CPAB’s regulatory assessment program includes the inspection of audits conducted by a Firm. Firms are expected to resolve audit quality issues as they arise. The CPAB Rules (Rules) provide a framework of remediation and enforcement mechanisms to address audit quality deficiencies at the file and firm levels.
During the inspection process, a Firm and its engagement team are given the opportunity to provide their perspectives and written responses in relation to the facts, findings and recommendations arising from CPAB’s inspection. Once the inspection process has concluded, matters of ongoing concern may be escalated to CPAB’s Enforcement Department to determine if enforcement actions are required. Enforcement actions may include the imposition of an undertaking, requirements, restrictions, or sanctions.
An undertaking is a contractual agreement between the Firm and CPAB which sets out specific components of a remediation plan targeted to address concerns emanating from an inspection, special inspection, or investigation. Requirements typically involve CPAB mandating that the Firm implement targeted actions or change certain practices to improve audit quality, such as conducting a cultural assessment or providing additional training, etc. Restrictions typically involve CPAB limiting the audit firm’s practice, including restricting the Firm from taking on new reporting issuer clients, high risk reporting issuer clients or reporting issuer clients in particular industries. Sanctions typically include a public censure or termination of a firm’s status as a Firm.
CPAB may commence an investigation when it considers that a Violation Event may have occurred and wishes to seek additional information. A Violation Event includes conduct that breaches the CPAB Rules or professional standards for the audit profession and may have an impact on the provision of audit services. It also encompasses breaches of enforcement actions previously imposed on a Firm.
To impose enforcement actions on a Firm, a recommendation is first brought to CPAB’s Enforcement Screening Panel, comprised of senior members of the CPAB Leadership Team. The Enforcement Screening Panel will assess several factors including but not limited to the severity and frequency of the conduct, the enforcement history of the Firm (if any), the risk posed to the investing public and the Firm’s level of cooperation throughout the process. In circumstances where it is determined that enforcement actions should be pursued, a recommendation will be brought to the CPAB Board of Directors for evaluation and determination. If approved, the Firm will be notified of CPAB’s proposal to impose enforcement actions including the particulars of the undertaking, requirements, restrictions, or sanctions in question.
Should a Firm wish to challenge CPAB’s enforcement actions they may petition for a review proceeding before a panel of independent hearing officers within 15 days of receiving notice of the proposal to impose enforcement actions.
CPAB and the Firm may engage in settlement discussions throughout the process in an effort to reach a resolution acceptable to both parties.
Administrative matters that require clarification, or reasonable requests for extensions of certain deadlines can be addressed through informal discussions with Enforcement staff.
Following an inspection, special inspection, or investigation respecting a Participating Audit Firm (Firm), CPAB may propose to impose enforcement actions. Within 15 days of CPAB notifying the Firm of CPAB’s intent to impose enforcement actions, the Firm may petition for a review proceeding. The CPAB Rules (Rules) set out the review proceeding petition process for Firms that wish to challenge CPAB’s proposed enforcement actions.
CPAB maintains a roster of independent review hearing officers who may preside over review proceedings. The review hearing officers and the roster Chair are appointed by CPAB’s Council of Governors and are independent of CPAB. After a Firm petitions for a review proceeding, the Chair of the roster will appoint an independent panel of three review hearing officers to preside over the review proceeding.
During a review proceeding a Firm may challenge and the review panel will determine whether a Violation Event has occurred and/or whether to accept, reject or vary any of the proposed enforcement actions. If the review panel upholds CPAB’s determination and proposed enforcement actions, the Firm is required by the Rules to pay CPAB’s costs related to the review proceeding and any investigation that preceded it.
Other instances that may trigger a review proceeding by a Firm are set out in the Rules.
An order for an Investigation may be issued for a Participating Audit Firm (Firm) if CPAB considers that a Violation Event may have occurred. A Violation Event includes conduct that breaches the CPAB Rules (Rules) or standards of professional conduct for the audit profession that may have an impact on the provision of audit services. It also encompasses a breach of enforcement actions previously imposed on a Firm.
During an investigation CPAB may require or request access to documentation and information from Firms and third parties (including e-mails, text messages, instant messages, internal correspondence, materials provided to the Firm’s board of directors, audit working papers etc.) and require or request individuals (including a client of a Firm) to provide testimony with respect to any matter that CPAB considers relevant or material to an Investigation. Pursuant to the Participation Agreements that Firm’s sign prior to registration, CPABs investigation costs are recoverable from the Firm.
Once the investigation has concluded, if Violation Events have been identified, CPAB may recommend to the Enforcement Screening Panel that enforcement actions be proposed. If the recommendation is accepted, a proposal to impose enforcement actions is brought to the CPAB Board of Directors for evaluation and determination. If approved by the Board of Directors, formal notice is provided to the Firm outlining the specifics of the enforcement actions which are being proposed. In cases of serious misconduct, enforcement actions will include a public censure and result in the publication of the outcome of the investigation. This process does not preclude a negotiated settlement between the parties at any time throughout the process.
Pursuant to 603 of the Rules, a Firm has 15 days to petition for a review proceeding following the receipt of the notice. If the Firm does not petition for a review proceeding, written notification is provided advising that the enforcement actions are in effect.
Enforcement actions imposed as a result of an investigation will result in a public censure. In cases of serious misconduct, the publication will remain on CPAB’s website in perpetuity, for less serious matters the publication will be removed after a period of four years.
The following are concluded investigations where a public censure was imposed.
Enforcement actions may be imposed on a Participating Audit Firm (Firm) as a result of a special inspection, investigation, or unsatisfactory inspection results. The initial decision to propose the imposition of enforcement actions is determined by CPAB’s enforcement screening panel where each matter is reviewed, and a recommendation is brought to CPAB’s Board of Directors for approval.
Following a decision by the board to approve the imposition of enforcement actions, formal notice is provided to the Firm. Pursuant to Rule 603 of the CPAB Rules (Rules), a Firm has 15 days to petition for a review proceeding following the receipt of the notice. If the Firm does not petition for a review proceeding, a final written notice is sent at the end of the petition period indicating that the enforcement actions are in effect and the Firm must comply with them immediately.
Beginning on January 1, 2023, CPAB will begin publishing on its website the names of Firms that are subject to significant enforcement actions imposed as a result of a regulatory assessment.
Significant enforcement actions include:
- Termination of one or more audit engagements (601 (d)).
- Prohibition from accepting new reporting issuer clients (601(f)) (which may include reporting issuers in specific industries or other defined categories).
- Prohibition from assigning a designated professional to audits of reporting issuers (601(g)).
- Sanctions imposed under Rule 601 for breaching an existing requirement, restriction, or sanction.
- Termination as a participating audit firm.
Firms subject to enforcement actions imposed as a result of regulatory assessments prior to this date will not be publicly disclosed.
CPAB will continue its current process of publishing enforcement actions emanating from investigations.