# Public Company Accounting Oversight Board; Notice of Filing of Proposed Rules on Amendment to PCAOB Rule 3502 Governing Contributory Liability

> Briefs, arguments, decisions, and more.

URL: https://www.frixlaw.com/law-library/documents/fr%3A2024-14487

## Record

- **Collection:** Federal Register
- **Document type:** Notice
- **Published:** July 2, 2024
- **Citation:** 89 FR 54895

## Text

SECURITIES AND EXCHANGE COMMISSION
[Release No. 34-100429; File No. PCAOB-2024-04]
Public Company Accounting Oversight Board; Notice of Filing of Proposed Rules on Amendment to PCAOB Rule 3502 Governing Contributory Liability
June 26, 2024.
Pursuant to Section 107(b) of the Sarbanes-Oxley Act of 2002 (“Sarbanes-Oxley” or the “Act”), notice is hereby given that on June 20, 2024, the Public Company Accounting Oversight Board (the “Board” or the “PCAOB”) filed with the Securities and Exchange Commission (the “Commission”) the proposed rules described in items I and II below, which items have been prepared by the Board. The Commission is publishing this notice to solicit comments on the proposed rules from interested persons.

I. Board's Statement of the Terms of Substance of the Proposed Rules

On June 12, 2024, the Board adopted an amendment to PCAOB Rule 3502,
Responsibility Not to Knowingly or Recklessly Contribute to Violations
(collectively, the “proposed rules”). The text of the proposed rules appears in Exhibit A to the SEC Filing Form 19b-4 and is available on the Board's website at
https://pcaobus.org/about/rules-rulemaking/rulemaking-dockets/docket-053
and at the Commission's Public Reference Room.

II. Board's Statement of the Purpose of, and Statutory Basis for, the Proposed Rules

In its filing with the Commission, the Board included statements concerning the purpose of, and basis for, the proposed rules and discussed any comments it received on the proposed rules. The text of these statements may be examined at the places specified in Item IV below. The Board has prepared summaries, set forth in sections A, B, and C below, of the most significant aspects of such statements. In addition, to the extent that Section 103(a)(3)(C) of the Act applies to the proposed rules, the Board is requesting that the Commission approve the proposed rules, pursuant to that provision, for application to audits of emerging growth companies (“EGCs”), as that term is defined in Section 3(a)(80) of the Securities Exchange Act of 1934 (“Exchange Act”). The Board's request is set forth in section D.

A. Board's Statement of the Purpose of, and Statutory Basis for, the Proposed Rules

(a) Purpose

Congress authorized the Board to promulgate rules and standards to govern auditor conduct.
1

To that end, in 2005, the Board codified auditors' longstanding ethical obligation not to contribute to firms' violations in PCAOB Rule 3502,
Responsibility Not to Knowingly or Recklessly Contribute to Violations.
2

For well over a decade now, the Board has brought enforcement proceedings against associated persons pursuant to Rule 3502.

1

See
Section 103(a)(1) of Sarbanes-Oxley;
see also, e.g., id.
101(c)(2), (c)(4), (c)(6) & (g)(1).

2

Ethics and Independence Rules Concerning Independence, Tax Services, and Contingent Fees,
PCAOB Release No. 2005-014, at 9 (July 26, 2005),
available at https://pcaobus.org/Rulemaking/Docket017/2005-07-26_Release_2005-014.pdf
(“The Board proposed [Rule 3502] to codify the ethical obligation of associated persons of registered firms not to cause registered firms to commit [ ] violations.”).

Yet Rule 3502's current formulation contains an incongruity that places negligent contributors to firms' violations beyond the rule's reach. That incongruity stems from the notion that registered firms, like any legal entity, can act only through natural persons. It logically follows that when a registered firm is found to have acted negligently, it is likely that such negligence is attributable to at least one natural person's negligence.

Rule 3502, however, at present requires a level of culpability higher than negligence—at least recklessness—before the Board can impose sanctions against associated persons who directly and substantially contribute to firms' negligence-based violations. Put another way, Rule 3502 requires a showing of more than negligence by individuals for the Board to sanction them for conduct resulting in negligence by firms. Thus, under current Rule 3502, associated persons who do not exercise reasonable care and contribute to firms' violations may escape liability and accountability—even while the firms committing the violations do not. The Board believes that amending Rule 3502 addresses this incongruity, and therefore better protects investors and promotes quality audits.

(b) Statutory Basis

The statutory basis for the proposed rules is Title I of the Act.

B. Board's Statement on Burden on Competition

Not applicable. The Board's consideration of the economic impacts of the proposed rules is discussed in section D below.

C. Board's Statement on Comments on the Proposed Rules Received From Members, Participants or Others

The Board released the proposed rule amendment for public comment in PCAOB Release No. 2023-007 (September 19, 2023). The Board received 28 written comment letters; one comment letter was subsequently withdrawn. The Board has carefully considered all comments received. The Board's response to the comments it received and the changes made to the rules in response to the comments received are discussed below.

Introduction

In the Sarbanes-Oxley Act of 2002 (“Sarbanes-Oxley” or the “Act”), Congress established the Board in the wake of a series of high-profile corporate collapses that laid bare auditor misconduct and the need for a new type of oversight of the public accounting industry.
3

As part of its

comprehensive, multipronged approach to such oversight, Congress authorized the Board to investigate, bring charges against, and sanction (when appropriate) registered public accounting firms and associated persons
4

thereof for violations of the laws, rules, and standards that Congress charged the Board with enforcing.
5

That enforcement authority covers a wide array of auditor conduct, including negligent conduct.

3
Public Law 107-204, 15 U.S.C. 7201
et seq.; see
S. Rep. No. 107-205, at 3 (2002) (“The purpose of [Sarbanes-Oxley] is to address the systemic and

structural weaknesses affecting our capital markets which were revealed by repeated failures of audit effectiveness and corporate financial and broker-dealer responsibility in recent months and years.”). As the Senate Report notes, “the frequency of financial restatements by public companies ha[d] dramatically increased” in the run up to the passage of Sarbanes-Oxley. S. Rep. No. 107-205, at 15;
see id.
(“From 1990-97, the number of public company financial restatements averaged 49 per year, but jumped to an average of 150 per year in 1999 and 2000.”).

4
An associated person is “any individual proprietor, partner, shareholder, principal, accountant, or professional employee of a public accounting firm, or any independent contractor or entity that, in connection with the preparation or issuance of any audit report . . . (1) shares in the profits of, or receives compensation in any other form from, that firm; or (2) participates as agent or otherwise on behalf of such accounting firm in any activity of that firm.” PCAOB Rule 1001(p)(i). The definition of an “associated person” does not include persons engaged only in clerical or ministerial tasks.
See id.

5

See
Sections 105(b) & (c) of Sarbanes-Oxley.

Congress also authorized the Board to promulgate rules and standards to govern auditor conduct.
6

To that end, in 2005, the Board codified auditors' longstanding ethical obligation not to contribute to firms' violations in PCAOB Rule 3502,
Responsibility Not to Knowingly or Recklessly Contribute to Violations.
7

For well over a decade now, the Board has brought enforcement proceedings against associated persons pursuant to Rule 3502.

6

See id.
103(a)(1);
see also, e.g., id.
101(c)(2), (c)(4), (c)(6) & (g)(1).

7

Ethics and Independence Rules Concerning Independence, Tax Services, and Contingent Fees,
PCAOB Release No. 2005-014, at 9 (July 26, 2005) (“2005 Adopting Release”),
available at https://pcaobus.org/Rulemaking/Docket017/2005-07-26_Release_2005-014.pdf
(“The Board proposed [Rule 3502] to codify the ethical obligation of associated persons of registered firms not to cause registered firms to commit [ ] violations.”).

Yet Rule 3502's current formulation contains an incongruity that places negligent contributors to firms' violations beyond the rule's reach. That incongruity stems from the notion that registered firms, like any legal entity, can act only through natural persons. It logically follows that when a registered firm is found to have acted negligently, it is likely that such negligence is attributable to at least one natural person's negligence.

Rule 3502, however, at present requires a level of culpability higher than negligence—at least recklessness—before the Board can impose sanctions against associated persons who directly and substantially contribute to firms' negligence-based violations. Put another way, Rule 3502 requires a showing of more than negligence by individuals
8

for the Board to sanction them for conduct resulting in negligence by firms. Thus, under current Rule 3502, associated persons who do not exercise reasonable care and contribute to firms' violations may escape liability and accountability—even while the firms committing the violations do not. The Board believes that amending Rule 3502 addresses this incongruity, and therefore better protects investors and promotes quality audits.

8
For ease of reference, this release sometimes refers to associated persons who are the contributory actors for purposes of Rule 3502 as “persons” or “individuals.” The Board notes, however, that both natural persons and entities can be associated persons, and therefore Rule 3502 charges can be brought against both natural persons and entities, consistent with the meaning of the term “person associated with a registered public accounting firm.”

Accordingly, following notice and comment, the Board has amended Rule 3502 by changing from recklessness to negligence the liability standard for associated persons' contributory conduct. As explained in greater detail below, the Board believes, based on its experience and having considered the comments received, that the amendment better aligns Rule 3502 with the scope of the Board's enforcement authority under Sarbanes-Oxley, thus further advancing the Board's mission of investor protection.

Rulemaking History

On September 19, 2023, the Board proposed to amend Rule 3502 in two ways: (1) by changing from recklessness to negligence the standard of conduct for associated persons' contributory liability and (2) by providing that, to be charged with violating Rule 3502, an associated person contributing to a registered firm's violation need not be an associated person of the firm that commits the primary violation (
i.e.,
that an associated person of one registered firm can contribute to a primary violation of another registered firm).
9

The Board received 28 comment letters on the Proposal from commenters across a range of affiliations.
10

In general, commenters recognized the importance of an effective PCAOB enforcement program and in holding individuals accountable when there are violations of applicable laws, rules, and professional standards. The final rule amendment—which, as detailed below, does not include the second aspect of the Proposal—is informed by the comments received on the Proposal, which are discussed throughout this release.

9

Proposed Amendments to PCAOB Rule 3502 Governing Contributory Liability,
PCAOB Release No. 2023-007 (Sept. 19, 2023) (“2023 Proposing Release” or the “Proposal”),
available at https://assets.pcaobus.org/pcaob-dev/docs/default-source/rulemaking/053/pcaob-release-no.-2023-007-rule-3502-proposal.?=7d49cc51_9.

10
Comment letters on the Proposal, as well as a staff white paper regarding characteristics of emerging growth companies, are available on the Board's website in Rulemaking Docket No. 053,
available at https://pcaobus.org/about/rules-rulemaking/rulemaking-dockets/docket-053/letters.
One of the comment letters was withdrawn.

Background

PCAOB Rule 3502 codifies associated persons' ethical obligation not to contribute to a registered firm's violations of the laws, rules, and standards that the Board is charged with enforcing. The rule provides grounds for secondary liability when an associated person of a registered firm acts at least recklessly to directly and substantially contribute to such a violation. Although the rule as adopted in 2005 incorporated a recklessness standard, the rule as proposed in 2004 required that individuals only negligently contribute to a firm's violation to be subject to liability.
11

Whereas negligence “is the failure to exercise reasonable care or competence,”
12

recklessness requires “an extreme departure from the standard of ordinary care” that “presents a danger to investors or to the markets that is either known to the (actor) or is so obvious that the actor must have been aware of it.”
13

Indeed, Sarbanes-Oxley characterizes “reckless conduct” as a subset of “intentional or knowing conduct,”
14

whereas negligence is an “objective” standard that is not measured by “the intent of the accountant.”
15

11

See Proposed Ethics and Independence Rules Concerning Independence, Tax Services, and Contingent Fees,
PCAOB Release No. 2004-015, at 18 & n.40 (Dec. 14, 2004) (“2004 Proposing Release”),
available at https://pcaobus.org/Rulemaking/Docket017/2004-12-14_Release_2004-015.pdf.

12

In re SW Hatfield, C.P.A.,
SEC Release No. 34-69930, at 35 n.169 (July 3, 2013) (citation and quotation marks omitted).

13

Id.
at 29 (citation and quotation marks omitted);
see also Marrie
v.
SEC,
374 F.3d 1196, 1204 (D.C. Cir. 2004); 2005 Adopting Release at 13 (“[T]he phrase `knew, or was reckless in not knowing' is a well-understood legal concept, and the Board intends for the phrase to be given its normal meaning.”).

14

See
Section 105(c)(5)(A) of Sarbanes-Oxley.

