PCAOB’s enforcement and standard setting rev up: what to expect in 2024

The Public Company Accounting Oversight Board (PCAOB) is the independent regulatory body established by Congress to oversee the audits of public companies and broker dealers. In 2023, the PCAOB continued to accelerate its enforcement and standard setting activities. And, in many respects, it was a record-setting year for the agency.

During 2023, the PCAOB imposed record-setting total sanctions and executed a number of first-of-their-kind enforcement actions. Additionally, the PCAOB proposed a number of amendments to auditing standards and PCAOB rules, some of which, if adopted, would impose substantial new burdens on, and potentially greater enforcement exposure for, auditors and public accounting firms.

As we head into 2024, this trend of increasingly aggressive enforcement and standard setting is likely to continue and is sure to have far-reaching implications for registered public accounting firms and their associated persons.

Enforcement: “We are making sanctions count”

At the end of 2023, PCAOB Chair Erica Williams stated, “We are making sanctions count.” That was no exaggeration. In 2023, the PCAOB imposed over $20 million in penalties, nearly doubling the penalties it imposed in 2022 (approximately $11 million) which was itself then a record-setting year.

Notably, the sharp increase in the sanctions imposed on registered public accounting firms and their associated persons was not the result of a significant increase in the number of enforcement actions. In fact, the PCAOB only saw a modest increase in the number of settled enforcement actions for the year (44 in 2023 versus 42 in 2022). Rather, the PCAOB increased the penalties it imposed across all types of enforcement actions, including audit deficiency, quality control, and PCAOB Form disclosure cases – ie, failures to file timely or accurate PCAOB-required disclosures.

The PCAOB also continued to push the penalty envelope by imposing more million-dollar-plus penalties in individual enforcement actions. The PCAOB has imposed such penalties in the past, including in 2022. However, in 2023, the PCAOB imposed fines of $2 million or more in five separate enforcement actions, more than any other year in its history.

Although the PCAOB substantially increased the penalties it imposed in enforcement actions, the type of enforcement cases it pursued in 2023 was generally consistent with those pursued in 2002. In 2023:

• About one-third of the PCAOB’s enforcement actions involved alleged substantive audit deficiencies.
• Almost 40 percent of the PCAOB’s enforcement actions were the result of enforcement “sweeps,” ie, simultaneous enforcement actions against multiple firms for the same alleged violation, such as alleged failure to file timely or accurate PCAOB-required disclosures in Forms AP, 2 and 3, or alleged violations of AS 1301 related to required audit committee communications.
• Nearly 40 percent of the PCAOB’s enforcement actions involved alleged quality control deficiencies.
• Roughly half of the PCAOB’s enforcement actions involved non-US firms and/or their associated persons.

The PCAOB also continued to sanction individual auditors for alleged misconduct: in nearly 90 percent of enforcement actions involving individual auditors, the PCAOB imposed bars or suspensions from auditing of public companies as well as monetary penalties.

The PCAOB also executed a number of first-of-their-kind enforcement actions in 2023. Most significantly, following the historic announcement in December 2022 that it achieved unfettered access to inspect registered public accounting firms based in the Peoples Republic of China (PRC) and Hong Kong, the PCAOB in November 2023 executed three enforcement actions involving PRC-based and Hong Kong-based firms and four individual auditors, imposing $7.9 million in total penalties. The penalties against the firms – two PRC-based and one Hong Kong-based – represent the highest civil money penalties the PCAOB has ever imposed against firms in the PRC and Hong Kong, as well as some of the highest penalties imposed against any firm.

In a statement on these historic enforcement actions, Chair Williams remarked that the PCAOB is “just getting started,” and announced that inspections teams have completed fieldwork for 2023 and plans to begin 2024 inspections were underway.

The PCAOB also announced a rare (if not, first) concurrent enforcement action with the US Securities and Exchange Commission (SEC) against a single firm. Although the PCAOB and SEC do have concurrent enforcement jurisdiction over registered public accounting firms, the PCAOB and SEC have historically avoided duplicative enforcement actions. As part of this enforcement action, furthermore, the PCAOB – for the first time ever – required changes to the firm’s supervisory structure, including creation of a new role of “Chief Quality Officer” and creation of a committee responsible for the oversight function for the audit practice.

In short, as PCAOB Chair Williams stated at the close of 2023, “The PCAOB is using every tool in [its enforcement] toolbox,” as well as continuing its global reach.

