SEC Adopts Auditor Independence and Workpapers Retention Rules

Article by David S. Rosenthal and Martin Nussbaum

Originally published in February 2003

On January 28, 2003, the Securities and Exchange Commission (the "SEC") published final rules regarding auditor independence and workpapers retention, as directed by Sections 208 and 802, respectively, of the Sarbanes-Oxley Act of 2002 ("SOX").¹ The SEC’s new auditor independence rules are intended to strengthen the existing requirements in that area by, among other things: (i) enumerating prohibited non-audit services, (ii) mandating preapproval by the issuer’s audit committee of audit and permissible non-audit services, (iii) prohibiting certain partners on the audit engagement team from providing audit services to the issuer for more than five or seven consecutive years, depending on the partner’s involvement in the audit, (iv) requiring that the auditor of an issuer's financial statements report certain matters to the issuer's audit committee, including "critical" accounting policies used by the issuer, and (v) prohibiting an accounting firm from auditing an issuer's financial statements if certain members of management of that issuer had been members of the accounting firm's audit engagement team within the one-year period preceding the commencement of audit procedures.² The SEC’s new workpapers retention rules require accountants who audit or review an issuer’s financial statements to retain workpapers and other documents that form the basis of the audit or review for a period of seven years after the conclusion of the audit or review.³

The SEC has strengthened the rules on auditor independence it adopted in November 2000 by (1) incorporating the list of prohibited non-audit services contained in Section 201(a) of SOX, and (2) eliminating from the existing rules the exceptions and exemptions that currently permit auditors to provide some of those services in limited situations.⁴ Under the new rules, an auditor performing audit services for a public company would not be considered to be independent if it provides to the same client any of the following non-audit services:

• Bookkeeping or other services related to the accounting records or financial statements of the audit client;
• Financial information systems design and implementation;
• Appraisal or valuations services, fairness opinions or contribution-in-kind reports;
• Actuarial services;
• Internal audit outsourcing services;
• Management functions;
• Human resources functions, such as searching for candidates, negotiating compensation, reference checking and testing;
• Broker-dealer, investment adviser or investment banking services;
• Legal services, i.e., services that can be provided only by persons licensed to practice law in the jurisdiction in which the services are provided; and
• Expert opinions or other services unrelated to the audit provided to the audit client or its counsel for the purpose of advocating the client’s interests in litigation or regulatory or administrative investigations or proceedings.

Auditors are able to provide non-audit services not on the list of specifically prohibited services if the company's audit committee has approved the services in advance. In approving non-audit services, the audit committee has to determine that provision of the services would be consistent with the basic principles that the audit firm should not:

• audit its own work;
• function as part of management or as an employee of the audit client; or
• act as an advocate of the audit client.⁵

The new rules specifically address the permissibility of tax services, which the SEC recognizes can include the preparation of tax returns, tax compliance, tax planning, tax recovery and other tax-related services, and in some circumstances (such as review of tax accruals) may constitute a part of audit services. The SEC clarifies that auditors may provide tax services to an audit client if the audit committee has pre-approved the services and the services would not violate any of the basic principles referred to above. As examples of tax services not satisfying those principles, the SEC cites services as an advocate for the client in tax court and other situations involving public advocacy.

The new rules require audit committee pre-approval of all audit, review or attest engagements. With respect to permissible non-audit services, the new rules require (1) audit committee pre-approval or (2) engagement arrangements entered into pursuant to pre-approval policies and procedures previously established by the audit committee, provided the audit committee is informed of each service.⁶ The audit committee is permitted to delegate to one or more of its members responsibility for pre-approving services.⁷ The new rules do not contain any general de minimis exception to the preapproval requirements beyond that contained in SOX, which permits non-audit services that in the aggregate do not constitute over 5% of the total revenues paid by the client to the auditor during the fiscal year, provided they were not recognized as non-audit services at the time of the engagement and are promptly brought to the attention of, and approved by, the audit committee.⁸

In light of the technical nature of the new rules defining prohibited non-audit services and the new pre-approval requirements, companies should begin now to establish procedures to control the retention of independent auditors for permitted non-audit services. Such procedures should be detailed, to the extent possible, as to the particular service and designed to safeguard the continued independence of the auditor, including (1) management establishing a record for the audit committee that demonstrates that the new non-audit service is not prohibited and that the auditor is best suited for the assignment and (2) specific authorization guidelines which must be acknowledged by the auditor before it accepts a non-audit assignment, requiring an audit firm to confirm to the client that a non-audit assignment does not constitute a prohibited service.

