Auditor Independence and Workpaper Retention Rules

February 24, 2003 SECURITIES T and Workpaper Retention Rules he Securities and Exchange Commission has recently adopted rules to amend and enhance its auditor independence requirements as directed by Section 208(a) of the Sarbanes-Oxley Act of 2002. Release No. 33-8183 (Jan. 28, 2003) http://www.sec.gov/rules/final/33-8183.htm. These new rules will become effective on May 6, 2003, although certain provisions of the rule are subject to various transition periods. The SEC also adopted rules to implement Section 802 of the Sarbanes-Oxley Act, which concern the retention of records relevant to an audit or review of an issuer s or a registered investment company s financial statements. Release No. 33-8180 (Jan. 24, 2003) http://www.sec.gov/rules/final/33-8180.htm. These rules will become effective on October 31, 2003. Background The accounting problems at the heart of many recent corporate failures in the United States have caused investors and lawmakers to re-evaluate the role of outside auditors in the assessment of public company financial statements. Many have questioned whether the provision of non-audit services has tainted the independence of auditors, resulting in lower quality audits. As Commissioner Paul Atkins noted during the open meeting on January 22, 2003, a recent poll indicated that 70% of US investors agreed that accounting issues were hurting the investment climate a lot. The SEC s new rules endeavor to address these investor concerns and restore confidence in the capital markets by strengthening auditor independence and enhancing the required disclosure of the audit and non-audit services provided by accountants to their clients. In many instances, the SEC went beyond its Sarbanes-Oxley Act mandate and imposed additional requirements on accountants and their audit clients. The new auditor independence rules amend Rule 2-01 of Regulation S-X by prohibiting nine nonaudit services as well as certain forms of auditor employment. The final rules also add certain new provisions to the SEC s existing auditor independence rules, including those which (i) require audit committees to pre-approve all permissible non-audit and required audit services; (ii) mandate annual disclosure of audit and non-audit fees; (iii) require the rotation of audit partners; (iv) prohibit certain types of auditor compensation and (v) require communication between auditors and their audit clients. The rules are an important step in the SEC s continued attempt to foster an enhanced environment in which auditors will not be beholden to, and can be independent from, management. The SEC initially proposed changes to its existing auditor independence rules at an open meeting in November 2002. Release No. 33-8154 (Nov. 19, 2002) http://www.sec.gov/rules/proposed/33-8154.htm. There were a considerable number of comment letters concerning this proposal, the majority of which were from domestic and foreign accounting firms, accountants and industry and governmental organizations. cov.com

Prohibited Non-Audit Services The SEC s amendments to Rule 2-01 of Regulation S-X list nine non-audit services that an accountant cannot provide to an audit client during the audit and professional engagement period and maintain its independence. 1 The SEC s current rules prohibit many of these non-audit services, subject to certain limited exceptions, but the new rules largely eliminate these exceptions. Any service that does not constitute one of the nine prohibited non-audit services is permitted, subject to audit committee approval. The nine prohibited non-audit services under the final rule are the following: bookkeeping or other services related to the accounting records or financial statements of the audit client, unless it is reasonable to conclude that the results of these services will not be subject to audit procedures during a financial statement audit; financial information system design and implementation, unless it is reasonable to conclude that the results of these services will not be subject to audit procedures during a financial statement audit; appraisal and valuation services, fairness opinions or contribution in kind reports, unless it is reasonable to conclude that the results of these services will not be subject to audit procedures during a financial statement audit; actuarial services, unless it is reasonable to conclude that the results of these services will not be subject to audit procedures during a financial statement audit; internal audit outsourcing services, unless it is reasonable to conclude that the results of these services will not be subject to audit procedures during a financial statement audit; management functions or human resources; acting as a registered or unregistered broker or dealer, or providing investment adviser or investment banking services; services that could only be supplied by an individual who is licensed, admitted or otherwise qualified to practice law in the jurisdiction where the service is provided; and expert services unrelated to the audit which were provided for the purpose of advocating an audit client s interests in litigation or during a regulatory or administrative proceeding or investigation. The SEC acknowledged that audit clients may require some additional time to ensure their compliance with the new rules. Until May 6, 2004, the provision of any of the nine prohibited non-audit services listed above will not impair an accountant s independence as long as the accountant is providing the non-audit services under a contract in existence on May 6, 2003. 1 Rule 2-01(f)(1) defines an accountant as a registered public accounting firm, certified public accountant or public accountant performing services in connection with an engagement for which independence is required. Under this definition, references to accountant include any accounting firm with which the certified public or public accountant is affiliated. 2

