SEC approves PCAOB rule amendment that expands individual auditor enforcement liability

The Securities and Exchange Commission (SEC) approved a proposed amendment to Public Company Accounting Oversight Board (PCAOB) Rule 3502.

The amended rule expands enforcement liability for associated persons who negligently, directly and substantially, cause a firm’s violation of any law, rule, or standard that the board is charged with enforcing.

Background

Since its adoption in 2005, PCAOB Rule 3502 (Responsibility Not to Knowingly or Recklessly Contribute to Violations) prohibited an associated person of a registered firm from knowingly or recklessly contributing, directly and substantially, to the firm’s primary violation.

However, on September 19, 2023, the PCAOB proposed to amend Rule 3502 to:

• Expand liability for associated persons’ contributory conduct under the rule from knowing or recklessness conduct to mere negligent conduct, and
  
  
• Provide that an individual contributing to a registered firm’s primary violation need not be an associated person of the firm that commits the primary violation so long as the individual is an associated person of any registered firm.

In its proposal to amend the rule, the PCAOB asserted that the amendments were necessary to fix an “incongruity”; that is, a firm can commit a primary violation of certain laws, rules, or standards by acting negligently, but an associated person who directly and substantially contributed to that violation must have acted at least recklessly to be secondarily liable.

The PCAOB argued that this incongruity likely “dissuade[d] associated persons from exercising the appropriate level of care in their audit work … [as] [t]hey may not exercise reasonable care (the standard for negligence) if they know that they cannot be held individually liable by the PCAOB for a firm’s primary violation unless an act or omission by them amounts to an ‘an extreme departure from the standard of ordinary care for auditors’ (the standard for recklessness).”

The PCOAB’s proposed amendment to Rule 3502 aligns with the board’s publicly announced efforts in recent years to broaden the PCAOB’s enforcement reach.

In particular, PCAOB Chair Erica Williams publicly stated that the agency intended to expand the types of enforcement cases it will pursue to include cases that hinge on only a single, wrongful act, whether reckless or negligent.

On August 20, 2024, the SEC approved the PCAOB’s proposed amendment to Rule 3502 (now styled, Responsibility Not to Contribute to Violations).

Commenting on the amendments, SEC Chief Accountant Paul Munter stated, “The amendments to Rule 3502 are critical … [to] align[] the rule with other negligence-based professional conduct standards … and align[] the rule with the same standard of reasonable care that auditors are required to exercise when executing their professional duties.”

Significant implications

The amended Rule 3502 will likely have significant consequences for senior leaders of registered firms and other associated persons.

Senior firm personnel responsible for overseeing a firm’s system of quality control or PCAOB-mandated disclosures may now be exposed to enforcement liability if they fail to exercise their oversight duties with reasonable care.

Moreover, component auditor personnel may now find themselves subject to enforcement action if they negligently cause, directly and substantially, a primary audit firm’s violation of PCAOB standards or rules. In fact, component auditing firms or service centers are also subject to Rule 3502 liability if they negligently cause a primary audit firm’s violation.

Because PCAOB Rule 1001(p)(i) defines “person associated with a registered public accounting firm” – language used in the amended rule – to include “any independent contractor or entity that, in connection with the preparation or issuance of any audit report – (1) shares in the profits of, or receives compensation in any other form from, that firm; or (2) participates as agent or otherwise on behalf of such accounting firm in any activity of that firm,” component auditing firms and other entities are subject to liability under the amended rule if they fail to act with reasonable care and directly and substantially cause a registered firm’s primary violation.

In short, amended Rule 3502 is only the latest step by the PCAOB to increase potential enforcement liability for registered firms and associated persons. The amended rule is expected to be effective on October 21, 2024 (ie, 60 days following SEC approval).

If you have any questions regarding the PCAOB’s enforcement activities or the impact on your business, please contact any of the author or your DLA Piper relationship attorney.