Section 203 of SOX requires the lead partner and concurring partner on an audit engagement to rotate off that engagement every five years. The SEC’s new rules specify that the lead and concurring partners must rotate after five years and be subject to a five-year "time out" period after rotation before serving on that client’s engagement again. The new rules also state that certain other audit engagement team partners are subject to a seven-year rotation period with a two-year time out period.⁹ The new rules also cover tax partners who perform tax services that are a necessary part of the audit engagement, but not partners providing other permitted tax services, such as those related to tax planning or tax compliance. Partners assigned to "national office" duties are not subject to the rotation requirement.

The requirement for audit partner rotation may be troubling for certain public companies, particularly companies that use smaller audit firms or that operate in industries requiring specialized accounting expertise. Public companies should begin discussing with their outside audit firm how the firm plans to comply with this requirement on their engagement, and companies considering new engagements should discuss the staffing issue to ensure the firm has enough depth to continue providing the expected level of service.

The new rules require a company’s auditor to report (orally or in writing) to the company’s audit committee, prior to the filing of an audit report with the SEC:

• all critical accounting policies and practices used by the company;
• all alternative treatments of financial information within GAAP discussed with management of the company, including (i) ramifications of the use of such alternative disclosures and treatments and (ii) the treatment preferred by the auditor; and
• other material written communications between the auditor and management.¹⁰

The new rules are intended to cover recognition, measurement and disclosure considerations relating to accounting for specific transactions as well as the selection of and changes in significant accounting policies, including the impact of management’s judgments and accounting estimates.

The new rules prohibit an accounting firm from auditing the financial statements of a public company if:

• a member of management who is in a financial reporting oversight role at the company had been a member of the accounting firm’s audit engagement team within the one-year period preceding the commencement of the audit procedures for the current audit (subject to certain exceptions for members of management joining the company by reason of an acquisition);¹¹ or
• at any point during an engagement period, any partner, principal or shareholder of the auditor serving as a member of the audit engagement team earns or receives compensation (including indirectly such as through allocation of equity shares in the audit firm) based on the performance or sale of any services to the audit client, other than audit, review, or attest services.¹²

The first of the above-referenced restrictions essentially imposes a one-year "cooling off" period for members of an accounting firm’s audit engagement team who wish to assume a "financial reporting oversight role" at the audit client. Financial reporting oversight role means a role in which a person is in a position to or does exercise influence over the contents of the financial statements or anyone who prepares them, such as when the person is a member of the board of directors or similar management or governing body, chief executive officer, president, chief = financial officer, chief operating officer, general counsel, chief accounting officer, controller, director of internal audit, director of financial reporting, treasurer, or any equivalent position.¹³

The SEC has expanded the current requirement for proxy statement disclosure of fees billed by a company's outside auditor. The new disclosure breaks the fees down into four categories of fees: (1) audit fees, (2) audit-related fees, (3) tax fees, and (4) all other fees. Companies have to describe in subcategories the types of services that fall into the "audit-related fees" and "all other fees" categories.¹⁴ In addition to adding disclosure of audit-related fees and tax fees, the new rules eliminate the current category of "financial information technology consulting fees," since those services are no longer permitted. The information on fees has to be given for the two most recent fiscal years, rather than for just the most recent fiscal year, as under existing rules.