15

In re Melissa K. Koeppel, CPA,
PCAOB File No. 105-2011-007, at 166 (Dec. 29, 2017) (quoting
In re Kevin Hall, CPA,
SEC Release No. 34-61162, at 12 (Dec. 14, 2009) (quotation marks omitted)).

The Board has adopted negligence as the liability standard for actionable contributory conduct under Rule 3502.

And for good reason: A negligence standard is appropriate based on the Board's extensive experience with Rule 3502 since the rule's adoption nearly two decades ago, it closes a gap in the PCAOB's regulatory framework that can lead to anomalous results, and it advances certain objectives in the Board's 2022-2026 Strategic Plan in furtherance of the Board's overall mission.

In the first subsection below, the Board reviews the Board's 2004 proposal and 2005 adoption of Rule 3502. Then, the Board details the reasons for the amendment the Board has adopted to modernize and strengthen the rule.

A. History of Rule 3502

As part of a package of proposed ethics and independence rules, the Board proposed PCAOB Rule 3502 in 2004.
16

In issuing the proposal, the Board observed that “[w]hile certain types of violations, by their nature, may give rise to direct liability only for a registered public accounting firm, the firm's associated persons bear an ethical obligation not to be a cause of any violations by the firm.”
17

Accordingly, through Rule 3502, the Board sought to “codify that obligation” and “make it clear that the obligation is enforceable by the Board.”
18

Using language “intended to articulate a negligence standard,” the proposed version of Rule 3502 subjected associated persons to potential contributory liability if they “knew or should have known” that an act or omission by them would contribute to a firm's primary violation.
19

16

See generally
2004 Proposing Release at 18-19. As originally proposed (and adopted), Rule 3502 was entitled
Responsibility Not to Cause Violations. See id.
at A-4; 2005 Adopting Release at A-5. Shortly after adoption, however, the Board changed the title of the rule to its current title,
Responsibility Not to Knowingly or Recklessly Contribute to Violations.
The Board made the change “[a]fter discussions with the SEC” and “to avoid any misperception that the rule affects the interpretation of any provision of the federal securities laws.”
Ethics and Independence Rules Concerning Independence, Tax Services, and Contingent Fees,
PCAOB Release No. 2005-020, at 2 (Nov. 22, 2005),
available at https://pcaob-assets.azureedge.net/pcaob-dev/docs/default-source/rulemaking/docket017/2005-11-22_release_-020.pdf?sfvrsn=69338fcd_0.
In so doing, however, the Board clarified that “[t]he rule, as amended, should be interpreted and understood to be the same as the rule adopted by the Board.”
Id.

17
2004 Proposing Release at 18.

18

Id.

19

Id.
at 18 n.40;
see id.
at A-4 (proposed rule text).

Following a public comment period,
20

the Board adopted Rule 3502 with two modifications from the proposal. First, while affirming its authority to promulgate a negligence-based ethics rule prohibiting contributory conduct,
21

the Board revised the liability standard from negligence to recklessness, which the Board at that time believed would “strike[ ] the right balance in the context of th[e] rule.”
22

Second, the Board modified “contribute”—the verb that describes the connection between the associated person's conduct and the firm's primary violation—by adding the words “directly and substantially.”

20
“Several commenters supported the rule as proposed and noted that they saw the rule as essential to the Board's ability to carry out its disciplinary responsibilities under the Act,” 2005 Adopting Release at 9, while others did not fully endorse it. Their objections were based principally on the view that negligence might be an ill-suited liability standard “in light of the complex regulatory requirements with which auditors must comply” and out of concern that such standard “would allow the Board, or the SEC, to proceed against associated persons who in good faith, albeit negligently, have caused a registered firm to violate applicable laws or standards.”
Id.
at 9, 13. Certain commenters “also questioned the Board's authority to adopt the proposed rule, or at least the proposed rule with a negligence standard.”
Id.
at 9.

21

See id.
at 12 n.23.

22
2005 Adopting Release at 13;
see id.
at 12 & n.23.

The latter modification was made due to commenters expressing concern that, because of the collaborative nature of accounting work, each individual involved in formulating a decision or other action that ultimately leads to a firm violation could be held liable for causing the violation.
23

The Board explained that the addition of “directly” means, among other things, that an associated person's conduct must “either essentially constitute[ ] the [firm's] violation” or be “a reasonably proximate facilitating event of, or a reasonably proximate stimulus for, the violation.” But, the Board clarified, “directly” does not place outside the scope of Rule 3502 contributory conduct “just because others also contributed to the violation, or because others could have stopped the violation and did not.” “Substantially,” the Board explained, means that an associated person's conduct must “contribute[ ] to [a] violation in a material or significant way,” though it need not be “the sole cause of the violation.”
24

23

See id.
at 9, 13.

24

Id.
at 13.

B. Reasons for the Amendment

As the Board previously recognized, when an associated person causes a firm to commit a violation, such conduct “operates to the detriment of the protection of investors.”
25

The following subsections explain why the modification to Rule 3502 is appropriate in furtherance of the Board's mission to protect the interests of investors and further the public interest in the preparation of informative, accurate, and independent audit reports.

25
2005 Adopting Release at 10.

1. Aligning Rule 3502 With the Board's Enforcement Authority

As the Board previously has explained, a registered firm “can only act through the natural persons who serve as its agents, including its associated persons.”
26

Accordingly, “a natural person's actions may render both the [firm] primarily liable and the natural person secondarily liable.”
27

Yet under the current formulation of Rule 3502, an incongruity exists between the respective requisite mental states for liability of a registered firm resulting from an associated person's conduct and for liability of the associated person: A firm can commit a primary violation of certain laws, rules, or standards by acting
negligently,
but an associated person who directly and substantially contributed to that violation must have acted at least
recklessly
to be secondarily liable.

26
2004 Proposing Release at 18;
see
2005 Adopting Release at 12 (“[Registered] firms . . . can only act through the natural persons that comprise them, many of whom are `associated persons' subject to the Board's ethics standards and disciplinary authority.”). Indeed, as one commenter on the Proposal put it, a firm is the sum of its parts.

27

In re Timothy S. Dembski,
SEC Release No. 34-80306, at 13-14 n.35 (Mar. 24, 2017) (quoting
SEC
v.
Koenig,
2007 WL 1074901, at *7 (N.D. Ill. Apr. 5, 2007)).

This incongruity means that associated persons may have weaker incentives to exercise the appropriate level of care in their audit work. They may not exercise reasonable care (the standard for negligence) if they know that they cannot be held individually liable by the PCAOB for a firm's primary violation unless an act or omission by them amounts to an “an extreme departure from the standard of ordinary care for auditors” (the standard for recklessness).
28

The modification to Rule 3502's liability standard from recklessness to negligence closes this regulatory gap, which should incentivize associated persons to be more deliberate and careful in their

actions. Indeed, “accountability frequently improves outcomes.”
29

28

Marrie,
374 F.3d at 1204;
see
Russell G. Pierce & Eli Wald,
The Relational Infrastructure of Law Firm Culture and Regulation,
42 Hofstra L. Rev. 109, 129 (2013) (explaining how rules from the legal industry's governing body that would restrict lawyers' limited liability “will encourage lawyers to devote more energy to maintaining the quality of the firm because they could potentially face personal liability for poor quality services”);
see also
Colleen Honigsberg,
The Case for Individual Audit Partner Accountability,
72 Vand. L. Rev. 1871, 1885 (2019) (arguing that “existing deterrence mechanisms have failed to produce optimal audit quality” and “are ineffective”).

29
Honigsberg,
supra,
at 1902.

Numerous commenters agreed with the Board's regulatory concerns noted above. These commenters generally noted that the Board's concerns were valid and clear, and that a negligence standard would better align Rule 3502 with the scope of the Board's enforcement authority under Sarbanes-Oxley and provide a tool to eliminate incongruous results in liability between individuals and firms. Indeed, one commenter characterized the difference between negligence and recklessness as “substantial” and “consequential” and noted that the current gap in liability standards directly impacts the Board's ability to fulfill its statutory mission.
30

30
Comment Letter from Better Markets at 3 (Nov. 3, 2023).

Another commenter remarked that a negligence standard will enable the PCAOB and the U.S. Securities and Exchange Commission (SEC or “Commission”) to more efficiently and effectively pursue enforcement cases regardless of which entity has the resources to bring the case. Commenters also stated that a negligence standard would appropriately align Rule 3502's liability threshold with the standard of care that auditors currently should be exercising when performing their professional responsibilities and that both the Commission and civil plaintiffs in private litigation currently can pursue cases against auditors for negligence. In encouraging the PCAOB to adopt the Proposal, one commenter further noted that the change to negligence would bolster investors' expectations that accountants will be independent and diligent in their audit work.

Other commenters, however, believed that the Proposal did not present a sufficient rationale for moving to a negligence standard after the Board previously declined to do so in 2005. These commenters opined that the same concerns about a negligence standard that existed in 2005 exist today and questioned whether there were significant enough developments to merit the change.
31

Indeed, certain commenters acknowledged the incongruity discussed in the Proposal but contended either that it is not significant or problematic, that it is not an impediment to enforcement, or that closing the gap in liability standards would not change auditor conduct.
32

One commenter stated explicitly that no incongruity or gap exists.

31
In support of such assertion, one commenter cited
F.C.C.
v.
Fox Television Stations, Inc.,
556 U.S. 502 (2009). The rationale articulated in the Proposal and this adopting release, however, more than satisfies
Fox'
s criteria for a conscious change in policy.
See id.
at 515 (“[I]t suffices that the new policy is permissible under the statute, that there are good reasons for it, and that the agency
believes
it to be better, which the conscious change of course adequately indicates.”). As to auditors' reliance on the standard in the current rule, as in
Fox,
the Board is not “punishing [auditors] without notice of the potential consequences of their action.”
Id.
at 518. That is so because the adoption of a negligence standard, by itself, does not impose any civil money penalty or other sanction; rather, sanctions are available only if Rule 3502 is
violated
after the amended rule becomes effective.

32
One commenter stated that the Proposal failed to articulate how the change to negligence would align Rule 3502 with Sarbanes-Oxley and questioned whether there were cases where the current recklessness standard did not suffice to hold persons accountable. The Proposal, however, made both of these points clear.
See
2023 Proposing Release at 7 (describing the current misalignment with Sarbanes-Oxley);
id.
at 24-25 (discussing estimated cases in 2022). That commenter and one other also noted that the PCAOB has been able to assess significant penalties under the current Rule 3502 formulation and that the Board's disciplinary proceedings have resulted in collateral consequences for firms and individuals. While that may be the case, the Board did not adopt a negligence standard for the purpose of facilitating an increase in
penalties;
rather, as the Proposal explained, the Board proposed—and has adopted—a negligence standard to facilitate an increase in
accountability
and
deterrence. See
2023 Proposing Release at 7.

Several commenters also stated that auditors are subject to sufficient oversight under the current framework, including via the PCAOB's inspection program, enforcement in Commission proceedings, and enforcement by state regulatory agencies. Certain of these commenters further stated that a negligence standard would risk, among other things, disturbing the PCAOB's inspection process by upsetting inspection dynamics and threatening the cooperative and constructive nature of the process that has developed over time.

The Board is mindful of the efficiencies gained through open dialogue with firms and individuals alike during the inspection process. Given that firms and individuals already are subject to a negligence standard for
primary
violations, however, the Board does not believe that the incremental change of moving from recklessness to negligence for
contributory
conduct will have a chilling effect on inspections, especially given that the Board will continue to exercise discretion about when to bring Rule 3502 charges.
33

33
One commenter expressed concern over whether the inspection process is sufficiently robust to conclude that an associated person has contributed to a firm's negligence-based violation, and relatedly, another asserted that auditors believe that the Board is holding them to an inspections bar that constantly evolves. Inspection staff's findings, however, are not conclusive for purposes of imposing legal liability under Rule 3502 (or any PCAOB rule).
See PCAOB Inspection Procedures: What Does the PCAOB Inspect and How Are Inspections Conducted?, available at

https://pcaobus.org/oversight/inspections/inspection-procedures
(“[A]ny references in [an inspection] report to violations or potential violations of law, rules, or professional standards are not a result of an adjudicative process and do not constitute conclusive findings for purposes of imposing legal liability.”). Rather, whether there is legal liability for a violation and whether conduct merits sanctions (and if so, what the sanctions are) are determined through the adversarial process involving the Board's Division of Enforcement and Investigations and only after respondents have been afforded the opportunity to present a defense.

