Don Pallais, CPA
Congress created the Public Company Accounting Oversight Board (PCAOB) as a response to the Enron, WorldCom, and other accounting-related scandals. The Sarbanes-Oxley Act of 2002 created new requirements for publicly held companies and others (Chapter 4 discusses that Act in more detail) and revamped the regulatory system for auditors of public companies. The authority for standard-setting for audits of financial statements of publicly held companies and for quality control for firms that perform those audits was taken from the American Institute of Certified Public Accountants (AICPA), where it had been since the 1930s, and bestowed on the PCAOB.
The PCAOB opened its doors in January 2003 and held its first meeting that month. The Securities and Exchange Commission (SEC) reported, on April 25, 2003, that the PCAOB was organized and had the capacity to carry out its legislated duties, the final critical step in its establishment.
Sarbanes-Oxley defines the PCAOB's authority and revises the Securities Act of 1934 to recognize it. PCAOB was established to:
oversee the audit of public companies that are subject to the securities laws, and related matters, in order to protect the interests of investors and further the public interest in the preparation of informative, accurate, and independent audit reports for companies the securities of which are sold to, and held by and for, public investors [sec. 101(a)].
The PCAOB's authority is subordinate to that of the SEC. Sarbanes-Oxley did not affect the SEC's authority to enforce the nation's securities laws, including regulating auditors, taking action against them, or setting accounting, auditing, or independence standards. The SEC maintains budgetary authority over the PCAOB and must approve proposed substantive rules before they take effect.
The PCAOB regulates auditors of issuers, which are described under Sarbanes-Oxley as follows:
The term "issuer" means an issuer (as defined in section 3 of the Securities Exchange Act of 1934 (15 USC 78(c)), the securities of which are registered under section 12 of that Act (15 USC 78l), or that is required to file reports under section 15(d) (15 USC 78o(d)), or that files or has filed a registration statement that has not yet become effective under the Securities Act of 1933 (15 USC 77a et seq.), and that it has not withdrawn [sec. 2(a)(7)].
It has authority over both domestic and foreign auditing firms that prepare or issue audit reports on U.S. public companies, or that play a substantial role in the preparation or issuance of such reports.
The PCAOB's primary public-interest functions include:
Registering accounting firms that audit public companies.
Establishing and maintaining standards for auditing, quality control, ethics, and independence related to the preparation of audit reports for public companies.
Conducting inspections of registered firms.
Conducting investigations and disciplinary proceedings against registered firms and associated individuals, including imposing sanctions when justified.
The PCAOB is not charged with standard-setting or regulatory authority over audits on nonpublic companies. Those audits are regulated at the state level and the state boards of accountancy (or similar bodies) continue to recognize the AICPA as the standard-setter for those audits. Although state boards of accountancy can choose to adopt PCAOB standards instead of those of the AICPA, Sarbanes-Oxley §209 explicitly notes that "the standards approved by the [PCAOB] should not be presumed to be applicable ... for small and medium sized nonregistered public accounting firms."
Although overseen by the SEC, the PCAOB is not an agency of the U.S. government and its staff members are not government employees. It is a nonprofit corporation that can be dissolved only by an act of Congress.
The PCAOB's Washington office is home to the board, the executive staff, and the standards-setting function. It is located at 1666 K Street, NW, Washington, DC 20006-2803. The phone number is (202) 207-9100 and its Web site is www.pcaobus.org. It has several satellite offices around the country, primarily involved with inspections.
There are five members of the board. The board members serve full-time and cannot engage in any other professional or business activity. They are appointed by the SEC, in consultation with the Chairman of the Federal Reserve and the Secretary of the Treasury. Two, and only two, of the members are to be current or former CPAs; however, a CPA cannot be appointed chairperson if he or she practiced as a CPA within five years of appointment to the board.
Board members serve five-year terms, except for the initial members who were appointed to staggered terms. No member can serve more than two terms.
The board is supported by a staff of several hundred accountants, attorneys, and others. Many of the accountants were partners in auditing firms before joining the PCAOB staff.
The board has established organizational functions as follows:
Division of Registration and Inspections, which creates the registry of accounting firms and performs inspections of the firms.