Tax Services The primary focus of many of the comment letters received by the SEC concerning its proposed rules on auditor independence was the provision of non-audit tax services. Section 201 of the Sarbanes- Oxley Act permits an accountant to perform any non-audit service, including tax services, that is not included in one of the nine prohibited categories of services listed above, provided that the client s audit committee approves the service in advance. In the SEC s commentary to the proposed release, it suggested that audit committees should evaluate the proposed tax services in light of the three basic principles that frame independence considerations -- accountants cannot (i) audit their own work; (ii) perform management functions; or (iii) act as advocates for their clients. Many commenters remarked that this evaluation was inconsistent with the text of the proposed rule and the legislative intent and would result in fewer tax services being approved by audit committees. The SEC addressed these concerns in its amendments to Rule 2-01 of Regulation S-X by generally permitting tax services, provided that the issuer's or registered investment company's audit committee approves such services. The rule does not define tax services, although the SEC did state that such services would include tax compliance, tax planning and tax advice. Chairman Harvey Pitt and Commissioner Harvey Goldschmid cautioned audit committees to evaluate carefully whether an accountant can impartially provide certain types of tax services, such as designing tax shelters or other novel tax products, particularly if such services are not related to the business purpose of the audit client. Additionally, if a tax service constitutes one of the nine prohibited non-audit services described above, it would impair the accountant s independence under the new rule. For instance, an accountant could not act as a public advocate by representing an audit client in tax court. Pre-Approval of Auditor Services Rule 2-01 now requires the audit committee of an issuer or a registered investment company, other than an asset-backed issuer or a unit investment trust, to pre-approve all permissible non-audit services as well as audit services required under the securities laws. 2 Audit committees may implement pre-approval policies and procedures as long as they are sufficiently specific with respect to the particular service, the audit committee is informed of each service that will be provided and such policies and procedures do not include the delegation of the audit committee s responsibilities to management. (See box at right for a description of the de minimis exception to the preapproval requirement.) The audit committee pre-approval requirement contained in Rule 2-01 is applicable to all permitted non-audit and required audit services entered into after May 6, 2003. Any service that has been entered into prior to May 6, 2003 is permitted, regardless of whether it was pre-approved by the audit committee, as long as such service is completed by May 6, 2004. De Minimis Exception to the Pre-Approval Requirement Rule 2-01 contains an exception to the preapproval requirement for non-audit services if: the aggregate fees for all such services do not constitute more than 5% of the total fees paid by the audit client to the accountant during the fiscal year in which the services are provided; the services are not recognized at the time of the engagement to be non-audit services; and the services are promptly brought to the attention of the audit committee and approved prior to the completion of the audit. 2 The Sarbanes-Oxley Act defines an audit committee as a committee (or equivalent body) established by and amongst the board of directors of an issuer for the purpose of overseeing the accounting and financial reporting processes of the issuer and audits of the financial statements of the issuer. If an issuer does not have an audit committee, the audit committee is deemed to be comprised of the entire board of directors. 3

Disclosure of Auditor Services to Investors The current proxy rules require a public company to disclose the professional fees that it paid to its principal independent accountant in the most recent fiscal year. The SEC s final rules expand the number of categories of professional fees paid for audit and non-audit services from three to four: audit fees, audit-related fees, tax fees and all other fees. Also, the rules require this disclosure for the two most recent fiscal years. If the company, such as a foreign private issuer, is not required to file a proxy statement, the disclosure must be included in the company s annual report. The new rules are effective for all periodic annual filings for the public company s first fiscal year ending after December 15, 2003. Audit fees generally include fees for services necessary to perform an audit or review and services required in connection with statutory or regulatory filings or engagements, such as comfort letters, attest services, consents and review of documents filed with the SEC. Any fees related to tax services and consultations with an accounting firm s national office would constitute audit fees if such services were rendered to comply with generally accepted auditing standards (GAAS). Audit-related fees include fees paid for assurance and related services, including employee benefit plan audits, internal control reviews, due diligence in connection with a proposed acquisition and consultation concerning financial accounting and reporting standards. Tax fees capture the services performed by the accountant s tax division, such as fees for tax compliance, consultation and planning, except for fees related to the audit. All other fees include all fees that do not fit within one of the other three categories. Additionally, public companies must disclose the percentage of fees by category that were paid subject to the de minimis exception discussed above. The SEC recognized that fees paid by other investment companies in an investment company complex may impact the independence of a registered investment company s accountant. Therefore, the SEC