Crossing Borders, Digging Deep: DEI’s Investor Protection Efforts in 2017

Thank you for that kind introduction. I am delighted to attend this gathering. Thank you to the AICPA for inviting me again this year to speak.

The views I express are my own and should not be attributed to the PCAOB as a whole or any other members or staff.

Today, I will be giving an overview about the Division of Enforcement and Investigations' work in 2017 and what we see on the horizon.

As a result of the hard work and determination of my division colleagues, this past year has been another active one for us. Thus far in 2017, the Board has made public 45 disciplinary proceedings, imposing sanctions including censures, monetary penalties, revocations of firm registration, and bars and suspensions on individuals' association with registered firms. Among the sanctions in those matters are 24 bars and six suspensions imposed on associated persons and 16 revocations of firms' registrations.

We continue to collaborate closely with our Securities and Exchange Commission enforcement colleagues to ensure that the waterfront of auditor misconduct is receiving appropriate attention and we are not duplicating efforts.

Our enforcement program, by virtue of the jurisdiction Congress gave us in the Sarbanes-Oxley Act, has a significant global component as well, which I will discuss in more detail.

In 2017, we continued to focus our efforts on our higher priority areas, which include:

• Investigations involving a lack of due care and professional skepticism;
• Audit matters related to the independence and integrity of the audit;
• Matters threatening or eroding the integrity of the Board's regulatory oversight processes; and,
• Matters involving risks associated with cross-border audits.

Our cases this year arising from various sources are aligning across all of these higher priorities. As was the case last year, a significant number of those cases involve cross-border audits.

Improper Document Alteration Cases

The scourge of improper document alteration is still with us. So far in its history, the Board has issued 67 disciplinary orders concerning failures to cooperate with a Board inspection or investigation, and most have involved improper document alteration.

To date, the Board has revoked 20 firm registrations and barred 51 individuals for such misconduct. The brighter side of this trend is that, more recently, some firms and individuals are taking the initiative and self-reporting this type of misconduct.

I believe this type of self-reporting not only shows how seriously people are taking these matters but also suggests that the risk of being caught and paying a higher price once caught is motivating the self-reporting.

I also believe that audit professionals more and more are focused on how this misconduct leaves a distinct blemish on the profession, all because some bad actors are leaving their integrity at the door, and want to do their part to rid the system of those bad actors.

Finally, I think the message of credit for extraordinary cooperation in terms of, among other things, reduced sanctions, is resonating with audit professionals and their firms. I am confident you all agree with me that this type of misconduct is an affront to what all of you and the audit profession stand for.

Our messaging on this topic was given more prominence starting with our April 2016 Staff Audit Practice Alert No. 14, "Improper Alteration of Audit Documentation," where we discussed the type of misconduct we were uncovering and the potentially severe consequences.

After that, the Board issued its settlements in the Deloitte Brazil and Deloitte Mexico matters last year. This year, we have some additional matters to bring to your attention.

In the cross-border audit space, we continue to examine the roles played by the international affiliates of global network firms in the audits of U.S.-listed companies, including substantial role work. In addition, we are looking out for smaller non-U.S. audit firms, particularly those with limited PCAOB audit experience.

Further, we have run into issues around Appendix K reviews and whether they are being dismissed or ignored by engagement teams. Finally, I will note that more than 40 percent of settled PCAOB disciplinary orders in 2016, and nearly 40 percent in 2017, have involved non-U.S. auditors.

I am now going to turn to our most significant non-U.S. audit firm case for 2017 — that involving Ernst & Young's Indonesian affiliate.

The Board censured and imposed a $1 million civil penalty on the Indonesian member firm of the Ernst & Young global network, for audit failure, noncooperation, and violations of the Board's quality control standards in connection with the 2011 audit of an Indonesian telecommunications company.

The Board also censured, fined $20,000, and barred for five years from association with a PCAOB-registered public accounting firm the Ernst & Young Indonesia engagement partner for his role in the audit failure and for noncooperation with a Board inspection and investigation.