The new rules require companies filing proxy statements to describe the policies and procedures followed by the audit committee in engaging the outside auditor to perform non-audit services. This disclosure must include a breakdown of the percentage of fees in each of the "audit-related fees," "tax fees" and "all other fees" categories that were preapproved by the full audit committee, that were pre-approved under delegated authority pursuant to the established policies and procedures, and for which pre-approval was waived.¹⁵

SOX requires disclosure about auditor fees and the audit committee's pre-approval activities in periodic reports. The SEC has satisfied this requirement by requiring the disclosure in a company's proxy statement, which is incorporated by reference into the company's annual report. Companies such as foreign private issuers that do not file proxy statements are required to include the disclosure in their annual report on Form 10-K, Form 20-F or Form 40-F.¹⁶

In a related rule directed at audit firms, the SEC implemented Section 802 of SOX by requiring that auditors retain, for a period of seven years, records relating to the audit or review of a company's financial statements.¹⁷ The seven-year period begins to run from the conclusion of the audit or review. The records to be retained include workpapers and other documents that form the basis for the audit or review, as well as memoranda, correspondence, communications, and other documents and records (including electronic records), which (1) are created, sent or received in connection with the audit or review, and (2) contain conclusions, opinions, analyses or financial data related to the audit or review. The term "workpapers" is defined to mean documentation of auditing or review procedures applied, evidence obtained, and conclusions reached by the accountant in the audit or review engagement, as required by standards established or adopted by the SEC or by the Public Company Accounting Oversight Board, an entity established by SOX. The new rules also state that the records described above shall be retained whether they support the auditor's final conclusions regarding the audit or review, or contain information or data, relating to a significant matter, that is inconsistent with the auditor's final conclusions regarding that matter or the audit or review.

The auditor independence rules are effective May 6, 2003. There will be a transition period for certain of the rules which varies by provision. For example, the prohibited non-audit services may be continued until May 6, 2004 provided those services are pursuant to contracts in existence on May 6, 2003. Rotation requirements for the lead audit partner and the concurring audit partner are effective for the first fiscal year ending after the effective date of the rules and the second fiscal year ending after the effective date of such rules, respectively. For other audit partners, the effective date is as of the beginning of the first fiscal year after such effective date, but without counting time served by such other partners prior to the effective date of the new rules. Compliance with the workpapers retention rules is required for audits and reviews completed on or after October 31, 2003.

1 The rules were adopted by the SEC in SEC Release No. 34-47265 ("Auditor Independence Adopting Release") and SEC Release No.
34-47241 ("Workpapers Retention Adopting Release"), respectively.
2 Pursuant to SOX §§ 201-209, the SEC has amended Regulation S-X Rule 2-01, Schedule 14A Item 9 and Form 10-K as well as added a new Regulation S-X Rule 2-07. SOX automatically amended several provisions of the Securities Exchange Act of 1934 (the "Exchange Act"), and such amendments did not require any SEC action.
3 Pursuant to SOX § 802, the SEC has added a new Regulation S-X Rule 2-06.
4 Rule 2-01(c)(4) of Regulation S-X, revised by the SEC pursuant to SOX § 201 and Exchange Action Section 10A(g).
5 See the preliminary note to Rule 2-01 of Regulation S-X.
6 Rule 2-01(c)(7) of Regulation S-X, added by the SEC pursuant to SOX § 201(a) and Exchange Act §§ 10A(h) & (i).
7 SOX § 202 and Exchange Act § 10A(i)(3).
8 Rule 2-01(c)(7)(ii)(C) of Regulation S-X, added by the SEC pursuant to SOX § 202 and Exchange Act § 10A(i)(1)(B).
9 Rule 2-01(c)(6)(i) of Regulation S-X, added by the SEC pursuant to SOX § 203 and Exchange Act § 10A(j).
10 Rule 2-07 of Regulation S-X, added by the SEC pursuant to SOX § 204 and Exchange Act § 10A(k).
11 Rule 2-01(c)(2)(iii) of Regulation S-X, revised by the SEC pursuant to SOX § 206 and Exchange Act § 10A(l).
12 Rule 2-01(c)(8) of Regulation S-X, added by the SEC.
13 Rule 2-01(f)(3)(ii) of Regulation S-X, revised by the SEC pursuant to SOX § 206 and Exchange Act § 10A(l).
14 Item 9(e) of Schedule 14A, revised by the SEC.
15 Item 9(e)(5) of Schedule 14A, added by the SEC pursuant to SOX § 202 and Exchange Act § 10A(i)(2).
16 Item 16(5) of Form 10-K
17 Rule 2-06 of Regulation S-X, added by the SEC pursuant to SOX § 802.

The content of this article does not constitute legal advice and should not be relied on in that way. Specific advice should be sought about your specific circumstances.