The Impact Of The SEC's New Whistleblower Rules On Public Accounting Firms: Some Initial Observations

The Securities and Exchange Commission ("SEC") adopted rules implementing the new whistleblower program mandated by the Dodd-Frank Wall Street Reform and Consumer Protection Act on May 25, 2011 ("Dodd-Frank").1 In broad terms, Congress believed that authorizing the SEC to pay substantial cash bounties to individuals who voluntarily come forward with credible information that leads to the successful prosecution of federal securities laws violations would strengthen the agency‟s ability to enforce those laws. Dodd-Frank requires the SEC to pay cash rewards of between 10–30% of any monetary sanctions in excess of $1 million that the Government, as a result of a whistleblower‟s assistance, recovers through administrative, civil, or criminal proceedings based on a violation of the securities laws. Such violations can involve private firms, public companies, or individuals.

This article discusses aspects of the SEC‟s new whistleblower rules that have special relevance to public accounting firms.2 They include (1) the treatment of whistleblower claims by personnel at a CPA firm relating to potential federal securities law violations by a firm‟s clients; (2) the treatment of whistleblower claims relating to potential federal securities law violations by a public accounting firm; and (3) practical considerations for CPA firms in light of the new rules. These considerations include the need for firms to review their existing quality controls for handling internal disagreements and situations within the scope of Section 10A of the Securities Exchange Act of 1934 ("Section 10A"), which requires CPA firms to craft procedures designed to detect illegal acts by issuer clients and to assess the adequacy of a client‟s response to allegations of potential wrongdoing.

The SEC's Dodd-Frank Whistleblower Rules

While Dodd-Frank set forth minimum requirements for a whistleblower program, the statute left the details of the program to the SEC to address through rulemaking. The SEC released its proposed rules last November and received more than 1,500 comments. Many commenters expressed concern that the SEC‟s proposals would subvert companies‟ existing compliance programs by permitting whistleblowers to bypass internal reporting mechanisms. For example, the Center for Audit Quality (the "CAQ") noted that, if employees failed to report concerns promptly through existing internal reporting mechanisms, the rules might have the unintended effect of increasing the number of instances where companies issued inaccurate financial statements.3 In addition, the CAQ and other commenters argued that the SEC‟s proposals failed to adequately recognize the existing legal and ethical obligations of CPAs and other professionals to maintain the confidentiality of client information.4 Despite these concerns, the SEC adopted the whistleblower rules substantially as proposed, with relatively minor revisions.

The final rules are quite detailed; indeed, the SEC‟s Adopting Release accompanying the new rules runs for over 300 pages. They generally preclude public accounting firm professionals from receiving whistleblower awards based on information about clients that was obtained through an audit or other mandatory engagement. There are exceptions to this general prohibition if the auditor believes that disclosure is necessary to prevent "substantial injury" to the company or investors, or if the auditor believes the client is engaging in conduct that "will impede an investigation of the misconduct." In addition, accounting firm personnel are allowed to allege that their own firms violated professional standards or securities laws, potentially entitling them to whistleblower awards based on successful enforcement actions against their firms or against clients. Although the SEC acknowledged that auditors "occupy a special position," the exceptions may overwhelm the general prohibitions against blowing the whistle on audit clients, impair auditor-client relationships, and pose new challenges for public accounting firms.

The SEC‟s new whistleblower rules also raise distinct issues for public accounting firms. Under the Sarbanes-Oxley Act of 2002 ("Sarbanes-Oxley"), virtually any violation of professional standards by a CPA firm involving an audit of an issuer can be cast as a federal securities law violation.5 Moreover, while the rules limit whistleblower awards to accountants in situations involving potential securities law violations by their clients, whistleblowers at a CPA firm are subject to fewer restraints when blowing the whistle on their own firms. Indeed, the SEC emphasized in its Adopting Release that accounting firm personnel could seek to recover whistleblower awards by alleging that their firms had failed to comply with Section 10A.6 Public accounting firms are required to exercise considerable judgment in many aspects of their practices, including when evaluating their duties under Section 10A. They may now find those judgments, which are already reviewable by the Public Company Accounting Oversight Board (the "PCAOB"), subjected to yet additional scrutiny, due to the incentives that have been created for whistleblowers.

Treatment of Claims Relating to Potential Violations by Firm Clients or Their Employees

Subject to several exceptions, which we discuss below, the SEC‟s new rules exclude whistleblower awards based on information obtained by CPA firm personnel in connection with audits and other engagements that are required under the federal securities laws. The rules also exclude information obtained when accounting firms provide certain services that are not required under the federal securities laws, but nevertheless support a client‟s compliance or internal audit functions, or a client‟s efforts to investigate possible violations of law. In addition, information that accounting firm personnel obtain in connection with a lawyer‟s engagement generally cannot serve as the basis for a whistleblower award. In comparison, information learned by accounting firm personnel while rendering other non-audit services to clients is not subject to similar restrictions.

Information Learned Through Financial Statement Audits and Other Engagements Required Under the Federal Securities Laws: Under Rule 21F-8(c)(4), information obtained through an audit of an issuer‟s financial statements is excluded from eligibility for whistleblower awards, if "making a whistleblower submission [based on such information] would be contrary to requirements of Section 10A." In the Adopting Release, the SEC noted that the most obvious example of such a situation would arise if an auditor neglected to file a report with the SEC‟s Office of the Chief Accountant that was required under Section 10A disclosing a client‟s failure to respond appropriately to evidence of violations, but instead made a whistleblower claim...