requires enhanced fee disclosure for registered investment companies. The final rules require a public company to disclose the audit committee s pre-approval policies and procedures. Such disclosure calls for a clear and concise description of such policies and procedures or the inclusion of a copy of the policies and procedures with the proxy statement or annual report. Audit Partner Rotation Section 203 of the Sarbanes-Oxley Act specifies that the lead audit partner and the concurring partner are subject to a five-year rotation requirement. The SEC proposed to expand that requirement, however, to all partners performing a continuing audit function with a five-year cooling off period. Numerous commenters stated that this expansion would increase costs for audit clients while reducing the quality of audits. The SEC modified its proposal in its final rules. Rule 2-01 of Regulation S-X now subjects the lead audit partner and the concurring partner to a five-year rotation requirement and a five-year cooling off period after rotation. All other audit partners (see box at right) are subject to a seven-year rotation requirement with a two-year cooling off period after rotation. The rule also provides time for new partners to be trained; for instance, a new partner can work on the audit engagement team for two years and then serve as the lead partner for five years before triggering the rotation requirements. Who is an Audit Partner? Each audit partner is subject to the partner rotation and compensation requirements under the final rules. An audit partner is defined as a member of the engagement team who has responsibility for decision-making on significant auditing, accounting and reporting matters that affect the financial statements or who maintains regular contact with management and the audit committee. The definition includes the key decision makers on the audit engagement team, such as the lead partner, the concurring partner, any partner who assists the issuer (other than a partner who consults with the audit engagement team concerning industryspecific or technical issues, transactions or events) and the lead partner on significant subsidiaries of the issuer. 4

Under the final rules, the lead partner in a domestic accounting firm must rotate after five years of client representation, regardless of whether the representation occurred before or after May 6, 2003, the effective date of the rules. However, the rotation requirement for all other audit partners, including a lead partner with a foreign accounting firm, applies from the first fiscal year after May 6, 2003. This means that an audit partner, other than the lead partner with a domestic accounting firm, could have served as a part of the engagement team for the previous 10 years, but would not have to rotate off of the engagement until five or seven years, as the case may be, following the first fiscal year after May 6, 2003. The SEC acknowledged this seemingly inconsistent result, but stated that it was primarily concerned with ensuring that the rotation requirements for the lead partner were the most stringent, as this individual arguably has the greatest ability to influence the audit and the strongest relationship with members of senior management at the audit client. Moreover, unlike other audit partners, lead partners in domestic accounting firms have traditionally been subject to rotation requirements. How do the auditor independence rules affect foreign accountants and foreign private issuers? Generally, the auditor independence rules apply to both foreign and domestic audit firms. During its consideration of the rule, the SEC analyzed concerns about the extraterritorial application of its rules, including those presented at roundtable discussions held by the SEC on December 17, 2002. One concern of many foreign audit firms and regulators was the prohibition on legal services. In many instances, services that would not be considered legal services in the United States would be considered legal services in the foreign accountant s home jurisdiction. For instance, at the roundtable discussions, Dr. Knorr from the German Chamber of Accountants observed that tax services that would be otherwise permitted under the Sarbanes-Oxley Act would constitute prohibited legal services in Germany. In order to prevent this anomalous result, the SEC will generally permit the provision of these services, regardless of whether they are categorized as legal services in the foreign jurisdiction if an accounting firm in the United States would be permitted to provide the services under the new rules. The SEC anticipates that audit firms will stagger the rotation of partners to maintain continuity on their audit teams. In order to facilitate an accounting firm s ability to stagger its partners rotation, the rotation requirements applicable to the lead partner are effective for the first fiscal year after May 6, 2003, but the rotation requirements applicable to the concurring partner are effective for the second fiscal year after May 6, 2003. The rotation requirements for all other audit partners are effective for the first fiscal year after May 6, 2003. In its proposed release, the SEC sought comment as to the effects of the partner rotation proposal on smaller firms, which may have difficulty staffing an audit team that is subject to these requirements. Many accountants provided comments to the SEC s proposal, asserting that compliance with a rotation requirement would be unduly burdensome for smaller firms. The SEC addressed these concerns in its final rules by providing an alternative to its partner rotation requirement for firms that have five or fewer audit clients and 10 or fewer partners. These firms can Foreign accountants and regulatory bodies also took objection to the partner rotation proposals. Many expressed concern that an expansive partner rotation requirement would negatively impact the audit of a foreign private issuer, since many foreign accounting firms have a limited number of partners with experience in US generally