Knowing the Risks When Following the AICPA’s Code of Professional Conduct

Background

Ethical standards and legal protections fall under different types of authorities. The AICPA Code of Professional Conduct defines ethical obligations and auditor independence rules for CPAs. State public interest laws generally require CPAs to follow this code, but these public interest laws generally do not address the other side of the equation; that is, what protections are extended when the code is followed. The code itself establishes professional ethical obligations but does not independently create statutory legal protections. This does not reflect a failure of the code or the ethical standards expressed in it, but rather a significant misalignment between expectations of professionals and the legal protections they are afforded. Legal protections, where they exist, arise from statutory frameworks such as the Sarbanes-Oxley Act (SOX) and the Dodd-Frank Act, which operate independently of the AICPA Code.

While employees upholding ethical standards may not have access to clear or effective legal protections; depending on the circumstances, employers’ labor decisions are generally protected by states’ at-will employment laws. Thus, there is an uneven playing field, and employers have the upper hand. At-will employment laws allow an employer to terminate an employee for any reason that is not explicitly illegal, even if unfair or unjust. While the origins and policy rationale of at-will employment laws are subject to debate, at-will laws generally allow employers to make employment decisions that may not be effectively contested in court.

Legal protections afforded under SOX and other federal laws are primarily extended to whistleblowers who report violations. Whistleblower protections, under certain circumstances, may be extended to accounting professionals under SOX, the Dodd-Frank Act, or the SEC’s rules. More broadly, whistleblower protections, under certain circumstances, may be extended to any individual under these same laws as well as under non-discrimination laws and many environmental laws. Non-discrimination and environmental laws, however, do not afford protections for taking ethical positions, particularly regarding financial reporting.

There were roughly 4,700 public companies in the United States in 2025. Direct employees of those companies may be extended whistleblower protections via SOX. Employees of private, foreign, and non-exchange-traded (e.g., having only public debt) companies generally fall outside of the scope of SOX whistleblower protections unless they qualify as employees of contractors, subcontractors, or agents of a public company under section 806. Employees of subsidiaries, affiliates, and contractors to public companies are generally intended to be covered by SOX, but such employees have a somewhat more difficult path to coverage. For example, when the subsidiary, affiliate, or contractor to a public company is also a private company or not under the absolute control of the public parent, whether SOX is applicable is up to the court.

Most CPAs probably assume they are not whistleblower candidates, yet having once learned of an illegal activity, a CPA cannot readily ignore it and still uphold his or her ethical standards. Whistleblowing occurs when someone, usually an employee or contractor, reveals information about the illegal, unsafe, or fraudulent activities of an organization to an appropriate authority. Internal company or government authorities are generally accepted. Claims of retaliation usually accompany allegations of illegal activities, as the employee or contractor who acts as a whistleblower usually suffers at least one form of retaliation, often termination.

Firms have responsibilities to both the client and the public interest in the case of a client failing to adequately address an issue contested by an auditing firm, and the firm may choose to withdraw from the engagement rather than act as a whistleblower. Auditors’ professional and legal responsibilities in such circumstances are governed by applicable auditing standards and by relevant legal obligations, which may require communication with those charged with governance and, in certain circumstances, withdrawal from the engagement.

SOX requires publicly registered auditing firms to adhere to the PCAOB’s ethical standards. Retaliation against an auditor who follows the PCAOB’s ethical standards is unlawful under SOX, and generally the same whistleblower protections are available under SOX to auditors as to others. Firms and their employees have, in practice, sought SOX whistleblower protections as contractors to their public clients.

A Personal Journey

This author learned of the limited legal protections the hard way, through personal experience. The author was a licensed CPA with an active standing for 40 years, was last in the position of vice president (finance) and corporate controller for a large US manufacturing company that is a subsidiary of a large foreign-owned parent and an affiliate, partner, and contract-service provider to two large US public companies. The author learned of an internal investigation into a probable environmental-reporting fraud that potentially represented a significant contingent liability due to fines that could be levied by government authorities.

