The US Sarbanes-Oxley Act established, amongst other things, the Public Company Accounting Oversight Board. In 2003, the PCAOB finalised a set of rules requiring registration with it of firms that audit US listed companies. Even if you are a UK registered audit firm, you may have to register with the PCAOB if you audit companies with secondary US share listings or large subsidiaries thereof.
Scope
The PCAOB mainly covers US audit firms. However, it also covers non-US firms who:
- have clients with shares (including ADRs) listed in the US (which includes any public company required to file reports with the Securities and Exchange Commission or that has filed a registration statement in the US for a public offering of securities); or
- "who play a substantial role in the preparation or furnishing of an audit report" on such companies.
The PCAOB defines the latter as being responsible for 20% or more of total audit hours or audit fees, or for performing the majority of the audit procedures with respect to a subsidiary or component of any issuer, which "constitute 20% or more of the consolidated assets or revenues of such issuer necessary for the principal accountant to issue an audit report on the issuer".
Thus, any firm auditing an unlisted UK subsidiary of a listed US company (or of a UK company with a secondary US listing) could be required to register if the subsidiary is fairly large relative to the group as a whole and the parent auditor relies on the UK auditor's report for group audit purposes. If in doubt, we suggest you contact the primary group auditor for clarification.
If you need to register, it covers the whole audit firm. Individual offices do not need to register, but international affiliations which comprise a series of legally separate national or regional firms will have to register separately if they are included in the scope.
Initial registration and disclosure issues
The process involves payment of a fee and completion of a lengthy form. The form, together with instructions and Q&As, are available on the PCAOB website. The form itself can be completed online after obtaining an ID from the PCAOB.
Information requested includes details of:
- the audit firm and its offices;
- the relevant clients it is responsible for;
- individuals at manager level or above who take part in the relevant audits;
- the total number of partners and employees;
- pending and past legal and other proceedings relating to audits.
The firm also has to consent to be subject to the oversight by the PCAOB.
During the initial consultation period, the Institute pointed out that there are major legal constraints in disclosing data relating to individuals, particularly outside of the European Union. The PCAOB subsequently recognised in its registration rules that there are legal issues outside the US and allows non-disclosure provided certain requirements are complied with.
The Items contained in Parts I-VII of the form require disclosure of specific information. Item 8.1 of the form requires the firms to provide a general consent to complying with future requests for information or cooperation by the PCAOB, and to obtain the same consents from their associated persons.
UK firms will need to consider whether the information required to be disclosed to the PCAOB in various elements of the application form, (particularly Parts V and VII) can be legally disclosed within the constraints of the Data Protection Act 1998. We understand there are a number of issues:
- in order to comply with the requirements of that Act, where information in the registration application form relates to individuals, their specific, informed and freely-given consent is necessary.
- some information required may be protected by confidentiality laws, including audit client information.
- in order to provide certain information on the form, firms will need to seek the prior consent of their audit clients.
- compliance with future requests of the PCAOB in connection with Item 8.1, may, depending on what is requested, breach a variety of English laws, including data protection, client and third party confidentiality laws.
- given the generality of Item 8.1, in that associated persons are requested to consent to disclosure of 'any information at any time in the future', as regards disclosure of their own personal information, we understand this would not be a valid consent under the Data Protection Act as it is not sufficiently specific.
- enforcing Item 8.1 consent against associated persons of the firm (for example, by dismissing them or removing them from US issuer audit work) may trigger further breaches of laws, including employment laws.
The PCAOB registration requirements permit non-disclosure of information where such disclosure would result in a breach of local law, with certain conditions. Where the application is incomplete, for example, in respect of Item 8.1 or where other consents have been withheld on legal grounds, the PCAOB needs to be provided with:
- a legal opinion obtained by the firm outlining the relevant legal impediments to the firm responding to the Items of the Form;
- a copy of the relevant legislation; and
- an explanation (where relevant) of the steps taken to obtain consents and waivers to overcome any legal impediments identified.
We are aware that a number of affected firms have been able to collaborate in groups, to obtain the relevant legal advice.
Costs, timing and ongoing reporting
Registration requires the payment of a fee (which will not be refunded even if registration is refused) based on the number of issuer clients. However, this only becomes large when the firm has more than 100 issuer clients, which is unlikely to impact on even the largest UK audit firms. Fees vary from year to year: current registration fees are available at www.pcaobus.org/registration.
The more significant costs for firms to assess when considering registration, are likely to be the internal administrative costs involved in the initial gathering of information, ongoing maintenance and extra regulatory oversight.
Registered firms will need to keep the information up to date, using 'form 2' and 'form 3'. These forms were due to be implemented from 12 October 2009 but have been deferred to 31 December 2009 to allow the PCAOB to address some issues with online use of the forms.
Form 2, in essence, needs to be sent in every year by 30 June (starting in 2010), containing similar information to the initial registration form. The legal disclosure issues that applied to the initial form, described separately, also apply.
Form 3 is a special report form, which needs to be sent to the PCAOB when certain events have happened: withdrawal of an audit report; association with suspended firms or people; certain legal proceedings; change in licence status; etc.
Forms 2 and 3 and general instructions are available on the PCAOB website.
Note that we have been advised by the PCAOB that the annual submission of form 2 does not require a new, annual legal opinion where local national law prohibits affirmative answers to all of the questions. Provided the firm has reason to believe that the national law has not changed since the original legal opinion was obtained for submitting form 1, that original opinion remains valid.
While attempts continue through the European Union to achieve mutual recognition arrangements in respect of registration, UK firms wishing to audit entities within the PCAOB's remit currently need to register directly with them. This does not impact in any way on the requirements relating to registration with the Institute in respect of UK audits.
Firms intending to commence audit work on companies within the PCAOB's scope may register at any point providing they have completed registration before they 'prepare or issue audit reports on U.S. public companies or participate in such audits'.
Continued regulatory oversight and inspections
The Institute, the Financial Reporting Council and the European Commission have been involved in discussions with the Board to see how its impact on non-US audit firms might be minimised.The PCAOB issued an initial briefing paper and subsequent rules on oversight of non-US audit firms aiming to "develop an efficient and effective co-operative arrangement where reliance may be placed on the home countries' system to the maximum extent possible".
Commentary on dealing with non-US firms is available at the PCAOB's website, but the key aspects of regulatory oversight are summarised below:
- The PCAOB has established its own inspectorate to undertake monitoring of audits undertaken by firms registered with it, in a similar manner to that which the Institute has performed over the years, through the Quality Assurance Directorate. The PCAOB carries out inspections of UK firms registered with it, directly.
- The PCAOB seeks to co-operate with the local inspection process (normally the Audit Inspection Unit in the UK). Usually it agrees the inspection work program in advance, it may require a PCAOB inspector to be involved depending on the circumstances, and would expect to review elements of the work papers resulting from the inspection.
- In principle the Board can undertake its own investigations of firms registered with it and would require co-operation. It can impose civil penalties including fines, suspension or withdrawal of registration, suspension of individuals from working on clients within its scope or detailed remedial requirements.
- However, the Board has recognised that unnecessarily duplicative investigations and disciplinary sanctions are undesirable and it will seek to rely, where possible, on local investigatory systems and ensuing sanctions.It does however reserve the right to conduct its own investigations and impose further sanctions should they be believed to be necessary, taking into account what has happened locally.