Office of the Chief Auditor and Professional Standards, which advises the board on standards-setting.
Division of Enforcement and Investigations, which performs investigations of possible violations of law or professional standards and recommends disciplinary actions to the board.
Office of General Counsel, which provides legal advice and assists the board's rulemaking functions.
Office of Operations, which is responsible for information technology, human resources, and finance.
Office of Research and Analysis, which provides the board with assessment of risk and related insights.
Offices of public affairs and government relations, which assist the board in communications with the public, Congress, and the news media.
International affairs staff, which advises the board on international issues.
The board has the authority to create advisory groups to make recommendations regarding standards. It has officially convened a Standing Advisory Group to assist the board in reviewing existing standards, in formulating new ones, and in evaluating proposed standards projects. Periodically, the board convenes ad hoc groups to advise the staff on specific practice issues.
The PCAOB is not a government agency and is not funded by the government, although its budget is subject to SEC approval. The bulk of the funding comes from an allocation of accounting support fees assessed on public companies. The PCAOB also receives registration and annual fees from auditing firms.
The PCAOB has the authority to assess monetary penalties against auditors, but the amounts so collected do not fund PCAOB activities. Under Sarbanes-Oxley, the penalties are donated to a merit scholarship program for undergraduate and graduate students in accredited accounting degree programs.
Under Sarbanes-Oxley, only firms registered with PCAOB may "prepare or issue, or ... participate in the preparation or issuance of, any audit report with respect to any issuer" [sec. 102(a)]. Thus, any firm—domestic or foreign—that plays a substantial role in an audit of a public company must be registered. However, a firm can voluntarily register with the board even if it does no audits of public clients.
It is illegal for a nonregistered firm to audit or participate in the audit of a public company. Accordingly, a firm must maintain its registration and needs to consider whether other firms that it relies on for the audits of subsidiaries or other elements of the company are registered.
Registered firms must follow the PCAOB standards in auditing, quality control, and independence; pay the required registration fees; undergo periodic inspections; and cooperate with PCAOB-initiated investigations.
The application form for registration, called Form 1, asks for a substantial amount of information, including:
The names of all public companies audited during the preceding calendar year, and those that the firm expects to audit during the current calendar year.
The annual fees the firm received from each public company for audit services, other accounting services, and nonaudit services.
A statement of the firm's quality control policies for accounting and auditing services.
A list of all accountants associated with the firm who participate in or otherwise contribute to audits.
Information relating to relevant criminal, civil, or administrative actions or disciplinary proceedings pending against the firm or any associated person of the firm.
The application form is completed and submitted electronically. Sarbanes-Oxley calls for some of this information to be publicly available, which the PCAOB expects to provide via the Internet. Firms can request that certain proprietary or confidential information be protected from public disclosure.
The board has 45 days to review a firm's application. The board can either: approve it; request more information from the firm, triggering another 45-day review period; or call for a hearing to determine whether the application should be approved. In the latter case, the acceptance decision is made by a hearing officer, although at the request of either party, it is reviewable by the board. Alternatively, the firm may elect to treat the call for a hearing as a written notice of disapproval that can be appealed directly to the SEC.
There is a registration fee and an annual fee, which are assessed based on the number of public clients the firm audits.
A firm may withdraw from PCAOB registration, but the board may delay the withdrawal for up to 18 months while it carries out inspection, investigation, or disciplinary proceedings.
Sarbanes-Oxley gave the PCAOB the authority to approve or establish standards for auditing, quality control, and independence. The board determined that, rather than adopt the standards of others (except for the transitional interim standards), it will establish its own standards. Thus, standards applicable to audits of public companies are established by PCAOB; standards for audits of nonpublic companies—known as generally accepted auditing standards—continue to be established by the AICPA. The PCAOB standards are not characterized as generally accepted because their authority does not derive from general acceptance, but rather from regulatory authority.
The PCAOB's practice standards apply to all auditors, including staff and independent contractors (called associated persons), who participate in an audit of a public company. Registered firms also must comply with the board's quality control standards.
