Three from the PCAOB

Today, we are considering three proposals—one rule and two standards—from the Public Company Accounting Oversight Board (“PCAOB”). The auditor’s calling is fundamental to the health of the capital markets. For this reason, we want to ensure that the standards and rules governing auditors are clear and sensible, do not rob auditors of their confidence to exercise judgment, and that they facilitate auditors’ focus on the critical job of ensuring that financial statements are reliable. The Commission’s review of the PCAOB’s rules and standards is integral to the process that Congress established to ensure the quality and effectiveness of the PCAOB’s work.

Commission review of PCAOB standard-setting is particularly important now. First, as evidenced by high audit deficiency rates[i] and much enforcement saber rattling,[ii] the PCAOB appears to be struggling with its critical mission of fostering audit quality. Second, the PCAOB is rushing new standards out the door without due regard for internal deliberation, public input, economic analysis, or implementation issues.[iii] Third, as many at the PCAOB and outside have noted, the audit profession faces challenges, including high rates of concentration, low rates of new recruits, and exits by seasoned auditors. While many factors contribute to these challenges, deliberate and prudent regulatory steps can mitigate them while hasty and ill-considered steps will exacerbate them.

Thank you to Chair Williams, Board Members Ho, Stein, Thompson, and Botic, the PCAOB staff, and SEC staff, including staff in the Office of the Chief Accountant, the Division of Economic and Risk Analysis, and the Office of the General Counsel. Your passion for high audit quality audits, which are so important to our capital markets, is evident in the work that you do.

Proposed Amendments to PCAOB Rule 3502 Governing Contributory Liability

I do not support the proposed change in the contributory liability standard from recklessness to simple negligence. This change is neither consistent with the requirements of the securities laws, nor necessary or appropriate in the public interest or for the protection of investors.[iv] It could have the unintended consequence of lowering audit quality and could worsen the trend toward fewer talented individuals entering the auditing profession. The more expansive liability standard reverses, without any clear reason for doing so other than “because we can,” the twenty-year old PCAOB decision not to adopt a negligence standard.[v] This decision reflects the PCAOB’s recent emphasis on aggressive enforcement.[vi] When placed in that context, the refusal to limit application of the new contributory negligence rule to multiple instances of negligent conduct is concerning.[vii] When paired with the PCAOB’s stated plan to “aggressively pursu[e] all statutory legal theories for charging respondents,”[viii] assurances that it “intends to deploy its prosecutorial discretion responsibly”[ix] provide little comfort. The PCAOB of course should enforce its rules, but bringing formal enforcement actions should not be the first tool a regulator grabs when deficiencies are identified -- particularly when the conduct at issue is merely negligent.

As many commenters on the PCAOB’s proposal pointed out, this change is unnecessary and could have adverse consequences on audit quality. The PCAOB already can and does pursue individual misconduct under its existing rules. The SEC, state accountancy boards, and audit firms already can respond to individuals’ negligent contributory conduct. The PCAOB interacts often with the SEC’s Office of the Chief Accountant and staff from the Division of Enforcement and can refer any instances of negligent misconduct to the SEC. The PCAOB’s own economic analysis estimates that this change will yield only two or three additional cases for the PCAOB each year.[x] The benefits are therefore likely limited, but the costs are likely to be high because audit professionals could be overcome by risk aversion as they fear being second-guessed by a PCAOB enforcement regime armed with the clarity found only in hindsight analysis. It adds yet one more reason for people to leave or never join the audit profession[xi] or to refuse to take on roles in important areas like quality control. The lower liability standard may be particularly challenging for small and foreign firms. The PCAOB acknowledges that “the amendment could lead some firms to exit the issuer audit market,” but rather than seriously grapple with this potential cost, the PCAOB instead looks forward to a “landscape . . . characterized by a higher concentration of more capable and compliant audit firms” as an outcome that mitigates “the negative impacts on the competitive landscape.”[xii] The PCAOB should work with audit firms to improve quality, rather than seek to clear the landscape of all but the biggest firms.

