Independence: the line between helping you and auditing you.

The attestation standards (AT-C section 105) require a practitioner to be independent to perform an examination. Independence is defined by the AICPA Code of Professional Conduct: its independence rule, a conceptual framework for identifying threats, and specific rules on services a firm may provide to a client it also attests for, called nonattest services.

The core idea is simple. A firm must not take on management responsibilities for an attest client, such as designing, implementing or operating internal control, making decisions on management's behalf, or owning the client's records. If it did, its opinion would be about its own choices.

These rules bind the CPA firm. A readiness provider that does not examine you is not giving an opinion, so its role is limited by a different principle: decisions stay with your management.

Self-review

The firm tests controls it designed, or evidence it produced. It is unlikely to find fault with its own work.

Management participation

The firm makes decisions only management should make, such as which controls to adopt or which risks to accept.

Advocacy

The firm promotes your position to buyers or regulators, which sits badly with judging it.

Self-interest

The firm's fees or finances depend on the outcome, such as a fee tied to a clean opinion.

Familiarity

Long or close relationships blunt professional scepticism.

Undue influence

Pressure from the client to reach a particular conclusion.

1. Engage the readiness provider and the CPA firm separately, with separate contracts.
2. Record management's decisions: which recommendations were adopted, by whom, when.
3. Make sure every control has an internal owner who runs it, not an outside adviser.
4. Disclose the readiness provider's role to the CPA firm at the start.
5. Ask both parties about referral fees or commissions between them, and get the answer in writing.
6. Keep the CPA firm out of design work once it is engaged to examine.

• To the CPA firm. How have you assessed your independence from us, and from anyone who prepared us?
• To the CPA firm. Have you or an affiliate provided any other services to us in the past year?
• To the CPA firm. Do you pay or receive any fee connected with referring us?
• To the readiness provider. Which deliverables will we need to adopt and own as management?
• To the readiness provider. Will anything you do count as operating a control on our behalf?
• To yourselves. Could we explain every control to the auditor without our adviser in the room?

Sources: AICPA attestation standards AT-C section 105 (independence as a condition of an attestation engagement); AICPA Code of Professional Conduct, independence rule, conceptual framework and nonattest services interpretations; AICPA Guide, SOC 2 Reporting on an Examination of Controls at a Service Organization.