On Tuesday, the Public Company Accounting Oversight Board (PCAOB) issued a proposal that would update a nearly 20-year-old rule to allow the agency to hold associated persons accountable when they negligently, directly, and substantially contribute to firms’ violations.

Issued for public comment, the proposal would amend PCAOB Rule 3502 or the Responsibility Not to Knowingly or Recklessly Contribute to Violations Rule. The rule, originally enacted in 2005, governs the liability of associated persons who contribute to registered public accounting firms’ violations of the laws, rules, and standards that the PCAOB enforces.

The deadline for public comment on the proposal is November 3.

Accountable associated persons

The PCAOB says in its press release published in conjunction with the new rule amendment that its purpose is to enable the Board to hold accountable associated persons of PCAOB-registered firms who directly and substantially contribute to violations committed by those firms. 

“This proposal is simply updating PCAOB rules to match what investors already expect: that auditors act with reasonable care whenever they are performing their duties – and when an auditor’s negligence results in firm violations that can put investors at risk, the PCAOB has tools to hold them accountable,” said PCAOB Chair Erica Y. Williams.  

Today’s proposal better protects investors with two key updates, the PCAOB says.

First, the rule amendment strengthens accountability for those who put investors at risk by updating the threshold for liability.

[T]he new language clarifies that associated persons of any firm can be held liable as long as their conduct at least negligently, and directly and substantially, contributes to any firm’s violation.

Auditors are already required to exercise reasonable care anytime they perform an audit – and failure to do so constitutes “negligence.” 

The current Rule 3502, however, only allows auditors to be held liable for firms’ violations when they “recklessly” contribute to those violations – which represents a greater departure from the standard of care than negligence.

This means even when a firm commits a violation negligently, an associated person who directly and substantially contributed to the firm’s violation can be sanctioned only if the PCAOB shows that the associated person acted recklessly. 

The proposal, if adopted, would update Rule 3502’s liability standard from recklessness to negligence, aligning it with the same standard of reasonable care auditors are already required to exercise anytime they are executing their professional duties. (Plus, the US Securities and Exchange Commission already has the ability to bring enforcement actions against associated persons when they negligently cause firm violations.)

“This proposal is simply updating PCAOB rules to match what investors already expect: that auditors act with reasonable care whenever they are performing their duties.”

Erica Y. Williams, PCAOB Chair

The proposal maintains the requirement under the current version of Rule 3502 that an associated person must have contributed to the firm’s violation both “directly and substantially” to be held liable. It clarifies the relationship between the contributory actor and the primary violator.

To be held liable under the current Rule 3502, an associated person who contributes to a firm’s violation must be an associated person of that particular firm.

Given the increasing complexity of arrangements among firms and the constantly evolving nature of technology, the new language clarifies that associated persons of any firm can be held liable as long as their conduct at least negligently, and directly and substantially, contributes to any firm’s violation, not just violations by a firm with which they are associated. 

A proactive PCAOB

In June, the PCAOB announced a proposal to amend PCAOB auditing standards related to the auditor’s responsibility for considering a company’s noncompliance with laws and regulations, including fraud.

Public comments were due on August 7; if adopted, the proposal would strengthen auditor requirements to identify, evaluate, and communicate possible or actual noncompliance with laws and regulations.

The new language clarifies that associated persons can be held liable as long as their conduct at least negligently, and directly and substantially, contributes to any firm’s violation.

In July, the agency issued a staff report that showed a year-over-year increase in the number of audits with deficiencies at audit firms that the PCAOB inspected in 2022. The “Staff Update and Preview of 2022 Inspection Observations” was a compilation of observations from the PCAOB’s inspections of certain public company audits conducted by 157 audit firms in 2022.

Three firms failed to obtain audit committee pre-approval in connection with providing audit and/or non-audit services to issuer audit clients, and two firms failed to make and/or document certain communications with audit committees related to the planned participation of other firms and auditors in the audit, the PCAOB said.