Commenters also opined that amending Rule 3502 is unnecessary because the Board's then-proposed (now-adopted
34

) QC 1000 standard provides clearer expectations with regard to individuals in quality control (QC) roles.
35

Although the Board agrees that QC 1000 crystallizes the responsibilities of certain individuals serving in QC roles, Rule 3502 applies more broadly than to just those particular individuals. Thus, although QC 1000 and Rule 3502 could overlap to cover the same conduct in some circumstances, there are other circumstances in which there would not be overlap.
36

34
This release references several professional standards that the Board has adopted but which are pending Commission approval, and which therefore are subject to change.
See
Section 107(b) of Sarbanes-Oxley.

35
See generally A Firm's System of Quality Control and Other Amendments to PCAOB Standards, Rules, and Forms, PCAOB Release No. 2024-005 (May 13, 2024) (“QC 1000 Release”).

36

See, e.g., Herman & MacLean
v.
Huddleston,
459 U.S. 375, 383 (1983) (“While some conduct actionable under Section 11 may also be actionable under Section 10(b), it is hardly a novel proposition that the 1934 [Securities Exchange] Act and the 1933 [Securities] Act `prohibit some of the same conduct.' `The fact that there may well be some overlap is neither unusual nor unfortunate.' ” (citations omitted)).

Commenters similarly expressed mixed views about whether the change to negligence would incentivize auditors to more fully comply with applicable laws, rules, and standards that the Board is charged with enforcing. Multiple commenters remarked in the affirmative, noting that such incentivization is foreseeable and that a negligence standard will encourage individuals and firms to maintain a high level of quality in their audit work, which in turn benefits investors and financial markets alike. Indeed, one commenter remarked that the current recklessness standard
in
adequately incentivizes associated persons to exercise the appropriate level of care in their audit work. This commenter also noted that, beyond incentivizing individuals' compliance, a negligence standard also would incentivize
firms
to ensure, through training and other measures, that their

employees are complying with applicable professional standards.

By contrast, other commenters argued that a negligence standard will not incentivize compliance, for a variety of reasons. Multiple commenters premised such view on the downstream effects that oversight with respect to firms has on individuals. According to certain of these commenters, such effects (
e.g.,
reduced responsibility on audits, compensation- and promotion-related consequences), as well as other firm policies and preventative measures (such as training), are sufficient to guard against negligence and incentivize individual compliance. Another commenter opined that the auditor reporting model and the identification of auditors in Form AP suffice to address individual accountability.

While the Board agrees that each of the above factors may play a role in driving individual accountability in certain respects, none is a form of
regulatory
accountability that is akin to the Board's authority to bring enforcement proceedings and impose publicly a range of disciplinary sanctions as remedial measures. Moreover, the market-driven consequences relating to the auditor reporting model and identification of auditors on Form AP are felt primarily (if not exclusively) by the engagement partner on an audit, while Rule 3502 applies more broadly.

Another commenter questioned whether a negligence standard would have a deterrent effect (or close any gap) given that auditors already are subject to a negligence standard for contributory liability in Commission actions. One commenter noted that, given that auditors already are subject to negligence actions by other entities (including the Commission and state regulators), empirical evidence should be provided to support how auditor behavior would change under a negligence standard for Rule 3502.
37

As the Board previously noted, however, an increase in the
number
of regulators on alert for the same or similar violative conduct increases the likelihood of that conduct being detected and, consequently, the likelihood that the conduct would be sanctioned.
38

37
This commenter did not provide the source of any data or propose any methods by which to generate empirical evidence on this subject.

38
2023 Proposing Release at 14 n.51.

In other commenters' views, a negligence standard would not incentivize compliance because sanctions are ineffective to deter mere errors in judgment. As explained below, however, the amendment does not target mere errors in judgment, but rather
unreasonable
conduct. Multiple commenters also posited that a lower threshold for auditor liability may have a negative impact on audit quality, including at smaller firms. Indeed, one commenter asserted that the impact of the proposed rule change (and proceedings brought pursuant to it) would be felt more acutely by firms that are not affiliated with the largest global networks, despite those firms having a significantly smaller share in auditing the market capitalization of U.S. issuers. These commenters generally attributed what they view as a potential loss in audit quality to several factors, including recruiting, retention, and staffing challenges; reduced collaboration among auditors; and auditors engaging in unproductive, excessive self-protective behavior. The Board addresses below commenters' concerns about the amendment's potential impacts on audit quality and smaller firms, respectively.

2. The Board's Implementation Experience

Although the Board viewed Rule 3502's recklessness liability threshold as “strik[ing] the right balance in the context of th[e] rule” at the time of the rule's adoption in 2005, the threshold had not yet been tested in practice by the PCAOB, and experience has shown that it prevents the Board from executing its investor-protection mandate to the fullest extent that Congress authorized in Sarbanes-Oxley.

In the instances in which the Board has instituted proceedings against firms for negligence-based violations, the Board has not been able to charge Rule 3502 violations against the individuals that negligently contributed to those firms' violations. Although the decision not to bring charges against individuals varies case by case and is at the Board's discretion, it remains that the Board has been legally barred by the current formulation of Rule 3502 from holding accountable under Rule 3502 individuals who negligently, directly, and substantially contributed to the firms' violations.
39

39
As the 2005 Adopting Release notes, however, Rule 3502 “is not the exclusive means for the Board to enforce applicable Board rules and standards against associated persons.” 2005 Adopting Release at 14 n.25.

The Board's application of Rule 3502 in various contexts supplies experience-based reasons for the proposed amendment to the liability standard. For example, when dealing with the design and implementation of firm QC policies and procedures under applicable QC standards, the Board has observed that registered firms that commit a QC violation often have multiple individuals with overlapping QC responsibility but that no single individual was reckless in failing to act, and thus no individual can be held personally accountable for the firm's QC failure.
40

And yet, individuals with QC responsibility at a firm are often in some of the most important decision-making roles within the firm because a compliant QC system serves as the backstop to ensure that all
other
professional standards are followed.
41

40
The Board's recently adopted QC 1000 standard mitigates this concern to an extent by requiring firms to assign one or more individuals to certain roles with designated responsibilities within a firm's QC system.
See
QC 1000 Release at 82-86. The concern remains, though, because “[a] firm may have multiple individuals or multiple layers of personnel supporting these roles.”
Id.
at 83.

41

See
QC § 20.03,
System of Quality Control
(“A firm has a responsibility to ensure that its personnel comply with the professional standards applicable to its accounting and auditing practice. A system of quality control is broadly defined as a process to provide the firm with reasonable assurance that its personnel comply with applicable professional standards and the firm's standards of quality.”); QC 1000 Release at 70-71 (setting forth, in QC 1000.05, the objective of a firm's QC system).

Multiple commenters suggested that a negligence standard should not apply to enforcement of QC matters because the Board's inspection function already provides it with transparency into a firm's QC system. Inspections (and, relatedly, remediation) of QC matters, however, are distinct from enforcement, including with respect to the available potential consequences for firms and individuals, respectively. Yet Congress also expressly envisioned that the Board's inspections program would inform its enforcement activities.
42

Such entwinement is therefore a feature of Sarbanes-Oxley—not a flaw or a reason not to adopt a negligence standard.

42

See, e.g.,
Section 104(c)(3) of Sarbanes-Oxley (requiring the Board, “in each inspection,” to “begin a formal investigation or take disciplinary action, if appropriate, with respect to any [potential] violation [identified during an inspection], in accordance with this Act and the rules of the Board”).

One commenter also appeared to interpret the Proposal as the Board suggesting that having multiple people with overlapping responsibility for a firm's QC system is an obstacle to investor protection or enhanced audit quality and that a single individual needs to be held accountable for a QC violation in the absence of reckless behavior. That was not the Board's intent; rather, the Board meant simply what it said: When there are multiple individuals involved in the QC function, it could be that no individual's conduct rose to the level of recklessness

despite a firm's QC failure, thus allowing persons who negligently, directly, and substantially contribute to a QC failure to avoid individual accountability under Rule 3502.
43

43

See
2023 Proposing Release at 9.

Moreover, the Board did not mean to imply that a single person “needs” to be held individually accountable in all circumstances for negligence contributing to a firm's QC failure.
44

The Board exercises discretion about whom to charge and what charges to bring, and even in the absence of a charge, the
potential
to be held individually liable for contributory negligence may increase the amount of care and attention dedicated to QC by responsible individuals. Indeed, while reflecting only a modest change, the Board anticipates that the amendment will have a positive impact on audit quality as a result of its deterrent effect.

44
Comment Letter from PricewaterhouseCoopers LLP at A4 (Nov. 2, 2023).

Another comment letter posited that a negligence standard would place an unfair burden on national office partners responsible for a firm's QC functions and engagement quality review partners, who the comment letter asserted typically do not have the authority to establish firm strategies or allocate resources. This commenter expressed concern that the Board would pursue enforcement actions against a single individual when a firm's partners collectively are responsible for the strategy and resource allocation decisions that led to a firm's violation. Regardless of whether collective responsibility is uniformly the practice, the Board should not be precluded from exercising its discretion to pursue a Rule 3502 charge against an individual who failed to exercise reasonable care and competence, even in cases involving a firm's strategy or resource-allocation decisions that led to a QC failure.

In addition to the QC context, Rule 3502 also arises in sole-proprietorship cases, in which the sole owner and sole partner of a firm causes the firm to commit a violation. Yet for some types of violations, there is not always sufficient evidence of reckless behavior. A negligence standard thus would promote greater accountability by the sole proprietor and prevent that person from being shielded from individual liability under Rule 3502.

One commenter sought clarity regarding how Rule 3502 might be applied to sole proprietors. The Board notes that examples include instances in which firms fail to obtain an engagement quality review
45

or fail to file (or file timely) required PCAOB forms.
46

In each scenario, the respective primary violations can be committed only by a firm because the obligations are imposed solely on the firm,
47

yet a sole proprietor of a firm could negligently, directly, and substantially contribute to the firm's violation of the relevant PCAOB rules and standard.

45

E.g., In re Jack Shama,
PCAOB Release No. 105-2024-004 (Jan. 23, 2024);
In re Robert C. Duncan Accountancy Corp.,
PCAOB Release No. 105-2022-010 (June 22, 2022);
In re Tamba S. Mayah, CPA,
PCAOB Release No. 105-2021-007 (Sept. 13, 2021).

46

See, e.g., In re Jeffrey T. Gross, Ltd.,
PCAOB Release No. 105-2019-016 (July 23, 2019) (primary violation of PCAOB Rule 3211 relating to Form AP).

47

See
AS 1220,
Engagement Quality Review;
PCAOB Rule 2200,
Annual Report
(Form 2 filing rule); PCAOB Rule 2203,
Special Reports
(Form 3 filing rule); PCAOB Rule 3211,
Auditor Reporting of Certain Audit Participants
(Form AP filing rule).

Another commenter identified independence violations as a common type of case not mentioned above and for which the commenter believes that a negligence standard of contributory liability would promote greater individual accountability. The Board agrees.
48

Another commenter identified a data compilation regarding cases and fact patterns that the commenter said could be a resource in confirming and validating the change to Rule 3502.
49

48
Indeed, as the Board has previously stated, Rule 3502 is “essential to the proper functioning of the Board's independence rules.” 2004 Proposing Release at 19;
see
2005 Adopting Release at 14.

49
The resource is available at
https://wp.nyu.edu/compliance_enforcement/category/artificial-intelligence.
PCAOB staff's review indicates that what the commenter referred to as qualitative data mainly consists of blog posts written on a wide array of legal issues and news articles that are much broader in scope, cannot be analyzed readily in their entirety, and are not directly relevant to the Board's analysis.

3. Advancing the Board's Investor-Protection Mandate

In the Board's 2022-2026 Strategic Plan, the Board expressed a rejuvenated focus on the PCAOB's investor-protection mandate and stated its intent “to modernize and streamline our existing standards . . . where necessary to meet today's needs.”
50

The Board also expressed an intent to “engag[e] in vigorous and fair enforcement that promotes accountability and deterrence,” including by “tak[ing] a more assertive approach to bringing enforcement actions” and “hold[ing] accountable” those who commit “violations that result from negligent conduct.”
51

The amendment to Rule 3502 is consistent with those goals.

50
PCAOB, Strategic Plan 2022-2026, at 10,
available at

https://assets.pcaobus.org/pcaob-dev/docs/default-source/about/administration/documents/strategic_plans/strategic-plan-2022-2026.pdf?sfvrsn=b2ec4b6a_4/.

51

Id.
at 3, 13;
see also id.
at 8 (“[W]e are focused on aggressively pursuing all statutory legal theories for charging respondents and remedies available in executing our enforcement program, which is central to protecting investors and promoting the public interest.”).

