PCAOB sets aggressive agenda for 2023: what to expect as agency enforcement expands

The Public Company Accounting Oversight Board (PCAOB) is the independent regulatory agency established by Congress to oversee the audits of public companies and broker dealers.  Although smaller than its regulatory cousin, the Securities and Exchange Commission (SEC), in 2022 the PCAOB began to flex its oversight and enforcement muscles. The number of PCAOB enforcement actions increased substantially over the prior year, as did the severity of sanctions imposed in those actions.  The past year also saw a number of first-of-their-kind enforcement actions.

The renewed vigor in PCAOB enforcement activity over the past year, as well the PCAOB’s publicly announced enforcement agenda, indicates that the trend of increasingly aggressive enforcement is only beginning.  This increased enforcement activity is sure to have far-reaching implications for registered public accounting firms and their associated persons in 2023 and beyond.

2022 by the numbers

PCAOB Chair Erica Williams, appointed in January 2022, announced that the PCAOB would approach enforcement with a “renewed vigilance.”  By any measure, the PCAOB’s 2022 enforcement results have lived up to her declaration. 

In 2022, the PCAOB instituted 42 public enforcement actions, doubling the number of such cases instituted in the prior year.  The agency has not brought this many enforcement actions in a single year since 2017. 

In 2022, the PCAOB also substantially increased the civil money penalties it imposed in enforcement actions.  In fact, in 2022 the PCAOB imposed the highest monetary penalties in any single year of its history, over $11 million in total.

The PCAOB imposed substantially higher penalties on registered public accounting firms across all types of enforcement actions (eg, audit deficiency, noncooperation, quality control, and PCAOB Form disclosure cases), including several actions that imposed civil money penalties of $1 million or more.  Notably, the agency had not issued a civil money penalty of $1 million or more since 2017.

By July 2022, the PCAOB had also more than doubled its average penalties against individual auditors compared to the previous five years and issued a record-setting penalty against an individual auditor.  By October 2022, the PCAOB eclipsed that record and imposed a new record fine of $150,000 fine on an individual auditor. 

Trends in the PCAOB’s 2022 enforcement actions

Apart from the substantial increases in both the quantity of enforcement orders and the sanctions in those orders, the PCAOB’s 2022 enforcement actions also reveal other trends.

Consistent with prior years, the PCAOB’s 2022 enforcement actions focused substantially on accounting firms’ systems of quality control and individual auditor accountability. Roughly one-third of its 2022 enforcement actions involved alleged deficiencies in firms’ systems of quality control.

Also consistent with prior years, the PCAOB continued to sanction individual auditors for alleged misconduct: it imposed bars from auditing of public companies in nearly 70 percent of enforcement actions involving individual auditors, and imposed suspensions or practice limitations in the remaining cases.  The PCAOB also imposed monetary penalties in all but two of its enforcement actions against individual auditors.

A newly emergent trend appears to be the increasing breadth of enforcement cases.  While in 2022 the PCAOB continued to bring enforcement actions in its traditional areas of focus, such as alleged deficiencies in particular public company audits and noncooperation with PCAOB inspections or investigations of PCAOB-registered firms and their personnel, the agency also brought a number of enforcement actions in other areas, among them alleged unethical conduct not related to a particular audit and unlawfully obtaining and using confidential PCAOB information. 

In addition, nearly a third of the PCAOB’s enforcement orders in 2022 targeted registered public accounting firms for the failure to file timely or accurate PCAOB-required disclosures, such as disclosures relating to the use of other auditors in Form AP or reportable events in Form 3.  Many of these disclosure cases were the result of enforcement sweeps, ie, simultaneous enforcement actions against multiple firms for the same alleged violation. 

Notably, the PCAOB brought some first-of-their-kind enforcement actions.  For instance, in 2022, it for the first time brought enforcement actions pursuant to Section 105(b)(6) of the Sarbanes Oxley Act.  That statutory provision provides, in part, that the PCAOB may impose sanctions on a registered public accounting firm or a “supervisory person” of a registered public accounting firm if the PCAOB finds that the firm has failed reasonably to supervise associated persons of the firm who engaged in misconduct.  Using Section 105(b)(6), the PCAOB can thus reach and sanction firms or “supervisory” personnel that did not directly engage in misconduct, but failed to appropriately supervise those who did. Notably, the agency may use Section 105(b)(6) to pursue senior supervisory personnel of a firm in certain cases.

