According to the PCAOB, an associated person is defined as “any individual proprietor, partner, shareholder, principal, accountant, or professional employee of a public accounting firm, or any independent contractor or entity that, in connection with the preparation or issuance of any audit report … (1) shares in the profits of, or receives compensation in any other form from, that firm; or (2) participates as agent or otherwise on behalf of such accounting firm in any activity of that firm.”

For decades under both AICPA and PCAOB auditing standards, auditors have been required to exercise reasonable care when they perform an audit; failure to do so constitutes “negligence.”

Currently, Rule 3502 allows the PCAOB to hold associated persons liable for contributing to a registered firm’s violation only when they did so “recklessly”—representing a greater departure from the standard of care than negligence. This means even when a firm commits a violation negligently, an associated person of that firm who directly and substantially contributed to the firm’s violation could only be sanctioned by the PCAOB if the board were to show that the associated person acted recklessly.

The PCAOB says in the amendment to Rule 3502:

Although the rule as adopted in 2005 incorporated a recklessness standard, the rule as proposed in 2004 required that individuals only negligently contribute to a firm’s violation to be subject to liability. Whereas negligence “is the failure to exercise reasonable care or competence,” recklessness requires “an extreme departure from the standard of ordinary care” that “presents a danger to investors or to the markets that is either known to the (actor) or is so obvious that the actor must have been aware of it.” Indeed, Sarbanes-Oxley characterizes “reckless conduct” as a subset of “intentional or knowing conduct,” whereas negligence is an “objective” standard that is not measured by “the intent of the accountant.”

The board is now adopting negligence as the liability standard for actionable contributory conduct under Rule 3502. And for good reason: A negligence standard is appropriate based on the board’s extensive experience with Rule 3502 since the rule’s adoption nearly two decades ago, it closes a gap in the PCAOB’s regulatory framework that can lead to anomalous results, and it advances certain objectives in the board’s 2022-2026 Strategic Plan in furtherance of the board’s overall mission.

By updating the liability standard from recklessness to negligence, the PCAOB is aligned more with the Securities and Exchange Commission (SEC), which already has the ability to bring enforcement actions against associated persons when they negligently cause firm violations.

The update to Rule 3502, which was proposed last September, does keep intact the rule’s current requirement that an associated person must have contributed to the firm’s violation both “directly and substantially” in order to be held liable.

The board voted 5-0 on Wednesday to change the liability threshold.

“With today’s adoption, the board has aligned PCAOB rules to what investors already expect: that when an associated person’s negligence directly and substantially contributes to firm violations, the PCAOB has tools to hold them accountable,” Williams said.

Board member Anthony Thompson added, “I am cognizant that auditors often are required to execute extensive and complicated procedures to amass audit evidence in order to conclude that it is sufficient and appropriate to support their audit opinions. As such, the amendment to Rule 3502 is not intended as a means to second guess auditors’ good-faith judgements, which was a commenter concern. The rule continues to pertain to associated persons who directly and substantially contribute to a firm’s violations. This amendment is not a ‘gotcha’ tool. It is designed to close a gap in accountability in our enforcement regime. As discussed in the release, we do not anticipate that this amendment will drive a tremendous surge in new Rule 3502 charges. The amendment to Rule 3502 would strengthen our enforcement authority by providing another tool whereby we can advance investor protection and elevate audit quality by holding negligent actors accountable for unreasonable conduct. The board remains judicious about how it utilizes enforcement resources and will pursue cases that it believes effectively drive deterrence.”

The new requirement on liability is set to go into effect 60 days after approval by the SEC.