Standard setting

In 2023, the Board took more formal actions on standard setting and rulemaking than any year in the last decade, issuing four proposals and adopting a final standard and related amendments, AS 2310, The Auditor’s Use of Confirmation. The PCAOB’s proposals include:

• AS 1000, General Responsibilities of the Auditor in Conducting an Audit
• AS 2405, A Company’s Noncompliance with Laws and Regulations (NOCLAR)
• Amendments to AS 1105 and AS 2301 related to aspects of Designing and Performing Audit Procedures that Involve Technology-Assisted Analysis of Information in Electronic Form
• PCAOB Rule 3502, Responsibility Not to Contribute to Violations

The PCAOB has announced that it expects to adopt four proposals in 2024 Quality Control (QC 1000, proposed in November 2022); NOCLAR (AS 2405); General Responsibilities of the Auditor in Conducting an Audit (AS 1000); and Designing and Performing Audit Procedures that Involve Technology-Assisted Analysis of Information in Electronic Form (AS 1105 and AS 2301). In addition, the PCOAB expects to propose four additional standards in 2024.

Among the PCAOB’s 2023 proposals, two stand out for their potential to expose auditors to increased enforcement scrutiny. First, the PCAOB’s proposal to amend Rule 3502 would (i) expand liability for associated persons’ contributory conduct under the rule from knowing or recklessness conduct to negligent conduct and (ii) provide that an individual contributing to a registered firm’s primary violation need not be an associated person of the firm that commits the primary violation so long as the individual is an associated person of any registered firm. The PCAOB contends that amending Rule 3502 is necessary to fix an “incongruity,” that is, a firm can commit a primary violation of certain laws, rules, or standards by acting negligently, but an associated person who directly and substantially contributed to that violation must have acted at least recklessly to be secondarily liable.

If adopted, the proposed amendments to Rule 3502 could have significant consequences for senior leaders of registered firms and other associated persons. For example, senior firm personnel responsible for overseeing a firm’s system of quality control may soon find themselves in the PCAOB’s enforcement crosshairs for failure to exercise their oversight duties with “reasonable care.” Similarly, component auditor personnel may now find themselves subject to enforcement action if they negligently cause, directly and substantially, a primary audit firm’s violation of PCAOB standards or rules. In fact, component auditing firms or service centers (that otherwise satisfy the definition of “associated person”) may also be subject to Rule 3502 liability if they negligently cause a primary audit firm’s violation.

Likewise, the PCOAB’s NOCLAR proposal could potentially expose auditors to increased enforcement scrutiny. Under the current standard, an auditor has no duty to affirmatively identify illegal acts. However, the proposed amendments to AS 2405 would require an auditor to affirmatively plan and perform audit procedures to identify and assess potential noncompliance. The proposal requires auditors to, among other things:

• “Identify the laws and regulations with which noncompliance could reasonably have a material effect on the financial statements”
• “[A]ssess and respond to the risk of material misstatement of the financial statements due to noncompliance” with the identified laws and regulations and
• “Identify whether there is information indicating noncompliance with those laws and regulations have or may have occurred.”

In its proposal, the PCAOB acknowledged that the proposal would substantially increases auditors’ responsibilities and burdens, including the expense of retaining outside specialists such as attorneys to conduct the required assessments. On top of these added responsibilities and burdens, the proposed standard will likely also expose auditors to added enforcement scrutiny, particularly in the event that illegal conduct is uncovered or disclosed after an audit.

In sum, if adopted, these proposals will result in increased enforcement exposure and increased compliance expense for registered firms and their personnel.

Takeaways – increasing enforcement risks and added costs

The PCAOB’s 2023 enforcement actions make clear that the agency’s get-tough enforcement approach continues and has, in fact, accelerated. Similarly, the agency’s proposed amendments to auditing standards and PCAOB rules would, if adopted, impose substantial new burdens on, and potentially greater enforcement exposure for, auditors and public accounting firms.

Registered public accounting firms and their personnel thus face greater risk that they will become ensnared in a PCAOB investigation. Auditor judgment, even in complex areas, will continue to come under greater scrutiny as the PCAOB continues to expand the types of cases it pursues and the liability theories it applies.

Similarly, non-US PCAOB registered firms, particularly those based in the PRC, may increasingly come under enforcement scrutiny as the PCAOB takes advantage of its “unfettered” access to inspect and investigate PRC and Hong Kong-based registered accounting firms.

In sum, in light of the PCAOB’s aggressive enforcement and standard setting activities, the future outlook for registered public accounting firms and their personnel appears increasingly complex, costly, and risky.

If you have any questions regarding the PCAOB’s enforcement and standard setting activities or the impact on your business, please contact any of the authors or your DLA Piper relationship attorney.