Further, the PCAOB also for the first time entered the cryptocurrency fray and brought an enforcement action based on the audit of a public company for which cryptocurrency investment and trading were significant parts of both assets and revenue. Notably this enforcement action did not allege that the audit of the public company’s crypto-related assets or revenues violated PCAOB standards; rather, it focused on whether the firm had sufficient quality control policies and procedures in place to audit such a company in the first place.  In particular, the PCAOB’s order alleged that the firm’s system of quality control failed to provide reasonable assurance that the firm had the competence and personnel to accept, continue, and ultimately perform the audit engagement.

The PCAOB also took steps to sharpen the bite of its penalties.  Beginning in late 2022, it included language in its enforcement orders that prohibits registered public accounting firms and their associated persons from seeking, directly or indirectly, any form of reimbursement, indemnification for, or other offset to, the PCAOB-imposed penalty from any source.  The PCAOB also began assessing interest on any civil money penalties not timely paid. 

Finally, international enforcement cases also increased in 2022. Half of the PCAOB’s 2022 enforcement actions involved non-US PCAOB-registered firms or associated persons of those firms. This is an uptick in non-US enforcement activity over prior years.

This increase in non-US enforcement activity is likely to continue.  On December 15, 2022, the PCAOB announced that it had been granted – for the first time in its history – complete and unfettered access to inspect and investigate audit firms in the People’s Republic of China (PRC) and Hong Kong.  With this new access, the PCAOB has already opened additional investigations of PRC-based auditing firms during the course of 2022 and is likely to open more such investigations in 2023.    

Looking forward

All indications are that this is just a start: the PCAOB is only beginning to ramp its enforcement efforts.  In a September 2022 keynote address to the Council of Institutional Investors, Chair Williams revealed that the agency was expanding its case identification process and expanding the types of cases it will pursue to include cases that hinge on only a single, wrongful act, whether reckless or negligent. She also announced that the PCAOB would seek admissions of wrongdoing in its enforcement orders in cases involving intentional or particularly egregious misconduct.

In December 2022, she conveyed a similar message concerning the PCAOB’s enforcement agenda and added that the PCAOB intends to “use every tool in our enforcement toolbox,” and “we won’t be constrained by the types of cases the PCAOB has pursued in the past” or “limited to the level of penalties that have been seen before.” 

Takeaways – more enforcement activity, more risk

The PCAOB Chair’s comments and 2022 enforcement actions make clear that the agency intends to continue, if not accelerate or expand, its get-tough enforcement approach. As a result, this year we can expect that the PCAOB will likely seek to top its 2022 activity and seek even higher penalties and other significant sanctions in coming enforcement actions. 

In addition, because the PCAOB no longer feels “constrained” by the types of enforcement cases it has brought in the past, registered public accounting firms and their personnel face greater risk that they will become ensnared in a PCAOB investigation, particularly given that a single negligent act may soon become grounds for enforcement action. Auditor judgment, even in complex areas, is likely to come under greater scrutiny as the PCAOB looks to expand the types of cases it pursues and the liability theories it applies. 

This more aggressive approach may also lead to more complex interactions between registered public accounting firms and their regulators.  The PCAOB and SEC have concurrent jurisdiction over registered public accounting firms; the newly assertive PCAOB may insist on having a seat at the table in higher profile enforcement matters where it had historically deferred to the SEC.  Registered public accounting firms may therefore find themselves dealing with parallel investigations and potential sanctions of two regulators in the future.

Similarly, non-US PCAOB registered firms, particularly those in the PRC, may find themselves under increasing enforcement scrutiny as the PCAOB seeks to vigorously enforce its statutory mandate to inspect and investigate registered accounting firms regardless of their location. 

All told, the future enforcement outlook for registered public accounting firms and their personnel appears far more complex and riskier than in years prior.

If you have any questions regarding the PCAOB’s enforcement activities or the impact on your business, please contact any of the authors or your DLA Piper relationship attorney.