PCAOB proposes to expand liability to those who negligently cause a firm’s violations

The Public Company Accounting Board (PCAOB) recently proposed to amend its rules to expand enforcement liability for associated persons who directly and substantially cause a firm’s violation of any law, rule, or standard that the Board is charged with enforcing.

Proposed amendment to Rule 3502

The PCAOB is proposing to amend Rule 3502 (Responsibility Not to Knowingly or Recklessly Contribute to Violations) to (i) expand liability for associated persons’ contributory conduct under the rule from knowing or recklessness conduct to negligent conduct, and (ii) provide that an individual contributing to a registered firm’s primary violation need not be an associated person of the firm that commits the primary violation so long as the individual is an associated person of any registered firm.

Background

Since its adoption in 2005, PCAOB Rule 3502 prohibited an associated person of a registered firm from knowingly or recklessly contributing, directly and substantially, to the firm’s primary violation. The rule thus has long had two essential elements limiting its application: (1) the required level of culpability – knowing or reckless conduct; and (2) the requirement that the individual who causes a violation by the registered firm be an associated person of that same firm.

Notably, in its original 2004 proposing release for Rule 3502, the PCAOB proposed language “intended to articulate a negligence standard,” and the originally proposed version of Rule 3502 subjected associated persons to potential contributory liability if they “knew or should have known” that an act or omission by them would contribute to a firm’s primary violation.

At the time, some commenters objected to such language since such a standard “would allow the Board . . . to proceed against associated persons who in good faith, albeit negligently, have caused a registered firm to violate applicable laws or standards.” Thus, presumably in part in response to these comments, in the final rule the PCAOB ultimately required a showing of knowing or reckless conduct under the rule rather than mere negligence.

In its proposal to amend the rule to capture mere negligent conduct, the PCAOB contends that amending Rule 3502 is necessary to fix an “incongruity,” that is, a firm can commit a primary violation of certain laws, rules, or standards by acting negligently, but an associated person who directly and substantially contributed to that violation must have acted at least recklessly to be secondarily liable. The PCAOB contends that this “incongruity” may “dissuade associated persons from exercising the appropriate level of care in their audit work . . . [as] [t]hey may not exercise reasonable care (the standard for negligence) if they know that they cannot be held individually liable by the PCAOB for a firm’s primary violation unless an act or omission by them amounts to an “an extreme departure from the standard of ordinary care for auditors” (the standard for recklessness).”

Regardless of the possible effects of this purported “incongruity,” the PCOAB’s proposed amendment to Rule 3502 is consistent with the Board’s more recent efforts to broaden its enforcement reach. In a September 2022 keynote address to the Council of Institutional Investors, PCAOB Chair Erica Williams revealed that the PCAOB was expanding its case identification process and expanding the types of enforcement cases it will pursue to include cases that hinge on only a single, wrongful act, whether reckless or negligent.

This intent was also reflected in the Board’s 2022-2026 Strategic Plan which provides that the Board intends to “take a more assertive approach to bringing enforcement actions” and “hold accountable” those who commit “violations that result from negligent conduct.” Notably, this approach marked a departure from the PCAOB’s historical practice of focusing its enforcement resources on the most egregious (ie, knowing or reckless) audit violations and deficiencies.

Implications

If adopted, the proposed amendments to Rule 3502 could have significant consequences for senior leaders of registered firms and other associated persons. For example, senior firm personnel responsible for overseeing a firm’s system of quality control may soon find themselves in the PCAOB’s enforcement crosshairs for failure to exercise their oversight duties with “reasonable care.”

Similarly, component auditor personnel may now find themselves subject to enforcement action if they negligently cause, directly and substantially, a primary audit firm’s violation of PCAOB standards or rules. In fact, component auditing firms or service centers may also be subject to Rule 3502 liability if they negligently cause a primary audit firm’s violation.

While the proposing release is ostensibly focused on the liability of natural persons, PCAOB Rule 1001(p)(i) defines “person associated with a registered public accounting firm” – language used in the proposed rule – broadly to include “any independent contractor or entity that, in connection with the preparation or issuance of any audit report – (1) shares in the profits of, or receives compensation in any other form from, that firm; or (2) participates as agent or otherwise on behalf of such accounting firm in any activity of that firm.” Therefore, component auditing firms and other entities also may be subject to liability under the proposed rule.

In short, the proposed amendments to Rule 3502 are a further step in the PCAOB’s march toward more aggressive enforcement. Comments on the proposed rule are due on November 3, 2023.

If you have any questions regarding the PCAOB’s enforcement activities or the impact on your business, please contact any of the authors or your DLA Piper relationship attorney.