Regulations Under the Sarbanes-Oxley Act

EXECUTIVE SUMMARY

THE SARBANES-OXLEY ACT OF 2002 is a major reform package mandating the most far-reaching changes Congress has imposed on the business world since FDR’s New Deal. THE ACT ESTABLISHES THE PUBLIC COMPANY Accounting Oversight Board (PCAOB) to regulate accounting professionals that audit the financial statements of public companies. The new board’s operations are subject to direct and substantial SEC oversight. ONCE THE SEC DETERMINES THE BOARD IS ORGANIZED and can accept its responsibilities (which could occur prior to April 26), public accounting firms have 180 days to register with the board or cease all participation in public company audits. TWO CRITICAL ISSUES THE SEC AND THE NEW BOARD will need to address relate to providing guidance regarding who is required to register and the treatment of persons associated with public accounting firms, who might include individual accountants or other entities that receive compensation from the accounting firm or participate as an agent of the accounting firm. PUBLIC ACCOUNTING FIRMS WILL HAVE TO PAY CAREFUL attention to the information on the application for registration with the PCAOB, some of which goes well beyond the scope of what is currently required by state boards of accountancy or the AICPA. AN IMPORTANT FUNCTION OF THE NEW BOARD includes conducting inspections of registered firms. In addition, it has a full range of sanctions at its disposal, including suspension or revocation of registration, censure and significant fines. THE SARBANES-OXLEY ACT PROHIBITS ALL REGISTERED public accounting firms from providing audit clients, contemporaneously with the audit, certain nonaudit services, including internal audit outsourcing, financial-information-system design and implementation services and expert services. THE ACT PROVIDES FOR SIGNIFICANT CORPORATE governance reforms regarding audit committees and their relationship to the auditor, making the audit committee responsible for the appointment, compensation and oversight of the issuer’s auditor.

PAUL H. PASHKOFF is an attorney and associate at Fried, Frank, Harris, Shriver & Jacobson, Washington, D.C. His e-mail address is PashkPa@ffhsj.com . RICHARD I. MILLER, JD, is general counsel and secretary of the AICPA. His e-mail address is RMiller@aicpa.org . Mr. Miller is an employee of the Institute and his views, as expressed in this article, do not necessarily reflect the views of the AICPA. Official positions are determined through certain specific committee procedures, due process and deliberation.

he Sarbanes-Oxley Act of 2002 is a major reform package mandating the most far-reaching changes Congress has imposed on the business world since FDR’s New Deal. It seeks to thwart future scandals and restore investor confidence by, among other things, creating a public-company-accounting-oversight board, revising auditor independence rules, revising corporate governance standards and significantly increasing the criminal penalties for violations of securities laws. This article highlights the provisions most important to accounting professionals engaged in public company audits.

Determining its full scope and impact remains a work in progress on many levels as the SEC undertakes the task of implementing the act. AICPA President and CEO Barry C. Melancon has affirmed the Institute’s commitment to working toward the effective implementation of the act and to rebuilding the faith of investors who depend on accounting professionals for information critical to the capital markets (see “ A New Accounting Culture ”).

Registering public accounting firms.

Establishing or adopting—by rules—auditing, quality control, ethics, independence and other standards relating to the preparation of audit reports.

Conducting inspections (the successor to peer review for public companies) of registered accounting firms.

Conducting investigations and disciplinary proceedings.

Imposing appropriate sanctions to enforce compliance with the rules and laws.

It is important to note the responsibility for establishing auditing, attestation and quality control standards—a function currently performed by the Auditing Standards Board (ASB)—now rests with the Public Company Accounting Oversight Board. While the new board is required to “cooperate on an ongoing basis” with designated professional groups of accountants and advisory groups engaged in standard setting, it will have authority to amend, modify, repeal or reject any standards suggested by these groups. Accordingly, the board may, but is not required to, continue to allow the ASB to establish these standards. (The AICPA expects to demonstrate to the PCAOB that the Auditing Standards Board is the appropriate body to continue to set auditing standards.)

REGISTRATION WITH THE BOARD
The Sarbanes-Oxley Act says the Public Company Accounting Oversight Board must take such action necessary to enable the SEC to determine by April 26, 2003 that it is organized and has the capacity to carry out its responsibilities under the legislation. After this determination is made (which could occur prior to April 26), public accounting firms have 180 days to register with the new board or cease all participation in public company audits.

