Non-Audit Service Restrictions of the Sarbanes-Oxley Act

Reproduced with permission from Daily Tax
Report, No. 185, pp. J-1 - J-5 (Sept. 24, 2002).
Copyright 2002 by The Bureau of National Affairs, Inc.

No. 185 Page J-1

Tuesday September 24, 2002

ISSN 1523-567X

Analysis & Perspective


The Non-Audit Service Restrictions of the Sarbanes-Oxley Act

By Thomas L. Riesenberg

Thomas L. Riesenberg is associate general counsel of Ernst & Young LLP. He is chairman of the American Bar Association's Business Law Section Committee on Law and Accounting and chairman of the Executive Council of Federal Bar Association's Securities Law Committee. He is also a member of the Advisory Board of the BNA Securities Regulation & Law Report. He served as an assistant general counsel and in other positions at the Securities and Exchange Commission from 1985 until 1993. The views expressed herein do not necessarily reflect the views of Ernst & Young or of Mr. Riesenberg's colleagues at Ernst & Young.

The authors of the Sarbanes-Oxley Act ("the Act") presented corporate America with numerous surprises and uncertainties--new CEO/CFO certification requirements; restrictions on loans to corporate officials; and many other provisions the precise reach of which is not yet known. But one matter addressed by the Act was certainly anticipated. During the past few years, the question whether accounting firms should be allowed to provide certain non-audit services to their audit clients prompted considerable controversy. Some members of Congress were convinced that the Securities and Exchange Commission, under Chairman Arthur Levitt, had in 2000 been forced to back off from imposing strict limitations on the provision of certain non-audit services because of intense lobbying pressure from the accounting profession. Many viewed the provision of consulting services by a company's independent auditor as constituting a "conflict of interest" and urged a ban on such services. 1

The Act prohibits the principal service that gave rise to the SEC's rulemaking in 2000 on auditor independence--large-scale, big-fee financial information systems design and implementation or information technology work. This service, which the SEC proposed to ban in 2000 but backed down from doing, is what the accounting firms traditionally labeled their "consulting" practice. For some accounting firms, this is a very significant development--it provided more than a third of the revenues of the Big Five accounting firms in recent years (before the firms began selling the practice). The Act also bars internal audit outsourcing (which the rules issued in 2000 only partially prohibited) and "expert" services (which were permitted under the SEC's final rules).

Beyond those three services, the Act takes a measured approach to the non-audit services issue. All non-audit services were not created equal, and, despite widespread misunderstanding, the SEC never sought to ban them generally. Many of them have been performed since the beginning of the accounting profession (well before the 1933 Congress required audits of public companies by "independent" auditors). Many such services are closely related to the audit itself (such as reporting on internal controls or performing statutory audits) or as a practical matter can only be performed by the auditor (such as advising on the appropriate accounting treatment of a transaction or assisting on SEC registration statements2. Moreover, it seems likely that a total prohibition on non-audit services for audit clients would, over time, diminish accounting firms' overall technical expertise and undermine audit effectiveness (it is essential, for example, to have skilled tax experts at the firm in order properly to audit a company's tax provision).3

Hence, except for the three newly banned services, the Act's list of prohibited services is the same as that in the existing SEC rule. Instead of prohibiting additional services, companies are allowed to retain their auditor to perform non-audit services subject to audit committee pre-approval and disclosure.


A. Background and Overview of Title II's Restrictions on Non-Audit Services

There was a variety of legislative proposals on this issue. At one extreme, there were proposals that would have prohibited "any" non-audit service work,4 but these received little support. Other proposals would have allowed non-audit services subject to audit committee pre-approval, but would have imposed hurdles to such pre-approval.5

These, too, did not pass. On the other hand, there were proposals that were less far-reaching. The accounting reform bill offered by Senator Gramm as a substitute to the Sarbanes bill at Senate Banking Committee markup did not include scope of service restrictions. The House bill, which passed the House by a vote of 334 to 90, would have banned financial systems design and implementation work and internal audit outsourcing (the two most controversial non-audit services), but would not have codified the prohibition of other non-audit services listed in the SEC rule or mandated audit committee pre-approval.6

The Act took a middle ground. Its significant provisions are contained in Sections 201 and 202 of Title II. Section 201 makes it "unlawful" for the auditor to provide nine non-audit services listed in that section. The Act provides that a registered public accounting firm "may engage in any non-audit service, including tax services, that is not described [in the list of nine specifically prohibited services] for an audit client only if the activity is approved in advance by the audit committee of the issuer" in accordance with the Act.

