Host
Philippa Lamb
Guests
- Gabriela Figueiredo Dias, Chair of the International Ethics Standards Board For Accountants
- Laura Hough, Independent Consultant on organisational integrity
Producer
Natalie Chisholm
Series Lead
Mark Rowland
Transcript:
Philippa Lamb: Welcome back! Another bonus episode for you today. This time we're looking at ethics as the world changes ever faster around us, and artificial intelligence opens up opportunities and dangers for accountants governed by an international code of ethics. This is a particular challenge. So, how does the code address these changes?
Gabriela Figueiredo Dias: Risks changing the culture of the of the organizations and of the firms as well. So, it just becomes more important to have strong frameworks and policies, practices, approaches, etc., to culture and governance.
Laura Hough: And the board also has a role to play in verifying compliance with those policies and standards they have internally. So I think it's really, really critical that these kind of decisions start from right at the top.
PL: Joining me to talk about changes to the code and what they could mean for accountants and how they do business, I am delighted to welcome Gabriela Figueredo Diaz and Laura Huff. Gabriella is chair of the International Ethics Standards Board for Accountants, which sets the code, and she's co-CEO of the International Foundation for Ethics and Audit. Laura is an independent consultant on organizational integrity, and until very recently, director trust and ethics at the ICAW. Hello to you both.
LH: Good morning. Thanks for having us.
GFD: Hello. Good morning.
PL: So, Gabriella, just so we start on the same page, do you want to just remind us of the overall purpose of the ethics code?
GFD: So, the purpose of the code is to offer the professionals a number of standards that they can use when they need to make ethical decisions. You know, accounting services and the accountancy profession face a lot of ethical dilemmas. So the purpose of the code is to serve both preparers, professional accountants in business, and auditors, professional accountants in practice, in navigating these dilemmas in a way that it's recognised as being the right way to do it globally. It sets a global baseline for ethics and also for independence for the firms to to act in a way that is globally recognised as the right way to do it.
PL: Yeah, because the pace of change is faster than it's ever been, isn't it? So this is a constant updating process.
GFD: It's a constant updating process, which doesn't mean that we are constantly changing the code, and we shouldn't. What it means is that we need to monitor if, as it is, it is fit for purpose. Sometimes, or more frequently, we sometimes come to the conclusion that we don't need to change the code. The principles embed the necessary responses and support, but that we need to offer more support to the adoption and implementation of the code, so that it is clear, so that the concrete situations are captured under the existing standards and principles, etc.
PL: Because Laura, I mean, Gabrielle mentioned AI. That must be the biggest catalyst for change that the county has ever seen, isn't it?
LH: I think people probably said that every time there was a big change of technology over time. No, but I do think that the scale of AI and the impact it has, every risk there is from an ethical point of view, has the potential to be magnified so quickly and at such great scale because of AI and the tools that are there. So it doesn't necessarily mean that we have to change the fundamental principles of the code and of the profession. I think those are very, very valid. But what people need is use cases and scenarios and those real-world practical insights of how to address ethical challenges in an era of AI. And to remember, I think as well that ultimately the professional accountant is still responsible and accountable for the decisions made, so you can't defer to AI. You're still responsible.
PL: Yeah, I mean specifically in thinking about ethics, where do you see the key risks in relation to AI?
LH: I think there are quite a lot of risks there, actually. So one key thing is something that we call automation bias. So trusting more in a decision that's made by technology rather than by a human. I think there's a risk as well in terms of just the scale and speed, as I mentioned earlier. So any risk that's in there, anything that maybe the decision wasn't ethically made in the first place, will be magnified using the AI tools. There's a question as well about just the opaque nature of AI tools. You know, the average person finds it very difficult to understand how a decision was arrived at. So then, how do you explain it, and how do you then be transparent with your clients about how AI has informed your decision making? That's just a few.
PL: I'm sorry to interrupt.
LH: No, no, it's fine.
PL: Is commercial necessity kind of driving the pace of adoption? It must be playing into the difficulty here, because as you say, there's just not enough time.
LH: I think there's a lot of pressure on you know organizations in general and accountancy firms to adopt AI. You know, quite often the decision is how do we put AI into our processes? How do we use it? Rather than oh, should we use it? Do we need it? I think sometimes we need to ask that question a bit more often, rather than just forging ahead. You know, it's kind of a bit like. An arms race, isn't it? Nobody wants to be the person that isn't using AI.