After discussing the matter with the CEO and agreeing to defer recognition of a contingent liability until an investigation had been conducted, the author responded to standard quarterly inquiries from the company’s external auditors, advising them of the potential environmental fraud and contingent liability, as required by the AICPA’s Code of Professional Conduct. The auditors, as required, reported the investigation into environmental fraud, subject to significant financial fines, to the company’s audit committee and board. After receiving communications from board members expressing displeasure with the company digging up dirt on itself, the CEO, in thinly veiled communications, asked the author to find a way to cover up the investigation. Upon the author’s refusal to do so, the CEO promised to complete the investigation and self-report the findings to the authorities, but the CEO never followed through on these promises. Instead, the author was terminated for his communications with the auditors and board members and for the prevention of financial frauds that the CEO attempted in the interim period.

The author researched legal protections extended to CPAs following the AICPA’s Code of Professional Conduct, only to find that such legal protections are severely limited or non-existent.

The author then sought protections under:

• SOX, as several financial frauds had been prevented, as two financial frauds stemming from environmental violations were pending, as the employer’s two subsidiaries were also affiliates to public companies, and as management, service, supply, and other contracts existed between the employer, including its subsidiaries, and two public companies;
• The Clean Air Act (CAA), based on having reported violations to the auditors, audit committee, and board;
• Utah’s public interest law, contending that the requirement of a CPA to uphold the AICPA’s Code of Professional Conduct, indirectly referenced in the law, should be supported; and
• Utah’s contract law, contending that the company’s own code of conduct, a compulsory agreement that the author was required to sign and uphold, had been violated via the retaliatory termination.

Based on experiences stemming from the events and legal cases noted above, the remainder of this article will note legal hurdles involved in securing protection, illustrative examples of what can transpire, and practical ideas for CPAs who may find themselves in similar circumstances. Most of the author’s experiences pertain to claims under SOX and the CAA within the Department of Labor’s (DOL) administrative law courts. Some of the hurdles in securing protections under federal laws involve procedural issues within the DOL, so those will be noted. The author will then briefly address his experiences with state contract law and state public interest laws.

Initial Proceedings

With some exceptions, whistleblower claims under federal laws, like SOX and the CAA, must first be filed with the Occupational, Safety, and Health Administration (OSHA), which investigates the claims. Then, if necessary, and as is often the case, OSHA’s findings are appealed to administrative law courts within the DOL. This is the usual route for retaliation claims involving financial fraud, environmental issues, or workplace safety.

After an administrative law judge (ALJ) rules on the claims, appeals to the DOL’s Administrative Review Board (ARB) may be filed. The ARB’s rulings may be appealed to a Federal District Court. Appeals to the ARB or a Federal District Court usually require issues of law to be raised, as opposed to a reexamination of the facts and circumstances.

The initial complaint/claim may be filed electronically with OSHA. Various federal statutes stipulate different deadlines, often starting 30 days from the date of the alleged violation (e.g., termination or demotion). Case law has recharacterized the filing period to commence with the date that notice of the violation is provided to the employee. If the employer provided enough advanced notice, a complaint could be due before retaliation even occurs. Most employees probably do not know about the laws or their right to file a complaint with OSHA. The courts’ insistence that a notice date starts the clock, rather than the date of retaliation, probably leads many employees to miss the filing deadlines.

The filing period for a SOX whistleblower complaint with OSHA is longer; within 180 days of the alleged retaliation or when the employee became aware of the retaliation (this primarily references the notice date). The SOX complaint filing period may be longer depending upon pertinent state laws.

OSHA will investigate whistleblower complaints of retaliation under most federal laws. OSHA may consider the relatively short time frame of three months or less between a whistleblowing incident and a retaliatory event as one factor in assessing whether a retaliatory action may be causally connected to the protected activity. In practice, cases in which an adverse action closely follows protected activity are generally easier to support.

While OSHA can subpoena information and witnesses during an investigation, in the author’s case, OSHA only requested both parties respond to the complaint’s allegations. Because an employer typically keeps pertinent records and a former employee no longer has access to those records, the employer is placed in a favored position in the early stages of the process. In practice, OSHA’s limited-scope investigations may contribute to the frequency with which cases are appealed to the DOL’s administrative courts. An appeal to the administrative courts must generally be filed within 15 days of receipt of OSHA’s rulings.

