How to Respond to a PCAOB Informal Request

The Informal Inquiry and Cooperation
Under PCAOB Rule 5100, the director of the DEI may undertake an informal inquiry where it appears that a firm or associated person of the firm may have violated PCAOB rules or auditing standards or securities laws. Unless an inquiry involves purely legal issues, such as noncooperation or other technical PCAOB rules violations, inquiries are usually staffed with an attorney and an accountant. At the informal inquiry stage, the DEI may request documents, information, or testimony from, or an interview with, any person. Typically, at this stage, the DEI does not take witness testimony. Under the Sarbanes-Oxley Act of 2002, as amended, all PCAOB informal inquiries and formal investigations are confidential.

In an informal inquiry, cooperation is voluntary. By cooperating with the DEI inquiry, the accounting firm and associated persons (collectively, the firm) will start the process of building trust and goodwill with staff. Firms that provide extraordinary cooperation may receive credit from the DEI and the PCAOB.

Refusing to cooperate with the DEI in an informal inquiry will likely lead to a DEI order of formal investigation (OFI). At the OFI stage, the firm is required to cooperate; and failing to comply with a formal request for documents, information, and/or testimony can lead to a charge of noncooperation with an investigation under Rule 5110. The sanctions for noncooperation can be severe. Therefore, it is important for the firm to cooperate and reasonably respond to DEI requests at the informal stage.

Sources of Inquiries
An inquiry may arise from a number of sources.

One of the DEI’s most important sources is the PCAOB inspections program. Registered firms are inspected on an annual basis (firm provides audit reports for more than 100 issuers) or every three-year basis (firm provides audit reports for 100 or fewer issuers) to assess compliance with the Sarbanes-Oxley Act, the rules of the PCAOB, the rules of the SEC, and professional standards in connection with the firm’s performance of audits of issuers and brokers/dealers. Public versions of the inspection reports for registered firms are available on the PCAOB website. Therefore, a firm should review the most recent inspection report to see whether PCAOB inspectors identified criticisms or concerns about any of the firm’s audits or the firm’s system of quality control.

Another source is the DEI’s public source analysis team, which monitors and assesses public disclosures in SEC filings, news articles, blogs, and other sources to identify potential new cases. The firm should review the SEC filings for the issuer or broker/dealer, which are available on the SEC EDGAR system. Restatements of financial statements are frequent triggers of both SEC and PCAOB investigations.

Another source of cases is referrals from regulatory authorities such as the SEC, the Financial Industry Regulatory Authority (FINRA), and state licensing boards. Frequently in matters involving restatements, both the SEC and the PCAOB will have separate inquiries. Often, the SEC will take the lead in the investigation of the issuer, and the PCAOB will take the lead in the investigation of the auditor.

Finally, the PCAOB has a Tip & Referral Center that receives tips and referrals from the public via email, phone, fax, or mail. Therefore, a firm employee or client may be the source of a matter.

Preservation of Documents and Information
An important step after receiving an accounting board request is to issue a litigation hold to all people who may have documents and information potentially responsive to the request. The request will usually contain an entreaty to preserve documents related to the request from a certain date to present. A litigation hold is a directive to custodians of electronically stored information (ESI) and all other documents to preserve potentially responsive documents. This hold overrides the firm’s document-retention policy. The firm should immediately identify all key current employees as well as former employees who may have responsive documents and should notify its information technology personnel to take steps to preserve ESI, including backup media.

Under PCAOB Auditing Standard (AS) 1215, Audit Documentation, a complete and final audit documentation should be assembled for retention not more than 45 days after the audit report release date. Audit documentation must not be deleted or discarded after the documentation date; however, information may be added. Any documentation added must indicate the date that the information was added, the name of the person who prepared the additional documentation, and the reason for adding it.