PL: So, Gabrielle, the profession is inevitably having to learn in real time, isn't it? As we as we say here, there's going to be issues, aren't there? There's going to be errors.
GFD: Of course, there will always be errors. But from our perspective as a standard setter, what we are trying to do is to offer the necessary support for these errors, to be well for less errors and to mitigate the risk of mistakes. We are all learning. It's not only the profession. We are learning as well. I must say that we were a little bit ahead of time because IESBA issued standards in 2023, which became effective in 2024 already for addressing the impacts of the use of technology and AI in accounting services. So the standards are there. One of the risks that we already addressed was exactly automation bias. So inevitably, there will be mistakes. That's absolutely clear. The pace, the speed, the intensity, the depth of the use of technology and mostly AI makes it, I would say, obvious that there will be errors. But besides technical mistakes and these kinds of things, the ethics part plays a critical role here.
PL: And as you say, the ethics piece that starts right at the beginning of the process, doesn't it? Because so many firms are developing their own AI tools, and the development of the AI tools necessarily involves consideration of ethics.
GFD: Yes, of course. We are not addressing each tool and its reality individually. That's not the purpose. But for instance, one of the ways that we have already found this...important to address this was by issuing some guidance to professionals based on the characteristics of AI and technology. There are some characteristics, Laura already mentioned some risks which are already which are also some characteristics. So we identified some common characteristics of technology and the risks that it may involve, and issued some general guidance, overarching guidance for the use of technology in accounting services. Another one will come soon, probably early next year, related to the use of AI, specifically related to the use of AI.
PL: Because agentic AI is the big issue here, isn't it? As AI agents act with more autonomy, is it possible for them to remain consistently accountable in the way that people have traditionally been?
GFD: Well, that's that's a very good question, Philippa, because I think that we think that accountability is one of the areas where things will evolve, and things are already evolving significantly in a different way, because as AI takes over, so to speak, the business operation, it is more and more difficult to identify who is accountable. Ultimately, we know that who remains accountable is the professional accountant and the firm, but it's very difficult to see the individual accountability and to attribute accountability to one person or one professional. So this is why things are moving towards a more significant focus on the accountability of the organisation. Broadly speaking, in this area, in this space, the accountability of the firm, because it's going to be very difficult, if not impossible, if you move towards, for instance, the zero-person organisation where everything is done by agents etc. Who is accountable? It has to be the firm, and that's when matters and topics like governance become very relevant.
PL: Laura?
LH: One thing I was reflecting on as Gabriella was talking was the need for training people on how to verify outputs from AI. So, if we're going to make people accountable, what does that actually mean, and how do they verify to then take on that accountability? The CCAB produced some AI ethics guidance recently, so a statement on the ethical use of AI, and one of the things they had in there was about validating inputs and outputs. I think we talk a lot about validating the outputs of AI, but actually, do we validate what's going in? You know, there's this thing about garbage in, garbage out, but there's a responsibility on both ends of the spectrum there.
PL: So, I mean, moving from standards to culture. I'm wondering about what your thoughts would be on how boards should interact with AI in this regard?
LH: So I think they've got a really important role to play in leading that governance piece and ensuring that the decisions are made in line with their organisational governance. You know who's responsible, who's accountable, and filtering those decisions down. And the board also has a role to play in verifying compliance with those policies and standards they have internally. So I think it's really, really critical that these kind of decisions start from right at the top.
PL: Does the code have thoughts on this, Gabriella, specifically around the duties of boards?
GFD: The code doesn't speak specifically about this topic, but of course it already includes. Includes materials and guidance and standards which help driving that or navigating that situation. Now, culture is for us currently one of the biggest topics of attention. Culture at a firm level, and the use of AI is changing the culture, or risks changing the culture of the organisations and of the firms as well, so it just becomes more important to have strong frameworks and policies, practices, approaches, etcetera, to culture and governance. And that's why we are working on something on a framework that is still under development.
Decisions will be made, so I cannot say yet what this is going to be, but the idea is that driven by the the consciousness and the understanding that things are not going always well, and that we need to act and intervene at a different level, not only addressing the individual behaviours of professionals, but the firm as a reality. But also under the pressure of the use of AI, technology, private equity investment, etcetera, there is a need to reinforce the culture and the governance of the firms.
PL: As we know, measuring culture is a very difficult thing to do. It is, and the sense I can understand why a framework, you know, benchmarking against a framework, obviously is a way to approach it. But I wonder, Laura, is there a danger there that reduces it to a tick box exercise for organisations?