Plaintiffs may represent themselves within the DOL’s administrative law courts. This is generally not recommended, as the legal system is complex and people often have difficulty recounting the pertinent parts of their own stories, but it can make the process more affordable.

SOX specifies that the employees of subsidiaries and affiliates of publicly traded companies are covered, but because subsidiaries and affiliates may be jointly owned and operated with private companies, and because companies use corporate veils to make related-parties appear unrelated or immaterial, there is uncertainty as to whether a court will decide that SOX applies to the employees of a private subsidiary or affiliate.

The ARB, the appellate authority within the DOL overseeing federal claims related to retaliation against whistleblowers, recently noted that SOX covers affiliates of public companies, but that the courts have yet to come up with a practical working definition of an affiliate, particularly one applicable to a private affiliate with a joint, private owner. At the time of this writing, the ARB is still considering whether the private affiliate to a public company for whom the author worked, which was also a subsidiary to a private foreign company, is covered by SOX.

In the author’s case, SOX protections were denied him as an employee of a private subsidiary of a public company because the ALJ considered the number of (wholly owned) holding companies between the subsidiary and the public parent to make the relationship too remote and the economic impact of the fraud immaterial, presumably due to the (non-existent) dilution of ownership.

The fact that the public company’s notes to the financial statements did not clearly communicate the method used to account for the private subsidiary did not help. The ALJ’s denial was rendered despite the public company stating that its 50%-owned private subsidiary was an important part of its integrated business and that the subsidiary and public parent were subject to service, partnership, and supply contracts with the author’s joint employers.

Determining Control

Under GAAP, subsidiary and affiliate relationships are determined based on the degree of economic control exercised by the parent. Conceptually, this control criterion may resemble certain interpretations of control considered in legal contexts. Legal determinations under SOX and related case law do not consistently align with accounting concepts of control, however. Courts tend to look to factors such as the public company’s ownership interest in the entity, the proportional number of directors appointed, the hiring authority for employees, and the existence of agency agreements. This approach makes many cases arguable as to whether a company is legally a subsidiary, an affiliate, or neither.

At the time of publication, the courts have not yet wrestled with the issue of control being distinguished through the identification of economic power versus via an ownership interest or management control. The courts still consider pre-SOX and pre-Dodd-Frank precedents to be pertinent.

In accounting determinations, an ownership percentage is now secondary to an entity’s ability to influence decision-making and financial results through contracts and risk exposure. Accounting standards, such as ASC 810, provide a framework for determining control and consolidation for financial reporting purposes. But legal determinations under SOX regarding whether an entity is a subsidiary, affiliate, or contractor are based on statutory language and judicial interpretation rather than accounting consolidation rules. Under ASC 810, a controlling financial interest in a variable interest entity (VIE) exists when the reporting entity has both: a) the power to direct the activities of the VIE that most significantly impact the VIE’s economic performance; and b) the obligation to absorb the losses or the rights to receive benefits that could be significant to the VIE.

Enron held little ownership in companies it economically controlled principally using supply, derivative, and other contracts. ASC 810 addressed the failure to consolidate entities with insignificant ownership but significant “economic power” by prescribing that VIEs will be consolidated as subsidiaries, given their degree of economic control. Because legal interpretations under SOX may apply different concepts of control than those used for financial reporting, an entity may be considered controlled under ASC 810, but not clearly fall within the scope of SOX whistleblower protections.

SOX, as amended, addresses special purpose entities; off-balance sheet transactions, arrangements, and obligations; and the consideration of economic influence. As previously noted, however, federal administrative courts apply statutory and case law interpretations that do not necessarily incorporate these accounting/legal concepts. As a result, courts may rely on established legal precedents that emphasize traditional indicators of control.

In the author’s case, the ALJ imposed an additional requirement that may be viewed as inconsistent with broader interpretations of fraud and protected activities under applicable laws. The ALJ required that the public parents to the jointly held subsidiary and affiliate have knowledge of the fraud by the private joint owner/contractor. Legally, fraud requires a showing of an intent to defraud; so, per the ALJ, the statutory requirements for establishing fraud and protected activity under SOX were not met, in part because the public parents were not found to have knowledge of the alleged misconduct. This ruling reflects an interpretation that focuses on specific legal points and may not consider the potential impact on financial reporting or stakeholders. The ruling emphasized whether the requisite intent and knowledge elements were present for the public parents, rather than for the affiliate, subsidiary, or contractor.

