Audit Quality and Investor Protection under the Holding Foreign Companies Accountable Act

Introduction[1]

One of the recent central themes of the Office of the Chief Accountant has been that high-quality audits are foundational to the trust that underlies our capital markets.[2] High-quality audits protect investors, instill shareholder confidence in the quality of the financial information, and enable public companies to raise capital efficiently.[3] The investor protection afforded by high-quality audits is as important to U.S. investors in foreign companies that participate in the U.S. capital markets as it is for investors in domestic companies. In fact, it could be argued that the additional information barriers that may exist when investing in foreign companies makes the role of trusted gatekeepers, like auditors, even more critical for investors in foreign companies.[4] Recently, we have observed instances of foreign issuers—especially foreign issuers located in the People’s Republic of China (“China”) or in Hong Kong—changing their lead auditor from a local registered public accounting firm to a registered public accounting firm located either in the U.S. or elsewhere, generally within the same network.[5] Such arrangements pose special challenges that raise questions about whether the newly engaged registered public accounting firms—whether located in the U.S. or elsewhere—will be able to satisfy their responsibilities to serve as the lead auditor. Accordingly, we direct this statement to those newly engaged lead audit firms located outside of China and Hong Kong for issuer audits of companies based in China or Hong Kong and others who may be considering similar arrangements.

In recognition of the importance of high-quality audits, both domestically and abroad, Congress has taken significant action on at least two occasions in the past twenty years—with the Sarbanes-Oxley Act of 2002 (“SOX”)[6] and the Holding Foreign Companies Accountable Act (“HFCAA”) in 2020[7]—to provide centralized oversight and standards for the accounting profession that audits public companies (and registered broker-dealers) and to enhance the effectiveness and investor protection of such oversight. In enacting SOX and HFCAA, Congress recognized that it is a privilege to access the U.S. capital markets, and responsibilities for high-quality financial reporting subject to high-quality audits apply to all issuers regardless of where the issuer is located.

The PCAOB’s Fundamental Role in Improving Audit Quality

The PCAOB is tasked with registering public accounting firms that prepare audit reports for issuers and registered broker-dealers; establishing auditing, quality control, ethics, and independence standards; inspecting the audits performed by registered public accounting firms to assess compliance with such standards; and investigating potential violations.[8] This mandate is not limited to domestic accounting firms. Foreign registered public accounting firms that prepare or issue an audit report on the financial statements of an issuer with reporting obligations in the U.S. are equally subject to the requirements of SOX and the PCAOB.[9] That being said, registration by public accounting firms with the PCAOB is voluntary in the sense that public accounting firms are free to decide whether to accept engagements that subject them to PCAOB registration requirements.

If an accounting firm, foreign or domestic, voluntarily chooses to engage in the business of participating in audits of issuers and registered broker-dealers, it is taking on a position of public trust. This trust is not given; it is earned through the fulfillment of the ethical duties incumbent upon the accounting profession and through cooperation and compliance with PCAOB oversight.

Responses to HFCAA Include Issuers Engaging New Lead Audit Firms

To re-enforce the reforms made by SOX to address threats to the integrity of audits and lack of investor protection, Congress enacted HFCAA, which amends SOX to require the PCAOB to determine whether it is unable to inspect or investigate completely registered public accounting firms located in a foreign jurisdiction because of a position taken by one or more authorities in that jurisdiction. HFCAA, among other things, also mandates that, after the PCAOB makes such a determination, the Commission require issuers who retain accounting firms in such jurisdiction to make specified disclosures in their annual reports and prohibit trading in those issuers’ securities if they are identified by the Commission as using such accounting firms for three consecutive years.[10]

On December16, 2021, the PCAOB formally determined that, due to the positions taken by the authorities in China and Hong Kong, the PCAOB was unable to execute its statutory mandates with respect to inspections and investigations of registered public accounting firms headquartered in those jurisdictions.[11] Subsequently, the Commission staff identified a number of issuers that retain auditors subject to the PCAOB’s determination.[12]

Recently, the PCAOB, the China Securities Regulatory Commission, and the Ministry of Finance of the People’s Republic of China signed a Statement of Protocol governing inspections and investigations of audit firms based in China or Hong Kong.[13] While this agreement is an important step, it remains to be seen whether the PCAOB will, in fact, be permitted, pursuant to the terms of the Statement of Protocol, to inspect and investigate completely audit firms in China and Hong Kong.

In light of this uncertainty, it appears that certain China- and Hong Kong-based issuers have begun attempting to structure audit engagements not with local registered public accounting firms but with registered public accounting firms located either in the U.S. or elsewhere to avoid the potential of consecutive PCAOB HFCAA determinations and a potential resultant trading prohibition.[14]

Audit Engagement Structures of Multinational Issuers[15]

Issuers generally engage auditors in their home jurisdiction,[16] and it should come as no surprise that those auditors often have a better understanding of local laws, regulations, and business practices.[17] Home jurisdiction auditors may also have easier access to management and other personnel. They are also more likely to speak the same language as the issuer’s audit committee and management, and be fluent in the language used in the issuer’s business documents. With the uncertainty about potential trading prohibitions and resulting illiquidity,[18] some issuers in China and Hong Kong have begun seeking ways to comply with applicable law while engaging home jurisdiction auditors and preserving the benefits of their access to the U.S. capital markets. Two such examples are described below, along with a discussion of the issues that firms should consider in order to ensure their compliance with PCAOB standards.