Senator Sarbanes, in statements on the floor of the Senate, made clear that the Senate Banking Committee did not ban all non-audit services. He stated that "[t]here are a lot of other auditing services, other than the nine I mentioned, that an auditor may want to provide and whose provision we did not preclude."7 The committee report for the Senate bill, which served as the basis for the final Act, further explained: "The intention of this provision is to draw a clear line around a limited list of non-audit services that accounting firms may not provide to public company audit clients because their doing so creates a fundamental conflict of interest for the accounting firms." 8

The report states that the committee "decided on a somewhat more flexible approach" by permitting non-audit services, other than those specifically prohibited, subject to pre-approval by an issuer's audit committee.9


B. Section 201 List of Prohibited Services

As noted, Section 201 prohibits nine specific services. They are as follows:

bookkeeping or other services related to the accounting records or financial statements of the audit client;

financial information systems design and implementation;

appraisal or valuation services, fairness opinions, or contribution-in-kind reports;

actuarial services;

internal audit outsourcing services;

management functions or human resources;

broker or dealer, investment adviser, or investment banking services;

legal services and expert services unrelated to the audit; and any other service that the new Public Company Accounting Oversight Board (which must be established within 270 days of enactment of the Act) determines, by regulation, is impermissible.

The words used in this list are largely the same as those in the list adopted by the SEC as its final rule.10There are, however, three significant differences between the Act and the final SEC rule. First, the Act uses words from the SEC's proposed rules11 rather than the final rule, and, as a result, the Act reintroduces some ambiguities that the SEC sought to fix when it issued its final rule. For the most part, however, interpretive problems raised by this approach are likely to be minor.12 Second, the Act includes a prohibition on "expert services" which the SEC dropped from its final rule; the likely meaning of this term is discussed below.

Third, both the SEC's proposed rule and the final rule contain various definitions, exceptions, and exclusions from the rule's prohibitory reach. To the extent Congress considered the question, it sought to keep the existing exceptions and exclusions intact, or at least to permit the SEC or the Board, through rulemaking, to maintain them. Section 201(c) of the Act originally (in a "Committee Print" circulated to senators on June 10, 2000) would have required that the SEC adopt definitions of these services that are "substantially similar" to those in the proposed rule (which also explains why the list of prohibited services was derived from the proposed rule). It stated:

The regulations of the Commission to carry out section 10A(g) of the Securities Exchange Act

of 1934, as added by this section, shall be substantially similar to the scope of practice

provisions of the proposed rule issued by the Commission and published in the Federal Register

on July 12, 2000 (65 Fed. Reg. 43148), regarding revision of the auditor independence requirements

contained in Parts 210 and 240 of Title 17, Code of Federal Regulations, consistent with the

provisions of this Act.

That paragraph was deleted during consideration of the Chairman's mark by the Senate Committee on Banking as part of negotiations between Senator Sarbanes and the securities subcommittee ranking Republican, Senator Enzi. The deletion of Section 201(c) was insisted upon by Senator Enzi and supported by Senator Bennett, who had filed an amendment to strike the provision. The deletion was also backed by Senator Bunning, who spoke to the issue during the adoption of the amendment at committee markup on June 18, 2002. He stated that the specific terms of the prohibited services listed in the final rule were improvements over the original proposal, changed after "[t]he SEC worked very hard and held many hearings on this subject." Senator Bunning added that "[t]his means that we will live under the current rules, not the July, 2000 [proposed] rules." Senator Bunning also explained why it was thought necessary to codify the existing list of prohibited services--"[t]his gives the board flexibility while at the same time making sure there is no backsliding. I think this is a better approach."13

