The U.S. Securities and Exchange Commission (“SEC”) recently approved a new standard proposed by the Public Company Accounting Oversight Board (the “PCAOB”) for concurring or engagement quality review (“EQR”) of financial information in audits and interim financial reviews for public companies.1 The new standard, reflected in Auditing Standard No. 7, Engagement Quality Review (“AS 7”), supersedes interim standards and is effective for fiscal years beginning on or after Dec. 15, 2009.
AS 7 strengthens EQR requirements to provide a “meaningful check” on the audit engagement team’s work. While the SEC and PCAOB recognize that AS 7 may require more work than was previously required in an EQR,2 much of the import of AS 7 is to make explicit requirements that previously were implicit. This alert highlights some of the more significant changes to EQR obligations.
As an initial matter, AS 7 establishes new terminology and additional criteria for EQR personnel. Previously, EQR reviewers were referred to as “concurring partner reviewers,” implying that the reviewer is a partner and possesses a certain level of competency. Under AS 7, the “engagement quality reviewer” should, at a minimum, be associated with a registered public accounting firm. If the reviewer is associated with the audit engagement firm, the reviewer must be a partner or hold an equivalent position. Persons outside the audit engagement firm may also serve as engagement quality reviewers, although they need not possess a specific title or hold a certain position of authority.3 In addition to competency, AS 7 requires that engagement quality reviewers have independence and integrity.
AS 7 sets forth nine specific and substantive tasks required in an EQR, none of which was required explicitly under prior standards:
- Evaluating the significant judgments that relate to engagement planning, including consideration of the firm’s recent engagement experience and risks identified in connection with the firm’s client acceptance and retention process;
- Evaluating the engagement team’s assessment of, and audit responses to, significant risks the engagement team identified as well as any other significant risks the EQR professional identified through his or her review;
- Evaluating significant judgments made about the materiality and disposition of identified misstatements and the severity and disposition of identified control deficiencies;
- Reviewing the engagement team’s evaluation of the firm’s independence;
- Reviewing management’s report on internal controls;
- Reading other information in documents containing the financial statements to be filed with the SEC to evaluate whether the engagement team has taken appropriate action with respect to any material inconsistencies or material misstatements of fact of which the EQR professional is aware;
- Evaluating whether appropriate consultations took place on difficult or contentious matters; and
- Evaluating whether appropriate matters have been communicated or identified for communication to the audit committee, management, and other parties, such as regulatory bodies.4
Prior guidelines, by contrast, described EQR responsibilities in a more generic and limited fashion. These included: discussing significant accounting, auditing, and reporting matters and high-risk transactions with the engagement team; reviewing documentation of significant accounting, auditing, financial reporting matters and unadjusted audit differences; reading the financial statements and auditor’s report; and confirming with the engagement team the absence of any significant, unresolved matters.5
EQR Approval and Documentation
Under AS 7, EQR approval is appropriate only if, “after performing with professional due care the review required by this standard, [the EQR professional] is not aware of a significant engagement deficiency.” A significant engagement deficiency includes the following circumstances: (1) engagement team’s failure to obtain sufficient evidence in accordance with the PCAOB’s standards; (2) engagement team’s inappropriate overall conclusion on an engagement subject matter; (3) an engagement report that is not appropriate in the circumstances; and (4) firm’s lack of independence. 6
Under prior standards, EQR approval was permissible under more generic terms—i.e., if the reviewer concluded that no matters came to the reviewer’s attention that would cause the reviewer to believe that the financial statements did not comply with GAAP or that the audit was not performed in accordance with GAAS.
