On March 6, the Public Company Accounting Oversight Board (PCAOB) held a virtual roundtable to discuss its June 6, 2023 proposed rule: Amendments to PCAOB Auditing Standards Related to a Company's Non-Compliance with Laws and Regulations (NOCLAR) ( PCAOB Release No. 2023-003). The proposal has sparked a significant debate within the auditing and legal community, given the expanded role it envisions for auditors in assessing legal compliance. PCAOB received an unusually high number of comments, 140 in total, and the roundtable was held by PCAOB staff as a means of further public outreach and discussion on the proposal and comments received.

This article delves into the concerns raised during the discussions at the roundtable and the comment period, particularly focusing on the proposed standard's potential over broadness, the implications for audit costs, and the unrealistic expectation for auditors to be omniscient regarding laws and regulations. For more information about the proposal, please see our earlier article, PCAOB Proposes Massive Expansion of the Auditor's Role.

New Standard Could "Reasonably Result" in Confusion

The proposed shift from requiring auditors to identify NOCLAR that have a "direct and material effect" standard to one where auditors are required to focus on laws and regulations with which noncompliance "could reasonably result in a material effect" on the financial statements has been a focal point of contention. The change aims to enhance the rigor of auditors' identification of relevant laws and regulations. However, it has led to concerns about the potential for confusion and overbroad interpretation.

During the roundtable, a divergence of opinions emerged on whether the proposal's "could reasonably have a material effect" threshold is overly broad. Ironically, even among proponents of this threshold, there was no consensus on its meaning, with some equating it to a "reasonably possible" scenario and others to a "reasonably likely" one. This lack of clarity underscores the argument that the proposed language might be too ambiguous, potentially leading to inconsistent application across audits.

Alternative thresholds, such as the "reasonably possible" standard from ASC 450 [1] or the "substantial likelihood" threshold by which materiality is traditionally assessed [2], were suggested as potentially clearer and more manageable benchmarks for auditors.

So Overbroad That It's Overboard?

The belief among many commenters is that the proposal to require auditors to assess NOCLAR that "could reasonably have a material effect" on financial statements is overly broad and unrealistic because it requires auditors to essentially know all laws to then be able to determine the scope of which laws could reasonably have a material effect on the financial statements. Roundtable panelist Kyle Owens, auditing standards partner at Crowe, expressed concern that determining the scope of laws could be difficult, stating "the Proposal is going to be overly broad because we believe it's going to be challenging to eliminate any law or regulation under the 'could reasonably' threshold."

Another concern is that the overbroad nature of the proposed standard could distract auditors from performing auditing duties by instead requiring them to spend significant time identifying and learning additional laws and regulations. Panelist Brian Croteau, U.S. chief auditor and auditing services leader at PricewaterhouseCoopers, stated "When you get to [laws] that are less likely to have a material effect on the financial statements, I think you need to be cautious about how much you're asking auditors to suspend time from a financial reporting perspective trying to identify the full set of those laws around the world."

The discussion also touched on the specific procedures auditors should undertake to identify relevant laws and regulations. While there was no clear consensus, several common procedures were highlighted, including reviewing legal expenses, conducting inquiries with management and legal counsel, and evaluating the company's whistleblower processes. These procedures underscore the importance of a comprehensive approach to identifying compliance risks. While some panelists dismissed these concerns, the debate highlights the need for a more practical approach to defining auditors' responsibilities in this area.

Significant Cost for Questionable Benefits

The potential economic impacts of the proposed standard were another area of concern for panelists and commentors. The overbroad nature of the "could reasonably have a material effect" threshold likely will lead to increased audit costs, as auditors may need to expend additional resources to cover a wider range of potential legal and regulatory risks. This could disproportionately affect smaller audit firms and their clients, raising questions about the cost-benefit balance of the proposal.

Remarks by several panelists and commenters emphasized PCAOB's lack of detailed cost analysis. For example, the proposal itself states the anticipated additional costs will be "substantial," but fails to put forth any meaningful economic analysis demonstrating the impact of the added costs. For some, this absence of specificity in outlining the financial implications of compliance raises questions about the feasibility and reasonableness of the proposed standards. Several roundtable panelist and commenter insights further illuminated the tangible impact of these costs, particularly on Emerging Growth Companies and other smaller and newly-public companies, as well as smaller audit firms, who have borne the brunt of increased auditing costs as a result of recent SEC rulemaking.

Just as the proposal failed to seriously analyze potential costs to issuers and auditors, benefits were also broadly described based on academic studies of aggregated potential benefits, for example, reduced fraud, enhanced compliance, and bolstered investor confidence. While laudable pillars in the pursuit of financial market integrity, such benefits lack any concrete economic benefit that would offset the "substantial" actual economic costs that would hit the bottom lines of both auditors and issuers.

The dialogue at the roundtable and through comment letters thus reflects that accuracy and fraud prevention must be judiciously balanced against the realities of regulatory compliance and economic feasibility.

Chilling Public Market Activity

Another frequently highlighted unintended consequence of the NOCLAR proposal was the negative impact on capital markets with companies choosing to remain or go private rather than face the substantially increased audit costs the proposal imposes if adopted. As noted by Nasdaq in its comment letter, "the Proposal goes too far — it massively expands the scope of an audit and drives up costs for public companies and investors, thereby incentivizing firms to stay private and curtailing access to capital."

