Currently, PCAOB Rule 3502 holds auditors liable for firms’ violations when they “recklessly” contribute to them. So when a firm commits a violation negligently, an associated person who directly and substantially contributed to the firm’s violation can be sanctioned only if the PCAOB shows that the associated person acted recklessly. 

The PCAOB states in its proposal:

For well over a decade now, the Board has brought enforcement proceedings against associated persons pursuant to Rule 3502.

Yet Rule 3502’s current formulation contains an incongruity that places negligent contributors to firms’ violations beyond the rule’s reach. That incongruity stems from the fact that registered firms, like any legal entity, can act only through natural persons. It logically follows that when a registered firm is found to have acted negligently, it is likely that such negligence is attributable to a natural person’s negligence.

Rule 3502, however, at present requires a level of culpability higher than negligence—at least recklessness—before the Board can impose sanctions against associated persons who contribute to firms’ negligence-based violations. Put another way, Rule 3502 requires a showing of more than negligence by individuals for the Board to sanction conduct resulting in negligence by firms. Thus, under the current Rule 3502, associated persons who do not exercise reasonable care and contribute to firms’ violations may escape liability and accountability—even while the firms committing the violations do not. As a result, the Board believes that the proposed Rule 3502 would address this incongruity, and therefore better protect investors and promote quality audits.

The proposal, if adopted, would update Rule 3502’s liability standard from recklessness to negligence, aligning it with the same standard of reasonable care auditors are already required to exercise anytime they are executing their professional duties, the PCAOB said. The Securities and Exchange Commission already has the ability to bring enforcement actions against associated persons when they negligently cause firm violations, the regulator noted.

The proposal also would maintain the requirement under the current version of Rule 3502 that an associated person must have contributed to the firm’s violation both “directly and substantially” in order to be held liable.

In addition, the proposal “clarifies the relationship between the contributory actor and the primary violator,” the PCAOB said. To be held liable under the current Rule 3502, an associated person who contributes to a firm’s violation must be an associated person of that particular firm. But given the increasing complexity of arrangements among firms and the constantly evolving nature of technology, the proposal clarifies that associated persons of any firm can be held liable as long as their conduct—at least negligently, directly, and substantially—contributes to any firm’s violation, not just violations by a firm with which they are associated, according to the PCAOB.

“This proposal is simply updating PCAOB rules to match what investors already expect: that auditors act with reasonable care whenever they are performing their duties—and when an auditor’s negligence results in firm violations that can put investors at risk, the PCAOB has tools to hold them accountable,” PCAOB Chair Erica Williams said in a press release.  

The deadline for public comment on the proposal is Nov. 3.