AS 7 also imposes specific documentation requirements for the EQR. Such documentation must “contain sufficient information to enable an experienced auditor, having no previous connection with the engagement, to understand the procedures performed” by the EQR professional.7 Documentation should identify who performed the EQR review and the documents reviewed. Until now, personnel merely were required to document compliance with the firm’s internal concurring review policies.8
AS 7 requires the same rigorous concurring review for interim financial information reviews as for audits, aside from a few differences.9 Previously, interim reviews of financial information required EQR consultation only for matters identified as involving a significant risk of material misstatement of the financial statements.10
Practical Implications of New EQR Standards
When it announced the AS 7 proposal, the PCAOB stressed that an EQR “should not become, in effect, a second audit.”11 AS 7’s attempt to crystallize EQR requirements, however, presages the PCAOB’s intent to scrutinize EQR quality more closely. AS 7 raises a number of practical concerns, many of which were noted in comments to the proposal.
Documentation. An EQR is an iterative process that often takes place simultaneous to the audit engagement. Because it is unclear whether deficiencies identified during the audit will be deemed “significant” for purposes of AS 7, there is concern that every deficiency identified throughout the audit process must be documented to comply with AS 7. In light of the confusion expressed by commentators,12 the SEC’s approval order encouraged the PCAOB to issue guidance for implementing the new documentation requirement. The PCAOB will do so by publishing a Staff Questions and Answers bulletin.
Interim EQR Cost/Benefit. Nor is it clear whether subjecting interim reviews to nearly identical EQR standards as audits will significantly improve the reliability of interim, unaudited financial information, especially given the additional time and cost such reviews will require and the resulting delays in disseminating quarterly financial information.
Conflict Resolution. AS 7 is silent about resolving conflicting views held by the engagement team and the EQR professional. Previously, such conflicts were to be resolved in accordance with applicable firm policy.13 The release accompanying AS 7 provides little guidance, addressing only how the reviewer should document requests to the engagement team to address significant deficiencies or additional risks the reviewer identified.14
Due Professional Care. The SEC and the PCAOB maintain that AS 7 does not redefine “due professional care” as applied in other auditing standards. However, the PCAOB, with the SEC’s support, has signaled that it will take a harder line with respect to the quality or review conducted by EQR professionals, noting in its release that a “reviewer cannot evade responsibility because, as a result of an inadequate review, he or she did not discover a problem that a reasonably careful and diligent review would have revealed.”15
Professional Liability. Last, it remains to be seen how AS 7 will impact liability under the securities laws and other provisions. Courts have long recognized that a concurring reviewer’s role is to provide a second-level review and additional assurance that a company’s financial statements conform with GAAP and that the audit complied with GAAS.16 Accordingly, courts generally acknowledge that EQR failures are not a basis for primary liability under the antifraud provisions of the securities laws, especially in jurisdictions in which a prerequisite for primary liability is the actual making of a false or misleading statement, for attribution. Even engagement partners have been held to be outside the scope of primary liability under the antifraud provisions where the claim is based on an alleged false or misleading statement in an audit report rendered by and in the name of a firm.17 While the SEC may seek to expand secondary liability claims against EQR professionals for aiding and abetting fraud violations, such claims do not give rise to a private cause of action. Moreover, for the SEC to prevail on a claim of aiding and abetting an audit firm’s alleged primary securities law violations, the SEC must establish that the EQR professional “knowingly provide[d] substantial assistance to” the audit firm in committing the alleged fraud.18 Nothing in AS 7 addresses or alters these principles. Nor is it clear how AS 7 will impact other claims, such as common law fraud and negligence claims, by plaintiffs asserting privity (or, where it is sufficient, “near-privity”) with firms issuing audit opinions. Unlike private plaintiffs, the SEC may assert Rule 102(e) claims against concurring partners, though historically it has done so only for alleged lack of independence, failure to perform a rudimentary EQR, or known GAAP violations.19
Due to the PCAOB’s limited history, predicting its response to AS 7 might seem more difficult. But the PCAOB’s ability to enforce violations of “professional standards,” coupled with its authorship of AS 7, suggests that it too will be anxious to pursue enforcement actions asserting AS 7 violations in appropriate cases.
In light of the foregoing, firms revising their procedures to incorporate AS 7 should evaluate whether those policies are sufficiently rigorous to insulate them and their EQR professionals from increased scrutiny of EQR quality by plaintiffs, the SEC and the PCAOB that is sure to follow this new standard.