When Congress enacted Sarbanes-Oxley, it empowered the Board to promulgate and adopt certain standards and rules, to inspect registered firms for compliance with those standards and rules, and to enforce compliance by firms and their associated persons. Among the tools that Congress provided to the Board for enforcement is the ability to impose certain sanctions for negligent conduct, including single instances of negligence.
52

That liability threshold serves a dual function: It incentivizes auditors to conduct their work knowing that reasonable care is the standard for assessing it (
i.e.,
deterrence), and it allows the Board to publicly discipline auditors who were found to have not exercised an appropriate degree of care (
i.e.,
accountability).
53

Each of those functions—one
ex ante
to auditors' conduct and the other
ex post—
goes to the core of the Board's mission of protecting investors and promoting high-quality audits.

52

See
Sections 105(c)(4) & (c)(5) of Sarbanes-Oxley;
Rules on Investigations and Adjudications,
PCAOB Release No. 2003-015, at A2-58 (Sept. 29, 2003),
available at https://assets.pcaobus.org/pcaob-dev/docs/default-source/rulemaking/docket_005/release2003-015.pdf?sfvrsn=35827b4_0
(“The Act plainly contemplates that disciplinary proceedings can be instituted for a violation based on a single negligent act.”). The Board received multiple comments regarding its authority to pursue enforcement proceedings based on single instances of negligence, and the Board addresses those comments below.

53

See
Honigsberg,
supra,
at 1899 (“Individual accountability could provide a counterweight to the current incentive structure. . . . [A]udit partners do not internalize the full consequences of an audit failure. Promoting individual brands will better address this inefficiency and reduce externalities by causing audit partners to internalize these failures.”);
see also
Gina-Gail S. Fletcher,
Deterring Algorithmic Manipulation,
74 Vand. L. Rev. 259, 268-69 (2021) (“[I]f the applicable laws are narrow, only capturing the most blatant misconduct, wrongdoers may not be deterred from breaking the law. . . . [D]eterrence is effective if regulators have strong, suitable tools to enforce the regime and market actors know whether they are violating the law.”).

The current formulation of Rule 3502, however, stops short of deploying the Board's authority to sanction negligent conduct to the fullest extent by requiring at least reckless conduct before an associated person can be held secondarily liable. The amendment that the Board has adopted to Rule 3502's liability standard removes this constraint and makes the rule both a more effective deterrent and a more

effective enforcement tool, and in so doing, better aligns the rule with Sarbanes-Oxley.
54

54

See
PCAOB, Strategic Plan 2022-2026, at 10 (“Effective auditing, attestation, quality control, ethics, and independence standards advance audit quality and are foundational to the PCAOB's execution of its mission to protect investors.”).

Several commenters stated that it is clear and understandable how the amendment to Rule 3502 advance the Board's statutory mandate to protect investors, including by promoting the twin goals of accountability and deterrence. One such commenter remarked that a negligence standard “may be needed” to enhance accountability to investors,
55

while another noted that such standard “fall[s] squarely” within the scope of the Board's mission and “clearly and unambiguously advances” the Board's cause.
56

Still another opined that the amendment would ensure consistency between the liability standard and investor expectations and that “it makes no sense” to have differing standards for firms and individuals.
57

55
Comment Letter from Council of Institutional Investors at 5 (Oct. 26, 2023).

56
Comment Letter from Better Markets at 8.

57
Comment Letter from Center for American Progress at 2 (Nov. 3, 2023).

As to deterrence, multiple commenters stated that the amendments should result in auditors being more likely to comply with their respective legal requirements. One commenter further opined that a negligence standard “sends a strong message” to auditors regarding the requisite level of care that they should be applying in their work.
58

58
Comment Letter from Better Markets at 5.

Other commenters expressed a different view of the amendments relative to investor protection. One commenter stated that, should the amendment discourage certain individuals from accepting important QC roles for fear of being held liable, the public's interest would not be served by having less cautious or less qualified individuals fill those roles. Another opined that the amendments would incentivize high-quality talent to avoid the audit profession, which could lead to lower audit quality, increased audit fees, and a large number of delistings. As certain other commenters pointed out and as the Board observed in the Proposal, however, auditors already are subject to liability and disciplinary schemes that encourage them to comply—and not just avoid reckless noncompliance—with applicable statutory, regulatory, and professional standards.

Still another commenter expressed uncertainty about how a change to negligence will achieve further investor-protection benefits. This commenter remarked that the Board currently has means to hold accountable individuals who are negligent in various contexts and that investors are best protected when noncompliance is avoided in the first place. While the Board agrees that avoiding noncompliance in the first instance promotes audit quality and benefits investors, the Board views the addition of another enforcement tool to deter negligent conduct (including conduct that currently is beyond the Board's reach), and to hold accountable those who engage in such conduct, as a complement to—not mutually exclusive from—avoiding noncompliance.

Beyond deterrence and accountability, multiple commenters remarked that the amendments should enhance investors' confidence, both in audits and in the information provided in companies' financial statements. Some commenters noted that a change to a negligence standard would protect investors by encouraging auditors to be more careful about their work and positively affecting capital-market efficiency. Another commenter offered several additional downstream investor-protection benefits, including that as audit quality improves, the likelihood of auditors being subjected to meritorious litigation, and the risks and costs to investors resulting from that litigation (as well as misstatements and omissions in audited financial statements), should be reduced.

Discussion of the Amendment

As discussed above, the Board has amended PCAOB Rule 3502 by changing the liability standard from recklessness to negligence. The details of the amendment are discussed in the following subsections.

A. Text of the Amended Rule and the Negligence Standard Generally

The Board has amended Rule 3502's liability standard as proposed by deleting the phrase “knowing, or recklessly not knowing” (and certain ancillary surrounding text) and inserting elsewhere into the rule the phrase “knew or should have known” (and certain ancillary surrounding text). The outgoing phrase describes conduct that amounts to at least recklessness,
59

whereas the incoming phrase sets a negligence standard using “classic negligence language.”
60

Consequently, the Board is changing the standard for contributory liability from an “extreme departure from the standard of ordinary care”
61

(recklessness) to “the failure to exercise reasonable care or competence” (negligence).
62

59

See
2005 Adopting Release at 12 n.23.

60

In re KPMG Peat Marwick LLP,
SEC Release No. 34-43862 (Jan. 19, 2001) (“Ordinarily, the phrase `should have known' . . . is classic negligence language.”),
pet. for review denied, KPMG, LLP
v.
SEC,
289 F.3d 109 (D.C. Cir. 2002);
see also Erickson Prods., Inc.
v.
Kast,
921 F.3d 822, 833 (9th Cir. 2019) (“ `[S]hould have known' . . . is a negligence standard. To say that a defendant `should have known' of a risk, but did not know of it, is to say that he or she was `negligent' as to that risk.”);
KPMG,
289 F.3d at 120 (“knew or should have known” is language that “virtually compel[s]” a negligence standard).

61

Marrie,
374 F.3d at 1204 (citation and quotation marks omitted).

62

SW Hatfield,
SEC Release No. 34-69930, at 35 n.169 (citation and quotation marks omitted).

Such a change addresses the incongruity and related issues noted above. Specifically, it aligns the requisite mental states for liability of a registered firm and for liability of an associated person whose conduct directly and substantially contributed to the firm's violation.
63

In so doing, the modification should better incentivize associated persons to exercise the appropriate level of care, thus promoting investor protection.

63
However, the sanctions to which a contributory actor may be subject upon being found to have violated Rule 3502—including whether the Board may impose any of the heightened sanctions in Section 105(c)(5) of Sarbanes-Oxley—depend on the associated person's conduct and not that of the firm that commits the primary violation.

Numerous commenters remarked that a change to negligence is appropriate, and with limited exception, commenters remarked that the proposed language to effectuate that change—which the Board has adopted—is clear and understandable.

One commenter called the proposed rule text (“knew or should have known”) “overly vague and broad” and asserted that, in contrast to an accountability framework that sets forth clear expectations, the proposed rule does not provide notice of specific conduct that may lead to a violation.
64

As the Proposal explained (and as repeated above), however, the “knew or should have known” phrasing is “classic negligence language,” and negligence is “the failure to exercise reasonable care or competence.”
65

Indeed, one commenter remarked that such language is “familiar in the American legal system.”
66

Moreover, as discussed in the 2005 Adopting Release and the Proposal (and as discussed below), the Board has delineated through its explanation of “directly and substantially” the nexus and magnitude that an auditor's conduct must have to

a firm's primary violation to be actionable. The Board is thus satisfied that such a well-known standard in the law, supplemented by additional parameters that have been in place for nearly two decades, is neither vague nor overly broad.

64
Comment Letter from RSM US LLP at 1 (Nov. 3, 2023).

65
2023 Proposing Release at 13 & n.45.

66
Comment Letter from Center for Audit Quality at 11 (Nov. 2, 2023).

Several commenters sought clarity over how the adopted text of Rule 3502 (“knew or should have known”), as well as the definition of negligence (“failure to exercise reasonable care or competence”), would interact with other standards of conduct applicable to auditors, and in particular the obligation of exercising due professional care under then-proposed (now-adopted) AS 1000,
General Responsibilities of the Auditor in Conducting an Audit.
67

To be sure, due professional care and reasonable care and competence are largely overlapping concepts.
68

However, the Board wishes to emphasize three points.

67
See General Responsibilities of the Auditor in Conducting an Audit and Amendments to PCAOB Standards, PCAOB Release No. 2024-004, at 30-39 (May 13, 2024) (“AS 1000 Release”) (subject to Commission approval); see also AS 1015, Due Professional Care in the Performance of Work.

68

See
AS 1000 Release at A1-3 (“due professional care” includes “acting with reasonable care and diligence”);
see also
QC 1000 Release at 81 (“We are adopting this provision [QC 1000.10] with modifications to align with the descriptions of due professional care and professional skepticism being adopted in AS 1000.”).

First, while there may be overlap, AS 1000 does not apply to all conduct for which the Board has enforcement authority;
69

thus, there is a need for a separate rule with a negligence standard. Second, because Rule 3502 includes the “directly and substantially” modifier, it will not always be the case that conduct that violates the obligation of due professional care also violates Rule 3502; thus, Rule 3502 is not duplicative of AS 1000, even if conduct violating the latter may also violate the former in certain circumstances. Third, Rule 3502—located within the “Ethics and Independence” section of the Board's rules regarding professional practice standards—reflects an overarching ethical obligation, and the Board believes it appropriate to codify that general obligation, even if it overlaps with more specific provisions in particular professional standards.

69

See
AS 1000 Release at 30-31 (delineating the parameters of “all matters related to the audit” to which AS 1000's requirement to exercise due professional care applies).

A substantial number of commenters did not appear to support the change. In general, these commenters stated that they do not believe that negligence is an appropriate standard for assessing conduct and compliance on complex audit engagements, which commenters said require a wide range of judgments. For instance, one commenter opined that what could be labeled as a “violation” of professional standards instead may be only a difference of opinions between accountants about a particular pronouncement(s). That commenter further opined that, by proposing a negligence standard, the Board misunderstands the nature of audits. Several other commenters opined that it is bad policy to penalize errors in judgment and for the PCAOB to second-guess auditors' good-faith decisions in situations involving the application of professional judgment.

As noted above, however, firms and associated persons already are subject to a negligence standard for their primary violations, including for single instances of negligence that violate professional standards.
70

The amendment to Rule 3502 therefore affects only an incremental (albeit important) change, and only for contributory conduct. Given the Board's nearly two decades of experience distinguishing isolated, good-faith errors in professional judgment from conduct that warrants disciplinary action, as well as the modest estimated increase in Rule 3502 cases that would result from the amendment, the Board does not anticipate that a change in the liability standard for contributory conduct will be used to sanction isolated, good-faith errors in professional judgment—let alone be wielded as a “blunt” or “draconian” instrument, as one commenter suggested
71

—including with respect to less senior engagement team members.
72

The amendment focuses on unreasonable conduct; it does not impose strict liability.
73

70

See, e.g., In re Sassetti, LLC,
PCAOB Release No. 105-2024-018 (Mar. 28, 2024);
In re Berkower, LLC,
PCAOB Release No. 105-2024-016 (Mar. 28, 2024).

71
Comment Letter from U.S. Chamber of Commerce at 2 (Nov. 7, 2023).

72
To iterate what the Board said in 2005, Rule 3502 is not “a vehicle to pursue compliance personnel who act in an appropriate, reasonable manner that, in hindsight, turns out to have not been successful.” 2005 Adopting Release at 14.

73
“Strict liability is imposed upon a defendant without proof that he was at fault. In other words, when liability is strict, neither negligence nor intent must be shown.” Dobbs' Law of Torts § 437.