Most of the act’s provisions affecting practitioners are effective upon registration with the PCAOB. As a practical matter, however, accounting firms should not attempt to wait until the 179th day to register because the new board has 45 days to act on an application and is permitted to request additional information from an applicant. It would be prudent for accounting firms to allow a sufficient time cushion for the registration process and submit applications no later than the 135th day after the SEC’s determination. Each firm should carefully review its application and request confidential treatment, as permitted under the act, with respect to any proprietary or personal information.

Another critical issue the SEC and the board will need to address relates to providing guidance regarding who is required to register. The act says accounting firms that “prepare or issue” or “participate” in the preparation or issuance of any audit report for any “issuer” must be registered. Exactly what is meant by “participate in the preparation…of any audit report,” for example, is not entirely clear. Nor is the act’s definition of “issuer,” which includes any issuer, as that term is defined by the Securities Exchange Act of 1934, whose securities are registered under Section 12 of the Exchange Act, that is required to file reports under Section 15(d) of the Exchange Act or that files a registration statement that has not yet become effective and that has not been withdrawn. Informal conversations with SEC representatives, as well as the Department of Labor, resulted in inconsistent interpretations regarding, for example, whether an employee benefit plan filing a Form 11-K would fall within the legislation’s definition of an issuer.

THE ASSOCIATED-PERSONS QUESTION
Another question left unanswered by the act is the treatment of persons associated with public accounting firms, who might include individual accountants or other entities that, “in connection with the preparation or issuance of any audit report,” receive compensation from the accounting firm or participate as an agent of the accounting firm. But what constitutes compensation in connection with an audit report will not be known until regulations are issued. The act does not require associated persons to register with the board or abide by the legislation’s independence requirements. The act does, however, grant the SEC and the PCAOB authority to extend these requirements to associated persons. Whether or not this authority is exercised will have far-reaching consequences with respect to a variety of services provided to issuers by persons associated with public accounting firms, both domestically and internationally.

FOREIGN FIRMS
Foreign firms that prepare or furnish audit reports with respect to any issuer are required to register under the act. Further, the Public Company Accounting Oversight Board has discretion to extend the act’s registration requirements to foreign firms that play a “substantial role” in the preparation of audit reports for any issuer. The act also has implications for any U.S.-registered firm that relies on the opinion of a foreign accounting firm in issuing part of any audit report. In such cases, the U.S. firm is deemed to have (1) consented to supplying the audit workpapers of the foreign firm in response to a request by the board or SEC and (2) secured the agreement of the foreign firm to such production as a condition of its reliance on the opinion. This provision remains very controversial because of the opposition of many countries to its broad extraterritorial reach. Further, the deemed consent to production of their documents may be inconsistent with, and in some cases prohibited by, the laws of foreign jurisdictions. Both the PCAOB and the SEC have authority to exempt foreign accounting firms from these requirements, and will undoubtedly be called upon to grapple with this issue in the near future.

APPLICATION REQUIREMENTS
Public accounting firms will have to pay careful attention to the information on the application for registration with the PCAOB. The following information is required under the new act, some of which goes well beyond the scope of what is currently required by state boards of accountancy or the AICPA:

Names of all audit clients who are issuers.

Annual fees received from each issuer, broken down by audit and nonaudit services.

Financial information as requested by the PCAOB.

A statement of quality control policies for the firm’s auditing and accounting practices.

A list of all accountants participating in any audit report of any issuer, including license or certification numbers.

Information relating to criminal, civil or administrative actions or disciplinary proceedings pending against the firm or any associated person of the firm.

Copies of any periodic or annual disclosures regarding disagreements between the issuer and the firm during the preceding calendar year.

Any additional information specified by the new board.

The application must include a consent by the firm to cooperate with the new board with respect to any request for documents or testimony (and an agreement by the firm to obtain similar consents from each person providing any audit services to issuers). Registered firms will be required to update the information contained in the application at least annually.

PERIODIC INSPECTIONS
One of the central functions of the Public Company Accounting Oversight Board is to conduct inspections of registered firms. They will occur annually for firms that audit more than 100 issuers and at least once every three years for all other firms (the new board has the discretion to adjust these schedules). The inspection concept is fundamentally different from the current peer review. First, it is not firm on firm. Second, it is not strictly remedial. Thus, if the inspectors find any violations of the act, the PCAOB’s rules, federal securities laws, applicable professional standards or the firm’s own quality control policies, these findings may serve as the basis for disciplinary action by the board. In addition, the inspections may include matters subject to ongoing litigation.

Interestingly, although the current system of regulation has been criticized for operating outside the public eye, any criticisms or deficiencies relating to a firm’s quality control system will not be made public unless the firm fails to satisfactorily address the issues within 12 months from the date of the inspection report. (There is some question as to whether the new board’s inspection process will satisfy the peer review requirements of certain state accountancy boards.)

