	Permitted for a private client if the general requirements are met, prohibited for an issuer, disqualifying for a plan.

Where to practise this

Start with the free AUD practice questions and explanations to try the public sample before creating an account.

Independence rewards drilling: the population of relationships is finite and the answers decidable. Prepito's AUD course covers Area I with practice questions, simulations and full explanations in English. The section is mapped in the CPA AUD study guide and the qualification in the CPA programme. None of this is the licensure ethics exam, a separate paper with its own pass mark: see The Ethics Exam After the CPA Exam.

CPA questions and written explanations are in English. Prepito’s interface is available in English and Arabic, and the AI tutor can respond in either language.

If you are sitting the Saudi Fellowship instead, its ethics content is the international code as endorsed: the same architecture, a different syllabus, covered in the SOCPA Audit study guide.

---

Sources: AICPA CPA Exam Blueprints effective 1 January 2026 for the AUD weights and references, the AICPA Code of Professional Conduct, the AICPA's Plain English Guide to Independence and its conceptual framework approach, SEC Regulation S-X Rule 2-01, PCAOB ethics and independence rules, GAO Government Auditing Standards, and the Department of Labor's interpretive bulletin on the independence of employee benefit plan accountants. Interpretations change continuously; confirm the current Code and Blueprint for your testing window.