I have some questions:

1. Several commenters questioned the PCAOB’s authority to adopt this amendment. The Commission’s order affirms the PCAOB’s authority under Sections 103 and 105 of Sarbanes-Oxley. The PCAOB also cites another provision as authority—the Sarbanes-Oxley directive that “[t]he rules of the board shall . . . provide for the operation and administration of the Board, the exercise of its authority, and the performance of its responsibilities under this Act.”[xiii] That provision seems inapt and, if used as authority for a rule like this one, potentially eviscerates any limits on the PCAOB’s authority. What are the limits to the PCAOB’s authority under Section 101(g) of Sarbanes-Oxley?
2. How will this new negligence-based liability standard interact with what one commenter described as the PCAOB’s shift away from principles-based and toward rules-based standard-setting?[xiv]
3. The PCAOB acknowledged that this rule and the quality control standard that the PCAOB recently finalized “could overlap to cover the same conduct in some circumstances” and explained the value of “the potential to be held individually liable for contributory negligence [which] may increase the amount of care and attention dedicated to QC by responsible individuals.”[xv] Are you concerned that this change in the liability standard could cause some people to avoid taking on quality control roles, particularly with a new and unfamiliar quality control standard potentially coming into effect?
4. The PCAOB insists that it is not planning to use the standard to go after junior auditors, but one of the PCAOB’s arguments in favor of the rule change is that “the market-driven consequences relating to the auditor reporting model and identification of auditors on Form AP are felt primarily (if not exclusively) by the engagement partner on an audit, while Rule 3502 applies more broadly.”[xvi] Are you concerned that this rule could dissuade people from entering the audit profession because they will fear that an early career misstep could be the basis for a PCAOB enforcement action?
5. After this change takes effect, in what types of self-protective behavior might associated persons engage to avoid being charged with contributory negligence, and how might such self-protective conduct undermine the collaborative nature and efficiency of audits?
6. The PCAOB explained that “an increase in the number of regulators on alert for the same or similar violative conduct increases the likelihood of that conduct being detected and, consequently, the likelihood that the conduct would be sanctioned.”[xvii] Although it does not currently have the ability to bring negligence-based charges against individuals, the PCAOB nevertheless should be on the lookout for such conduct since it can make referrals to the SEC.
   1. How frequently has the PCAOB over the past two decades referred negligence-based misconduct by individuals to the SEC?
   2. In how many of those instances has the SEC declined to bring a negligence-based secondary liability charge?
7. As one commenter noted, when the SEC brings negligence-based cases, it typically also brings a case under Rule 102(e) of the SEC’s Rules of Practice. For that rule to apply, there must be either “repeated instances of unreasonable conduct” or “a single instance of highly unreasonable conduct,” which means “higher than ordinary negligence but lower than the traditional definition of recklessness.”[xviii] Will the PCAOB be bringing cases that the SEC would not since the SEC in practice has not pursued instances of simple negligence?
8. I appreciate the PCAOB’s assurances that it does not intend to use this new liability standard “to sanction isolated, good-faith errors in professional judgment,”[xix] but how do we ensure that the PCAOB does not use this lower standard to look through the unforgiving lens of hindsight to punish a well-intentioned auditor for her work on a highly complex and collaborative audit engagement that entailed judgments about which reasonable minds can disagree?

AS 1000, General Responsibilities of the Auditor in Conducting an Audit and Amendments to PCAOB Standards

I support this new auditing standard, which, in the words of the PCAOB, “reaffirm[s] the general principles and responsibilities of the auditor so that the foundation underlying our standards continues to be sound and appropriate for performing high-quality audits.”[xx] Undergirding my support is an expectation that the PCAOB will stand ready to provide guidance, answer questions, monitor for issues during implementation, and conduct a post-implementation review. The new standard, by modernizing, and consolidating a group of interim standards adopted at the PCAOB’s inception, should facilitate compliance and strengthen audit quality.

The adopting release is helpful in setting the basic parameters within which auditors operate. It reaffirms that the auditor’s fundamental obligation is to protect investors through the preparation and issuance of independent auditor’s reports. While this language does not change auditors’ obligations, it places appropriate emphasis on the investor. AS 1000’s shortening of the time period within which auditors must complete their workpapers also should be protective of investors. The PCAOB worked to balance principle-based standards with specificity in response to commenters’ questions.

Commenters also were generally supportive of AS 1000 but underscored the need for implementation guidance and post-implementation review. I have some questions:

1. One commentator opined that “The adoption of AS 1000 is expected to have a profound impact on the auditing profession.”[xxi] Do you agree? If so, what do you anticipate being the biggest changes resulting from this standard?
2. The adopting release states that auditors should pay attention to guidance, whether included in an adopting release or staff guidance, but that such guidance is not binding.[xxii]

Did the PCAOB put all guidance intended to be authoritative in the standard itself as opposed to in the accompanying release?