The Board also sanctioned the former professional practice director for the Ernst & Young network's Asia-Pacific region, who was censured, fined $10,000, and restricted for one year from serving as an engagement partner, an engagement review partner, or professional practice director for his role in authorizing the release of the audit report under the circumstances.

Several items are noteworthy in this case. First, the case originated as a referral from our Inspections Division. In other words, once again, the improper document alteration did not achieve its objective of masking poor audit work.

Second, during the 2011 audit, the partner responsible for performing the cross-border regulatory review of the issuer's audit as required by PCAOB standards (the "Appendix K review") expressed concern to the engagement partner and the engagement team regarding the sufficiency of the issuer's cellular tower slot lease analysis.

As many of you know, Appendix K is meant to enhance the quality of SEC filings for companies whose financial statements are audited by international affiliates of U.S. firms. Appendix K provides, among other things, that financial statement filings of audits performed by a foreign associated firm should be reviewed by a person knowledgeable in accounting, auditing, and independence standards generally accepted in the U.S.

In response to the concerns raised by the Appendix K reviewer, the engagement partner and the engagement team repeatedly requested that management complete a properly supported lease accounting analysis. The respondents failed, however, to obtain and evaluate a completed analysis before releasing audit reports on the issuer's December 31, 2011 financial statements and internal control over financial reporting.

And, although those audit reports contained unqualified audit opinions, respondents released the reports based on the audit evidence obtained to date and subject to the requirement that management provide a completed — and properly supported — tower slot lease accounting analysis in the future. Respondents further understood that, depending on the outcome of that analysis, a restatement of the 2011 and prior year's financial statements might be required.

Respondents released the audit reports even though the Appendix K reviewer informed the engagement partner that he did not believe that the issuer's tower slot lease accounting was adequately supported and, thereby, indicated that he was not in a position to conclude that a significant unresolved matter did not exist.

Third, and equally important, is what a member of the firm's senior leadership did not do. In addition to the audit failure, the Board charged Ernst & Young Indonesia with failing to cooperate with the Board's investigation by failing to timely disclose its full knowledge of the improper document creation, including the engagement partner's role in that creation.

Soon after the PCAOB investigators made Ernst & Young Indonesia aware of information suggesting that audit work papers may have been improperly altered, the firm commenced an internal investigation. During the course of that investigation, the engagement team member who was directed by the engagement partner to copy and paste the memo into a document with a creation date during the 2011 audit period, and improperly alter the memo, informed a member of the firm's senior leadership that the engagement partner was involved in the improper alteration of the memo.

The member of the firm's senior leadership did not promptly follow up on that information or inform those performing the internal investigation. Instead, the member of senior leadership allowed the internal investigators to conclude — and to inform the PCAOB staff — that no evidence existed that any senior firm personnel, including the engagement partner, knew of or participated in the improper conduct.

Only after the PCAOB investigative staff informed the firm that it had learned from the engagement team member of the engagement partner's involvement and senior management's knowledge did Ernst & Young Indonesia conduct a further internal investigation and then make its own disclosure to the PCAOB investigative staff regarding the scope of the engagement partner's involvement and senior management's knowledge.

Through its actions, Ernst & Young Indonesia obstructed the Board's investigation. The engagement team member — who was no longer with the firm — provided substantial assistance to the PCAOB investigation by confirming the scope of the improper document alteration and identifying those at the firm who were involved in or had knowledge of it. That person was not disciplined by the Board due to their substantial assistance.

What are the lessons of this case? Professional skepticism did not get its due.

Be skeptical about the sufficiency of the audit evidence supporting a client's assertion, particularly when another partner raises concerns about it. Also, don't discount the concerns of a junior person raising issues about an engagement partner's possible misconduct and, when it does get raised to you, act promptly. Finally, credit for extraordinary cooperation, depending on the facts and circumstances, may give you maximum relief in the form of no prosecution by the Board.