DISCIPLINARY POWERS
The PCAOB’s other major responsibility is its disciplinary function. The new board has a full range of sanctions at its disposal, including suspension or revocation of registration, censure and significant fines. It has authority to investigate any act or practice that may violate the act, the new board’s rules, the provisions of the federal securities laws relating to audit reports or applicable professional standards. These proceedings will generally be confidential, unless for good cause the board orders a public hearing. Although any disciplinary sanctions, accompanied by a supporting statement from the board, would be made public after the process was concluded, the act includes confidentiality provisions protecting most documents prepared or received by the board in connection with an investigation. These materials can, however, be shared with other regulators.

FUNDING
Accounting firms will pay a registration fee and an annual fee to cover the costs of processing and reviewing applications and annual reports. The bulk of the Public Company Accounting Oversight Board’s funding will be provided through an annual accounting support fee assessed on issuers; these funds will support the board’s inspection program, relieving firms of a financial burden they now bear. The fee will be levied in proportion to each issuer’s equity market capitalization—larger issuers will pay larger fees. These fees also will be used to fund the FASB, which will continue to set accounting standards.

DOCUMENT RETENTION
There are three separate, and potentially inconsistent, document retention requirements in the act. First, the board is required to adopt rules mandating a seven-year retention period for audit workpapers and “other information related to any audit report, in sufficient detail to support the conclusions reached in such a report.” Second, the board may require retention of additional documents for inspection purposes. Third, the criminal provisions of the act include a five-year retention period for all audit and review workpapers, and the SEC is directed to establish rules relating to the retention of such workpapers by January 26, 2003. These document retention issues may be further complicated by state-level retention requirements. For example, California recently passed a law requiring accountants to maintain certain audit documentation for seven years and accounting firms to write document retention and destruction policies. As the penalties for noncompliance can be severe, it is increasingly important for accounting firms to pay careful attention to the various record retention requirements that may be applicable in the jurisdictions in which they practice.

AUDITOR INDEPENDENCE
Sarbanes-Oxley prohibits all registered public accounting firms from providing audit clients, contemporaneously with the audit, certain nonaudit services including internal audit outsourcing, financial-information-system design and implementation services and expert services. These scope-of-service restrictions go beyond existing SEC independence regulations. In addition, all other services, including tax services, are permissible only if preapproved by the issuer’s audit committee and all such preapprovals must be disclosed in the issuer’s periodic reports to the SEC.

The act also requires auditor (not audit firm) rotation. The lead audit partner and/or the concurring review partner must rotate off the engagement if he or she has performed audit services for the issuer in each of the five previous fiscal years. There is no distinction regarding the capacity in which the audit or concurring partner provided such audit services. Accordingly, services provided as a manager or in some other capacity appear to count toward the five-year period. In addition, the provision applies as soon as the firm is registered, so, absent guidance to the contrary, the audit and concurring partner must count back five years starting with the date in which PCAOB registration occurs. This provision is particularly important because of its potential impact on small accounting firms. The SEC is considering whether or not to accommodate small firms in this area; currently there is no small-firm exemption from this provision.

AUDIT COMMITTEES
The act provides for significant corporate governance reforms regarding audit committees and their relationship to the auditor, making the audit committee responsible for the appointment, compensation and oversight of the issuer’s auditor. This should fundamentally change the auditor/client relationship. Further, the auditor reports directly to the audit committee, not to management, reinforcing the position that the auditor’s duties run to the shareholders, rather than management. Each member of the audit committee must be independent, and the audit committee must have the authority to hire independent counsel and other advisers. In addition, each issuer must provide appropriate funding, as determined by the audit committee, for compensating the auditor and any advisers retained by the audit committee. The audit committee also must establish procedures for handling complaints regarding accounting or auditing matters and for the confidential submission by employees of concerns regarding questionable accounting or auditing matters. In light of these new increasingly important audit committee responsibilities, the audit committee must forge an effective working relationship between itself and the auditor.

The full scope of the act is too expansive to address in this article other provisions such as CEO and CFO certification of financial reports, enhanced financial disclosures, including off-balance-sheet transactions and special purpose entities, pro forma financial information reconciling to GAAP financial statements and auditor reports on management assessments of internal controls. The act mandates the completion of several studies, which may result in additional legislation or rule making.

There is no doubt the profession is on the cusp of a new era of accounting regulation. Accordingly, it must appropriately focus on the effective implementation of the Sarbanes-Oxley Act, as well as the challenge of meeting its primary objective: restoring investor confidence.