Auditors of nonpublic companies may choose to apply PCAOB standards either voluntarily or to meet the needs of clients or financial statement users. If an auditor of a nonpublic company complies with the PCAOB auditing standards and the audit report specifically refers to compliance with the PCAOB's auditing standards, the auditor need not comply with the board's independence standards, nor does the reference imply that the auditor is subject to the securities laws or PCAOB regulatory requirements such as inspections.
The AICPA has issued an auditing interpretation (AU 9508.89) explaining that if an auditor applies PCAOB standards in the audit of a nonpublic company, the auditor must also comply with generally accepted auditing standards and the audit report should refer to both sets of standards.
Although the PCAOB had immediate authority over standards, it chose to adopt as interim standards the professional standards that existed on April 16, 2003. The standards adopted were the following as they existed on that date:
Generally accepted auditing standards as established by the AICPA.
Statements on Standards for Attestation Engagements, and related interpretations.
Statements on Quality Control Standards and certain AICPA SEC Practice Section Requirements of Membership.
Rule 102 of the AICPA Code of Professional Conduct and related interpretations and rulings.
Rule 101 of the AICPA Code of Professional Conduct and related interpretations and rulings and Independence Standards Board Standards Nos. 1, 2, and 3 and interpretations 99-1, 00-1, and 00-2. The board recognizes, though, that to the extent an SEC independence rule differs from the AICPA or ISB rules, the SEC rule takes precedence.
The PCAOB's intention in adopting the interim standards were to methodically review them and revise, replace, or supplement them as necessary.
Although the board will issue new standards and amend or replace the interim standards, Sarbanes-Oxley explicitly calls for the PCAOB to require:
Audit firms to prepare work papers and other information related to the audit report, in sufficient detail to support the auditor's conclusions, and to maintain them for at least seven years.
A concurring or second-partner review and approval of audit reports.
An audit report that includes a description of tests and findings related to the entity's internal control, including an evaluation of the effectiveness of internal control, an evaluation of the assessment of internal control made by management, and a description of material weaknesses in control or material noncompliance with controls the auditor discovered.
Quality control standards that deal with:
Monitoring of professional ethics and independence
Consultation on accounting and auditing questions
Supervision of audit work
Hiring, professional development, and advancement of personnel
Acceptance and continuation of engagements
Internal inspection
Sarbanes-Oxley requires auditors to report directly to the audit committee or, when there is none, the board of directors. It also requires the auditor to report on a timely basis to the audit committee all critical accounting policies and procedures used; alternative accounting treatments discussed with management, along with their ramifications and the treatment the auditor preferred; and other written communications between the firm and management, such as management letters or schedules of unadjusted differences.
The auditor of a public company, under the law, may also provide to that company nonaudit services, such as tax services, only with the advance approval of the company's audit committee. However, the law specifically prohibits auditors of public companies from also providing the following services to those companies:
Bookkeeping or other accounting services.
Financial information systems design and implementation.
Appraisal or valuation services, fairness opinions, or contribution-in-kind reports.
Actuarial services.
Internal audit outsourcing services.
Management or human resource functions.
Broker or dealer, investment advisor, or investment banking services.
Legal services and expert services unrelated to the audit.
Sarbanes-Oxley requires that partners on an audit rotate off after performing audit services for that company for five consecutive years. It also prohibits auditors from taking certain senior financial positions with the companies they audit if they worked on the audit less than a year before the initiation of the current audit.
Standards are approved on a majority vote of the board members. The members are assisted by the chief auditor's staff and, as necessary, ad hoc participation from outsiders.
The board is assisted by its Standing Advisory Group (SAG). Chaired by the chief auditor, the SAG reviews existing standards, evaluates proposals to amend standards, and recommends new standards to the board. Its contribution is advisory only, but it provides the views of a diverse spectrum of backgrounds and viewpoints.
The board's standard-setting process involves the following steps:
The proposed standard is discussed by the board at an open meeting. The briefing papers that provide background and recommendations are available on the PCAOB Web site and the board's meetings are Webcast and archived on the Web site.