Another cross-border matter with different dimensions is our case involving a former PricewaterhouseCoopers Brazil partner and his audit work concerning a U.S.-based issuer's Brazilian operations. The Board charged him with a failure to exercise appropriate care and skepticism in response to, among other things, indications that receivables were overstated.

The receivables of the U.S. issuer's Brazilian subsidiary were overdue, disputed, and "re-aged" by management. The partner further knew that management was re-aging overdue receivables by extending their due dates in the company's accounting system. He understood that the re-aging of receivables could cause overdue receivables to appear current.

He therefore knew, or should have known, that an even larger portion of the receivables was likely overdue than what was shown in the company's accounting records. He further understood that the re-aging could cause the company to underestimate its accounts receivable reserves and thereby cause an overstatement of the subsidiary's reported net accounts receivable.

In 2012, the company disclosed that an internal investigation had identified intentional overrides of certain internal controls as well as extensive cross-functional collusion by management, resulting in improper revenue recognition and overstatement of accounts receivable due to the failure to write off uncollectable customer discounts, among other things.

As a result of the internal investigation, which included findings indicating fraud, the company restated its FY 2010 and FY 2011 financial statements and concluded a material weakness existed in internal control over financial reporting as of June 30, 2012. The former PricewaterhouseCoopers Brazil partner received a two-year bar and a $10,000 penalty from the Board.

Why did we pursue this type of audit failure relating to the referral work at a subsidiary? First, we thought the PCAOB audit departures were serious. Most notably, the engagement partner exhibited a significant lack of professional skepticism in response to red flags, including management re-aging receivables, and the restatement helped expose the seriousness of the partner's departures.

Second, the global audit and investors depend on each piece of the audit being appropriately performed. Third, the partner was not only doing this referral work at the time, but also performing other PCAOB audit work for other issuers, including as an engagement partner responsible for issuing the principal auditor's audit report, so, as a result, he posed a larger risk.

Among members of global network firms, we have found fundamental independence violations such as those by BDO Hungary — multiple auditor independence violations involving unpaid, prior-year audit fees. The firm failed to maintain an effective system of quality control and the Board imposed a $20,000 civil money penalty on the firm as well as requiring the firm to undertake remedial measures.

In the case of another BDO affiliate, BDO Spain, there were very fundamental audit failures with multiple violations of PCAOB rules and standards over two audits for an issuer client, including failures to identify and address Generally Accepted Accounting Principles departures and appropriately audit revenue.

There also, the firm failed to maintain an effective system of quality control — it had no PCAOB standards training for personnel auditing the issuer. The Board imposed a $40,000 civil money penalty on the firm, the firm was required to undertake remedial measures and two BDO Spain partners were barred for their audit failures.

In this instance, the firm and the engagement partner initially concluded that the accounting treatment for the extinguishment of legal fees in 2012 was not in conformity with Generally Accepted Accounting Principles. A partner responsible for performing the cross-border regulatory review of the 2012 audit (i.e., the Appendix K review), reached the same conclusion.

Nonetheless, the firm and the engagement partner ultimately did not object to the issuer's derecognizing the forgiven legal fees in its December 31, 2012, financial statements and issued an unqualified opinion on those financial statements. BDO Spain is a good example of how a non-U.S. affiliate, ill-equipped to conduct a PCAOB audit, can find itself in trouble.

In other cross-border matters, we have faced failures to provide investigative documents and significant audit failures. In Crowe Horwath (HK) CPA Limited, the firm refused to produce documents in a PCAOB investigation regarding the audit of a China-based issuer. The Board revoked the firm's registration for three years and the firm admitted to the facts, findings, and violations in the order.

In the case of Anthony Kam & Associates Limited (China), the Board found that the firm violated Section 10(b) of the Exchange Act for its failure to perform any audit procedures in a 2012 audit of a China-based issuer, and issuing a false audit report.