3. Our order states: “For audits of stub periods, we believe the effective date of the document completion requirement is clear. Nevertheless, we encourage the PCAOB staff to consider the need to provide additional guidance which could be useful to firms.” What is the effective date of the document completion requirement for stub periods?
4. The standard requires auditors to critically assess “audit evidence and other information that is obtained to comply with PCAOB standards and rules.”[xxiii] AS 1105 governs the critical assessment of audit evidence, but what standard applies to the critical assessment of other information that is obtained to comply with PCAOB standards and rules?
5. This standard is applicable to audits of broker-dealers, but the adopting release barely mentions broker-dealer audits. Did the PCAOB adequately consider unique issues related to broker-dealer audits?
6. At the open meeting adopting this standard, one of the PCAOB economists acknowledged the assistance of the SEC in preparing the economic analysis. What was our contribution to the analysis? What does the statute require of us and the PCAOB when it comes to performing an economic analysis?

Amendments Related to Aspects of Designing and Performing Audit Procedures that Involve Technology-Assisted Analysis of Information in Electronic Form

I support, albeit with reservations, today’s amendments to the PCAOB’s standards on Audit Evidence and The Auditor’s Responses to the Risks of Material Misstatement. These amendments should help to guide auditors as they increase their use of technology-assisted analysis of information in electronic form. These amendments should help to alleviate the uncertainty that has led to different practices across firms and has kept some firms from using data analytics. This standard is a good start, and I look forward to the PCAOB’s continuing efforts to provide regulatory clarity around how auditors can use—and respond to their clients’ use of—new technologies, including artificial intelligence and blockchain.

While these amendments provide clarity about the use of technology, the associated burden on auditors and their clients is unclear. This standard could be very expensive. The ambiguity around the cost of these amendments flows from how the standard was drafted coupled with questions about how it will be implemented. Our approval order addresses some of the concerns raised by commenters and “encourage[s] the PCAOB to provide further implementation guidance” affirming the acceptability of a risk-based approach. I still have some questions:

1. Have you discussed with the PCAOB its plans with respect to developing implementation guidance, working with firms on implementation, setting up a mechanism for consulting on implementation questions, monitoring implementation, considering how this standard interacts with other forthcoming standards, and conducting a retrospective assessment of the costs and benefits of these changes?
2. The final amendments require auditors, among other things, to “evaluate whether external information provided by the company in electronic form and used as audit evidence is reliable by “testing the information to determine whether it has been modified by the company and evaluating the effect of those modifications; or testing controls over receiving, maintaining, and processing the information (including, where applicable, information technology general controls and automated application controls)” and explains that such information includes “cash receipts, shipping documents, and purchase orders.”[xxiv] Given that this language sounds very expansive, commenters struggled to understand whether the amendments are truly risk-based. I would like to get your reaction to some of their concerns:
   1. Must “the auditor, in all circumstances and without regard to the auditor’s assessment of risk, . . . perform specific procedures to determine whether or not any intentional or unintentional modifications have been made to information a company receives from external sources and provides to the auditor in electronic form”?[xxv]
   2. Must an auditor look at the non-electronic source document? What if no hardcopy exists because “a purchase order [was] sent to the company in the form of a PDF attachment in an email or [was] submitted through an electronic portal), or the hardcopies themselves may routinely be digitized and discarded upon receipt”?[xxvi] Or does an auditor have to “test each piece of information received in electronic form by obtaining a copy of the electronic information directly from the original source of the external information”?[xxvii]
   3. An auditor may test controls instead of testing information, but the release states that “[c]ontrols over processing the information would include internal controls over any modifications made by the company to the information.”[xxviii] What is the significance of “any,” which was added at the adopting stage?[xxix]
   4. “If the company did not explicitly identify a risk of material misstatement related to the risk of modification . . . of the electronic information,”^[xxx] does the auditor have to demand the company implement effective internal controls?
3. In setting the effective date for this standard, did the PCAOB take into account work that auditors will need to do to incorporate elements of other standards that were recently adopted or proposed? For example, one commenter noted that “the PCAOB’s proposed amendments to AS 2301, The Auditor’s Responses to the Risks of Material Misstatement (specifically, new paragraph .40A), which are part of the PCAOB’s proposal to replace extant AS 2305, would create significant new implementation challenges for both issuers and auditors by broadening the scope of evidence subject to AS 1105.10A(b)’s prescriptive requirements.”[xxxi]
4. Will companies need to implement or formalize controls or processes around information received from one or more external sources, which auditors will then need to check for appropriate design and implementation? If so, does applying the standard to audits of financial statements for fiscal years beginning on or after December 15, 2025 give companies enough time?