PCAOB Registration for CPA Firms: What Section 102 Requires

A CPA firm that takes its first SEC registrant client meets a statute before it meets a standard. Section 102 of the Sarbanes-Oxley Act says who may touch an issuer audit report at all. This guide reads that section and the inspection section that follows it, and sets out what a firm should settle before it signs an engagement letter for an issuer.

The rule: no registration, no issuer audit report

Section 102(a), codified at 15 U.S.C. 7212(a), makes it unlawful for any person that is not a registered public accounting firm to prepare or issue an audit report for an issuer, broker or dealer, or to participate in doing so. The word "participate" matters. The prohibition reaches a firm that does part of the work behind another firm's report, not only the firm that signs.

Two consequences for engagement acceptance:

• A firm that is not registered cannot accept an issuer audit engagement, however small the client.
• A registered firm that brings in another firm to do audit work on an issuer should confirm that the other firm is registered too.

What the application contains

Section 102(b)(2) sets out what an application must include, in the form the Board prescribes by rule:

• Clients. The names of issuers, brokers and dealers for which the firm prepared or issued audit reports during the prior calendar year, and those for which it expects to do so during the current calendar year.
• Fees. The annual fees received from each such client for audit services, other accounting services and nonaudit services.
• Financial information. Other current financial information for the most recent fiscal year that the Board reasonably requests.
• Quality control. A statement of the firm's quality control policies for its accounting and auditing practices.
• People and licenses. A list of the accountants who participate in or contribute to the audit reports, with the license or certification number of each, and the firm's own state license numbers.
• Proceedings. Information on criminal, civil or administrative actions, or disciplinary proceedings, pending against the firm or any associated person relating to audit reports.
• Disagreements. Copies of any periodic or annual SEC filings of issuers from the prior year that disclose accounting disagreements between the issuer and the firm over an audit report.
• Other information. Anything else the Board's rules or the SEC require as necessary or appropriate in the public interest or for the protection of investors.

Section 102(b)(3) adds consents. The applicant consents to cooperate with Board requests for testimony or documents, and secures similar consent from each associated person as a condition of employment. The firm also acknowledges that compliance is a condition to the continuing effectiveness of the registration.

Timing and fees

Under Section 102(c), the Board must approve a complete application within 45 days of receipt unless, before then, it issues a written disapproval or requests more information. A written disapproval is treated as a disciplinary sanction for purposes of the statute's enforcement provisions. The Board assesses a registration fee and an annual fee set to recover the cost of processing and reviewing applications and annual reports.

Plan the intake calendar from the 45 days. The firm holds all issuer audit work until registration is in place.

Annual reports and public record

Each registered firm files an annual report and may be required to report more often. These reports update the application information. Section 102(e) makes applications and annual reports available for public inspection, subject to the Board's and SEC's rules and confidentiality laws, and requires the Board to protect from public disclosure information the firm reasonably identifies as proprietary. A firm should mark proprietary content when it files.

The client list, fee breakdown and disagreement filings in the application mean that a firm's issuer practice is a matter of public record to the extent the Board's rules provide.

Inspections follow registration

Section 104, 15 U.S.C. 7214, provides for a continuing program of inspections to assess each registered firm's and its associated persons' compliance with the Act, the Board's and SEC's rules, and professional standards in audits of issuers. Frequency under the statute depends on size of the issuer practice: annual for a firm that regularly audits more than 100 issuers, and at least once every three years for a firm that audits 100 or fewer. The Board may adjust these schedules by rule.

The scope of an inspection includes a review of selected audit and review engagements across offices and personnel, and an evaluation of whether the firm's quality control system is sufficient and how the firm documents and communicates it. The statute lets the Board require firms to keep records for inspection purposes. The firm may respond to a draft inspection report, and the response is attached to the final report with confidential information redacted. Criticisms of quality control defects are withheld from the public report if the firm addresses them to the Board's satisfaction not later than 12 months after the date of the inspection report.

For a small firm, the implication is practical: registration brings the firm into the inspection program, and the quality control documentation is part of what inspectors evaluate. See SQMS 1 quality management.

A worked intake decision

Alder & Finch LLP, a six-partner firm, is asked to audit Corvane Holdings, a company preparing a registration statement. The firm has never audited an issuer.

1. Registration check. The firm is not registered. It cannot prepare, issue or participate in an issuer audit report until registered, so it cannot accept the engagement as drafted.
2. Application. The firm gathers the application contents: its expected issuer client list (Corvane), fee expectations for audit and nonaudit services, quality control statement, list of accountants and license numbers, and any pending proceedings.
3. Timetable. The application's 45-day review period runs before the first procedure that counts as participating in the audit report. The engagement letter's start date is set after approval.
4. Associated persons. The firm's application includes its agreement to secure and enforce cooperation consents from its associated persons as a condition of their continued employment or association with the firm, as Section 102(b)(3) requires.
5. Inspection readiness. The firm builds the engagement file to the standard an inspector would test, including documentation of independence, quality control and the review chain.

The engagement letter is signed after the registration is effective.

Related reading

For the independence layer that applies once registered, see SEC auditor independence under Rule 2-01 and Rule 2-01 prohibited nonaudit services and partner rotation.

Where CORAA fits

CORAA prepares ready-to-review audit files for US CPA firms. The firm keeps the client, the review and the signature, and the registration and inspection obligations stay with the firm. See /us.

Sources

• Legal Information Institute, 15 U.S.C. 7212, Registration with the Board: https://www.law.cornell.edu/uscode/text/15/7212
• Legal Information Institute, 15 U.S.C. 7214, Inspections of registered public accounting firms: https://www.law.cornell.edu/uscode/text/15/7214

AU-C references are to AICPA Professional Standards, paraphrased here; read the standard itself before relying on a requirement. This page is guidance, not professional advice. Report an error