accepted accounting principles (GAAP) and GAAS. Foreign accountants also recommended that there be a transition period that was sufficient to enable such firms to relocate or provide additional training to audit partners practicing in foreign jurisdictions. The SEC addressed both of these concerns in the final rules. The final rules narrow the scope of the audit partners subject to the rotation requirements and are effective for the first fiscal year after May 6, 2003. The SEC is continuing to discuss the auditor independence rules with foreign regulators. The SEC is also evaluating the appropriateness of using its authority under Section 106(c) of the Sarbanes-Oxley Act to exempt foreign accounting firms, or classes of foreign accounting firms, from the requirements of the Sarbanes-Oxley Act. choose to follow the partner rotation requirements described above or subject each of their engagements that would require rotation to a special review by the Public Company Accounting Oversight Board (PCAOB) at least every three years. This alternative treatment for small audit firms comports with the professional rules of the accounting industry, which also exempt firms with five or fewer audit clients and 10 or fewer partners from the current partner rotation requirements. 5

Auditor Compensation Under the final rules, an accountant is not independent if any audit partner during the audit and professional engagement period earns or receives compensation based on the performance or procuring of engagements with the audit client to provide services other than audit, review or attest services. Although this requirement goes beyond the letter of the Sarbanes-Oxley Act, the final rule has a narrower scope than the proposed rule, which would have included each partner, principal or shareholder of the accounting firm that was a member of the audit engagement team in the compensation prohibition. The rule attempts to prevent audit partners from becoming sales agents for the provision of non-audit services to their clients. Audit partners can be compensated for selling services within their discipline; for instance, a tax partner can receive compensation for selling tax services. Additionally, audit partners are permitted to share in the overall profits of the accounting firm. The final rule concerning auditor compensation is effective for the accounting firm s first fiscal year that includes May 6, 2003. Accounting firms that have five or fewer audit clients and 10 or fewer partners are not subject to these compensation requirements. Employment Under the SEC s existing rules, an accounting firm is not independent if a former partner, principal, shareholder or professional employee of such firm accepts employment with an audit client while having a continuing financial interest in the accounting firm or the ability to influence the firm s operations or financial policies. The SEC s new rules add an additional requirement to Rule 2-01 of Regulation S-X so that an accounting firm loses its independence if an issuer employs certain audit team members in a financial reporting oversight role during the one-year period prior to the commencement of the audit procedures for the financial period that included the date of the team member s initial employment by the issuer. 3 The members of the audit team included in this prohibition are the lead partner, the concurring partner and any other member of the audit engagement team who provided more than 10 hours of audit, review or attest services to the issuer within the one-year period prior to the commencement of the current year s audit. This de minimis exception addresses several commenters concern that the proposed rule was too broad and would have included members of the engagement team who had relatively minor roles in the financial statement audit. The SEC added several other exceptions to this rule to address issues raised in the comment letters. One such exception is for conflicts resulting from a merger or acquisition, provided that the audit committee is aware of such conflict. There is also an exception for unusual or emergency situations if the audit committee determines that the employment relationship is in the interest of investors. The SEC expects that the latter exception will be invoked infrequently by audit clients. An individual is in a financial reporting oversight role at the audit client if he or she has direct responsibility for overseeing the preparation of the public company s financial statements and related information included in the audit client s filings with the SEC. This definition is broadened in the investment company context and includes positions at any entity in the investment company complex that would allow the former audit engagement team member to unduly influence the audit process of a registered investment company. These rules are effective for all employment relationships with the issuer or registered investment company that begin after May 6, 2003. 3 Audit procedures are deemed to have commenced for the current audit engagement period on the day after the prior year s periodic annual report is filed with the SEC. 6

Communication with Audit Committee The SEC s new Rule 2-07 of Regulation S-X requires each registered public accounting firm, prior to filing its audit report with the SEC to report to the issuer s or registered investment company s audit committee on the following matters: all critical accounting policies and practices to be used; all alternative treatments of financial information within GAAP for policies and practices related to material items that have been discussed with management, including the ramifications of such treatment and the preferred treatment by the accounting firm; and other material written communications between the accounting firm and management, including management representation letters, reports on observations and recommendations on internal controls, schedules of unadjusted audit differences and unrecorded adjustments and reclassifications, engagement letters and independence letters. The report covers communications that are both oral and written. The SEC expects that these communications would occur, at a minimum, during the annual audit, but anticipates that they could occur as frequently as quarterly or on a real-time basis. 