As part of the preservation process, the firm should be mindful of recent significant PCAOB settled disciplinary orders involving the improper alteration or backdating of audit documentation. Improper document alteration has been one of the four higher-priority enforcement areas in recent years. Common improper alterations after the documentation date involve adding sign-offs and sign-off dates, adding new work papers, revising conclusions reached in audit steps or memoranda in the work papers, and completing checklists. There may be a temptation by the engagement team to alter work papers after receipt of a request. Firm leadership, in-house counsel, and outside counsel should take this into account not only at the preservation stage but also as part of the firm’s continuous training of personnel. It is a violation of PCAOB rules regarding noncooperation to improperly alter work papers not only as part of an investigation but also in advance of a PCAOB inspection. See PCAOB Rules 4006, 5110. Be aware that DEI staff attorneys and accountants will be reviewing metadata produced with electronic work papers and comparing electronic versions of work papers with paper versions. Also, if the audit at issue in the inquiry was the subject of an inspection, DEI staff may compare the work papers produced to inspectors with work papers produced to the DEI in response to the request.

Production of Documents and Information
The request will be accompanied by standard instructions as to how documents and information should be produced to the DEI. There are specific instructions regarding the form in which electronic documents should be provided. If ESI is not produced in a form in compliance with the instructions, the firm runs the risk of having to engage in the time-consuming and expensive process of reproducing the ESI, as well as incurring the ire of DEI staff. If the firm is smaller and does not have in-house IT staff, the firm should engage the services of a competent IT services company to assist in this process. It is good practice, and a usual DEI request, for the firm to place identifying numbers on each page of paper and electronic documents to be produced, known as Bates numbering.

Typically, the request will also ask that the work papers be loaded onto a laptop computer and produced to the DEI. The firm must provide all passwords needed to access the software and make sure work paper–related software is up to date. The firm should also make sure that the computer and work paper software allow work papers to be printed. Be prepared to be without the laptop for a year or more because DEI inquiries may take over a year; and if the PCAOB issues a formal investigation, add one to two more years to complete the investigation. When the inquiry or investigation closes or is otherwise resolved, the DEI will return the laptop to the firm.

If the request is extensive, particularly when dealing with ESI, the firm should approach DEI staff about appropriate scope and custodian limitations.

Also, it is good practice for a firm using search terms to collect ESI to provide those terms in advance to the DEI. It is the firm’s responsibility to perform a reasonable search in response to the request. Therefore, DEI staff will never “bless” the terms proposed but will frequently provide feedback and/or suggestions for improving the search.

Privilege and Work-Product Claims
In conducting the search, the firm and its counsel should be mindful of potentially privileged documents, such as the accounting firm’s own communications with its inside or outside counsel or attorney work product of the firm’s client that may be in the audit work papers or the files of the engagement partner. A majority of courts have held that disclosure of attorney work product to the outside auditor does not result in a waiver of the work-product protection. See, e.g., United States v. Deloitte LLP, 610 F.3d 129, 142 (D.C. Cir. 2010); In re Weatherford Int’l Sec. Litig., No. 11CIV1646LAKJCF, 2013 WL 12185082, at *5 (S.D.N.Y. Nov. 19, 2013). Nevertheless, to the extent that the firm has any of its client’s protected materials in the work papers or engagement team files, the firm will need to reach out to and coordinate with its client to ensure that there is no waiver of the client’s protected materials.

PCAOB Rule 5106 addresses the assertion of privilege. It generally requires the firm to produce a privilege log identifying the date of the document, the type of the document, the author, the recipients, and the nature of the privilege. DEI staff will scrutinize privilege logs and potentially challenge certain privilege assertions that they view as lacking adequate support.

In instances where the firm may have conducted an internal investigation and there is a written report, counsel in consultation with the accounting firm client will have to weigh whether the potential benefit of narrowing the issues or persuading the staff to close the inquiry is outweighed by the risk of waiver of work-product protection. Cases, including a December 2017 decision by a federal magistrate judge in Florida, raise the possibility that disclosure to government authorities, such as the SEC and the PCAOB, may result in waiver, including subject-matter waiver. See In re Columbia/HCA Healthcare Corp. Billing Practices Litig., 293 F.3d 289, 306–07 (6th Cir. 2002) (not permitting selective waiver of work-product material to government agencies); In re Initial Pub. Offering Sec. Litig., 249 F.R.D. 457, 465–67 (S.D.N.Y. 2008) (finding that company waived work-product protection by disclosure of memoranda to the SEC, which was investigating the possibility of the company’s wrongdoing, to limit liability for that wrongdoing); Order on Defendants’ Motion to Compel Prod. from Non-Party Law Firm, SEC v. Mathias Francisco Sandoval Herrera, No. 17-cv-20301 (S.D. Fla. Dec. 12, 2017). Even an oral synopsis of the contents of work product–protected investigation reports, memoranda, and interview notes may risk waiver.