LH: I think, as you say, it's very challenging to measure culture. So we can measure adoption rates of standards and compliance with the mechanisms that firms have put in place, or indeed organisations, but what we're trying to see here is a behavioural change, and I think that's very difficult to measure. I think we need to talk to a behavioural scientist really to get some insights into that, because there are crude metrics, aren't there? Like having more reports come through, so more compliance breaches are identified, or more cases come up. Those kinds of things is one metric, which in a fraud world, I would always say that's a good thing. More reports means more people are aware of fraud. It doesn't mean more fraud.
PL: Well, not necessarily.
LH: Not necessarily. Quite right. Quite right. But quite difficult with culture.
PL: Yeah. Gabriela?
GFD: I agree. It's very difficult. But I also think that just because it's difficult, we should not have it. So we need to be between these two tensions, which is the need to have something that drives good behaviour through a strong, robust culture and governance, and the reality of the difficulty of measuring how this is working. Now, this is the first thing. It's not short-term. We don't see the short-term impacts. Never. If I take as an example the UK governance code for audit firms, which was a product of the the joint work of FRC and ICI UW, it was issued for the first time in 2010, and they are now trying to understand more and better how this has impacted positively the behaviour, the culture, and etcetera. So it's not something for tomorrow. You need time to see it to see it landing and and and translating into positive results. As you're saying, it's not because we have more reports about what they have done or they have not done that we can conclude that it has improved. And above all, it should not become a compliance exercise. It's for us. It's absolutely clear that the objective of any framework of this kind is to establish an environment where people feel comfortable and have the right incentives to do what is right. And then compliance is out of this space.
PL: Just to be clear in my mind, this is a rolling process. It's updating of the code. What's the time frame on the current set of changes that you're proposing at the moment?
GFD: With respect to the firm culture and governance project, so in December we expect to have an exposure draft approved by the board. So it's a long process. We have been working on this already for almost three years, so because it's new and we needed to gather all the information and have all the insights and discussions, it's been very intense. Not everyone agrees immediately around the same approaches and topics etcetera. But in December we will have an exposure draft, hopefully. So then we will consult on the proposal that we will make for a framework, and then expectedly we will have something approved by the September next year, something like that.
PL: Okay.
GFD: It's very short. What we are suggesting is a very short, sharp, narrow, high-level principles-based, overarching framework with One requirement and a little bit of application material in the code, and then we will develop – we are already developing – guidance outside the code to help professionals, regulators, everyone better understand how this works.
PL: Yes, because as you say, if it becomes too rules based, it becomes impossible to implement, doesn't it? Particularly, I'm guessing for smaller organisations.
GFD: We fully agree. There will be a lot of proportionality embedded in this framework. We are fully aware that this is a reality where the one size fits all approach doesn't work at all. First, because firms have different realities, different capacity, but also because they pose different risks. Because this is also this is a firm culture and governance framework, is also a risk management tool. It's to manage helps managing the risk of unethical behaviour of the individuals in the firm, but because when there is unethical behaviour, it has impacts on investors, on the market, on confidence, trust, etcetera. Not all the firms pose the same risks to the public interest. So this will be fully is…already being fully considered in the way we develop the framework. It's not going to be rules-based at all. Again, an overarching single principles-based requirement in the code with some application material, not with a compliance approach, not rules-based because this won't work in an area in a space where there are so so many nuances, different cultural approaches, and different realities in the different firms. We see that there are some firms which already have a lot of things in place, won’t need to change a lot, but there are other firms who will need to make an effort. So this has to be flexible enough to adjust to the capacity, to the risk, to the necessity of each firm.
PL: Yes, because as you say, it's all very well for firms with compliance teams, but for smaller firms, and of course that is the majority of firms, more of this is just more of a burden, isn't it, on the business?
GFD: Well, I'm always afraid, if I may, of the word burden.
PL: As soon as I said it, I knew Gabriela wouldn't like it.
GFD: I blinked my eyes. Yes, because there is a, there is sometimes a temptation or of speaking about ethics as a burden. Ethics is not, should never be a burden, but of course, it's we recognise that there is a responsibility on our side not to make it a burden and to make it really a tool for value creation, growth, good reputation, etcetera. With respect to the smaller firms, again, we are very well aware that not everything is going to be needed or fair to impose or ask or recommend or advise to the smaller firms. But I must also say that the smaller firms should not use the excuse of being small not to do anything to be even better. So there is an expectation that everyone will make an effort and should be making an effort to embed good practice, good behaviour, good culture, good governance as much as they can, and that just saying 'I'm small, I'm not going to do anything', is not okay because it's in the interests of the firms, and even the smaller firms to you know to evolve, to progress, and to aim, and have the ambition of getting somewhere else because this makes the market more robust and reputation as well. But be sure that this is completely front of mind for us. That the smaller firms need to have a different. We need to have a different approach to the firm culture and governance topic with respect to them.
