SEC amended PCAOB Rule 3502 to raise the bar on ethics rules
By Jonathan D. Uslaner and Lauren M. Cruz
October 2, 2024
On Aug. 20, 2024, in a 3-2 vote along party lines, the Securities and Exchange Commission (SEC) approved a long overdue measure to protect investors by raising the bar on the ethics rules that apply to those auditing the financial statements of public companies. The amendment, which is set to take effect on Oct. 21, 2024, was proposed by the Public Company Accounting Oversight Board (PCAOB), the regulatory body created by the Sarbanes-Oxley Act with a stated mission to protect investors.
PCAOB Rule 3502 governs the liability of "associated persons," who are defined as individuals and entities who directly and substantially contribute to an accounting firm's primary violation of the PCAOB's rules. With the SEC's adoption of Amended Rule 3502, the PCAOB will now be able to hold associated persons to an objective standard of a reasonable and competent auditor. When the amendment takes effect, it will harmonize the ethics rules that apply to audit firms and to the associated persons who actually perform the audit on the audit firm's behalf.
Background of the need to modernize Rule 3502
Under Section 103(a)(1) of Sarbanes-Oxley Act, the PCAOB is authorized to establish ethics standards for registered public accounting firms in the preparation and issuance of audit reports. With this authority, the PCAOB adopted Rule 3502 in 2006 to codify auditors' ethical obligations not to contribute to an accounting firm's violations of the laws, rules, and standards that the PCAOB is charged with enforcing.
For nearly 20 years, the ethics standard applicable to associated persons — those individuals and entities responsible for the actual audit — has been lower than the standard applicable to the auditing firms that employ them. Specifically, the PCAOB applied a "negligence" standard to the audit firm and a "knowing" or "reckless" standard to associated persons.
As the SEC explained in its order granting approval of the amendment to PCAOB Rule 3502, in this context, negligence is "the failure to exercise reasonable care or competence," while "recklessness" is an "extreme departure from the standard of ordinary care" that "presents a danger to investors or to the markets that is either known to the (actor) or is so obvious that the actor must have been aware of it." SeeSEC Release No. 34-100772; File No. PCAOB-2024-04, Aug. 20, 2024.
Under the prior Rule 3502, an accounting firm could be found primarily liable based on the "negligence" of the associated persons, while the associated persons could not also be held liable for their contribution to the violation unless they "knew" they were contributing to a violation or performed their job so egregiously that it presented a "danger to investors."
The lack of harmony between the ethics standards under the prior Rule 3502 made it nearly impossible for the PCAOB to hold associated persons liable for their contributions to a firm's negligent violations. This is because the PCAOB was required to show that the associated person acted at least recklessly, a much higher burden on the PCAOB, in order for the PCAOB to hold the associated person liable for their contributions to a negligent violation by the firm.
Indeed, the PCAOB reported that since adopting Rule 3502, the PCAOB had never succeeded in charging an associated person with secondary liability when the PCAOB brought negligence-based claims against an audit firm. Moreover, since 2009, in over two-thirds of the cases in which the PCAOB has sanctioned an auditing firm, it was unable to hold any of its auditors accountable under Rule 3502. See Settled and Adjudicated Disciplinary Orders Reported by the Board to the Public Pursuant to Section 105(d) of Sarbanes-Oxley, available here:, opens new tab
In addition, because the prior Rule 3502 prohibited the PCAOB from bringing negligence-based contributory claims against associated persons, this created inefficiencies. The PCAOB was, instead, required to outsource negligence-based contributory claims against responsible auditors to the SEC to take action, if the SEC so chose. This outsourcing was required even if the PCAOB was also prosecuting the same case against the audit firm in connection with the same audit.
Under Amended Rule 3502 (now styled, Responsibility Not to Contribute to Violations), these problems should be resolved. The PCAOB will now be able to hold associated persons responsible for their negligent actions — meaning that the PCAOB can now hold individuals personally accountable "when they negligently, directly, and substantially contribute to firms' violations."
The PCAOB believes this rule change will resolve the "incongruity" in the existing structure by harmonizing the requisite ethics standard for accounting firms and their auditors. See Final Rule, PCAOB Release No. 2024-008, June 12, 2024. The PCAOB's ability to utilize additional tools to police auditors and not rely solely on the SEC's resources to bring negligent-based contributory liability claims should prove a powerful step forward in ensuring that auditors are held to the standard of care that investors deserve.
The modernization is a win for investors
The goal of amending Rule 3502 is clear: empower the PCAOB to ensure individuals performing audits of public companies exercise a higher degree of care in their work, thereby lowering the risk that audit firms issue audit reports that fail to protect investors. In her Aug. 20, 2024, Statement concerning "SEC Approval of Three PCAOB Standard-Setting and Rulemaking Actions That Will Protect Investors," PCAOB Chair, Erica Y. Williams, calls the amendment part of several "wins for investors" initiated by the PCAOB. As Williams explained, "[t]o keep investors protected in an era of rapid change, our standards and rules must keep up."
Auditors are gatekeepers for the entire financial reporting system. They must operate at a level of due care to ensure that they meet their responsibility in effectuating accurate financial disclosures that are decision-useful to investors and maintain public confidence in the capital markets. By amending Rule 3502, the SEC and the PCAOB have made clear that they understand that investors expect greater competence from those tasked with being a critical stopgap in the process of ensuring that public companies issue accurate disclosures.
The timing of the amendment is critical. As Commissioner Jaime Lizárraga noted in his speech, Harmonizing Liability Standards for Auditing Firms and Associated Persons, the amendment "is especially useful at a time when audit deficiencies and an overall drop in audit quality continue to persist." Indeed, over the last several years, the public markets were rocked by several significant auditor failures.
At the same time, the Supreme Court has rolled back powers long held by the SEC to protect investors from auditor failures. On June 27, 2024, the Supreme Court issued SEC v. Jarkesy, 144 S. Ct. 2117 (2024), holding that when the SEC brings an enforcement action for civil penalties, it must do so in federal court instead of using its administrative law judges. This decision is expected to increase significantly the burden on the SEC to bring such cases and decrease the SEC's ability to police auditors because of the increased time, difficulty, and expense associated with pursuing these actions through the federal court system.
Of note, challenges have also been made to the PCAOB's power under the constitution to bring disciplinary proceedings against individuals without the protections and oversight of the judiciary. The lead case challenging the PCAOB's authority is John Doe Corporation v. Public Company Accounting Oversight Board, No. 1:24-cv-00780-UNA, which was transferred to the United States District Court for the District of Columbia on March 23, 2024, for all further proceedings.
Time will tell how and whether the ramifications of Jarkesy will affect the SEC's ability to ensure that auditors act responsibly and whether plaintiffs will be able to expand the reach of Jarkesy to limit the PCAOB's powers.
In the meantime, the much-needed amendment of Rule 3502 is expected to give the PCAOB an additional tool necessary to better execute the agency's investor-protection mandate. Investor advocates hope that the amended rule will improve the PCAOB's ability to detect and sanction misconduct, thereby enhancing investor protections and supporting the efficient functioning of the capital markets. The need to improve the quality of audits cannot be overstated, and the PCAOB's amendment should be a step in the right direction.
Jonathan D. Uslaner is a regular contributing columnist on securities litigation for Reuters Legal News and Westlaw Today.
[Reuters]