The SEC's final rule was adopted as it was because a complete ban on particular services was deemed unnecessary or inappropriate. For instance, instead of prohibiting all bookkeeping services, the SEC's final rule allows such services in "emergency or other unusual situations, provided the accountant does not act as a manager or make any managerial decisions." 14 Similarly, the SEC provided an exception for appraisal or valuation services where the accounting firm merely reviews and reports on work done by the audit client or by a third-party specialist employed by the audit client because, the SEC explained, in such a situation the "third party or the audit client is the source of the financial information subject to the review or audit" and "the accountant will not be reviewing or auditing his or her own work." 15 No members of Congress or committee witnesses attacked the specific terms of the SEC's existing rule regarding appraisals, or valuation, or bookkeeping, or other of the services prohibited under the SEC's existing independence rule. The rule's treatment of these services was also not criticized by current or former SEC commissioners or staff.16 Moreover, the Act does not define these services, and the legislative history does not suggest that the SEC's rulemaking power in this area was circumscribed.17

The legislative history therefore supports keeping the terms of the existing rule intact and allowing the new Board to revisit the specific terms of the existing prohibitions as it deems necessary.


C. Section 202 Pre-Approval Requirements The Act states that "[a]ll auditing services and non-audit services [other than those specifically prohibited] ... shall be preapproved by the audit committee of the issuer."18 Requiring audit committee pre-approval of non-prohibited services reflects a growing consensus on how permitted non-audit services should be scrutinized.19 And it adds to the Act's requirement, in Section 301(m)(2), that the audit committee be "directly responsible for the appointment, compensation, and oversight of the work of any registered public accounting firm employed by that issuer." But while the text of the Act and its legislative history emphasize the importance of audit committee pre-approval, they also make clear that audit committees are not straitjacketed in how they may implement this requirement. The Senate committee report seems to go out of its way to emphasize the flexibility that audit committees have in how they handlethis matter. First, the report states that pre-approval may be given "at any time in advance of the activity."20 The report states that the SEC or the Board might "specify a maximum period of time in advance of which the approval may not be granted, such as, for example, requiring the pre-approval to be granted no earlier than one year prior to the commencement of the service." 21 Second, the report states that the legislation "does not limit the number of non-audit services that the audit committee may pre-approve at one meeting or occasion."22 This would suggest that the audit committee could annually or quarterly review the list of non-audit services that were provided in the prior year or quarter and approve their continued provision, perhaps adding any new services to be provided or subtracting services no longer needed or deemed inappropriate. Third, the report states that "each non-audit service be specifically identified in order to be approved by the audit committee."23 The report does not state exactly what is meant by "specifically identified," but, in giving some examples of what is "not" permitted, it suggests that audit committees have latitude as to the process they can use. It states: "The Committee does not intend for the statutory requirement to be satisfied by an audit committee voting, for example, to permit 'any service that management determines appropriate for the auditor to perform' or 'all non-audit services permissible under law.' "24 It would seem that audit committee members could fulfill their obligations if they have enough details about the non-audit service to be able to determine that the service to be performed would not be one of the specifically listed proscribed services and would not raise other independence concerns. Fourth, the Act itself authorizes audit committees to delegate pre-approval authority to one or more independent members of the audit committee, provided any approvals are subsequently made known to the full audit committee.25 Thus, an audit committee might delegate pre-approval authority to a particular audit committee member in order to facilitate the pre-approval of services below a particular monetary threshold. Or the committee might delegate pre-approval for a particular type of non-audit service. Fifth, the committee report states that Congress rejected proposals that audit committees make "findings" to support their decision. The report states: "The bill does not require the audit committee to make a particular finding in order to pre-approve an activity. The members of the audit committee shall vote consistent with the standards they determine to be appropriate in light of their fiduciary responsibilities and such other considerations they deem to be relevant."26

In sum, audit committees must understand the nature of the non-audit services being provided and consider whether they raise independence concerns. But, Congress made an affirmative decision to give audit committees flexibility in implementing the pre-approval process.


