June 2024 financial reporting, governance, and risk management

SEC proposes rule on customer identification programs for RIAs and ERAs

On May 13, 2024, the SEC and the Financial Crimes Enforcement Network (FinCEN) jointly issued a proposed rule to subject registered investment advisers (RIAs) and exempt reporting advisers (ERAs) to customer identification program (CIP) requirements. Generally consistent with existing requirements for other financial institutions, the proposal would require RIAs and ERAs to establish and maintain written CIPs to verify the identities of their customers (to a reasonable extent), obtain certain information on each customer, and maintain records on the information used to verify customer identity. The proposed rule is issued in tandem with a previous FinCEN proposal to designate RIAs and ERAs as “financial institutions” under the Bank Secrecy Act, which would subject them to reporting obligations related to anti-money laundering and countering terrorism.

Comments are due July 22, 2024.

SEC adopts final amendments on consumer information protections

On May 16, 2024, the SEC adopted final amendments to Regulation S-P to modernize and enhance protection of nonpublic consumer information obtained by covered financial institutions. Covered institutions include broker-dealers (including funding portals), investment companies, registered investment advisers, and transfer agents.

Among other provisions, the amendments require covered institutions to:

• Maintain written policies about detecting and responding to incidents of unauthorized access to sensitive consumer information
• Establish procedures to notify individuals whose information has been accessed without authorization, or is reasonably likely to have been accessed, as soon as practicable and no more than 30 days after the institution becomes aware of the incident
• Expand the scope of covered consumer information to include nonpublic personal information that a covered institution receives from other financial institutions, in addition to information that it collects directly from its own customers

Compliance dates are based on institution size. Larger entities must comply within 18 months of publication in the Federal Register, and smaller entities must comply within 24 months. Larger entities are defined in the final amendments as investment companies with $1 billion or more in net assets, registered investment advisers with $1.5 billion or more in assets under management, and broker-dealers and transfer agents not designated as small entities.

Chief accountant speaks on tone at the top at audit firms

On May 15, 2024, SEC Chief Accountant Paul Munter issued a statement on the responsibility of audit firm leadership to foster a healthy tone at the top. Munter emphasized the key role of the tone at the top in establishing firm culture, which in turn supports audit quality – for example, by empowering auditors to exercise professional skepticism and by serving as the foundation for an effective quality control system. Conversely, a weak firm culture could result in ethical misconduct by firm employees that undermines public trust in auditors. Munter stated that seeking investment from third parties that are not subject to auditor independence and ethics requirements, such as private equity firms, could create additional risks.

Munter highlighted the importance of leading by example, stating that audit firm leadership should:

• Take care that the firm’s actions align with its written code of conduct or ethics
• Incorporate ethics and character as key considerations in hiring, promotion, and compensation decisions to advance firm professionals who act ethically and serve as a positive example for less experienced staff
• Encourage candor and transparency, empowering employees of all levels to provide confidential feedback on the firm’s culture and report misconduct without fear of retaliation
• Conduct business strategy and communications to staff that reflect the importance of audit quality and compliance with professional standards

SEC issues statement on applying IFRS 19 in SEC filings

On May 17, 2024, Chief Accountant Munter and Division of Corporation Finance (CorpFin) Director Erik Gerding issued a joint statement on the application of International Financial Reporting Standard (IFRS) 19, “Subsidiaries Without Public Accountability: Disclosures,” which permits reduced financial statement disclosures for certain subsidiaries of eligible reporting companies that do not have public accountability. The statement addressed scenarios in which financial statements that apply IFRS 19 are included in an SEC filing. Munter and Gerding stated that entities in this scenario likely will be required to make additional disclosures due to investor use of those financials in the SEC filing.

CorpFin director releases statement on cybersecurity incident disclosures

On May 21, 2024, CorpFin Director Gerding issued a statement on the SEC’s rule requiring disclosure of material cybersecurity incidents on Item 1.05 of Form 8-K, encouraging companies that elect to make voluntary disclosures – for example, of incidents that are still undergoing assessment or incidents that have been determined immaterial – to do so on a different item of Form 8-K (such as Item 8.01) to avoid confusion or dilution of material disclosures required under Item 1.05. If a company does voluntarily disclose a cybersecurity incident under Item 8.01 but subsequently determines that the incident is material, it must still fully disclose the incident under Item 1.05.

Gerding emphasized that the materiality of a cybersecurity incident should be based on both qualitative and quantitative factors, including the impact on financial condition and results of operation; reputation; customer and vendor relationships; competitiveness; and possible litigation or regulatory actions that could arise from the incident.

Enforcement director speaks on cooperating with investigations

On May 23, 2024, Division of Enforcement Director Gurbir Grewal spoke on the benefits of cooperation with SEC investigations, stating that the division might recommend reduced or no charges or civil penalties to reward meaningful cooperation. Grewal described five principles of effective cooperation:

1. Self-policing prior to SEC involvement: Entities should encourage a culture of compliance and update risk awareness and compliance policies to keep up with technological advances.
2. Proactive self-reporting: Entities are encouraged to report as soon as they become aware of a potential issue; they don’t have to wait until they have reached a full conclusion. Proactive reporting can signal strong self-policing and an effective compliance culture, and it could help build credibility with SEC staff.
3. Proactive remediation: Meaningful cooperation credit can be given when an entity makes strong proactive remediation efforts prior to an enforcement action, even if the entity did not self-report.
4. Cooperation that goes “above and beyond”: Meaningful cooperation goes beyond bare minimum compliance efforts. For example, entities and their legal counsel can proactively call attention to relevant materials not included in initial requests, or they can aid the Enforcement team in contacting hard-to-reach witnesses.
5. Early, frequent, and purposeful collaboration: Establishing open communication with the Enforcement team is crucial to setting the foundations for meaningful cooperation.

