PCAOB Independence Rules: SEC Rule 2-01 and AICPA Guide (2026)

By GreenGrowth CPAs Audit & Assurance Team · Updated October 2026 · Audit & Assurance

PCAOB independence rules require a registered audit firm and its people to stay independent of every public company audit client for the whole audit and professional engagement period. PCAOB Rule 3520 makes that duty enforceable and pulls in all SEC independence requirements, starting with Rule 2-01 of Regulation S-X.

Independence is not a single test. It spans investments, loans, jobs, side services, fees, and who leads the audit. One partner's slip can taint the audit report for the whole firm.

PCAOB and SEC Independence Rules: At a Glance

• Who must be independent: The firm and its covered persons, led by the audit team and its chain of command.
• Which rules apply: AICPA rules for private company attest work. SEC Rule 2-01 and PCAOB Rules 3520 to 3526 for issuers.
• What is banned: Direct investments, most loans, ten non-audit service categories, and contingent fees.
• Rotation and cooling-off: Five years on and five off for key partners. One year before audit staff join the client in oversight roles.
• GreenGrowth's role: As a PCAOB-registered firm, we help companies plan audit and advisory work so independence never stalls a filing. Talk to our team →

Why Independence Matters

Investors trust an audit opinion because someone with no stake in the outcome signed it. Without independence, the opinion is just another management claim.

The SEC frames the risk around four warning signs. A relationship raises doubt when it creates a mutual or conflicting interest, or has the accountant auditing their own work. Acting as management or an employee does too, and so does becoming the client's advocate. These rules apply equally to software issuers, miners, and US-listed cannabis operators.

AICPA Independence Framework

For private company audits and other attest work, the AICPA Code of Professional Conduct governs. Its Independence Rule (ET 1.200.001) requires members in public practice to be independent whenever professional standards demand it.

Where no specific rule fits, the Code's conceptual framework applies. Members identify threats, weigh them, and apply safeguards or decline the work. The Code names seven threats: adverse interest, advocacy, familiarity, management participation, self-interest, self-review, and undue influence. Public company audits layer SEC and PCAOB rules on top.

SEC Rule 2-01

Rule 2-01 of Regulation S-X (17 CFR 210.2-01) is the backbone for SEC registrants. Under paragraph (b), an accountant is not independent if a reasonable investor, knowing all relevant facts, would conclude it cannot exercise objective and impartial judgment.

Paragraph (c) gives a non-exclusive list of situations that fail this test:

• Financial relationships, including investments and loans
• Employment relationships, including the cooling-off rule
• Business relationships with the client or its decision-makers
• Prohibited non-audit services
• Contingent fees and commissions
• Partner rotation and partner pay tied to selling non-audit services
• Audit committee pre-approval of services

PCAOB Independence Rules

Rule 3520 anchors the PCAOB's independence rules. Rules 3521 through 3526 then target specific risks.

Rule 3526 Communications

Before accepting a new issuer audit, the firm must describe in writing any relationships that may reasonably bear on independence. It then discusses their potential effects with the audit committee and documents that talk. Each year after, it repeats the process and affirms in writing that it is independent under Rule 3520. Companies nearing a first filing can see the wider checklist in our guide to PCAOB audit requirements.

Covered Member Definition

Under the AICPA Code, a covered member includes the attest engagement team and anyone able to influence the engagement. Partners and managers who provide 10 or more hours of nonattest services to the client in a fiscal year count too. So do partners in the lead partner's office, the firm and its benefit plans, and entities they control.

SEC Rule 2-01 uses a parallel term, covered persons in the firm. It reaches the audit engagement team, its chain of command, 10-hour non-audit service providers, and partners in the lead audit partner's office. Most financial interest bans also extend to their immediate family: a spouse, spousal equivalent, and dependents.

Prohibited Non-Audit Services

Rule 2-01(c)(4) bars ten categories during the audit and professional engagement period:

• Bookkeeping and related services
• Financial information systems design and implementation
• Appraisal, valuation, fairness opinions, or contribution-in-kind reports
• Actuarial services
• Internal audit outsourcing
• Management functions
• Human resources services, such as executive search
• Broker-dealer, investment adviser, or investment banking services
• Legal services
• Expert services unrelated to the audit

Audit Committee Pre-Approval

Permitted services still need clearance. Under Rule 2-01(c)(7), the audit committee approves each engagement in advance or through detailed policies that never delegate its role to management. A de minimis exception covers non-audit services up to five percent of fees paid to the auditor that year, if they were not recognized as non-audit services when engaged and the committee approves them before the audit ends.

Partner Rotation (5-Year Rule)

Rule 2-01(c)(6) limits the lead partner and the engagement quality reviewer to five consecutive years on an issuer. Each must then sit out for five years. Our guide to engagement quality review explains why the reviewer role carries the same limit.

Other audit partners with significant decision-making roles may serve seven years, then rotate off for two. Firms with fewer than five issuer clients and fewer than ten partners are exempt if the PCAOB reviews those engagements at least every three years.

Cooling-Off Period

Under Rule 2-01(c)(2)(iii)(B), a firm loses independence if a former audit team member takes a financial reporting oversight role at an issuer too soon. That person must have stayed off the engagement for the one year before audit procedures began for the period that includes the hire date.

Oversight roles include board members, the CEO, CFO, controller, chief accounting officer, treasurer, and similar posts. Team members other than the lead partner and reviewer who logged 10 or fewer hours do not count. Timing questions like these often surface during client acceptance reviews.

Financial Interest Rules

Under Rule 2-01(c)(1), any direct investment in an audit client impairs independence, whatever its size. So does a material indirect interest. That covers the firm, covered persons, and their immediate family.

Loans to or from the client, its officers and directors, or significant owners are also barred. The rule excepts certain loans made on normal terms by a financial institution. Examples include car loans, cash-secured loans, and primary residence mortgages not obtained while a covered person.

Enforcement History

In September 2016, Ernst & Young agreed to pay $9.3 million to settle SEC charges. One partner kept an improperly close friendship with a client CFO. Another had a romantic relationship with a client's chief accounting officer.

In September 2019, PricewaterhouseCoopers agreed to pay more than $7.9 million. According to the SEC, the firm provided prohibited non-audit services and violated PCAOB Rule 3525 on engagements for 15 SEC-registered clients.

Both cases teach the same lesson: monitoring matters as much as policy. Our public company audit services build that monitoring in from day one, and our IPO readiness team helps pre-IPO companies sort out advisor relationships early.

Frequently Asked Questions

Where to Go From Here

Related: PCAOB-registered cannabis auditor