Materiality

In the author’s case, the ALJ also disputed the quantitative materiality of the alleged misconduct perpetrated on the public companies, despite testimonies that the matters were material. While quantitative materiality is important, the assessment of materiality generally includes both quantitative and qualitative considerations. The ALJ appeared to place primary emphasis on quantitative measures.

A loss of trust in one partner can have a material impact upon the other partner, regardless of the dollar amount involved. Investors in public companies have been significantly affected by qualitative factors such as the loss of faith in a company’s financial reporting. This illustrates how differing interpretations of materiality, including the weight given to qualitative factors, may influence legal outcomes, particularly in complex organizational structures.

Coverage and Authority

SOX explicitly states it covers public companies and “any officer, employee, contractor, subcontractor, or agent of such company.” Years ago, this wording raised the question of whether SOX protected employees of privately held contractors or subcontractors directly servicing a public company. In Lawson v. FMR LLC, in the interest of furthering the purposes of SOX, the United States Supreme Court held that SOX does protect employees of private contractors (if engaged by a publicly traded company) from retaliation for whistleblowing (571 U. S. 429, 2014). But this ruling still left many substantive questions unanswered, such as the following:

• If the private contractor is not directly engaged by the public company but rather indirectly by a subcontractor, are SOX protections still extended?
• If a private service provider or joint-venture partner supplies financial reports consolidated into the public company’s financial statements, are the private entity’s employees covered by SOX?
• If a public company engages a private contractor, but the services do not materially affect the public company’s financial reports, are the private contractor’s employees covered by SOX?

While reporting a violation to one’s supervisors often evokes whistleblower protections under federal laws, courts have, in certain circumstances, held that reporting conduct already known to supervisors may not constitute protected whistleblowing, particularly where the supervisor is alleged to have participated in or been aware of the underlying conduct.

In the author’s case, an ALJ ruled that discussing remedies to potential violations of SOX and the CAA with the CEO, who was later alleged to have participated in a cover-up, did not count as a protected whistleblowing activity, as the superior was determined to have already been aware of the alleged violations.

Turning to a related development in state law, whistleblower protections may, in certain jurisdictions, extend to employees who report violations already known to their supervisors. In 2023, in Garcia-Brower v. Kolla’s Inc., the California Supreme Court held that an employee who makes a whistleblower complaint to their employer may bring a retaliation claim under California Labor Code, Section 1102.5(b), even if the subject of the complaint was already known to the employer. This ruling reversed California’s prior case laws on the subject.

Courts have ruled that reporting illegal actions to external auditors and/or supervisors not involved with compliance does not evoke whistleblower protections under SOX and other federal laws. First, external auditors may not always qualify as a statutorily recognized authority, depending on the facts and the court’s interpretation of whether they have authority to investigate or remediate the alleged misconduct. Second, unless auditors, company managers, or company officers have the authority to investigate allegations, they are probably not recognized as an authority under the federal laws. In the author’s cases, an ALJ ruled in this fashion, namely that external auditors were not a statutory authority and that a human resources manager to whom the author reported alleged retaliation lacked the authority to investigate the CEO’s actions. Of course, communications with auditors may occur or be required by accounting standards as part of the broader internal reporting processes.

Federal laws stipulate (though sometimes not so clearly) the authority to whom a whistleblower may report a violation. One of the clearer stipulations is under Dodd-Frank, which indicates that violations must be reported to the SEC. In Digital Realty Trust, Inc. vs. Somers, the Supreme Court ruled that employees who only report securities law violations to any authority other than the SEC do not qualify for whistleblower protections under Dodd-Frank (583 U.S. ___, 2018).

Because financial misstatements, fraud, and illegal acts are not perpetrated if prevented, it is difficult to invoke whistleblower protections for professionals who prevent, rather than report, these acts. While, in theory, legal protections are extended to whistleblowers who prevent fraud or other illegal activities, in practice, the prevention of an illegal action makes it exceedingly difficult to prove criminal intent on the part of the employer or client who permitted the prevention.