Other than obtaining 2012 audit work papers from the predecessor auditor and obtaining a management representation letter from the issuer, the firm conducted no other audit procedures to support its 2012 audit opinion. The order included additional serious violations in auditing revenue recognition in the 2013 and 2014 audits.

The Board revoked the firm's registration for five years and Mr. Kam was barred for five years. I will note that there was a prior PCAOB enforcement action in 2015 against the predecessor audit firm, Utah-based Madsen & Associates, and Ted A. Madsen, for their audits of the same China-based issuer.

Broker-Dealers

Now, I wish to shift gears and move into a relatively new oversight space for us, the audits of broker-dealers.

Fulvio & Associates

This was the Board's first enforcement order charging audit violations with respect to the audit and examination of a carrying broker-dealer (i.e., a broker-dealer that maintains custody of customer assets). This matter originated as a referral from our Inspections Division.

This was the first order charging violations of PCAOB Attestation Standard No. 1 ("AT 1") and PCAOB Auditing Standard No. 17 ("AS 17"). The matter involved the 2014 audit and examination engagement of a broker-dealer, and involved the following violations:

• With respect to the audit of the broker-dealer's financial statements, the Fulvio audit team failed to obtain sufficient evidence to support the broker-dealer's valuation of the securities it owned.
• The Fulvio team violated AS 17 by failing to obtain sufficient audit evidence regarding two supporting schedules that the broker-dealer was required to file to report on its compliance with the SEC's financial responsibility rules regarding (1) maintaining a reserve of funds or qualified securities for the exclusive benefit of customers, and (2) maintaining a sufficient amount of net capital liquidity to satisfy claims promptly.
• The Fulvio team violated AT 1 by failing to develop a sufficient basis for their opinion that the broker-dealer's assertions in its 2014 compliance report concerning, among other things, the effectiveness of the broker-dealer's internal controls over compliance with the SEC's financial responsibility rules were fairly stated.
• The engagement partner and the senior manager on the audit also improperly altered audit documentation and failed to cooperate with the Board's inspection.
• The engagement quality reviewer violated Auditing Standard No. 7 by failing to obtain and evaluate any audit documentation with respect to the significant judgments made by the Fulvio team in either the audit or the examination.

As sanctions, the firm's registration was revoked, with a right to re-apply in one year; a $20,000 penalty was imposed on the firm; the engagement partner and senior manager were barred (for two years and one year, respectively); a $10,000 penalty was imposed on the engagement partner; and a limitation on activities for one year was imposed on the engagement quality reviewer.

PwC – Merrill Lynch

Released August 2, 2017, this was the first Board order against a global network firm for violations in connection with a broker-dealer engagement.

The Board's order found that PricewaterhouseCoopers violated the Board's broker-dealer auditing and attestation standards (AT 1 and AS 17) in its evaluation of Merrill Lynch's compliance with the "no lien" provision of the Customer Protection Rule, which requires that certain customer securities must be kept in a separate account free of liens by third parties.

The Board found that, in February 2015, PricewaterhouseCoopers issued audit and examination reports without obtaining sufficient evidence about Merrill's compliance assertions, as required by PCAOB auditing and attestation standards.

In June 2016, the SEC had found that for several years, including fiscal year 2014, Merrill Lynch held tens of billions of dollars of its customers' fully paid and excess margin securities in accounts that were subject to liens by third parties, in violation of the Customer Protection Rule. The Board censured and fined PricewaterhouseCoopers $1 million for its audit failure.

We will continue work with the SEC and the Financial Industry Regulatory Authority ("FINRA") to ensure that we are addressing any serious misconduct in the broker-dealer auditor space.

As I have stated before, these matters demonstrate the ongoing need for a strong, robust investigatory and disciplinary body over the profession to ensure high ethics and audit quality for the protection of investors.

In 2018, I expect DEI to continue to be active on the international front as well as in domestic firm matters.

I thank you for having me here today, and I wish you a productive remainder of the conference. I also am happy to answer any questions.