Audit Firm to Pay $100 Million to Settle SEC Ethics Standards Violations
Commentary by Ilan T. Graff
A UK-based audit firm agreed to pay a $100 million penalty after a number of its audit professionals were found to have improperly shared answers on the ethics component of the Certified Public Accountant ("CPA") exam and other certification examinations. Although the SEC credited the firm's "robust" internal investigation, cooperation and remedial steps as to the underlying conduct, it criticized the firm's failure to cooperate and remediate with respect to misleading statements made in connection with the SEC investigation.
According to the Order, the SEC found that audit professionals at the firm used answer keys to achieve passing scores on the CPA exam and other certification exams, which they then shared with other examinees. The SEC also noted that a significant number of audit professionals who did not share answers failed to report those who did, despite the firm's code of conduct requiring them to do so.
Further, the SEC discovered that the firm withheld information from the SEC about the misconduct during an investigation. Following a similar action brought against a separate auditor (see related coverage), the firm issued multiple warnings in an attempt to dissuade employees from engaging in the practice, but the warnings were not successful. The SEC sent a request for information ("RFI") at that time asking the firm to provide any complaints or information it had received regarding illicit test-taking practices. The firm reported five previous incidents of improper answer sharing but did not disclose that it understood audit professionals to still be engaged in such behavior. Even after learning of ongoing cheating, the firm did not correct its submission in response to the SEC RFI.
In addition to the $100 million penalty, the largest ever imposed against an audit firm, the firm has agreed to (i) cease and desist from further violating PCAOB Rule 3500T ("Interim Ethics and Independence Standards"), (ii) accept a censure, and (iii) notify all relevant clients of the enforcement action. The firm also agreed to take remedial actions that include (i) evaluating the adequacy of its procedures relevant to ethics and integrity, (ii) summarizing its review and identifying changes made to policies relating to ethics and integrity, and (iii) retaining two separate auditors, one to evaluate policies and procedures and another to review its disclosure failures.
SEC Commissioner Hester M. Peirce dissented, claiming that the action "quietly sets the precedent that failing to correct a response to a voluntary information request received from the [SEC] might be a strict liability offense punishable with outsized penalties and other costly remedial measures." Additionally, Ms. Peirce asserted that the required remedial steps also establish a dangerous precedent and looks to "find attorneys and compliance personnel to blame for not complying with a non-existent obligation."
Commentary
As Commissioner Peirce's dissent notes, the record-setting fine is particularly notable since the most recent enforcement action involving similar audit firm misconduct yielded a $50 million penalty. In that sense, this settlement starkly illustrates a principle that SEC Enforcement Director Gurbir S. Grewal articulated last fall: "[T]o achieve the intended deterrent effect, it may be appropriate to impose more significant penalties for comparable behavior over time."
In other words, from the SEC's perspective, precedents are no longer core drivers of settlement amounts so much as evidence that whatever penalties have already been paid were insufficient to deter industry misconduct.