One commenter opined that a Rule 3502 charge could cause associated persons to “lose their livelihood” due to “career-ending penalties” under the Proposal.
74

Several other commenters expressed a similar concern about the negligence threshold and the potential collateral effects and impacts on auditors' careers. While the Board appreciates that disciplinary orders have consequences—as they should—research suggests that auditors remain gainfully employed following a culpability finding.
75

And in all events, the Board emphasizes that it is not the Board's intent to pursue, through Rule 3502 charges, what one commenter described as “foot-faults” or “unintentional slips, pure errors of judgment, and innocuous errors on `technicalities.' ”
76

Nor do the Board's standards require that auditors exercise “perfect judgment at all times,” as one commenter put it,
77

to avoid an enforcement proceeding (under Rule 3502 or otherwise).
78

74
Comment Letter from RSM US LLP at 1, 2.

75

See
J. Krishnan, M. Li, M. Mehta & H. Park,
Consequences for Culpable Auditors, available at https://ssrn.com/abstract=4627460.
In their working paper studying audit professionals subject to Commission or PCAOB enforcement proceedings between 2003 and 2019, the authors make three key findings: First, a substantial number of culpable auditors remain gainfully employed by their firms one year after the enforcement event (26% of Big 4 and 43% of non-Big 4 culpable auditors). Second, culpable individuals leaving Big 4 firms primarily move to the corporate sector and secure senior or mid-level executive positions at private firms. By contrast, culpable auditors departing from non-Big 4 firms tend to join other non-Big 4 public accounting firms, often as partners. Third, . . . the large majority of culpable auditors do not engage in liquidity-increasing real estate transactions around enforcement.

76
Comment Letter from U.S. Chamber of Commerce at 9, 10.

77
Comment Letter from RSM US LLP at 3.

78

See
AS 1015.03,
Due Professional Care in the Performance of Work
(quoting a treatise describing the obligation of due care as: “[N]o man, whether skilled or unskilled, undertakes that the task he assumes shall be performed successfully, and without fault or error; he undertakes for good faith and integrity, but not for infallibility, and he is liable to his employer for negligence, bad faith, or dishonesty, but not for losses consequent upon pure errors of judgment.” (citation omitted)); AS 1000 Release at 31 (“We continue to believe that the description of due professional care in the final standard is consistent with the description in AS 1015.03 (and the reference in the current standard to the legal treatise,
Cooley on Torts
), which uses the terms `reasonable care and diligence' and `good faith and integrity but not infallibility' to describe due care.”).

Some commenters expressed concern over the notion that, as a result of the amendment, the Board would be able to pursue conduct that is not itself a violation but that merely contributes to a violation. One commenter characterized this as a “significant change from current PCAOB enforcement policy,”
79

but in fact it is no change at all; under the current version of Rule 3502, the Board can bring charges for conduct that is not itself a primary violation. The amendment merely changes the standard for when an individual's contributory conduct becomes actionable; it does not alter whether the

contributory conduct must be an independent violation apart from the firm's underlying primary violation.

79
Comment Letter from U.S. Chamber of Commerce at 2.

Several commenters expressed concern regarding a negligence standard in Rule 3502 in light of the current regulatory environment—specifically amidst the Board's other standard-setting projects, including the then-proposed (now-adopted) quality control standard, QC 1000. These commenters opined that new requirements in proposed and adopted other standards may put auditors at greater risk of violating Rule 3502, including based on the introduction or modification of key concepts and their interrelation to negligence.

The Board appreciates that audits, especially of large enterprises, have the potential to be quite complex and can require input from various individuals, including individuals not on the engagement team. QC systems likewise can be quite complex and require input from numerous people. And as in 2005, “[t]he Board also recognizes that persons subject to its jurisdiction must comply with complex professional and regulatory requirements in performing their jobs.”
80

But complexity is not a reason to allow negligent auditors—individuals who by definition have acted
unreasonably
—to contribute directly and substantially to firms' violations without consequence. Indeed, as one commenter noted, the complexity of audits and the current environment in which companies operate—which is rapidly changing and subject to emerging risks—
supports
amending Rule 3502 because audited financial statements are becoming increasingly important.

80
2005 Adopting Release at 14.

The Board also recognizes that it recently has adopted amendments to several standards
81

and has proposed amendments to other standards
82

and to certain PCAOB rules.
83

This is consistent with the Board's Strategic Plan, which states: “We expect to propose and adopt numerous amendments and new standards over the coming years, in accordance with our standard-setting and research agendas. We also plan to evaluate certain existing standards to determine whether they are outmoded.”
84

Many of the newly adopted standards, moreover, have staggered effective dates, and thus auditors will not be required to come into compliance with each of them at the same time.
85

And in all events, as firms make efforts to comply with new standards, it necessarily follows that individuals who could be subject to Rule 3502 also would be making such efforts because firms can act only through their natural persons.

81
See generally Amendments Related to Aspects of Designing and Performing Audit Procedures that Involve Technology-Assisted Analysis of Information in Electronic Form, PCAOB Release No. 2024-007 (June 12, 2024) (subject to Commission approval); QC 1000 Release; AS 1000 Release; The Auditor's Use of Confirmation, and Other Amendments to PCAOB Standards, PCAOB Release No. 2023-008 (Sept. 28, 2023); Planning and Supervision of Audits Involving Other Auditors and Dividing Responsibility for the Audit with Another Accounting Firm, PCAOB Release No. 2022-002 (June 21, 2022).

82
See,
e.g.,
Proposed Auditing Standard—Designing and Performing Substantive Analytical Procedures and Amendments to Other PCAOB Standards, PCAOB Release No. 2024-006 (June 12, 2024); Proposing Release: Amendments to PCAOB Auditing Standards related to a Company's Noncompliance with Laws and Regulations And Other Related Amendments, PCAOB Release No. 2023-003 (June 6, 2023).

83
See,
e.g.,
Proposing Release: Firm Reporting, PCAOB Release No. 2024-003 (Apr. 9, 2024); Firm and Engagement Metrics, PCAOB Release No. 2024-002 (Apr. 9, 2024); Proposals Regarding False or Misleading Statements Concerning PCAOB Registration and Oversight and Constructive Requests to Withdraw from Registration, PCAOB Release No. 2024-001 (Feb. 27, 2024).

84
PCAOB, Strategic Plan 2022-2026, at 10.

85

See
PCAOB Release No. 2022-002, at 58 (effective for audits of financial statements for fiscal years ending on or after December 15, 2024); PCAOB Release No. 2023-008, at 96 (effective for audits of financial statements for fiscal years ending on or after June 15, 2025); AS 1000 Release at 96 (with limited exception, effective for audits of financial statements for fiscal years beginning on or after December 15, 2024); QC 1000 Release at 378 (effective December 15, 2025); PCAOB Release No. 2024-007, at 61 (effective for audits of financial statements for fiscal years beginning on or after December 15, 2025).

The Board does not intend for any of its new or revised standards, either alone or in conjunction with the amendment the Board has adopted, to “create[ ] a trap for the unwary,” as one commenter opined.
86

Far from it, the Board's standard-setting agenda seeks to modernize standards in a way that promotes high-quality audits through compliance in the first instance. Enforcement proceedings promote this same
ex ante
focus on compliance insofar as they serve as a deterrent to other auditors from engaging in the same or similar misconduct.

86
Comment Letter from U.S. Chamber of Commerce at 10.

Finally, some commenters expressed concern about whether an associated person could be liable for negligence under Rule 3502 in situations where a primary violation by a firm requires a standard higher than negligence. One commenter remarked that holding an associated person liable in such circumstances would be “unprecedented (and unlawful)” and stated that the Board should consider specifically exempting violation-causing conduct when a primary violation involves intentional conduct.
87

Another commenter sought clarity from the Board on the issue and asked whether the Board believes that individual liability in such a scenario would be appropriate. Although the Board will continue to evaluate whether to bring Rule 3502 charges on a case-by-case basis, when the firm's primary violation requires more than negligence, the Board does not anticipate charging individuals for negligently contributing to such violations.
88

87
Comment Letter from RSM US LLP at 3.

88

See Howard
v.
SEC,
376 F.3d 1136, 1141 (D.C. Cir. 2004) (“Although we held in
KPMG, LLP
v.
SEC,
that the `knew or should have known' language in § 21C embodied a negligence standard for purposes of that case, it does not necessarily follow that negligence is the standard” where “scienter [is] an element of the primary violations.”);
KPMG Peat Marwick,
SEC Release No. 34-43862 (“We hold today that negligence is sufficient to establish `causing' liability under Exchange Act Section 21C(a), at least in cases in which a person is alleged to `cause' a primary violation that does not require scienter.”).

B. Retention of “Directly and Substantially”

As proposed, the Board has decided to retain the “directly and substantially” modifier to describe the connection between a contributory actor's conduct and a registered firm's primary violation.
89

Thus, for conduct to “directly” contribute to a primary violation, it must “either essentially constitute[ ] the violation”—in which case the conduct necessarily is a direct cause of it
90

—or be “a reasonably proximate facilitating event of, or a reasonably proximate stimulus for, the violation”; but it need not “be the final step in a chain of actions leading to the violation.”
91

Moreover, “directly” does not excuse an associated person who negligently “engages in conduct that substantially contributes to a violation, just because others also contributed to the violation, or because others could have stopped the violation and did

not.”
92

Nor would it necessarily excuse an associated person's conduct when another actor engages in intentional misconduct that might otherwise break the chain of causation—in particular where the associated person's conduct is at least negligent and created the situation for the other actor to engage in intentional misconduct, and where the associated person realized or should have realized the potential for, and likelihood of, such third-party intentional misconduct.
93

89

See
2005 Adopting Release at 13. As discussed above, the “directly and substantially” modifier was added in response to commenters' concerns that a negligence standard might sweep too broadly.
See also
2005 Adopting Release at 13. Because the Board is retaining “directly and substantially,” as explained herein, the guardrails that the Board put in place in 2005 in response to such concerns remain in Rule 3502.

90

Cf. Paul F. Newton & Co.
v.
Tex. Commerce Bank,
630 F.2d 1111, 1118 (5th Cir. 1980) (“[C]ommon law agency principles, including the doctrine of respondeat superior, remain viable in actions brought under the Securities Exchange Act and provide a means of imposing secondary liability for violations of the Act independent of § 20(a). The federal securities statutes are remedial legislation and must be construed broadly, not technically and restrictively.”).

91

See
2005 Adopting Release at 13.

92

Id.

93

See
Restatement (Second) of Torts § 448 (“The act of a third person in committing an intentional [violation] is a superseding cause of harm to another resulting therefrom, although the actor's negligent conduct created a situation which afforded an opportunity to the third person to commit such a [violation], unless the actor at the time of his negligent conduct realized or should have realized the likelihood that such a situation might be created, and that a third person might avail himself of the opportunity to commit such a [violation].”).

For its part, “substantially” continues to require that the associated person's conduct “contribute[ ] to the violation in a material or significant way,” though it “does not need to have been the sole cause of the violation.”
94

The Board stresses that Rule 3502 is not intended to “reach an associated person's conduct that, while contributing to the violation in some way, is remote from, or tangential to, the firm's violation.”
95

94
2005 Adopting Release at 13.

95

Id.; see also id.
at 14 (the Board does not “seek to reach those whose conduct, unbeknownst to them, remotely contributes to a firm's violation”). One commenter opined that the distinction between obligations placed on individuals and firms, respectively, should not be disturbed insofar as there may be instances where it is appropriate for a firm to be sanctioned for a violation but where no particular individual played a sufficient role in that violation. This commenter urged the Board to not use Rule 3502 to “collapse this distinction.” Comment Letter from Center for Audit Quality at 9. The Board agrees—there are indeed instances where it is appropriate to sanction a firm but not any individual(s) (under Rule 3502 or otherwise). The amendment the Board has adopted does nothing to collapse that distinction: It changes only the actionable standard of conduct, but does nothing to alter the nexus and magnitude requirements of “directly and substantially,”
i.e.,
it does not alter the requisite sufficiency of an individual's role relative to a firm's violation.

Commenters generally encouraged the Board to retain the “directly and substantially” modifier, including one commenter remarking that the Board's reasons for retaining it “remain valid.”
96

Multiple commenters, moreover, stated that these terms are clear and understandable. One commenter posited that the Board should not retain “directly and substantially” as part of Rule 3502.

