Chance of Financial Fraud Reduced with PCAOB New Requirements
The Sarbanes-Oxley Act of 2002 (SOX) requires that any accounting firm that prepares or issues an audit report with respect to a U.S. public company must register with the Public Company Accounting Oversight Board (PCAOB). Until recently, an accounting firm was required only to provide information current as of the initial registration date for the firm. Beginning on December 31, 2009, accounting firms were required to register with the PCAOB and file annual and current reports with the PCAOB. On August 13, 2009, the SEC approved the proposed rules with the original effective date of October 12, 2009, but on September 30, 2009, the PCAOB delayed the effective date to December 31, 2009. These parts implement the requirements of SOX section 102(d) that registered public accounting firms 1) report annual information about the firms and their audit practices, and 2) submit, as specified by the PCAOB or the SEC, more frequent information necessary to update the information previously filed with the PCAOB. Until now, the PCAOB had no requirement for annual reports or amendments to report material changes in initial registration information.
The purposes of the new sections are 1) to keep the PCAOB up to date on a firm's basic professional information, such as name, location, licenses, and contact information; 2) to provide the PCAOB with current information regarding a firm's audit practice in order to facilitate analysis and inspection by the PCAOB and keep the public informed of such information; and 3) to alert the PCAOB of any events that would require more immediate action by the PCAOB in terms of inspections or enforcement and that might otherwise warrant public disclosure. As required by SOX section 102(e), all registration applications and annual reports will be made publicly available, subject to PCAOB and SEC rules on the confidentiality of proprietary and personal information. The PCAOB is also authorized to collect an initial registration fee and an annual fee from each registered firm.
Disciplinary Authority
Pursuant to the PCAOB rules, each registered firm is subject to regular and special inspections, such as the PCAOB’s choices on conduct. The PCAOB has amended these rules to provide that it may, at any time, request that a firm provide additional information or documents relating to information provided on a Form 2 or Form 3, or relating to information that has otherwise come to its attention. Such information requests are deemed to be in connection with the firm's next regular or special inspection, and, accordingly, the cooperation requirements and disciplinary provisions of the PCAOB rules apply.
If the PCAOB discovers, through inspections or otherwise, that a report is untrue, incomplete, or misleading, it is authorized to take disciplinary action against the firm for violating the reporting requirements, and potentially against any associated person who caused the firm's violation. To the extent that a firm subsequently discovers an error in a filed report, it should, as promptly as practicable, file an amended report correcting such error or supplying the missing information.
Responsibilities of an Auditing Firm to Detect Fraud During Audit Process
The PCAOB defines "audit report" as a document or record prepared following an audit done for purposes of compliance with requirements of the securities laws, in which the firm sets forth its opinion regarding a financial statement, document, or record, or declares that no such opinion can be asserted. Accordingly, the disclosure in Form 2 does not pertain to reports prepared for entities that are not issuers under the PCAOB guidelines (i.e., entities that have not reported or otherwise utilized the federal securities disclosure system).
The PCAOB continues to recognize the concerns of non-U.S. firms faced with local legal restrictions on their ability to provide information to the PCAOB pursuant to these new reporting forms. If a foreign-registered firm cannot complete an item on Form 2 or Form 3 because disclosure would violate non-U.S. law, then it must: indicate that it has omitted required information on the grounds that disclosure would violate non-U.S. law; identify the items it has withheld on that basis; and represent that it has, in good faith, sought waivers or consents under local law to allow it to make such disclosures. Before filing the report with the PCAOB, a foreign-registered firm must have in its possession and maintain: an electronic version of the report and a manually signed copy of the report that would satisfy the PCAOB rules in full, if it were to be filed with the PCAOB; a copy of the provisions of nonU.S. law that prohibit the disclosure; a legal opinion addressed to the firm, in English, to the effect that the foreign-registered accounting firm cannot provide such information to the PCAOB without violating non-U.S. law; and a written representation that the report is complete and nonmisleading.
Preparing for Reporting
The practical implications of the new reporting rules are that registered accounting firms have significant information-gathering, as well as reporting, obligations. Given that the reporting requirements are now effective, and the first annual reporting period ends on March 31, 2010, it is imperative that registered accounting firms begin gathering the necessary information as soon as possible. Because these reporting requirements have now become a fixture of accounting, with respect to publiccompany issuers, a firm must implement internal controls and disclosure systems, as well as internal education programs, in order to ensure that the accountants and professional staff report the required information to the firm's compliance department on a timely basis.
Firms should set up new, or modify existing, internal reporting systems that will collect information regarding the information required for annual reports as well as the triggering events for special reports. To the extent that these systems collect information on a regular basis during the year, a firm will not face a crunch of searching for and organizing the information necessary for the reports as they come due. The information required by the Form 2 annual report and the Form 3 special report are not, for the most part, duplicative. Accordingly, internal reporting systems must track both annual information and triggering event information. For the annual report, such a system should collect the information surrounding each audit report and consent issued, including the issuer, the issuefs CIK number, the date of the audit report, and the date each consent is issued. A firm's billing systems should contain codes to identify billed fees as one of the four types required by the annual report. The compliance department and the firm's personnel department must also keep track of the accountants who have signatory authority with respect to each audit report. Finally, since information may be required from shareholders, partners, and even audit managers, the firm should be constantly aware of its personnel hierarchy and its designations of audit managers. For Form 3, a firm's internal controls should contain a list of triggering events and educate all of its personnel on how to communicate such information to the compliance department Because of the sensitive nature of some of the items constituting triggering events, a firm may want to create a confidential way of communicating such information to the compliance department.
Exhibit 1 sets forth recommended tasks that a firm's compliance department should undertake to gather the information that will be necessary to complete Form 2 and Form 3 going forward. Exhibit 2 highlights some important dates under the new PCAOB filing requirements.
As firms cope with the new disclosure regime and raise issues and questions about events not failing squarely within any of the disclosure rules, it is likely that the PCAOB will be issuing further guidance on compliance. Nevertheless, annual and current reporting for accounting firms has now become a fixture of the accounting profession for firms under PCAOB jurisdiction, so firms must harmonize the disclosure requirements with their internal operations.
Steven R. Berger, JD, is a shareholder of Vedder Price P.C. in New York, NY.