Federal appeals court vacates private fund advisers rule

On June 5, 2024, the U.S. Court of Appeals for the 5th Circuit vacated the SEC’s final rule on private fund advisers, stating that the SEC exceeded its statutory authority in adopting the final rule. The rule, adopted in August 2023, prohibited private fund advisers from activities that result in preferential treatment to certain investors, and it required registered private fund advisers to issue quarterly statements for investors, among other provisions. The rule will be fully vacated in July 2024 absent further SEC action.

SEC holds Investor Advisory Committee meeting

The Investor Advisory Committee met on June 6, 2024. Agenda items included discussion of:

• The increasing trend of investment advice offered through social media
• Regulating the use of AI, disclosures of and data controls over AI, and the SEC’s role in advancing the responsible and ethical use of AI
• A recommendation regarding the protection of self-directed investors when trading complex products and using complex strategies
• A recommendation on financial literacy and investor education

PCAOB shares results from conversations with audit committee chairs

On June 11, 2024, the PCAOB released “Spotlight: 2023 Conversations With Audit Committee Chairs,” summarizing conversations with 230 audit committee chairs. The report presents high-level observations and key takeaways related to current economic and audit workforce environments. It also touches on significant discussions with auditors, monitoring quality control systems, and independence of the company’s auditors. The report includes PCAOB resources for audit committees.

PCAOB adopts new quality control standard

On May 13, 2024, the PCAOB adopted a new quality control standard that requires all PCAOB-registered firms to identify their risks and design a quality control (QC) system that includes policies and procedures to guard against those risks. Under the standard, firms would be required to annually evaluate their QC system and report the results of their evaluation to the PCAOB on a specific form, which would be certified by key firm personnel to reinforce individual accountability. Additionally, firms that annually audit more than 100 issuers would be required to establish an external oversight function for the QC system. Responsibilities of the external function would include evaluating the significant judgments made and the related conclusions reached by the firm when evaluating and reporting on the effectiveness of its QC system.

Subject to approval by the SEC, the new standard and related amendments will become effective on Dec. 15, 2025.

PCAOB Chair Erica Y. Williams shared thoughts on the new standard in a statement presented at the PCAOB open board meeting.

PCAOB adopts new standard on general responsibilities of the auditor

On May 13, 2024, the PCAOB adopted AS 1000, “General Responsibilities of the Auditor in Conducting an Audit,” which addresses the general principles and responsibilities of the auditor, including due professional care, professional skepticism, competence, and professional judgment. The new standard and related amendments provide clarification of the general principles and responsibilities of auditors and the auditor’s responsibility to evaluate whether the financial statements are presented fairly. They address the engagement partner’s due professional care responsibilities by adding specificity to certain audit performance principles detailed in the standards. In addition, they note that an auditor’s professional skepticism extends to other information that is obtained to comply with PCAOB standards and rules. The new standard also shortens the documentation completion date by reducing the maximum period for the auditor to assemble a complete and final set of audit documentation from 45 days to 14 days.

The new standard will apply to all audits conducted under PCAOB standards. Subject to SEC approval, the new standard will be effective for audits of financial statements for fiscal years beginning on or after Dec. 15, 2024. However, for certain firms, the documentation completion date will take effect for audits of financial statements for fiscal years beginning on or after Dec. 15, 2025.

PCAOB updates agendas

Citing the PCAOB’s progress in 2024 and continued drive toward its goal of modernizing its standards and rules, the PCAOB on May 14, 2024, posted updates to its standard-setting, research, and rulemaking agendas. The updates include:

• Two projects completed and awaiting SEC approval (quality control and general responsibilities of the auditor in conducting an audit)
• Two projects added to the short-term standard-setting agenda (Inventory and Other Reporting)
• A new project on internal audit added to the midterm agenda
• Timeline for the attestation standards update project updated to 2025
• Follow-on disciplinary proceedings project removed from the rulemaking agenda

CAQ analyzes financial restatement trends

In June 2024 the CAQ released a report, “Financial Restatement Trends in the United States: 2013-2022,” that examines the trends in public company restatements and provides insights into restatement characteristics, accounting issues underlying restatements, investor concerns and restatement severity, restatement company characteristics, internal controls over financial reporting, and critical audit matters (CAMs). The report noted, “Restatement activity is frequently used as an outcome-based measure of financial reporting quality.” Considering changes in both the regulatory and economic environments, an analysis of restatement trends might provide some insight into how the financial reporting ecosystem is managing factors that can affect the risk of material misstatement.

Among other findings, the analysis revealed:

• Expenses – specifically the misapplication of reporting rules for accruals, reserves, and estimates – are cited most frequently in restatement announcements.
• Fraud is implicated in 3% of restatements.
• The financial, banks, and insurance industry was identified as one of the top three industries reporting the most restatements.
• Public companies that have announced restatements are more likely to have ineffective internal control over financial reporting based on management’s assessment.
• Internal control over financial reporting reports are not predictive of restatements.
• CAMs do not provide information about restatement risk.