96
Comment Letter from Ernst & Young LLP at 4 (Nov. 3, 2023).

Several commenters sought additional clarity around the terms “directly and substantially.” For instance, one commenter noted that the terms are not defined in Rule 3502 and claimed that the purported lack of clarity will make the rule inoperable. This commenter suggested that the Board instead import a more established legal doctrine of causation. Another commenter called the terms “subjective” and asked for a clearer articulation of them,
97

and another asked whether the terms “will be applied differently moving forward.”
98

97
Comment Letter from Accounting & Auditing Steering Committee of the Pennsylvania Institute of Certified Public Accountants at 5 (Nov. 2, 2023).

98
Comment Letter from Audit and Assurance Services Committee of the Illinois CPA Society at 3 (Nov. 2, 2023).

Having considered all commenters' views, the Board is satisfied that the modifier “directly and substantially” is sufficiently clear and operable and believes that no further delineation of the terms is needed at this time. The Board notes that, going back to the 2005 Adopting Release, the explanation of “directly and substantially” includes concepts from established legal principles (
e.g.,
“directly” includes circumstances where an individual's conduct is a “reasonably proximate facilitating event of, or a reasonably proximate stimulus for, the [firm's] violation”).

The Board further notes that, based on the amended rule text, “directly and substantially” would apply only to the sufficiency of the connection between an associated person's conduct and a firm's violation. Thus, to be liable under Rule 3502, a person must have known, or should have known, that an act or omission by them would contribute—but not that it would
directly and substantially
contribute—to a firm's violation.

One commenter remarked that the Board failed to explain its intention behind this aspect of the amendment and that the wording creates potential ambiguities and unfairness. The Board, however, sees it differently—by eliminating the need for any inquiry into individuals' mental states regarding the manner in which their conduct contributes to the firm's violation, the Board believes that the rule has the potential to be applied more uniformly (and thus more fairly). Moreover, if an associated person knew or should have known that his or her conduct would contribute to a violation in
any
way, then that individual should not be able to evade liability simply because the individual did not know the extent of the nexus and magnitude of such contribution. But in all events, the Board iterates that, absent conduct “directly and substantially” contributing to a firm's violation, an individual's actions or omissions are not subject to discipline under Rule 3502.

Two commenters opined that the Proposal suggested that the Board was open to a tertiary liability theory, in which a first associated person's conduct contributes to the conduct of a second associated person, which in turn contributes to a registered firm's violation. But as those commenters also recognized, the rule still would require the first person's conduct to directly and substantially contribute to
the firm's
violation.
99

Thus, contrary to those commenters' concerns, the definition of “directly” is not stretched beyond what it would be if there were no second person involved, let alone beyond common usage of the word.

99

See
2023 Proposing Release at 17 n.65;
e.g., In re Shandong Haoxin Certified Public Accountants Co., Ltd.,
PCAOB Release No. 105-2023-045, at ¶ 65 (Nov. 30, 2023) (multiple individuals violated Rule 3502 in connection with the same primary violation by the firm through different (though related) contributory conduct).

Finally, some commenters suggested other phrases or concepts to incorporate into the rule to modify “contribute.” One commenter called for limiting liability to “egregious actions.”
100

Such a standard, however, more aptly describes conduct that is reckless (as opposed to negligent),
101

which would be contrary to what the Board intends for the amendment to accomplish.

100
Comment Letter from Accounting & Auditing Steering Committee of the Pennsylvania Institute of Certified Public Accountants at 5.

101

See, e.g., In re Gately & Assocs., LLC,
SEC Release No. 34-62656, at 18 (Aug. 5, 2010) (“Recklessness can be established by an `egregious refusal to investigate the doubtful and to see the obvious.' ” (citation omitted)).

That same commenter expressed the view that the negligence standard should not apply to a professional who spends only a de minimis amount of time on an engagement, and further suggested that the Board add language to clarify that liability would only extend to a professional having a substantive level of participation on the engagement. Another commenter similarly suggested that the Board require that an associated person's conduct be a “substantial factor” in bringing about the firm's violation.
102

The Board, however, believes that the contours of “substantially” (in “directly and substantially”) suffice to help ensure that Rule 3502 is applied only to those individuals with a substantive level of participation or responsibility on an engagement with respect to a firm's violation in connection with an audit. And as the Board previously has

expressed—in the 2005 Adopting Release, in the Proposal, and above—Rule 3502 is not intended to reach an associated person's conduct that, while contributing to the violation in some way, is remote from, or tangential to, the firm's violation.

102
Comment Letter from RSM US LLP at 7.

C. No New Liability Standard in Light of the Commission's Authority

As explained in the Proposal, associated persons already are subject to potential liability—including money penalties—for negligently contributing to registered firms' violations of numerous laws and rules governing the preparation and issuance of audit reports via the Securities Exchange Act of 1934 (“Exchange Act”). Specifically, Section 21C of the Exchange Act authorizes the Commission to institute cease-and-desist proceedings against any “person that is, was, or would be a cause of [a] violation [of the Exchange Act or any rule or regulation thereunder], due to an act or omission the person knew or should have known would contribute to such violation,”
103

and Section 21B further authorizes the Commission to “impose a civil penalty” upon finding that such person “is or was a cause of [such] violation.”
104

Section 3(b)(1) of Sarbanes-Oxley, in turn, provides that “[a] violation by any person of . . . any rule of the Board shall be treated for all purposes in the same manner as a violation of the [Exchange Act] or the rules and regulations issued thereunder.” Thus, the amendment to Rule 3502's liability threshold does not subject auditors to any new or different standard to govern their conduct in light of the Commission's authority.
105

103
15 U.S.C. 78u-3(a);
see also
15 U.S.C. 77h-1(a), 80a-9(f)(1), 80b-3(k)(1).

104
15 U.S.C. 78u-2(a)(2). The Commission's Section 21B authority to impose civil penalties for violations in Section 21C cease-and-desist proceedings was added in 2010 as part of the Dodd-Frank Wall Street Reform and Consumer Protection Act.
See
Public Law 111-203.

105
Nor does the Commission's authority to sanction associated persons' negligent contributory conduct detract from the proposed amendment's deterrent effect. As previously noted, as an increase in the number of regulators on the lookout for the same or similar violative conduct increases the likelihood of that conduct being detected and, consequently, the likelihood that the conduct would be sanctioned.
See
Anton R. Valukas,
White-Collar Crime and Economic Recession,
2010 U. Chi. Legal F. 1, 12 (2010) (“One of the most powerful deterrents to misconduct is an increased threat of prosecution. . . . A `can do' accountant is less likely to provide questionable opinions if there is a substantial certainty that he will be caught and punished.”);
see also
Fletcher,
supra,
at 268 (“Certainty of punishment”—including “the possibility of detection, apprehension, conviction, and sanctions”—is one of two “primary factors” that drive deterrence.).

Numerous commenters seemed to disagree with that proposition for several reasons. Some commenters pointed out that the Commission cases cited in footnote 52 of the Proposal, while each a proceeding under Section 21C of the Exchange Act, were also proceedings under Commission Rule of Practice 102(e), which requires either “[a] single instance of highly unreasonable conduct that results in a violation” or “repeated instances of unreasonable conduct, each resulting in a violation of applicable professional standards.”
106

Sanctions are not available under Rule 102(e) when an auditor engages in a single instance of unreasonable (but not highly unreasonable) conduct.
107

Thus, certain commenters said that the cases were not “on par” with what the Board intends through the amendment to Rule 3502.
108

106
17 CFR 201.102(e);
see In re David S. Hall, P.C.,
SEC Initial Decision Release No. 1114 (Mar. 7, 2017) (ALJ Op.),
decision made final,
SEC Release No. 34-80949 (June 15, 2017);
In re Gregory M. Dearlove, CPA,
SEC Release No. 34-57244 (Jan. 31, 2008);
In re Philip L. Pascale, CPA,
SEC Release No. 34-51393 (Mar. 18, 2005).

107

See Amendment to Rule 102(e) of the Commission's Rules of Practice,
SEC Release No. 34-40567 (Oct. 26, 1998) (“[T]he Commission is not adopting a standard that reaches single acts of simple negligence.”).

108
Comment Letter from Center for Audit Quality at 7; Comment Letter from Moss Adams LLP at 3 (Nov. 3, 2023). One commenter observed that the Commission proposed but ultimately declined to adopt an ordinary negligence standard for contributory conduct by accountants under Rule 102(e). But as that commenter also recognized, the Commission did so while expressly acknowledging that an ordinary negligence standard in Rule 102(e) would have been duplicative of authority that it already possessed.
See
SEC Release No. 34-40567 (“Moreover, the Commission possesses authority, wholly independent of Rule 102(e), to address and deter such errors through its enforcement of provisions of the federal securities laws that impose liability on persons, including accountants, for negligent conduct.”). The Board, by contrast, lacks ability to pursue contributory negligent conduct based on the current formulation of Rule 3502.

To be sure, those commenters are correct that the cases cited in footnote 52 of the Proposal involve proceedings under Commission Rule 102(e), as well as under Section 21C. Commenters, however, did not appear to contest that the Commission has the authority to bring proceedings for single acts of ordinary negligence under Section 21C, including for civil money penalties (authorized by Section 21B),
without also proceeding under Commission Rule 102(e).
109

Rather, commenters instead suggested only that the Commission rarely exercises such authority in practice. While that may be the case, the Board's point nonetheless remains: The amendment to Rule 3502's liability threshold does not subject auditors to any new or different standard to govern their conduct.

109
Indeed, civil money penalties are not available under Commission Rule 102(e)—only censure or denial (temporary or permanent) of the privilege of appearing or practicing before the Commission. 17 CFR 201.102(e). Thus, the Commission would not need to meet Rule 102(e)'s “highly unreasonable conduct” standard to impose a civil money penalty for a single act of negligence under Section 21B of the Exchange Act.

The Commission release cited by certain commenters when advancing the contrary argument makes this point abundantly clear. In it, the Commission stated that a single act of negligence “may result in a violation of the federal securities laws” and that “the person committing such an error, though not subject to discipline under Rule 102(e), would be exposed to the sanctions available under [such] other provisions.”
110

The Commission noted elsewhere in its release that a single act of ordinary negligence “could have legal consequences.”
111

110
SEC Release No. 34-40567 at n.28;
see also id.
at n.38 (“In other instances, the federal securities laws expressly subject auditors to liability without requiring intentional misconduct. . . . [S]ection 21C of the Exchange Act imposes liability when a person is a `cause' of a violation `due to an act or omission the person knew or should have known would contribute to such violation.' ”).

111

Id.
at n.47.

One commenter suggested that Section 21C proceedings are an inapt analog for charges under Rule 3502 because Section 21C was intended to quickly enjoin conduct that may lead to violations, but was not designed to be a sanctions-imposing provision. Whether that was the original intent of Section 21C,
112

Section 21B now indisputably allows for sanctions (in the form of monetary penalties) in a proceeding under Section 21C when an auditor or any other person was negligent in causing violations by others. Indeed, much like Section 21B's direct-violation provision, the text of the secondary-violation provision in Section 21B expressly contemplates the imposition of a penalty based on conduct that
already
occurred.
113

112
The commenter's cited authority does not appear to support that view.
See
Andrew M. Smith,
SEC Cease-and-Desist Orders,
51 Admin. L. Rev. 1197, 1226 (1999) (“The legislative history of the [statute that includes Section 21C] is not clear as to whether Congress intended to require the SEC to find a reasonable likelihood of future violation before imposing a cease-and-desist order, although a strong argument can be made that Congress did not intend to require the SEC to make such a finding. In addition, most, if not all, of the proponents and architects of cease-and-desist authority, and many who have commented on the [relevant statute] and its predecessor legislative proposals, believe that such a finding is not necessary.”).

113
15 U.S.C. 78u-2(a)(2)(B) (“In any proceeding instituted under [Section 21C] against any person, the Commission may impose a civil penalty, if the Commission finds, on the record after notice and

opportunity for hearing, that such person . . . is
or was
a cause of the violation of any provision of this chapter, or any rule or regulation issued under this chapter.” (emphasis added));
see also
Smith,
supra,
at 1199 (“[Section 21C's] plain language—`has violated'—appears to authorize the SEC to base a cease-and-desist order upon a
single past violation,
without any showing that the violator is likely to break the law in the future.” (emphasis added)).