4 Retention of Records Relevant to Audits and Reviews The SEC also adopted a new Rule 2-06 of Regulation S-X to implement Section 802 of the Sarbanes-Oxley Act, requiring accountants to observe certain rules with respect to record retention. These new rules are designed to discourage the destruction and increase the availability of records relevant to an audit or review of an issuer s or a registered investment company s financial statements. The rules are applicable to both domestic and foreign accountants. The SEC initially proposed rules relating to auditor record retention at an open meeting in November 2002. Release No. 33-8151 (Nov. 19, 2002) http://www.sec.gov/rules/proposed/33-8151.htm. There were not many comment letters on this proposal, most being from accounting firms and industry organizations. Documents to be Retained Rule 2-06 requires accountants to retain records that are relevant to the audit or review of an issuer s or registered investment company s financial statements, including workpapers and other documents that form the basis of the audit or review, and memoranda, correspondence, communications, other documents and records (including electronic records) that satisfy the following two criteria: the materials are created, sent or received in connection with the audit or review; and the materials contain conclusions, opinions, analyses, or financial data related to the audit or review. Rule 2-06 defines workpapers as the documentation of auditing or review procedures applied, evidence obtained and conclusions reached by the accountant that is required under standards set by the SEC or 4 Asset-backed issuers and unit investment trusts are not subject to the audit committee communication requirements. Additionally, the rules applicable to registered investment companies are slightly different to account for the varying fiscal year ends of the registered investment companies in the investment company complex. 7

the PCAOB. This definition is based on guidance contained in Statement on Auditing Standards No 96, Audit Documentation. Non-substantive materials, such as administrative records and other documents that do not contain relevant financial data or conclusions, opinions or analyses, do not have to be retained. Additionally, the PCAOB has the authority to enhance or modify this definition after collecting empirical data as to its effectiveness. Rule 2-06 as initially proposed would have required an accountant to retain audit and review materials that either support or cast doubt on the accountant s conclusions. Many commenters stated that this requirement was too vague, especially in light of the criminal penalties that could result from violations of the rule and would force accountants to keep every piece of documentation relating to the audit until after a final conclusion was reached. The SEC modified the final rule to address these concerns and now requires the retention of records that substantiate the accountant s final conclusions or contain information or data relating to a significant matter, that is inconsistent with the final conclusions of the accountant on that matter regarding the audit or review. Significance is evaluated objectively and is based on an analysis of the facts and circumstances surrounding the matter. The SEC went beyond the current accounting standards and required that inconsistent documentation be retained because such documentation may be pertinent to an investigation of possible violations of the securities laws. Several commenters remarked that the requirement that accountants retain records related to differences of opinion would result in accountants asking fewer questions and recording less information in writing during the audit or review. However, the failure to document a disagreement over a significant matter would be contrary to an accountant s professional responsibilities when conducting an audit or review and an ineffective mechanism of avoiding liability under the securities laws. Time of Retention Under GAAS, there is no specific time period for record retention, leaving the decision to the professional judgment of each accounting firm. The retention period for covered documents under new Rule 2-06 is seven years after the accountant completes the audit or review of financial statements. Initially, the SEC had proposed that records be retained for a five-year period after the end of the fiscal period in which the audit or review is conducted. The retention period was increased so that it is consistent with the retention requirement in Section 103 of the Sarbanes-Oxley Act. Section 103 requires the PCAOB to adopt standards mandating that each registered public accounting firm retain audit work papers, and other information related to any audit report for seven years. Commenters indicated a preference for having a consistent retention period under each of the two sections to reduce the administrative burden of complying with two different time requirements. Conclusion The auditor independence and workpaper retention rules are part of an important next step in a renewed effort by the SEC to promote improved audit practices. Although these rules were adopted in a short timeframe, the PCAOB has the authority to modify rules that prove to be too burdensome or are otherwise unworkable in the future. Commissioner Paul Atkins remarked at the open meeting on January 22, 2003 that the auditor independence and workpaper retention rules are not necessarily the end of the story. They are simply the first chapter in the book. David B.H. Martin Kerry Shannon Burke 2003 Covington & Burling This information is not intended as legal advice, which may often turn on specific facts. Readers should seek specific legal advice before acting with regard to the subjects mentioned herein. 8