Employers are usually indirect in communicating illegal expectations of an employee. Suggestions may be made, such as:

• “You know we all suffer if we miss budget,”
• “You are not a good accountant unless you can interpret the rules in the company’s favor,” or
• “You aren’t serving your client if you highlight adverse information.”

This is pertinent, as courts have consistently ruled, as in the author’s case, that mere suggestions by an employer or client do not give rise to reasonable beliefs that the employer directed fraud or other illegal activity.

The Legal Process

Unless representing oneself within the DOL’s administrative courts, a terminated CPA or other professional pays for the forum of a court. Filing suit against an employer is time consuming and expensive. Few lawyers want to take on cases that are not clear-cut, and virtually none will take such cases on a contingent-fee basis. Employers generally have money, time, and access to good legal counsel. The former employee who files a suit is therefore at an inherent disadvantage. These comments are applicable to suits filed in state or federal courts.

Regarding possible protections afforded under states’ contract and public-interest laws, claims under these laws may be filed in state court, and questions of law arising from the lower court’s ruling may then be appealed to a state’s court of appeals. Technically, an individual is permitted to represent oneself (i.e. pro se representation) in state cases, but this is almost never recommended. In pro se representation, one must follow all court rules, procedures, and evidence standards just as a lawyer would. This is quite difficult, and therefore increases risk in undertaking complex cases.

Considering contract law, if the employee is fortunate enough to negotiate a contract, the contract should contain enforceable protections for exercising professional judgment and upholding ethical standards. If an employee does not have a contract, a state’s at-will employment laws allow an employer to dismiss employees for no reason at all. If a reason is later requested for a legal case, given reasons may include any employee statement, practice, or action that was contrary to the wishes of management. Whether the wishes of management are ethical or comply with company policy is not a consideration unless the wishes are reasonably believed to be illegal and those reasonable beliefs can be demonstrated in the state’s courts.

An employee handbook or a company’s ethics policy could constitute a contract with an employee, in which case, contract law could protect the professional adhering to the policy over the objection of management. But companies invariably add a boilerplate disclaimer to a handbook or policy saying that it does not constitute a contract, so such policies rarely provide any protection in practice. In the author’s case, the company’s ethics policy had no disclaimer, promised the company would never retaliate against an employee who took reasonable ethical actions, and prescribed the termination of an employee who refused to follow the policy. Nevertheless, Utah’s court dismissed the contractual basis for the case because an ethics policy is inherently an aspirational document and not binding upon the employer. The author has noted the use of company codes of conduct by auditors to evidence sound internal controls, but given such court rulings, such reliance may not be merited.

If the upper management of a company takes its own ethics policy seriously, there should be no issues. But upper management may be motivated to ignore the company’s own ethics policy, without repercussion, to report better financial results, protect their own jobs, protect their networks, avoid legal liability, get a bonus, meet budget, exceed past sales or production records, spin a presentation, save face, and many other reasons. Similarly, corporate attorneys may be motivated to ignore the company’s ethics policy, without repercussion, to spin public perception; minimize a liability’s impact upon financial reports; deflect, avoid, or mislead auditors; and draft disclosure language that complies with regulations but tells readers little about substantive issues. If a CPA or other professional stands up against these unethical practices, they can generally be terminated under the at-will employment laws without repercussion.

States have public interest laws that usually require all professionals to uphold their professional codes of conduct. In a few states, courts have ruled that it is only fair that these same laws extend protections to the professionals who uphold the requirements. While SOX, Dodd-Frank, and SEC rules may protect CPAs working for publicly traded US companies, the state public interest laws seem to be the only laws that could extend protections to the many CPAs and other professionals working for private, foreign, and non-traded US companies.

There is a small but growing body of state cases that have found in favor of a CPA or other professional when an employer blatantly violated the public interest by dismissing the employee for following professional standards required by the state. A number of public interest laws make vague references to the AICPA’s Code of Professional Conduct or other professional standards, thus opening the door to a public interest claim. The outcomes are far from certain, however, largely because the applicability of the public interest laws is challenged and remains uncertain. Challengers usually contend that just because a state requires a CPA to adhere to professional standards does not mean that protections are extended to that professional for doing so. The applicability of public interest laws is complicated further by the absence of specificity in requirements and protections. In the author’s case, an experienced state judge ruled that the public interest law was applicable, but then another new judge, later assigned to the case, reversed that ruling, saying that the letter of the state’s public interest law did not stipulate protections for professionals at all, let alone for upholding standards only vaguely referenced in the law.