This commenter also posited that, in addition to a primary violation, Section 21C also requires a finding of harm to the public that was in part caused by a contributory negligent act. While that may be the case for issuance of a temporary order pursuant to Section 21C(c), no such finding is required for imposition of a monetary penalty under Section 21B.
114

And regardless, although harm is not an element of proof for a Rule 3502 violation, inherent in any proceeding under Rule 3502 is the foundational principle that the Board is bringing the proceeding and imposing sanctions “to protect the interests of investors and further the public interest in the preparation of informative, accurate, and independent audit reports.”
115

114

Compare
15 U.S.C. 78u-3(c)(1),
with id.
78u-2(a)(2). In any event, it would appear that harm to the public interest is sufficient, but not
required,
for a temporary restraining order under Section 21C, as that provision allows the Commission to enter a temporary restraining order “[w]henever the Commission determines that the alleged violation or threatened violation . . . is likely to result in significant dissipation or conversion of assets, significant harm to investors,
or
substantial harm to the public interest.”
Id.
78u-3(c)(1) (emphasis added).

115
Section 101(a) of Sarbanes-Oxley. As the Commission has recognized, moreover, even “unreasonable, or negligent, accounting or auditing errors . . . could undermine accurate financial reporting.” SEC Release No. 34-40567.

Another commenter remarked that in a Commission proceeding for ordinary negligence under Section 21C (and not also for highly unreasonable conduct under Rule 102(e)), the Exchange Act limits what sanctions the Commission can impose, and in the commenter's view, the Commission lacks the authority to impose certain sanctions that the Board can impose. But while the available sanctions for a single act of negligence might be different in a proceeding under Rule 3502 compared with one under Section 21C—indeed, the Commission can seek certain sanctions that the Board cannot
116

—Sarbanes-Oxley
does
place express limits on what sanctions the Board can impose.
117

In the Board's view, that the limitations on sanctions in the Exchange Act and in Sarbanes-Oxley, respectively, might not be the same in all respects does not render the Board's enforcement authority “unprecedented.”
118

116
The Commission's authority is more expansive in other ways, as well. For example, as noted in the Proposal, the Commission is not limited to holding accountable auditors for contributory conduct with respect to primary violations committed only by registered firms; rather, the Commission also may hold accountable auditors who cause violations by any other person, including issuers.
See
2023 Proposing Release at 9 n.33. Additionally, while Rule 3502 applies only to associated persons of registered firms, the Commission's authority under Section 21C is not so limited; it applies to “any person,” including nonaccounting professionals. 15 U.S.C. 78u-3(a);
see also id.
78c(a)(9) (defining “person”).

117

See
Section 105(c)(5) of Sarbanes-Oxley. One commenter sought clarity with respect to footnote 48 of the Proposal, and specifically the circumstances under which the Board would be permitted to impose heightened sanctions. The Board takes this opportunity to clarify that, although the amendment to Rule 3502 allows the Board to sanction single instances of negligent contributory conduct, the heightened sanctions referenced in Section 105(c)(5) of Sarbanes-Oxley—specifically, those sanctions listed in subparagraphs (A) through (C) and (D)(ii) of Section 105(c)(4)—would
not
be available for a Rule 3502 violation absent a finding that the individual who violated Rule 3502 acted at least recklessly or committed repeated acts of negligence each resulting in a violation of an applicable statutory, regulatory, or professional standard.

118
Comment Letter from Center for Audit Quality at 8. This commenter also sought to cast as inappropriate a negligence standard for Rule 3502 in light of the mental state required for aiding and abetting liability. The Board agrees with the commenter that aiding and abetting generally requires knowing conduct, which is why the Board has not relied on that theory of liability—in 2004, in 2005, in the Proposal, or now—as an analog or basis for Rule 3502.
See, e.g.,
2005 Adopting Release at 11 n.20 (“Rule 3502, of course, differs from an aiding-and-abetting cause of action in important respects. Among other things, the rule does not apply whenever an associated person causes another to violate relevant laws, rules and standards. Rather, Rule 3502 applies only when an associated person causes a violation by the registered firm with which the person is associated.”).

D. Authority for the Amendment

Several commenters expressed doubt regarding the Board's statutory authority for the amendment in two respects: They questioned whether the Board has the authority to sanction single acts of ordinary negligence as a general matter (
i.e.,
in cases of direct violations or otherwise), and they questioned the Board's authority to promulgate a contributory liability rule at the negligence standard. In general, these commenters asserted that the Board's authority in these respects is either unclear or rests on questionable interpretations of Sarbanes-Oxley. One commenter further opined that the Proposal ignores congressional intent and that the Board's authority is “not as settled as the Proposal assumes,”
119

and still another comment letter posited that Sarbanes-Oxley is clear that in the absence of repeated negligence, sanctions should not be imposed.

119
Comment Letter from U.S. Chamber of Commerce at 2.

Although the Board believes that its authority in both respects is well-settled for reasons the Board has previously explained,
120

the Board nonetheless addresses these commenters' views.

120

See
2004 Proposing Release at 18; 2005 Adopting Release at 10-12;
see also
2023 Proposing Release at 12 n.43.

1. Authority To Sanction Single Acts of Negligence Generally

The text of Section 105 of Sarbanes-Oxley plainly permits the Board to impose liability for single acts of negligence. Specifically, Section 105(c)(4) authorizes the Board to impose an array of sanctions—listed in subparagraphs (A) through (G)—upon finding that a registered firm or associated person engaged in violative conduct, without reference to the level of culpability required but “subject to applicable limitations” in Section 105(c)(5). Section 105(c)(5), in turn, provides that “[t]he sanctions and penalties described in subparagraphs (A) through (C) and (D)(ii) of [Section 105(c)(4)] shall only apply to [ ] intentional or knowing conduct, including reckless conduct,” or “repeated instances of negligent conduct each resulting in a violation of the applicable statutory, regulatory, or professional standard.” Section 105(c)(5) thus does not restrict the Board's authority to impose for single acts of negligence certain sanctions—those in subparagraphs (D)(i) and (E) through (G) of Section 105(c)(4).

The Board has long recognized this grant of authority,
121

as did multiple commenters. One commenter agreed that the Board has had authority to bring enforcement proceedings for negligence “[s]ince the PCAOB's creation,”
122

and another posited that Congress “clearly” intended for the Board to sanction associated persons for negligent conduct.
123

Still another asserted that Sarbanes-Oxley “empowers” the Board

to sanction associated persons in instances “when their conduct was not intentional or reckless.”
124

Indeed, this latter commenter opined that the Proposal created a “misimpression” that associated persons currently can
only
be sanctioned for intentional or reckless misconduct.
125

This of course was not the Board's intent.

121
Two decades ago, the Board stated:

The Act
plainly contemplates that disciplinary proceedings can be instituted for a violation based on a single negligent act.
Section 105(c)(5) of the Act provides that the Board may impose the more severe sanctions authorized by section 105(c)(4) only in cases that involve intentional or knowing conduct (including reckless conduct) or repeated instances of negligent conduct. Implicit in that provision is that
a violation based on a single instance of negligent conduct is sufficient to warrant a disciplinary proceeding to impose lesser sanctions.

PCAOB Release No. 2003-015, at A2-58-59 (emphases added);
see also id.
at A2-76 (“[S]ection 105(c)(5) of the Act requires scienter or repeated negligence for imposition of the most severe sanctions. The Act does not limit the standard that must be met for imposition of other sanctions.”); 2005 Adopting Release at 12 n.23.

122
Comment Letter from North American Securities Administrators Association, Inc. at 1 (Nov. 13, 2023).

123
Comment Letter from Center for American Progress at 3.

124
Comment Letter from Ernst & Young LLP at 2.

125

Id.

Other commenters, however, took the opposite view. One comment letter opined that, when read together, the provisions of Sections 105(c)(4) and (c)(5) discussed above make clear that unless negligent conduct is repeated, sanctions and penalties “should not be applied.”
126

If Congress had intended for
all
sanctions listed in Section 105(c)(4) to be unavailable absent reckless conduct or repeated acts of negligence, however, then it would have had no reason to make the specific carve-outs that it did in Section 105(c)(5); there would be no point to them. Such an interpretation thus runs contrary to both Section 105(c)(5)'s text and the bedrock principle of statutory construction to not read a statute in a way that renders language superfluous.
127

126
Comment Letter from Eight Accounting Professors (Cannon, et al.) at 4 (Nov. 2, 2023).

127

See, e.g., FCC
v.
NextWave Personal Cmmc'ns Inc.,
537 U.S. 293, 302 (2003) (“[E]ven § 525(a) itself contains explicit exemptions for certain Agriculture Department programs. These latter exceptions would be entirely superfluous if we were to read § 525 as the Commission proposes—which means, of course, that such a reading must be rejected.”);
see also TRW Inc.
v.
Andrews,
534 U.S. 19, 31 (2001) (“[W]ere we to adopt [respondent's] construction of the statute, the express exception would be rendered insignificant, if not wholly superfluous.” (citation and quotation marks omitted)).

2. Authority for a Negligence-Based Contributory-Liability Rule

Congress intended to grant to the Board “plenary authority” to establish or adopt ethics standards.
128

To that end, Section 103(a)(1) of Sarbanes-Oxley mandates that the Board

128
S. Rep. 107-205, at 8.

shall, by rule, establish . . . and amend or otherwise modify or alter, such auditing and related attestation standards, such quality control standards, such ethics standards, and such independence standards to be used by registered public accounting firms in the preparation and issuance of audit reports . . . as may be necessary or appropriate in the public interest or for the protection of investors.
129

129

See also
Section 101(c)(2) of Sarbanes-Oxley.

As the Board twice recognized nearly two decades ago—once when it proposed Rule 3502 and again when the Board adopted it—a contributory liability rule merely codifies auditors' longstanding ethics obligations.
130

130
2004 Proposing Release at 18;
see
2005 Adopting Release at 9. Beyond codifying auditors' ethics obligations, Rule 3502 is also “essential to the proper functioning of the Board's independence rules.” 2004 Proposing Release at 19;
see also
2005 Adopting Release at 14. As the Board previously explained:

For example, Rule 3521 provides, in part, that a registered firm is not independent of its audit client if the firm provides that audit client with a service for a contingent fee. When an associated person causes . . . the registered firm to provide that service for a contingent fee, Rule 3502 would allow the Board to discipline the associated person for that conduct.

2005 Adopting Release at 14.

Some commenters nonetheless expressed doubt about whether the statutory authority to regulate ethical conduct equates to a statutory authority to sanction negligent conduct. In doing so, one such commenter appeared to interpret the Proposal's discussion of the Commission's authority under Section 21C of the Exchange Act to mean that the Board was relying on that provision as authority for the amendment. The Board, however, did not rely (and is not relying) on Section 21C of the Exchange Act as a source of authority for its negligent contributory-liability standard; rather, the Board agrees with the commenter that such provision applies only to the Commission. The Proposal's discussion of Section 21C instead was meant to show that, by adopting a negligence threshold in Rule 3502, the Board would not be subjecting auditors to any new standard to govern their contributory conduct.
131

131
2023 Proposing Release at 14 (discussing Section 21C and concluding: “Thus, the proposed amendment to Rule 3502's liability threshold would not subject auditors to any new or different standard to govern their conduct.”).

As the Board previously explained, “an associated person's ethical obligation is not merely to refrain from knowingly causing a violation but also to act with sufficient care to avoid negligently causing a violation.”
132

Such obligation has deep historical roots. For instance, the AICPA's Code of Professional Conduct at the time that Sarbanes-Oxley was enacted (and still today) made it an “act discreditable to the profession”—and therefore a violation of its ethics rules
133

—for a member accountant to “
permit[ ] or direct[ ] another
to make[ ] materially false and misleading entries in the financial statements or records of an entity” “
by virtue of his or her negligence.”

134

Just the same if a member were to “
permit[ ] or direct[ ] another
to sign[ ] a document containing materially false and misleading information” “
by virtue of his or her negligence.”

135

132
2005 Adopting Release at 9.

133
The AICPA's
Ethics Rulings
are a body of decisions made by the AICPA's professional ethics division's executive committee that “summarize the application of Rules of Conduct and Interpretations to a particular set of factual circumstances.” Introduction, Code of Professional Conduct (as Adopted January 12, 1988),
available at https://us.aicpa.org/content/dam/aicpa/research/standards/codeofconduct/downloadabledocuments/2014december14codeofprofessionalconduct.pdf;

see also
AICPA Code of Professional Conduct § 0.500.01 (updated June 2020) (“The code is the only authoritative source of AICPA ethics rules and interpretations.” (italics omitted)).

134
AICPA Code of Professional Conduct, ET § 501.05(a),
Negligence in the Preparation of Financial Statements or Records
(emphases added),
recodified at
Section 1.400.040.01.

135

Id.
§ 501.05(c) (emphases added).