PL: So yeah, the code: a 600 page PDF. I mean, it's not a light read, is it?
GFD: No, the code is long. It's not a light read, but there are a few things that I think it's important to say. For instance, the code looks very long because it's a code. Because at some point in the past, someone decided rightly to codify the standards and make it in accordance to a building block approach. This means that not all the code, the full code, is applicable to everyone. It's only the fundamental principles, the five fundamental principles, which is the first part of the code, a few pages that is applicable to everyone. Then you have parts of the code which only apply to professional accountants in business, part two, and then you have parts of the [Code] which only apply to professional accountants in practice, part three, and then you have part part four which is about independence that apply to the firms. So it's not that everyone needs to know and apply the full code. Secondly, it became very...well bigger and longer because of the sustainability standards which were added to the code. But the sustainability standards, they basically replicate what's already there for financial statements in terms of independence, but adjusted the language a little bit, and and in some cases in some concrete situations, to the reality of sustainability. Thirdly, and importantly, if you think of a process about audit standards or the standards issued by our sister board, and you put them all together, I tell you, it's not 600 pages. Oh no, you can. I don't know the number of the pages, but it's much more than 600 pages, and still nobody says, "Oh, what a long, long, long thing," because it's not put together. I mean, it's a matter of the way it is presented. The number of pages that audit standards involve? It's, I mean, it's huge. So the number of pages per se, I don't think, should be a way of measuring the complexity or the difficulty of the code.
LH: Do you have any plans to make it accessible in a different way? To use AI to make it more interactive?
GFD: This is central in our reflection today, we have been told by many people that it's complex, that it's long, that it's this and that. But of course, even if there are reasons for this, and it is probably not as complex as it seems, we realise that there is a perception on the one hand, and there are some difficulties as well in terms of....well, I'm not going to go into the details. So one central proposal that we are making for our next strategy and our plan is to put the simplification of the code at the centre of our attention. Now let me explain what this means. This not this does not mean that we are going to delete standards or delete parts of the code; that would not make sense. Of course, if one day we come to the conclusion that one standard is not necessary anymore, we'll do it. But the simplification is really working on the code to see how we can make it more usable, more accessible, better understood, more applicable. If there are overlaps, things that we can do better facilitate the access to the code within different ways. We are already working on it.
LH: I think that would be very welcome.
GFD: Yeah, I hope so.
LH: Yeah.
PL: What form might that take? The process you're talking about. Would you literally be presenting it in a different format?
GFD: It's possible. I'm not. I cannot put my hand in, myself –
LH: Top secret for now.
GFD: No, it's not top secret. It's a work in progress, a work in progress. Yeah. We already have, we are already doing a few things to simplify the access to the code. We have a let's call it a project internally, but we have a framework which is the smart framework that we have put in place like one year ago or something. Smart stands for simplification, mobilisation, adoption, responsiveness, and targeted approach under the simplification, the S of the smart. We are already working on some a few things that we believe will already help
PL: Potentially app-based tools?
GFD: We'll see what we can do. Of course, it depends on our resources as well as as you know they are not... but we'll do, and we are also planning to work with some other entities like PAOs and etcetera. Not only to understand exactly – and this is a call that we are making –tell us what we need to do to make it easier for you, because it's easy to say 'it's complex, it's long', but then we need to understand concretely what our stakeholders may need. Yeah, we are not committing to respond to all these requests and calls, but putting them together will help us clearly understand what we can do in that respect.
PL: Okay, so Laura, tell me you've heard all this now. The general approach, this conceptual...the concentration on the conceptual framework rather than a bunch of rules, the fact that is not necessarily going to be a huge compliance exercise, but more of a direction of travel in an orderly way. I mean, does that reassure you about the way this will play out in the future?
LH: Yeah, I think it's definitely reassuring to hear that the focus is on sort of simplification in the longer term, and also the focus on practical case studies. I think you mentioned that earlier. I think that really brings things to life for people. Ethics, as they can relate to it, how it might apply to their everyday life, is something that people find really, really valuable and easy to engage with, I think. I don't know if you want to touch on this, but I was interested: what do you think about culture in respect of professional accountants who are not in firms? So those who are CFOs and working in business, because that's a whole other spectrum with the cultural...