The proposed standard is issued for comment. An exposure draft is made available on the PCAOB Web site for at least 21 days. Hard copies of the exposure draft are generally not produced or mailed out for comment.
The draft, revised as appropriate following exposure, is discussed and approved for issuance by the board at a public meeting. The approved rule is made available on the PCAOB Web site.
The final rule is filed with the SEC for its review. The SEC has the final approval power over PCAOB rules.
The SEC publishes a notice of filing for the PCAOB's rule in the Federal Register and comments are received for at least 35 days.
The SEC decides whether to approve the PCAOB standard. The SEC can only accept or reject the rule; it cannot make revisions. If the rule is approved, it is printed in the Federal Register and becomes a PCAOB standard.
PCAOB standards contain three parts: a release, the standard, and the background and basis for conclusions. The PCAOB staff has indicated that all three sections, having been approved by the board, are authoritative and auditors are required to follow the guidance in all three.
The PCAOB staff also issues interpretive guidance in the form of Staff Questions and Answers. Although this guidance does not constitute rules of the board and is not approved by the board, the staff considers it in interpreting the rules when questions arise in inspections or investigations.
The PCAOB is charged by Congress with conducting:
a continuing program of inspections to assess the degree of compliance of each registered public accounting firm and associated persons of that firm with [Sarbanes-Oxley], the rules of the [PCAOB], the rules of the [SEC], or professional standards, in connection with its performance of audits, issuance of audit reports, and related matters involving issuers [Sarbanes-Oxley § 104(a)].
The Division of Registration and Inspection is responsible for the inspection program.
All firms that audit public companies are required to undergo PCAOB inspection. A registered firm with no public clients is not subject to inspection.
Foreign registered firms may request that the board rely on a non-U.S. inspection. In that case, the board will determine the degree, if any, to which it will rely on the non-U.S. inspection. The board considers the level of the non-U.S. inspection program's independence, rigor, and inspection work program.
Sarbanes-Oxley calls for annual inspections of firms with more than 100 public clients and inspections at least every three years for firms with 100 or fewer public clients, although it allows the PCAOB to adjust this schedule. In addition, the PCAOB may also conduct special inspections at its own discretion or SEC request.
The PCAOB inspection is similar in concept to the peer reviews of public-company auditors that had been administered by the AICPA, but there are some significant differences. The inspection is not done by another public accounting firm, but by the PCAOB staff. Whereas peer reviews were intended primarily as a way to improve the firm's practice, inspections can be more punitive: negative results may be communicated to the SEC or state boards of accountancy and disclosed to the public. In addition, an identified deficiency might lead to a PCAOB investigation.
Before arriving at the firm to be inspected, the PCAOB requests a substantial amount of information from the firm to help determine the inspection scope. The information requested includes the firm's financial statements, business model, internal policies and procedures, client lists, proposals, withdrawals, and latest internal inspection or peer review results.
Inspections focus on two general aspects of a firm's practice: practice management and individual audits. The focus for smaller firms is different than for larger ones, taking into account the structural differences resulting from smaller size.
In assessing the firm's practice management, the inspectors review policies and procedures and interview personnel. They focus on seven significant areas:
The tone at the top; that is, management's commitment to quality auditing practices, and whether the expectation for quality practices is communicated unambiguously to the partners and staff.
Whether compensation and promotion within the firm are driven by technical proficiency, not just the ability to generate new business.
How the firm monitors compliance with applicable independence rules, including those related to nonaudit services both for the firm and those in its alliances and joint ventures.
What factors the firm considers in client acceptance and continuance, including whether the engagements accepted are within the firm's competence and how the audit work addresses identified risks.
The effectiveness of the firm's internal inspection process, including consideration of actions the firm takes to address identified problems.
The effectiveness of the firm's audit policies and procedures, including how policies are identified, developed, and communicated.
How the firm coordinates the use of foreign affiliates for audits of foreign subsidiaries of U.S. clients, including how the firm satisfies itself about the foreign affiliates' knowledge of U.S. technical requirements.