The New York Stock Exchange (NYSE) echoed concerns that the costs outweigh potential benefits and criticized the proposal for its lack of consideration toward the materiality of noncompliance with laws or regulations, stating "the greatest financial impact of a company's immaterial noncompliance could be the increased audit fees paid to identify these insignificant failures."

Could Legal Advice Remain Privileged?

The PCAOB's proposed amendments have sparked a significant debate over the balance between enhancing audit quality and preserving attorney-client privilege and work-product protection. The collaboration between auditors and attorneys, guided by the ABA Statement of Policy regarding auditors' inquiries for the past 50 years, has aimed to balance auditor access to information while protecting privilege. The proposal's failure to mention attorney-client privilege, however, raised substantial concerns among panelists and commenters. Would the absence of clarifying language on this critical aspect of legal protection create a situation where legal privilege would be negated by the disclosure of privileged advice to third-parties? This has led to apprehension among issuers and their legal advisors about the potential erosion of privilege, which forms the cornerstone of legal advice.

The roundtable discussion underscored the inherently fact-intensive nature of privilege analysis. This complexity necessitates that auditors, in their efforts to comply with the proposal, may need to navigate the delicate task of assessing the credibility of sources, such as legal counsel, without infringing upon protected communications. This is particularly challenging given the proposal's perceived requirement for auditors to independently evaluate NOCLAR and make definitive conclusions regarding such noncompliance.

Turning Auditors Into Lawyers

A critical issue often discussed in comment letters and during the roundtable is that the proposed standard would require auditors to delve into complex regulatory matters without the necessary expertise. As Nasdaq stated in its comment letter, "[t]he Proposal would require auditors to duplicate a significant amount of work already done by a company's legal and compliance team." The proposal thus raises questions about the value such duplication would bring to investor protection or financial statement accuracy. Nasdaq's comment letter also aptly articulates this concern, stating, "[a]uditors will need to develop or hire legal experts in every area of law in virtually every country and jurisdiction in the world in order to fulfill their duties under the Proposal."

Expanding the Auditor's Role

Several roundtable participants and commenters raised concerns about the expanded responsibilities the proposal would place on auditors, as the proposal could fundamentally change the auditor's role from validating material disclosures to assessing a company's internal processes for identifying and addressing NOCLAR. As PCAOB acknowledged, the proposal is expected to result in "substantial public company resources in the form of new personnel and increased legal and consulting costs."

Commenters have voiced concerns that such expansions could significantly alter the traditional scope of auditing, imposing on auditors the need to navigate complex legal terrains for which they may not be adequately prepared. Grant Thornton's comment letter highlighted this concern stating "Auditor core competencies may not be adequate to address (i) laws and regulations that indirectly impact the financial statements; (ii) identification of instances of NOCLAR that have or may have occurred; and (iii) appropriate evaluation and use of the work of legal specialists."

In its comment letter, Deloitte expressed apprehension about the practicality of auditors engaging directly with regulators, raising concerns about the potential impracticalities and novel challenges that could arise from expecting auditors to step beyond their traditional roles and engage in direct communication with regulatory bodies without clear precedents or established pathways for such interactions. Deloitte wrote, "We do not believe it is common practice today for auditors to directly correspond with regulators regarding these types of matters."

The requirement for auditors to consider whether specialized skills or knowledge, particularly legal expertise, is needed to assist in evaluating noncompliance has also been a point of contention. The concern is that the proposal will require legal specialists for all PCAOB audits and require auditors to make legal judgments in carrying out the audit process. This shift is anticipated to be particularly challenging, given the diversity and complexity of legal environments in which issuers operate, raising questions about the availability and willingness of legal professionals to provide the definitive views required under the proposed standards.

The broad scope of laws and regulations that auditors would need to consider under the proposed changes has also been a source of concern. The universe of laws and regulations, as observed by PCAOB Board Member Duane DesParte, covers "a myriad of areas including corporate governance, securities, markets, trade, contracts, taxes, consumers, employment, health, safety, environmental, privacy, intellectual property, mergers, acquisitions, and foreign corrupt practices, among others."

Conclusion

PCAOB's NOCLAR proposal has sparked a wide-ranging conversation about the scope and nature of auditors' responsibilities in identifying noncompliance with laws and regulations. While the goal of enhancing audit quality and investor protection is commendable, the concerns raised during the roundtable and through the comment process, highlight the need for careful consideration of the proposal's practical implications. A more defined and realistic standard, coupled with clear guidance on the expected procedures for auditors, will be crucial in ensuring that the final rule achieves its objectives without imposing undue burdens on auditors and the companies they audit.

As the PCAOB considers the feedback from the roundtable and comment letters, it faces the challenge of balancing the need for rigorous audit standards with the practical realities of auditing practice. The debate over the NOCLAR proposal is far from over, and all stakeholders in the financial reporting ecosystem must remain engaged in the conversation.

[1] See Accounting Standards Codification 450-20, which states that a future outcome is "reasonably possible" when the chance of the future event or events occurring is more than remote but less than likely.

[2] See Securities and Exchange Commission, Staff Accounting Bulletin No. 99 – Materiality, 64 Fed. Reg. 45150, where the SEC states that "[a] matter is "material" if there is a substantial likelihood that a reasonable person would consider it important."