First, some issuers with multiple locations or business units (e.g., foreign or domestic subsidiaries, divisions, components) may choose to retain a lead auditor that the PCAOB is already able to inspect or investigate completely that uses, and assumes the responsibility for, the work of other independent auditors or uses the reports of other independent auditors. Those other auditors have audited the financial statements of one or more of the issuer’s subsidiaries, divisions, branches, components, or investments included in the issuer’s consolidated financial statements.[19] This audit engagement structure is not uncommon and is infused with professional requirements and responsibilities per PCAOB AS1205. Such responsibilities include supervision, documentation, and review requirements. Further, the first requirement is the responsibility of the lead auditor to determine whether it can serve as the lead auditor of the engagement when other auditors perform significant aspects of the audit.[20]

Second, issuers with multiple locations or business units may, for example, choose to retain a lead auditor that the PCAOB is able to inspect or investigate completely that, in turn, directly engages another independent accounting firm or other individual accountants to participate under the direction and supervision of the lead auditor pursuant to PCAOB AS 1201.[21] The other auditors in this second scenario work directly under the lead retained auditor’s guidance and control, such that the other auditors serve as an extension of the lead auditor’s engagement team, performing all procedures pursuant to the lead auditor’s engagement planning and under the direction and supervision of the lead auditor. Critically, the lead auditor’s system of quality control encompasses requirements over personnel management and supervision of the audit engagement, including over the work of other auditors.

These two examples of alternative audit engagement structures—although different in some ways—are similar in three respects critical to a firm’s ability to comply with SOX and HFCAA and applicable auditing standards: (i) both place a responsibility on the lead auditor to determine whether it can serve as lead auditor and fulfill those responsibilities prior to accepting the engagement, (ii) both place significant supervisory responsibilities, and the associated potential for liability, on the lead auditor that the issuer engages; and (iii) both require that audit documentation must be retained by or be accessible to the retained lead auditor’s office that is issuing the audit report and must support the work performed by any other auditors involved, including auditors associated with other offices of the lead accounting firm, affiliated firms, or non-affiliated firms.[22]

Engaging a New Accounting Firm to Remediate Prior Non-Compliance with SOX and HFCAA

Issuers seeking to remediate prior non-compliance with SOX and HFCAA by retaining a new accounting firm and using one of the audit engagement structures described above should understand that, in addition to the requirements of PCAOB AS1205 and AS1201, the newly retained accounting firm should communicate with the predecessor accounting firm and evaluate the information obtained prior to accepting the engagement.[23] Critically, the predecessor accounting firm should respond fully to any inquiries that the new accounting firm makes under applicable PCAOB standards, including any requests for access to the work papers of the predecessor accounting firm relating to audits of previous financial statement periods.[24]

In addition, under AS2610, a newly engaged accounting firm, even if it can engage in basic appropriate communications with and acquire requested information (including work papers) of the issuer, should still also make inquiries of the predecessor accounting firm about certain matters. Such inquiries include: (i)the integrity of the issuer’s management; (ii)any disagreements with management that the predecessor firm may have had regarding accounting principles or other significant matters encountered during the previous audit(s); (iii)communications of matters between the predecessor firm and the issuer’s audit committee; (iv)the predecessor firm’s understanding of the nature of the issuer’s relationships and transactions with related parties and any significant unusual transactions; and (v)the predecessor auditor’s understanding as to the reasons for the change of auditors.[25]

If the issuer does not authorize appropriate communications, or places significant limitations on the responses of its predecessor accounting firm, the new accounting firm may not be able to accept the engagement and be in compliance with applicable PCAOB standards.[26] The same is true if the predecessor auditor creates roadblocks and fails to engage in appropriate communications or to provide requested information, including prior work papers. Therefore, accepting such an engagement to serve as the retained lead auditor creates risk for the new accounting firm of potential enforcement action by the PCAOB, the Commission, or both, and creates potential liability for the issuer.

In other words, exchanging non-compliance with SOX and HFCAA for retaining an accounting firm in violation of PCAOB standards is simply trading one bad outcome for another and does not adequately address the underlying problem.

Important Considerations for Accounting Firms and Issuers

We caution registered public accounting firms that all audit engagements entail significant requirements and responsibilities, consideration of which should take place prior to an accounting firm’s acceptance of a client or a specific engagement. The two audit engagement structures we described above permit the accounting firm retained by the issuer to use the work of another auditor as long as the requirements for serving as the lead auditor can be met and the lead auditor is able to fulfill its responsibilities, including those for supervision and documentation. The applicable standards, however, only permit such flexibility because of the concomitant obligations of the retained lead auditor, including the production of any audit work papers upon any PCAOB inspection or investigative demand and making any relevant audit personnel available to the PCAOB upon inspection or investigative demand. The failure of the retained lead auditor to meet any of its legal or professional obligations with respect to PCAOB inspection and investigative demands, or the failure of the lead auditor to comply with all applicable audit standards can result in significant liability for not only the auditor and its personnel, but also for the issuer.[27]

Issuers and accounting firms looking to avoid the uncertainty about whether they will be in compliance with HFCAA may be tempted to engage in an efficient breach of other applicable legal and audit requirements.[28] Such issuers and accounting firms should be forewarned that doing so may well result in investigations and enforcement actions by the PCAOB, the Commission, or both, and that the attendant liabilities may attach not only to the accounting firms and their associated persons, but also to issuers, their audit committees, and officers and directors. Any attempt by issuers or accounting firms to engage in such an efficient breach and avoid the consequences of HFCAA in contravention of other legal and audit requirements should therefore be avoided.