GFD: I'm very interested. Yeah. Yes, Laura, thank you for bringing that [up]. So as you may know, the Yasba has been working on a project called the the role of the the new role of the CFO, and the idea was exactly, and again, as we mentioned at the start, to try to understand if the code is still fit for purpose to serve CFOs in when they have to make ethical decisions, given all the evolutions around AI technology, but also sustainability, much bigger involvement in governance, strategy, and etc. So the role of the CFO is really changing, is growing, is becoming different, and still the code is the same that we had developed years ago. We undertook a huge, massive information-gathering exercise to try to understand what is there, but this was finalised with the report very recently. We concluded that, at least at this point in time, the code doesn't need to change, but we need to help them more, and probably not only us, but others as well. PAOs very, very significantly, because the biggest conclusion is that yes, they are pressured by very significant ethical dilemmas. They feel very much alone. It's because they don't know where to go when they have these problems. Certainly not, most of the times, to the CEO or the board because they are the ones sometimes where the pressures are coming from. They are expected to do something which sometimes is not exactly the most ethical-based decision ever. So it's there is really space for action. Many of them, they don't know that the code is there to serve them, so it's an awareness raising and support that we need to undertake together with other players, PAOs, governance organisations, business, etcetera.
LH: So, do you see the role for the PAOs and others to be more active than IESBA? So, IESBA is providing a kind of high level framework, but the hands-on activity would be more for the PAOs and governance.
GFD: I'll not put a hierarchy there, more or less. I think that we need to work together. Yeah, that's the conclusion.
LH: Okay, great.
PL: It's interesting territory, this, isn't it? Because it opens up that long-standing question about where does ethics live in the board, and if it makes it easier for accountants, CFOs sitting on the board with an accountancy qualification to lean on your code. I mean, that's going to be helpful, isn't it, generally?
LH: I do think that for those in finance roles, not in firms, it can often be very isolating, as Gabriella said. So anything that's there to bring them closer to their peers for advice or just a sense check on is this actually an ethical dilemma that I've missed? You know, because I've been so entrenched in this decision, I failed to see it. Perhaps so. I think anything we can do to give them more support would be great.
PL: You've alluded to this a bit already about how the code evolves and how you know whether it's working well isn't necessarily evident until many years in the future, but how will you evaluate the success of this code once it actually comes into into play?
GFD: Well, one of the ways, even if it's not very rigorous, is the adoption; the levels of adoption and implementation of the code. It's very formal. It's very formal because you may have the numbers may say a lot of things which do not...the reality doesn't meet depending on how it is implemented, enforced, etcetera. But at least it's an indication. Secondly, the way the adoption and implementation is measured is changing. IFAC is working on this in this area. It's very difficult to get to a very concrete and clear assessment of adoption and implementation because the nuances are so many that if you go to a very rigorous and rigid classification, you may can make some mistakes. But still, adoption and implementation rates and levels, it's a significant way of measuring it. But of course, in the long run, what will allow us to measure the effectiveness of the code is how well things are going out there in the market. How many? If you continue to see things which do not should not work, but again, sometimes this is even misleading because you can have a strong code and still have these problems, because of other reasons. Namely enforcement, because something is missing at the firm level as we are suspecting, etcetera. And the third indicator, the real one, I think it's trust. Trust is also difficult to measure, but there are some ways of measuring it. How much people trust the firms, accounting services, etcetera, will say something about the effectiveness of the code and how effectively...it's not only the code, but because the code and the standards themselves they won't take us anywhere. It has to do with the way the code is actually implemented, enforced, monitored, absorbed, etcetera. You may have the best code in the world; if there is not an active, proactive, intense approach from the ones using the code to use it well and appropriately, to follow the standards etcetera. That's not going to be effective. So it's difficult to measure the effectiveness. But I think that with some different elements, we'll get somewhere.
PL: Thank you very much indeed.
LH: Thank you, Philippa.
GFD: Thank you very much.
PL: On the next episode of Beyond Finance, we'll be looking at how forensic accountants are turning to blockchain to tackle economic crime. Subscribe to Beyond Finance on your favourite app so you will never miss an episode. Every single one counts towards your CPD for all the accountants listening. So log your listen right now from the link in the show notes, and every single time you listen in future. Thanks for being with us.