Congress clearly had in mind the AICPA Code of Professional Conduct when it authorized the Board to promulgate ethics standards. The AICPA had a prominent presence during the drafting of Sarbanes-Oxley and in the run up to its passage,
136

and beyond Congress empowering the Board to write its own ethics standards, it also empowered the Board to “adopt as its rules[ ] . . . any portion of any statement of auditing standards or
other professional standards”
and to “modify, supplement, revise, or subsequently amend, modify, or repeal, in whole or in part, any portion of any [such] statement.”
137

In other words, Congress authorized the Board to adopt (and later amend or modify) parts of the AICPA's Code of Professional Conduct as the Board's ethics standards, and at the time of Sarbanes-Oxley's enactment, that Code included prohibitions on negligent contributory conduct.

136
During committee hearings for Sarbanes-Oxley, the Senate heard testimony from five individuals who were serving, or previously had served, in leadership roles within the AICPA (including the AICPA's then-current Chair and its former Chair), and also relied on data provided by the AICPA.
See
S. Rep. 107-205, at 3-4, 61, 63;
see also
H.R. Rep. No. 107-414, at 19 (2002) (noting that the AICPA's then-President and CEO provided testimony to a House of Representatives committee on a related bill).

137
Section 103(a)(3) of Sarbanes-Oxley (emphasis added). In 2003, the Board adopted parts of the AICPA Code of Professional Conduct as its interim ethics standards,
Establishment of Interim Professional Auditing Standards,
PCAOB Release No. 2003-006, at 10 (Apr. 18, 2003), and the Commission approved such adoption “as consistent with the requirements of [Sarbanes-Oxley],”
Order Regarding Section 103(a)(3)(B) of the Sarbanes-Oxley Act of 2002,
SEC Release No. 34-47745 (Apr. 25, 2003).

One commenter cited a provision of the AICPA Code of Professional Conduct that has a “knowingly” standard for contributory conduct (Section 0.200.020.04). This commenter also cited the Board's then-proposed (now-adopted) EI 1000,
Integrity and Objectivity,
to note that the definition of “integrity” in that standard includes

“[n]ot knowingly or recklessly misrepresenting facts,” without reference to negligence.
138

However, this commenter did not acknowledge that the AICPA Code also has contributory-conduct provisions at the negligence standard, as discussed above.

138
QC 1000 Release at A4-1.

Certain commenters compared the Board's authority for a contributory negligence standard in Rule 3502 to private plaintiffs' inability to bring suit under Section 10(b) of the Exchange Act
139

for aiding and abetting securities fraud. To be sure, in
Central Bank of Denver,
the U.S. Supreme Court held that “there is no private aiding and abetting liability under § 10(b)” “[b]ecause the text of § 10(b) does not prohibit aiding and abetting.”
140

But that holding regarding an implied private right of action has little bearing on the Board's authority for the amendment.

139
15 U.S.C. 78j.

140

Cent. Bank of Denver, N.A.
v.
First Interstate Bank of Denver, N.A.,
511 U.S. 164, 191 (1994).

The Board draws its authority for the amendment from different text in a different statute. As explained above, Congress empowered the Board to promulgate ethics standards pursuant to Section 103(a) of Sarbanes-Oxley, which is distinct from any congressional grant of authority to the Commission, including those in Sections 10(b) or 21C of the Exchange Act.
141

There is no analogous statutory mandate for the Commission to “establish . . . ethics standards” in the area of auditors' professional responsibility.

141
Section 105 of Sarbanes-Oxley also supplies authority to adopt the proposed amendment.
See
2005 Adopting Release at 12; 2023 Proposing Release at 12 n.43. As the Board previously explained, “Section 105 authorizes the Board to investigate and, when appropriate, discipline registered firms
and
their associated persons,” and because (1) “[c]ertain types of violations, by their nature, may give rise to direct liability only for a registered public accounting firm,” and (2) “[s]uch firms . . . can only act through the natural persons that comprise them,” it follows that (3) “[w]hen one or more of those associated persons has caused that firm to” commit a violation, “it is appropriate, and consistent with the Board's duty to discipline registered firms and their associated persons under Section 101(c)(4) of the Act, that the Board be able to discipline the associated person for that misconduct.” 2005 Adopting Release at 12.

The Board, however, indisputably
does
have such a mandate in Section 103(a)(1) of Sarbanes-Oxley,
142

and with that distinct mandate comes distinct authority.
143

Indeed, as the Commission recognized when approving the Board's adoption of Rule 3502 in 2006, “the rule is within the scope of the PCAOB's authority, particularly its authority to establish ethical standards.”
144

Section 103(a)(1), moreover, is an enabling (or authorizing) statute that permits the Board to establish standards to govern the preparation and issuance of audit reports “as may be necessary or appropriate in the public interest,” which text provides broad rulemaking authority.
145

142
One commenter remarked that Section 103 “is not untethered” from the rest of Sarbanes-Oxley. Comment Letter from U.S. Chamber of Commerce at 4. The Board agrees: Section 103 tethers
directly
to Section 101(c)(2), which mandates that the Board “establish or adopt, or both, by rule, auditing, quality control, ethics, independence, and other standards . . . in accordance with section 7213 [103] of this title.” Indeed, doing so is an express “Dut[y] of the Board” under Section 101(c). Section 101(c)(2) is thus another source of authority for the Board's amendment.

143
Nor does Section 103(a) of Sarbanes-Oxley include the telltale terms of a statute that requires a mental state higher than negligence, as does Section 10(b) of the Exchange Act.
See Ernst & Ernst
v.
Hochfelder,
425 U.S. 185, 197 (1976) (“Section 10(b) makes unlawful the use or employment of `any manipulative or deceptive device or contrivance' in contravention of Commission rules. The words `manipulative or deceptive' used in conjunction with `device or contrivance' strongly suggest that § 10(b) was intended to proscribe knowing or intentional misconduct.”);
id.
at 199 (“The argument simply ignores the use of the words `manipulative,' `device,' and `contrivance' [are] terms that make unmistakable a congressional intent to proscribe a type of conduct quite different from negligence.”).

144
Order Approving Proposed Ethics and Independence Rules Concerning Independence, Tax Services, and Contingent Fees and Notice of Filing and Order Granting Accelerated Approval of the Amendment Delaying Implementation of Certain of these Rules, SEC Release No. 34-53677, at 9 (Apr. 19, 2006).

145

See, e.g., AT&T Corp.
v.
Iowa Utils. Bd.,
525 U.S. 366, 377-78 & n.5 (1999) (construing a provision allowing the FCC to “prescribe such rules and regulations as may be necessary in the public interest to carry out” the relevant statute as a “general grant of rulemaking authority” sufficient for the FCC to promulgate the regulations at issue);
Metrophones Telecommc'ns, Inc.
v.
Global Crossing Telecommc'ns, Inc.,
423 F.3d 1056, 1068 (9th Cir. 2005) (“Given the reach of the [FCC's] rulemaking authority under § 201(b)”—which granted to the FCC the “broad power to enact such `rules and regulations as may be necessary in the public interest to carry out the provisions of this Act' ”—“it would be strange to hold that Congress narrowly limited the Commission's power to deem a practice `unjust or unreasonable.' ”);
Brown
v.
Azar,
497 F. Supp. 3d 1270, 1281 (N.D. Ga. 2020) (“[W]hen an agency is authorized to `prescribe such rules and regulations as may be necessary in the public interest to carry out the provisions of the Act,' Congress' intent to give an agency broad power is clear.”),
appeal dismissed as moot,
20 F.4th 1385 (11th Cir. 2021) (mem.).

So, too, is Section 101(g)(1) of Sarbanes-Oxley—yet another source of authority for the amendment. That provision authorizes the Board to promulgate rules to “provide for . . . the exercise of its authority, and the performance of its responsibilities under this Act,” which include “enforc[ing] compliance” with applicable laws, rules, and standards; “conduct[ing] investigations and disciplinary proceedings”; and “impos[ing] appropriate sanctions where justified.”
146

Section 101(g)(1) thus empowers the Board to implement the Board's “ultimate purposes” under Sarbanes-Oxley of “protect[ing] the interests of investors and further[ing] the public interest in the preparation of informative, accurate, and independent audit reports.”
147

The amendment, and Rule 3502 generally, do precisely that.

146
Sections 101(c)(4) and (6) of Sarbanes-Oxley.

147
Section 101(a) of Sarbanes-Oxley;
In re Permian Basin Area Rate Cases,
390 U.S. 747, 780 (1968) (“We are, in the absence of compelling evidence that such was Congress' intention, unwilling to prohibit administrative action imperative for the achievement of an agency's ultimate purposes.”);
see Doe
v.
FEC,
920 F.3d 866, 870-71 (D.C. Cir. 2019) (“When an agency's `empowering provision' ” permits the agency “`to make, amend, and repeal such rules . . . as are necessary to carry out the provisions of' ” the statute, “the courts will sustain a regulation that is `reasonably related' to the purposes of the legislation.” (citations omitted)).

Statement Regarding the Proposed Amendment To Clarify the Relationship Between Contributory Actor and Primary Violator

As noted above, in addition to proposing a change in Rule 3502's liability standard, the Proposal also contemplated amending Rule 3502 to provide that an associated person contributing to a violation need not be an associated person of the registered firm that commits the primary violation (
i.e.,
that an associated person of one registered firm can contribute to a primary violation of another registered firm).
148

Specifically, the Board proposed changing the word “that” to “any” immediately before the reference to the registered public accounting firm that commits the primary violation. After due consideration, the Board has decided not to adopt any changes to Rule 3502 to implement this aspect of the Proposal, for two primary reasons.

148

See
2023 Proposing Release at 16-17.

First, as the Proposal explained, the Board's rules already contemplate that associated persons can be associated with more than one registered firm at the same time.
149

Specifically, PCAOB Rule 1001(p)(i)'s definition of an “associated person” provides that if a firm reasonably believes that one of its associated persons is primarily associated with another registered firm, then that person is excluded from the definition of an “associated person,” but only “for purposes of completing a registration application on Form 1, Part IV of an annual report on Form 2, or Part IV of a Form 4 to succeed to the registration status of a predecessor.” For all other purposes, that carveout does not apply, thus underscoring that, in the context of Rule 3502's reference to an

“associated person,” a person can be associated with two or more registered firms at once.

149

See id.
at 10 n.36.

Second, an individual who “directly and substantially” contributes to a firm's violation (consistent with the meaning of that phrase in Rule 3502, as described above) in all instances likely also will have “participate[d] as agent
or otherwise on behalf of
such [ ] firm in
any
activity of that firm” “
in connection with
the preparation or issuance of
any
audit report,” and thus be an “associated person” of that firm.
150

In the Board's view, this definition of “associated person,” in combination with the notion that a person can be associated with multiple firms at the same time, renders unnecessary the proposed change from “that” to “any” in Rule 3502.

150

See
Section 2(a)(9) of Sarbanes-Oxley (emphases added); PCAOB Rule 1001(p)(i).

The Board appreciates commenters' feedback on this aspect of the Proposal. As one commenter surmised, this aspect of the Proposal was aimed at providing for equal accountability by associated persons as firm structures evolve. Based on the two points noted above, however, the Board believes that such accountability currently exists.
151

It was not the Board's intent through this aspect of the Proposal to deter collaboration or the sharing of perspectives between firms. And, to the extent that commenters believe that this aspect of the Proposal would exacerbate their concerns with respect to a negligence standard, the Board's decision not to adopt any amendment in this regard should help to alleviate those concerns.

151
Beyond these two points, one commenter opined that “in most, if not all, cases,” an auditor's direct and substantial contribution to a primary violation by a firm with which the auditor is
not
associated also would have at least negligently, directly, and substantially contributed to a primary violation by a firm with which the auditor
is
associated. Comment Letter from Ernst & Young LLP at 4. This proposition further underscores the point that no clarifying amendment is needed given the current regulatory framework.

Effective Date

If the amendment to PCAOB Rule 3502 is approved by the Commission, then (as proposed) the Board intends that it would become effective 60 days from the date of Commission approval.
152

In that regard, the Board anticipates that conduct occurring more than 60 days after Commission approval would be subject to Rule 3502, as amended, but that conduct occurring prior to, or within 60 days after, Commission approval would not be subject to the amendment to Rule 3502.

152

See
2023 Proposing Release at 31.

Commenters expressed mixed views regarding the effective date. One commenter agreed that 60 days after Commission approval is appropriate, and another stated that it did not disagree with the Board's basis for an effective date 60 days after Commission approval. Another commenter stated that it could not comment on an appropriate effective date because the Board should redeliberate and repropose amendments to Rule 3502. Other commenters encouraged the B

[Text truncated at 120,000 characters. The full text is on the page linked above.]

---

Source: Frix Law Library, https://www.frixlaw.com/law-library/documents/fr%3A2024-14487. Public record. Not legal advice.