How Can the Dilemma Be Resolved?

CPAs are required to behave ethically in fact and appearance in all cases. Legal protections for professionals who raise ethical or financial reporting concerns are fragmented and depend upon specific statutory frameworks. While certain federal and state laws provide whistleblower protections, these protections apply only in defined circumstances and may not cover all professionals working outside a public company environment. It may be clear in accounting theory courses, ethics courses, and in professional codes of conduct that unbiased and ethical judgments are to be front and center in a professional’s mindset, but what happens when an employer demands bias from an accountant, or when a client demands bias of its independent auditor?

How are ethical standards to be upheld and bias avoided when laws do not consistently protect CPAs? Can laws be enacted that consistently protect all CPAs and other professionals from their employers and clients when they are making reasonable professional judgments? This has been feasible in other contexts. For example, in bankruptcy cases and civil suits, evidence of a reasonable professional judgement can provide a solid legal foundation. Why not use such foundations in cases of wrongful termination?

To the author, it seems the greatest benefit would be achieved by each state amending its public interest law to specify 1) the requirements of a professional, in terms of upholding ethical codes of conduct, and 2) the protections to be extended to that professional for doing so when they are opposed by their employer or client. To the author, reciprocity for upholding the required standards is fair. It is critical that the public interest laws consistently protect all CPAs and other professionals; otherwise, protections will only be available to the subset working for publicly traded companies.

While legal reforms to address the issues noted in cases involving SOX, Dodd-Frank, and SEC rules may not be imminent, the author hopes that this article will resonate with those impacted by the issues and help inform future regulatory discussions and rule-making agendas. Among the options, consideration could be given to exploring whether SOX could be amended to provide even more clarity and specificity. Enhanced clarity may help drive consistency in courts when addressing the issues noted above.

While accounting and auditing firms with whom the author has spoken have been supportive of extending CPAs legal protections for upholding ethical standards, they noted that any expansion of their role would need to be carefully considered in light of existing professional obligations and legal responsibilities. If accounting and auditing firms are recognized as an authority to whom whistleblowers can report and if courts begin to rely on a CPA’s judgment as to when an entity qualifies as a subsidiary or affiliate of a public company, firms’ legal exposure and responsibilities may increase.

In addition, whistleblowers reporting illegal activities to an auditor may affect professional relationships. Depending on the circumstances and applicable professional standards, such situations can have complex professional repercussions, including auditor independence (e.g., under AICPA Code of Professional Conduct § 1.200 and SEC Rule 2-01) and confidentiality obligations. These situations may also raise questions regarding prior internal control evaluations. It also needs to be considered that accounting and auditing firms are employers and may be sued by their own employees in certain circumstances under SOX whistleblower provisions. These considerations do not diminish the obligation of firms to act in accordance with professional standards and in the public interest; rather, they highlight the importance of clearly defined legal frameworks that align with those obligations. Given these considerations, amendments to state or federal laws may require more of a grassroots initiative.

If the AICPA, FASB, state accounting societies, state bars, other professional organizations, the PCAOB, the SEC, other regulators, and legislators are serious about creating an environment in which adherence to ethics, objectivity, and sound financial reporting are held as important objectives, the author hopes they will advocate for amendments to protect CPAs and other professionals that stand up for ethical practices. In the current environment, not only are professionals exposed to largely unchecked retaliation and termination, but employers and clients may, in certain circumstances, exert pressure on financial reporting through personnel decisions, including the replacement of employees, contractors, and auditing firms. This serves neither the professionals involved, sound financial reporting practices, nor the public interest.

It is beneficial to lobby lawmakers to specify the ethical codes of conduct to be enforced via state public interest laws, specify state protections for upholding those specified codes, and clarify accounting terms and legal requirements in SOX. Forbidding retaliation against CPAs who uphold the ethical standards on which state and federal governments, investors, lenders, and other interested parties rely for sound financial reporting could greatly facilitate fair and materially accurate financial reporting practices within the United States.