Be aware that when there are parallel investigations, the SEC frequently requests access to the DEI’s investigative record in the PCAOB inquiry or investigation, and the DEI requests access to SEC Division of Enforcement’s investigative record in the SEC investigation. Therefore, production and possible waiver of work-product protection in producing protected material to the PCAOB may also mean production and waiver in any SEC investigation. Because there are fewer confidentiality protections in SEC investigations than PCAOB investigations, there is a heightened risk of privileged materials becoming public and/or disclosed to third parties.

Extensions
Typically, requests will have a two-week deadline for responding. If the firm is unable to provide the documents and information by the two-week deadline, the firm should seek an extension as soon as possible. The DEI will usually grant timely, reasonable requests for an extension. Be prepared in making the request to set forth the reasons why the firm is unable to produce the documents and information by the deadline, how long of an extension is requested, and whether the firm is willing to produce the documents on a rolling basis.

Supplemental Requests       
After production, be prepared to receive questions from staff or additional requests for information in letters or emails. The firm should understand that staff, on occasion, may be sending voluntary requests to the issuer (i.e., its client), former employees, or other interested third parties. See PCAOB Rule 5105. To the extent that information or documents in the hands of third parties are important to the firm’s defenses in the inquiry, firm counsel may want to approach counsel for these third parties, keeping in mind that communications may fall outside of a joint defense privilege and, therefore, be discoverable.

Though infrequent, staff may request to interview the engagement partner, manager, or, where a global network firm is involved, national office personnel to gain an understanding of areas of the audit that are of concern. The firm should take advantage of these opportunities to educate DEI staff about why the evidence may not constitute a violation of PCAOB rules or standards. The firm may also want to be proactive and request a meeting with DEI staff to make its case about why the conduct at issue does not constitute a violation of any rule or standard.

Closing of Inquiry and Early Resolution
An informal inquiry usually lasts a few months to a year. DEI staff may believe that there is insufficient evidence of a violation of PCAOB rules or standards, SEC rules, or the Sarbanes-Oxley Act. At that point, staff make a recommendation to DEI management, and the DEI may close the inquiry. Usually, the firm will receive a letter from the DEI that the inquiry is being closed; and if a laptop has been provided, provisions are made for its return.

On the other hand, if DEI staff believe that there are sufficient grounds for further investigation (or it believes the firm has not cooperated in the informal inquiry), DEI staff may recommend (1) seeking an OFI from the PCAOB, (2) conducting a charging call or sending a charging letter detailing the alleged violations, and/or (3) approaching the firm about an early resolution of the matter through a settled disciplinary order.

If the firm believes that it or one of its accountants has committed one or more violations, it may be to the firm’s advantage to approach the DEI to propose a settlement. The advantage of an early resolution is that the firm may be able to narrow potential charges and/or seek reduced sanctions that may not be available once the DEI moves to an OFI.

Conclusion
A PCAOB informal inquiry can be a time-consuming and expensive process. However, there are opportunities for a firm to narrow the scope of the inquiry, shorten the duration of the inquiry, or resolve the matter at an early stage.

Robert H. Cox is of counsel at Briglia Hundley, P.C., in Tysons Corner, Virginia. From 2011 to 2017, Cox was an assistant director with the PCAOB’s Division of Enforcement and Investigations.

^{Copyright © 2018, American Bar Association. All rights reserved. This information or any portion thereof may not be copied or disseminated in any form or by any means or downloaded or stored in an electronic database or retrieval system without the express written consent of the American Bar Association. The views expressed in this article are those of the author(s) and do not necessarily reflect the positions or policies of the American Bar Association, the Section of Litigation, this committee, or the employer(s) of the author(s).}