PCAOB Adopts Rule Intended to Increase Auditor Accountability
June 12, 2024
Less than a year after proposing a rule intended to more effectively deter auditor misconduct, the Public Company Accounting Oversight Board (PCAOB) on June 12, 2024, voted unanimously to adopt the rule by fully using the enforcement authority granted by the Sarbanes-Oxley Act of 2002.
The adopting release updates the board’s auditor contributory liability standard from “recklessness” to “negligence,” aligning it with the same standard of reasonable care auditors are already required to exercise when they perform audits of a public company’s financial statements. Recklessness represents a level of culpability that is higher than negligence.
Today, “even when a firm commits a violation negligently, an associated person of that firm who directly and substantially contributed to the firm’s violation could be sanctioned by the PCAOB only if the PCAOB were to show that the associated person acted recklessly,” the board explained.
The board is aligning PCAOB rules “to what investors already expect: that when an associated person’s negligence directly and substantially contributes to firm violations, the PCAOB has tools to hold them accountable,” said PCAOB Chair Erica Williams.
The contributory liability standard is in Rule 3502, Responsibility Not to Knowingly or Recklessly Contribute to Violations, which became effective in 2006. When the PCAOB was first drafting the rule about 20 years ago, it decided to use the reckless threshold because of pushback from the largest accounting firms at the time against the negligence standard of conduct.
Explanation of the Law and Existing Rule
However, Sarbanes-Oxley allows the board to bring charges against any registered firm or any associated person. The PCAOB is also authorized to go after violations committed in negligence—a result of the failure to exercise reasonable care. And now today’s board is aligning Rule 3502 with the mandates conferred to the PCAOB two decades ago.
Under Sarbanes-Oxley, the PCAOB can impose sanctions when appropriate for a single act of negligent conduct that constitutes a violation, and it may impose certain enhanced sanctions when appropriate if a registered firm or an associated person has engaged in repeated instances of such negligence.
But existing 3502 requires a showing of recklessness and requires the contributory act to be associated with a particular firm that committed the violation before contributory liability may be imposed.
Operative Words: “Directly and Substantially” Contributed to Violation
The PCAOB said that the new rule maintains the requirement under existing Rule 3502 that an associated person must have contributed to the firm’s violation both “directly and substantially” in order to be held liable. Thus, this will not apply to simple negligence, as the auditing profession claimed that it would in comment letters.
This also means that remote or tangential negligence by associated persons will not be held liable.
Regulators understand that auditors will at times make unintended mistakes, and the board is not trying to second guess their work.
The PCAOB is in part making changes to Rule 3502 because it now has ample experience with the provisions, and the Securities and Exchange Commission (SEC) already has the ability to bring charges related to negligence. Both the SEC and the PCAOB can bring enforcement actions against auditors.
The board made a change to its 2023 proposal following feedback.
The proposed change would have stated that an associated person can be liable for contributing to a violation by any firm. Existing standard applies to associated persons who contribute to a violation by their firm, and the board is keeping it in the final standard, which it “believes already encompasses all plausible scenarios.”
Mixed Reactions
Daniel Goelzer, a founding member of the PCAOB, said “some board members seemed to acknowledge that there were legitimate concerns about the negligence standard ensnaring people who made good faith judgment calls that turned out to be wrong in hindsight.”
“But the bottom line is that the board thought it should have the same ability to penalize those who act negligently as the SEC has,” Goelzer said. “A lot depends on how the board uses this new power. I hope they will be careful to limit it to cases where it is clear that the person charged ‘should have known’ that they were causing a violation. Time will tell.”
The Center for Audit Quality (CAQ), which had concerns with the PCAOB’s proposal, declined to weigh in, saying it needs time to digest the final rule. But the CAQ pointed to its comment letters submitted in response to the proposal last year.
If adopted, the rule could “discourage auditors from accepting important audit roles due to fear of being held liable under a simple negligence standard for good faith judgments,” wrote the CAQ, an affiliate of the AICPA which represents accounting firms that audit public companies.
“This concern is particularly relevant in relation to key roles associated with a firm’s quality control system, where the activities of the individual may touch numerous PCAOB engagements and be significant to a firm’s overall quality system but may not involve the performance of audit procedures governed by the PCAOB auditing standards,” the CAQ wrote.
However, it is unclear whether this will exacerbate the talent shortage. The negligence standard is when the associated person “directly and substantially contributed” to the violation. Moreover, surveys indicate that the biggest factor for the decline in the interest in the accounting profession is a relatively low salary for new graduates.
Investor advocates, on the other hand, supported the change.
The Council of Institutional Investors (CII) “generally believes that . . . updating of Rule 3502’s liability threshold from recklessness to negligence will appropriately bring it in line with the existing requirement for auditors to exercise a standard of reasonable care during the performance of their professional responsibilities,” CII General Counsel Jeffrey Mahoney wrote in a comment letter when the board first proposed the rule.
“And like the SEC has done historically, we believe the PCAOB will appropriately exercise its prosecutorial discretion when the underlying conduct is negligent,” he added.
The PCAOB’s Investor Advisory Group (IAG) believes the change is a step in the right direction. However, it is likely to be disappointed that the board decided to retain the language “directly and substantially” in its negligence standard.
“We note that the modifier [directly and substantially] does not appear in either the SEC rules or the provisions and related legislative history of SOX that provide the SEC and the PCAOB, with the ability to bring enforcement actions against associated persons if they engage in negligence,” the IAG wrote. “As indicated, we believe the Board should bring Rule 3502 proceedings against accountants whose conduct demonstrates their lack of competence and violates applicable statutory or regulatory requirements or the Board’s professional standards.”
The adopting release is subject to SEC review. If approved, the final rule will become effective 60 days after such approval.
The PCAOB release number is 2024-008, and the rule is renamed Responsibility Not to Contribute to Violations.
[Thomson Reuters]