Individual engagements are selected for review based on factors such as the office or partner involved significant client or industry risks, or other information suggesting that the engagement might be of particular interest. The focus of the engagement review is to assess the quality of the audit work and related documentation, evaluate the knowledge and ability of the engagement team, determine whether the work was performed or reviewed timely, and identify the need for improvements or new standards.
The inspection involves detailed review of the work papers and interviews with those who did the work, including staff at all levels and nonaudit personnel, such as tax or information technology specialists. The PCAOB inspectors may also interview members of the engagement clients' audit committees to gain their perspectives on the audit and auditor communications.
At the conclusion of the inspection, the PCAOB prepares a draft report, which is made available to the firm. A firm that disagrees with the findings can file a response within 30 days. The board then reviews the draft report and the firm's response, if any, and after due consideration, issues a final report. A firm that continues to disagree with the findings can appeal to the SEC to review the PCAOB report.
The final inspection report is sent to the SEC. The report is made available to the public except that criticisms or defects identified in the firm's quality control system are not made public unless they are not corrected to the board's satisfaction within a year of the inspection report. The public disclosure excludes certain confidential or proprietary information and information privileged under the rules of evidence.
The board may refer information emanating from the review, along with the firm's response to the report, to relevant state licensing authorities.
The PCAOB's Office of Investigations and Enforcement can investigate possible violations by registered firms of Sarbanes-Oxley, PCAOB rules, securities laws applicable to auditors, or professional standards. Allegations of potential violations might come from PCAOB inspections, information forwarded to the PCAOB (its Web site has a facility for such reporting), or public information that comes to the PCAOB's attention.
Informal inquiries and formal investigations, along with related documents provided to PCAOB, are confidential until presented in connection with a public proceeding. Thus, until made public, they are protected from discovery by plaintiffs' counsel. The PCAOB may, however, make such documents available to the SEC, U.S. or state attorneys general, or other applicable federal or state regulatory authorities.
In conducting an investigation, the board can call for testimony, audit work papers, or other documents from a firm or other person involved in the audit. Registered firms are required to cooperate with the investigation; failure to do so can be the basis for disciplinary action.
The board may also request testimony or documents from others, such as the public company whose audit is under investigation. The PCAOB may request the SEC to issue a subpoena to compel cooperation of these individuals or organizations.
If the board chooses, it can hold formal proceedings to determine whether an individual or firm should be disciplined. These proceedings are not public, unless agreed to by the relevant parties. However, they are on the record, before a trier of fact, and involve testimony under oath and the offering of evidence. Firms or individuals subject to the hearing may be accompanied by counsel.
The board has the authority to sanction any registered firm or associated individual who it determines violated Sarbanes-Oxley, PCAOB rules, securities laws relating to the preparation and issuance of audit reports, or professional standards. Sanctions may include:
Suspension or revocation of registration.
Temporary or permanent suspension or bar of a person from further association with any registered public accounting firm.
Temporary or permanent limitation on the activities, functions, or operations of the firm or person (e.g., prohibiting a firm from accepting new audit clients for a period of time, requiring a firm to assign a reviewer or supervisor to an associated person, requiring a firm to terminate one or more audit engagements, and requiring a firm to make functional changes in the firm or the engagement team).
A civil money penalty for each such violation to a maximum of $100,000 for an individual and $2 million for a firm or, if the violation is intentional, reckless, or knowing or involves repeated instances of negligence, $750,000 for an individual and $15 million for a firm.
Censure.
Additional professional education or training.
Requiring the firm to engage an independent monitor, subject to the approval of the board, to observe and report on the firm's future compliance with relevant laws or standards.
Requiring the firm to engage counsel or another consultant to design policies to comply with relevant laws or standards.
Requiring the firm or associated person to adopt or implement policies, or to undertake other actions, to improve audit quality or to comply with relevant laws or standards.
Requiring a firm to obtain an independent review and report on one or more engagements.
Any sanctions imposed can be appealed to the SEC.
For investigations of foreign firms, the board may rely on the investigation or sanction of the firm by a non-U.S. authority.
The PCAOB reports the name of the individual or firm sanctioned, a description of the sanction and the basis for its imposition, and other information the board deems appropriate to the SEC, the appropriate state or foreign licensing authority, and the public.