Redwood Assurance LLC is finishing a 12/31/2026 review engagement for Harbor Health Clinics, Inc., and the engagement partner, Elena Cruz, gets pulled into four requests that happen in real firms. A bank covenant is tight, Harbor’s CFO asks for help drafting a covenant add-back memo, and Elena is offered a $15,000 success bonus if the covenant is met. At the same time, Elena’s spouse is applying for a controllership job at Harbor, and Redwood wants to showcase Harbor’s turnaround in marketing. Each item feels operational, but each one can create an ethics threat that can affect what we can accept, what safeguards we need, or whether we have to change the relationship or step away.
The conceptual framework is what we use when the Code does not hand us a simple, single interpretation that answers the fact pattern. For members in public practice, that framework is in ET 1.000.010, and it tells us to identify threats, evaluate whether they are at an acceptable level from the perspective of a reasonable and informed third party, and apply safeguards when needed. For members in business, the parallel framework is ET 2.000.010, and the first practical decision is always which part of the Code applies to the role we are acting in when the issue arises.
When the issue hits, we start with where it lives in the Code, not with the label we want to give it. The Preface applies to all members, then 0.200 explains how the Code is structured and how to cite it, and Parts 1 and 2 are split by role. Part 1 applies when we are providing professional services as a member in public practice, and Part 2 applies when we are in an employment context as a member in business. If a member has multiple roles, the Preface says we consult all applicable parts and apply the most restrictive provision. That matters here because Elena’s spouse’s job search and Redwood’s marketing pressure can overlap professional, personal, and firm interests, and we need the strictest applicable rule set.
A fast navigation check that prevents miscitation is to place the conceptual frameworks before we analyze any threats. ET 1.000.010 sits in Part 1 as the Conceptual Framework for Members in Public Practice, and ET 2.000.010 sits in Part 2 as the Conceptual Framework for Members in Business. Interpretations then sit under the relevant rule topics and are meant to guide scope and application, with departures requiring justification in a disciplinary setting, which is why we cite the right section and document our reasoning when the fact pattern is not directly answered. The Code’s structure language in 0.200 is the map that keeps our conclusion tied to the right authority. To apply that map to Elena’s four issues, we first decide where each issue belongs in the Code. Here is the matching exercise:
After mapping, we have a clearer starting point for the analysis because each issue is anchored to the member’s role and the Code’s organization, which is what we need before evaluating threats and safeguards.
A situation becomes an ethics workpaper when we can describe the threat and explain why the safeguards do or do not reduce it enough. The conceptual framework for a member in public practice is a threats and safeguards approach that requires professional judgment and evaluates the facts through the perspective of a reasonable and informed third party who is aware of the relevant information. Under ET 1.000.010, we identify threats, evaluate their significance individually and in the aggregate, identify and apply safeguards when threats are not at an acceptable level, and then evaluate whether the safeguards are effective. The same workflow exists for a member in business under ET 2.000.010, and our first step is still to name the threat category before we debate the fix.
The Code groups threats into seven categories that we use as our sorting bins. A threat is a relationship or circumstance that could compromise compliance, and the seven categories in the framework are adverse interest, advocacy, familiarity, management participation, self-interest, self-review, and undue influence. The categories matter because they push us toward different safeguards. Management participation and self-review threats often point to changing who performs a service or whether we can perform it for an attest client at all, while self-interest threats often point to changing compensation arrangements or removing a person from the engagement. Before we evaluate significance, we need to classify the threats created by the four facts in the case. Sort each item into the threat bucket it best fits: