The Public Company Accounting Oversight Board (PCAOB or the Board) has closed the comment period for its proposal to amend the professional auditing standards that govern the auditor’s consideration of a company’s noncompliance with laws and regulations (the Proposal). Most of the over 130 comment letters — submitted by certified public accountant (CPA) societies, public accounting firms, lawmakers, industry groups, and nonprofit organizations — either echo or expand on the concerns raised in the dissenting remarks of the two Board members who voted against the Proposal. These concerns include, among others, the following:
- By expanding the scope of an independent financial statement audit to include any noncompliance with laws and regulations by a company, including noncompliance that does not have a direct impact on the company’s financial statements, the Proposal would require auditors to perform procedures far outside of their core area of competency.
- The Proposal’s significant expansion of the breadth and depth of procedures required by auditors and their specialists will impose substantial costs on public companies and investors that the Proposal has not attempted to quantify.
- The Proposal’s requirements disproportionately impact smaller companies and audit firms and reduce competition in the public company accounting industry.
- The Proposal effectively requires companies to provide their independent auditors with materials protected by the attorney-client privilege or attorney work product doctrine, exposing companies to significant litigation discovery risks.
- The Proposal significantly increases the scope and frequency of communication between independent auditors and audit committees to include matters that are immaterial to the financial statements and outside of the expertise of many audit committees.
In the coming months, the Board may choose to adopt a final rule to be filed with the Securities and Exchange Commission (SEC), issue a revised proposal, or withdraw the Proposal.
On June 6, 2023, the PCAOB proposed amendments to its auditing standards that would replace AS 2405, Illegal Acts by Clients, the current standard that governs the auditor’s consideration of a company’s noncompliance with laws and regulations. The Proposal also includes substantive amendments to several existing standards, including those that govern the auditor’s identification and assessment of the risk of material misstatement in the financial statements. In sum, the proposed amendments would require independent auditors of public companies to plan and perform procedures to
- identify laws and regulations with which noncompliance could reasonably have a material impact — whether direct or indirect — on the issuer’s financial statements
- assess and respond to risks of material misstatement due to noncompliance with the identified laws and regulations, including understanding management’s processes for preventing, identifying, investigating, evaluating, communicating, and remediating noncompliance
- evaluate information indicating whether noncompliance with laws and regulations has or may have occurred, as well as the possible effects of such noncompliance on the financial statements and implications on other aspects of the audit
- communicate with management and the audit committee when the auditor becomes aware of information indicating noncompliance with laws and regulations has or may have occurred
The Board approved the proposed rule with a 3-2 vote, with the only accountants on the Board issuing separate dissenting remarks. Similar to the points raised in the comment letters, the dissenting Board members expressed concerns that the Proposal, among other things, (i) understates the costs to both auditors and issuers of implementing the proposed rule, (ii) would expand the auditor’s responsibility to areas outside of the auditor’s competency, and (iii) would reduce competition by creating additional barriers to entry for midsize and smaller accounting firms.
If adopted, the proposed rule would significantly expand the auditor’s objectives and responsibilities when auditing the financial statements of public companies and increase the role of specialists (including outside legal counsel) in the performance of financial statement audits, thereby resulting in sizeable additional costs for public companies. The proposed rule also would require the individuals in management, compliance, and legal functions of public companies to provide information to independent auditors far beyond what has traditionally been required in a financial statement audit, including information that may only indirectly relate to the financial statements.
Overview of Current Standard
The current standard, AS 2405, Illegal Acts by Clients, largely mirrors Section 10A of the Securities Exchange Act of 1934 (Section 10A), which requires that auditors perform “procedures designed to provide reasonable assurance of detecting illegal acts that would have a direct and material effect on the determination of financial statement amounts.”1 If an auditor becomes aware of a possible illegal act, the auditor is required to “obtain an understanding of the nature of the act, the circumstances under which it occurred, and sufficient other information to evaluate the effect on the financial statements.”2 The auditor also is required to consider the implications of the possible illegal act in relation to other aspects of the audit and “assure that the company’s audit committee is adequately informed [with respect to the possible illegal act] as soon as practicable and prior to the issuance of the auditor’s report ….”3
Other illegal acts outside of the scope of the current standard may have material but indirect effects on a company’s financial statements because they can result in recording or disclosure obligations when a company does not comply, including penalties, fines, and loss contingencies. Such acts include violations of occupational safety, health, environmental, cybersecurity, data privacy, and antitrust laws. While the current standard requires financial statement auditors to be aware of the possibility of such illegal acts (and respond if any such acts come to the auditor’s attention), it does not require auditors to perform specific procedures designed to provide any assurance of detecting such acts.4 The auditor’s limited responsibility in this regard reflects the recognition that illegal acts stemming from a company’s operations are further removed from financial reporting and unlikely to come to an auditor’s attention in the course of its audit procedures or be identified by the auditor as “illegal.”5 The current standard, in fact, expressly presumes auditors “do not have sufficient basis for recognizing possible violations of such laws and regulations.”6
Identification of All Laws and Regulations With Which Noncompliance Could Reasonably Have a Material Effect — Direct or Indirect — on the Financial Statements
The proposed rule would impose additional obligations on auditors beyond what the Board describes in its proposal as the “baseline” requirements of Section 10A.7 Specifically, auditors would be required to perform procedures to identify any laws and regulations with which noncompliance “could reasonably have a material effect on the company’s financial statements.”8
Most notably, the proposed rule eliminates the distinction between noncompliance that has a “direct” versus “indirect” effect on the financial statements. The Board has expressed that the categorization of illegal acts in the current standard has been “a source of confusion to investors” and that under the proposed rule, it would expect auditors to “focus on all types of noncompliance, whether the violations concern financial or operational issues or involve intentional or unintentional conduct.”9 The Proposal acknowledges that this would “encompass a wide variety of conduct” that includes not only financial crimes such as embezzlement and asset misappropriation but also “other conduct that has financial consequences to the company, such as violations of employment, occupational safety and health, antitrust, or privacy laws and regulations.”10Such financial consequences include fines, penalties, costs associated with remediation, or other contingent monetary effects.
The proposed rule would permit auditors to use the results of management’s own efforts to identify relevant laws and regulations. However, the auditor’s inquiry would not be limited to those laws and regulations identified by management.11 In addition, whereas the existing standard only requires the auditor to consult with the company’s legal counsel if management does not provide satisfactory information that there has been no illegal act,12 the proposed rule expressly requires the auditor to consider whether specialized skill or knowledge is needed to assist in the auditor’s evaluation.
Assessing the Risk of Material Misstatement Due to Noncompliance With Laws and Regulations
The Board also has proposed amending AS 2110, Identifying and Assessing Risks of Material Misstatement, which establishes requirements for auditors regarding the process of identifying and assessing risks of material misstatement in a company’s financial statements. These proposed amendments would require auditors to perform procedures to assess a company’s risk of material misstatement of the financial statements due to noncompliance with those laws and regulations the auditor determines “could reasonably have a material effect on the financial statements” if not complied with. Among other things, auditors would be required to understand management’s processes for
- identifying relevant laws and regulations with which noncompliance could reasonably have a material effect on the financial statements
- preventing, identifying, investigating, evaluating, communicating, and remediating instances or alleged or suspected instances of fraud and other noncompliance
- receiving and responding to tips and complaints from internal and external parties regarding noncompliance
- evaluating potential accounting and disclosure implications as a result of noncompliance13
The Board’s proposal provides a hypothetical illustration of how it envisions this risk assessment process to play out in practice, using an example involving laws and regulations that have an indirect effect on the financial statements:
[A]s a result of performing procedures, the auditor of a chemical company may identify information about environmental regulations related to chemical waste disposal that create a risk of material misstatement because the effect of violations of the regulations could result in material fines, penalties, or the obligation to perform environmental remediation.
The auditor would be required to obtain an understanding of management’s processes related to preventing, identifying, investigating, evaluating, communicating, and remediating noncompliance with such laws and regulations. Management’s processes could involve the company’s specialists who tested whether the company’s chemical waste disposal complied with regulatory requirements. Obtaining an understanding of management’s processes could also involve obtaining reports from the company’s specialist or reports from relevant regulators about the company and understanding how the company used those reports in their processes. Performing such a procedure could inform the auditor about whether noncompliance with any relevant environmental regulations has or may have occurred.14
In addition, the proposed amendments to AS 2110 would make mandatory several procedures the current auditing standard describes as discretionary — that is, procedures the auditor “should consider performing.”15 These include, among others, specific requirements for obtaining an understanding of a company’s regulatory environment, obtaining an understanding of compensation arrangements with senior management other than executive officers, and reading public information (such as the company’s and its officers’ social media accounts and other public statements).16 The Board expressed that reading such information “may bring to the auditor’s attention statements … [that] may be contradictory to other information obtained by the auditor or within the financial statements.”17
Evaluating Potential Noncompliance With Laws and Regulations
For all laws and regulations that could reasonably have a material effect on the financial statements, the proposed rule would require auditors to plan and perform procedures to determine whether there is information indicating noncompliance “has or may have occurred (regardless of whether the effect of such noncompliance is perceived to be material to the financial statements).”18 If the auditor determines there is information indicating noncompliance “has or may have occurred,” it would be required to perform additional procedures to understand the nature and circumstances of any such noncompliance and determine whether it is “likely” that any such noncompliance occurred.19
The proposed rule provides a non-exhaustive list of procedures the auditor may perform to obtain such an understanding, including several that contemplate a significant increase in the exchange of information between auditors and individuals who serve in in-house legal and compliance functions. Among other things, the auditors would be required to consider
- ·obtaining an understanding of the nature and status of any relevant investigations internal or external to the company
- confirming significant information concerning the events or transactions with other parties, intermediaries, financial institution, and legal counsel, among others
- discussing the facts and circumstances with the company’s legal counsel or others with specialized skill or knowledge about the application of relevant laws or regulations to the circumstances and the possible effects on the financial statements20
The Board has made clear its expectation that auditors may need to engage legal counsel as specialists to (i) assist in understanding certain laws and regulations, (ii) assess and respond to the risk of material misstatement due to noncompliance, (iii) evaluate whether it is likely that noncompliance occurred, and (iv) develop more rigorous inquiries of management.
The Proposal illustrates how the auditor’s risk assessment might inform subsequent internal control testing and substantive audit procedures using a hypothetical situation involving the Foreign Corrupt Practices Act (FCPA):
[I]f an auditor identified the FCPA as a law that could reasonably have a material effect on the financial statements because the company’s operations are in a jurisdiction where bribery may be more common, or the company or its competitors have a history of FCPA violations, the auditor in planning and performing procedures would understand management’s processes around FCPA compliance, test relevant controls that were put in place to maintain compliance with the FCPA, or perform cash disbursement testing designed to identify potential bribes. These would be in addition to inquiring of management and other employees about whether any FCPA violations, or alleged or suspected violations, have been identified. These types of procedures could be performed on a standalone basis or simultaneously with other planned procedures (i.e., internal control testing of cash disbursements in an integrated audit or detail testing of cost of goods sold or other expenses).21
Lastly, the proposed rule would introduce a new requirement that the auditor determine whether senior management has taken timely and appropriate remedial action to address any noncompliance.22
Communicating Noncompliance With Laws and Regulations to the Audit Committee
The Proposed Rule would require more frequent communication between auditors and the audit committee.23 This aspect of the Proposal contemplates a two-step process that expressly expands on the requirements set forth in Section 10A by requiring additional, earlier communication between the auditor and those charged with governance.
First, except where the matter is “clearly inconsequential,” the auditor would be required to make an initial communication to management and the audit committee upon becoming aware of information indicating that noncompliance with laws and regulations “has or may have” occurred.24 The Proposal expressly contemplates such communication before the auditor completes its evaluation of whether noncompliance has in fact occurred or whether any noncompliance has a material effect on the financial statements.25
Second, auditors would be required to make an additional communication after completing the evaluation of whether the noncompliance has or may have occurred or if the auditor is unable to complete its evaluation. Specifically, the auditor would be required to communicate to management and the audit committee which matters previously identified reflect noncompliance and whether they result in a material misstatement in the financial statements.26 Auditors would not be required to communicate to the audit committee regarding matters deemed to be “clearly inconsequential.”27
In addition, consistent with Section 10A(b)(2) of the Exchange Act, the proposed rule would require auditors to make additional communications directly to the company’s board of directors if the auditor concludes that (1) the likely noncompliance has a material effect on the financial statements; (2) senior management has not taken, and the board of directors has not caused senior management to take, timely and appropriate remedial action with respect to the likely noncompliance, and (3) the failure to take remedial action is reasonably expected to cause the auditor to not issue an unqualified opinion or to resign from the audit.28
Dissenting Remarks and Comment Letters
Board members Duane M. DesParte and Christina Ho — the only members who are accountants — voted against the proposed rule and issued separate dissenting remarks raising concerns regarding the scope, cost, practicability, and competitive impact of the proposed rule.29
Board member DesParte remarked that while “many of [the Board’s] proposed enhancements are positive,” he could not support the proposal because it “unreasonably and at great cost expands the scope of the audit to incorporate extensive new compliance attestation procedures and will require legal acumen and expertise well beyond the auditor’s core competency.”30 Among other things, Board member DesParte expressed concerns that the proposed rule’s “filtering threshold” — any laws or regulations that “could reasonably” have a material effect on the financial statements — is not adequately explained in the proposal or elsewhere in the PCAOB standards.31
Board member DesParte also voiced broader concerns regarding the implications of the current Board’s standard-setting agenda on the role of independent auditors:
I am increasingly concerned we are establishing new auditor obligations and incrementally imposing new auditor responsibilities in ways that will significantly expand the scope and cost of audits, and fundamentally alter the role of auditors without a full and transparent vetting of the implications, including a comprehensive understanding of the overall cost-benefit ramifications. I also wonder whether we are further contributing to the expectations gap by imposing responsibilities on auditors not aligned with their core competencies or the fundamental purpose of a financial statement audit.32
Board member Ho also voiced concerns regarding key elements of the proposed rule, which she stated would mark a “breathtaking expansion of the auditor’s responsibilities.” Specifically, Board member Ho expressed that the Proposal (i) was not “fully transparent about the significant additional responsibilities it would impose on all public company auditors by eliminating the distinction between noncompliance that has a direct versus indirect effect” on the financial statements; (ii) “introduces ambiguities regarding auditor obligations to investors, by transforming the auditor’s role from one providing reasonable assurance to one of performing management functions”; and (iii) takes a “one-size-fits-all approach” that will create additional barriers for entry for midsize and smaller audit firms.33
Numerous interested parties have submitted comment letters, many of which echo the concerns raised by the dissenting Board members. In addition, the comment letters noted that the proposed rule’s terminology concerning the probability of noncompliance — including “could reasonably,” “may,” “might,” and “likely” — lacks clarity and introduces confusion because it does not align with the operative terms applicable under Generally Accepted Accounting Principles (GAAP) that govern the recognition and disclosure of loss contingencies (“probable,” “reasonably possible,” “remote,” and “estimable”).34 Commentors also expressed concern that the proposed rule would weaken attorney-client privilege protections by requiring companies to provide their auditors with privileged information, ultimately exposing issuers to significant litigation and discovery risks.35 This includes the risk that companies will be deemed to have waived applicable privileges by disclosing otherwise privileged communications with their independent auditors.
In addition to raising concerns regarding the proposed rule’s substantive requirements, several interested parties expressed concern that the Board had not provided sufficient time for comment and urged the Board to engage in further dialogue with key stakeholders (including public companies, auditors, and outside counsel) before moving forward.36
Practical Implications for Public Companies
If adopted in its current form, the proposed rule would have the following significant implications for public companies.
- Expanded Use of Nonauditor Third-Party Specialists in Financial Statement Audits. The proposed rule will significantly expand the use of lawyers and other subject matter experts as specialists in financial statement audits, which will increase the cost of an audit.
As Board member (and former auditor) Ho expressed in her dissenting remarks, for the auditor “[t]o identify the laws and regulations with which noncompliance could reasonably have a material effect on financial statements, an auditor must first identify all the laws and regulations applicable to the public company.”37 Board member DesParte predicts that to accomplish this, “[l]awyers will be required across the wide array of disciplines and specializations to assist the auditor in identifying the population of relevant laws and regulations, assess the ‘could reasonably’ scoping filter, design and perform compliance attestation procedures to identify information that may indicate potential noncompliance, and evaluate whether such noncompliance has or has likely not occurred.”38 The burden of complying with the proposed rule in this regard would be significantly greater in audits of public companies that are subject to laws in multiple jurisdictions, including, for example, companies with significant operations or subsidiaries abroad.39
Auditors will incur significant firmwide costs to implement the proposed amendments, update firm procedures, and develop and manage knowledge and training regarding its implementation. The Board also foresees audit firms incurring “engagement-level variable costs related to implementing the proposed amendments” that “could be substantial.”44 While the proposal does attempt to quantify the estimated increase in audit fees, commentators have predicted the increase might be “a multiple of current audit fees.”45
Companies also would face additional costs in the form of increased audit fees, which includes the costs associated with the work of specialists. Companies also will incur indirect costs in the form of additional burdens on its personnel, including costs associated with responding to auditors’ requests for information and supporting documentation, as well as the cost of enhancing processes and controls related to noncompliance with laws and regulations.
* * *
Sidley will continue to monitor developments related to this Proposal. However, we do not know whether the proposed rule will be adopted and, if so, whether the Board will modify it in any respect to address the dissenting Board members’ concerns and the concerns raised in various comment letters. While the PCAOB may modify the proposed rule to address some of the concerns described above, it appears likely the Board will expand the auditor’s responsibilities with respect to noncompliance with laws and regulations in some way. The proposed rule has support from a majority of the Board in its current form, and, notwithstanding their concerns, both dissenting Board members have expressed support for certain aspects of the Proposal.
115 U.S.C. § 78j-1(a)(1) (emphasis added).
2AS 2405, Illegal Acts by Clients (“AS 2405) at .10.
7Proposal at 6.
8AS 2405, A Company’s Noncompliance with Laws and Regulations (Proposed AS 2405) at .04 (emphasis added).
9Proposal at 5, 24 (emphasis added).
11SeeProposal at 5.
13Proposed AS 2110, Identifying and Assessing Risk of Material Misstatement (Proposed AS 2110) at .26.
14Proposal at 22.
15CompareAS 2110, Identifying and Assessing Risks of Material Misstatement at .11, with Proposed AS 2110 .11.
16Proposed AS 2405.11.
17Proposal at 37.
18Proposed AS 2405.07 (emphasis added).
19Proposed AS 2405.09.
20Proposed AS 2405.08.
21Proposal at 32.
22SeeProposed AS 2405.11.
23SeeProposed AS 2405.12–15.
24Proposed AS 2405.12–13.
25SeeProposal at 49.
26Proposed AS 2405.14.
29SeeStatement on Proposal to Amend PCAOB Auditing Standards Related to a Company’s Noncompliance with Laws and Regulations and Other Related Amendments by Duane M. DesParte, Board Member, dated June 6, 2023 (DesParte Statement); Statement on Proposed Amendments to PCAOB Auditing Standards related to a Company’s Noncompliance with Laws and Regulations by Christina Ho, Board Member, dated June 6, 2023 (Ho Statement).
34Letter to the PCAOB from the U.S. Chamber of Commerce Center for Capital Markets Competitiveness regarding Proposing Release: Amendments to PCAOB Auditing Standards related to a Company’s Noncompliance with Laws and Regulations (PCAOB Release No. 2023-003, June 6, 2023; PCAOB Rulemaking Docket Matter No. 051), dated August 2, 2023 (U.S. Chamber Letter) at 9–10; Comments of the Auditing Standards Committee of the Auditing Section of the American Accounting Association on the PCAOB’s Amendments to PCAOB Auditing Standards Related to a Company’s Noncompliance with Laws and Regulations and Other Related Amendments, dated August 2, 2023 (Auditing Standards Committee Letter), at 7.
35E.g.,U.S. Chamber Letter at 11; Letter to PCAOB from the Audit Committee Counsel regarding Proposing Release: Amendments to PCAOB Auditing Standards related to a Company’s Noncompliance with Laws and Regulations and Other Related Amendments; PCAOB Rulemaking Docket Matter No. 051, dated July 25, 2023 (Audit Committee Counsel Letter) at 3; Letter to the PCAOB from the Society for Corporate Governance regarding PCAOB Release No. 2023-003: Proposed Amendments to PCAOB Auditing Standards related to a Company’s Noncompliance with Laws and Regulations and Other Related Amendments on Amendments to PCAOB Auditing Standards related to a Company’s Noncompliance with Laws and Regulations, dated August 10, 2023 (the Society for Corporate Governance Letter) at 10–11.
36E.g., Society of Corporate Governance Letter at 1–2; Audit Committee Counsel Letter at 5; Letter to PCAOB from PricewaterhouseCoopers LLP regarding PCAOB Rulemaking Docket Matter No. 51, dated August 7, 2023, at 2, 6–7.
37Ho Statement (emphasis added).
39SeeSociety of Corporate Governance Letter at 4 (noting, by way of example, that an estimated “162 countries had enacted data privacy laws as of May 2023, 17 of which were enacted between 2021 and 2023. In the U.S., at least six new privacy laws were adopted at the state level between January to June 2023 alone” — many of which vary considerably from one another in their scope, application, and specific requirements).
40Proposal at 81.
42Proposal at 43.
43Proposal at 76.
44Proposal at 77.
45Auditing Standards Committee Letter at 3; see alsoU.S. Chamber Letter at 15 (estimating that audit fees for public registrants will triple under the proposed rule).