D. Tax Services Tax services are expressly permitted by the Act and are not included in the list of prohibited services. Section 201 states that an audit firm may engage in any non-audit service, "including tax services," that is not described in the prohibited activities section of the Act, provided the audit committee of the client approves such activity in advance. This approach is consistent with the SEC view set forth in its release in adopting its final independence rule, where it stated that "tax services generally do not create the same independence risks as other non-audit services."27 Indeed, even the SEC's "proposed" independence rule (which went further than the final rule in banning services) did not seek to limit tax services. What this means is that tax services are in the "pre-approval bucket" and not in the "prohibited service bucket." Most commentators, including most leading law firms (notwithstanding their competitive interest in wresting more tax work from accounting firms), have also reached that view. However, a recent article in BNA's "Daily Tax Report" concluded that a different result is possible.28 The author argued that because the Act restricts "valuation" services and "expert" services for a client, it arguably imposes wide-ranging restrictions on the provision of tax services for audit clients because certain of those services might fit within the meanings of those words. The author stated that, for instance, the provision of transfer pricing tax services to an audit client by an audit firm might be prohibited by the Act.29 In this author's view, that conclusion overlooks the statutory language, the legislative history, and the SEC rulemaking upon which the Act's restrictions are based. Most importantly, had Congress sought to tuck tax services into the prohibited service list, it surely would have said so, since this would have been a major change in existing law and practice. Instead, its only express decision on tax services was to put them in the Section 202 pre-approval "bucket." In addition, transfer pricing services would not be "valuation" services for independence purposes because, among other things, they do not result in expressions of opinion on the value of an asset, liability, or business that is then included in the financial statements subject to audit. Rather, these services generally establish approximate arm's length prices only for intercompany transactions, virtually all of which are eventually eliminated in consolidation for financial statement purposes. As for "expert services," that term can easily be misconstrued, since virtually anything an accounting firm does--including performing audits or providing tax services--involves use of "expert" judgment. There is no indication in the legislative history suggesting that this term should be given a broad meaning. In fact, the legislative history suggests just the contrary. The only legislative guidance is a statement in the Senate committee report that "the accounting firm should not act as an advocate of the audit client, which would be involved in providing legal and expert services to an audit client in legal, administrative, or regulatory proceedings," and thereby place the auditor "in the role of promoting" the client's interests."30 Congress seemed to intend that the accounting firm should be prohibited from being retained as a "hired gun" for its audit client-that is, to provide testimony as an expert witness in a court or administrative proceeding supporting the client's pre-conceived position on a particular issue. Importantly, this was the purpose behind the SEC's June 2000 proposed restriction on expert services, which was the basis for the prohibition included in the Act.31

Such a "hired gun" service is not the purpose of a typical tax engagement (or most other accounting firm engagements), and the use of professional experience and judgment would not be prohibited on such engagements. And in any event, as noted above Congress treated tax services as separate from "expert services" in distinguishing between the "prohibited service bucket" and the "pre-approval bucket."


E. Effective Date Little in the Act can be interpreted straightforwardly, and the effective date for Title II is no exception. Title II refers in almost every section to new auditor independence restrictions on "registered public accounting firms." That term is defined in Section 2(a)(12) of the Act as "a public accounting firm registered with the Board in accordance with this Act," and the term "Board" is defined in Section 2(a)(5) as "the Public Company Accounting Oversight Board established under section 101." Section 101(d), in turn, requires that the SEC "not later than 270 days after the date of the enactment of this Act" (which is April 23, 2003) determine that the Board is "organized" and "has the capacity to carry out the requirements of this title" and "to enforce compliance with this title." Under Section 102(a), all accounting firms that audit SEC registrants will then have 180 days to register with the Board. Thus, Title II establishes an "outer limits" effective date of 450 days from enactment, or October 23, 2003 . It seems most likely, however, that both the SEC and accounting firms will act more quickly than the 270 and 180-day provisions would permit. There are two caveats to this "450-day" conclusion. First, one section of the Act--Section 202, which establishes audit committee pre-approval requirements--uses the phrase "auditor of the issuer" rather than "registered public accounting firm," which on its face would mean that the new requirement became effective immediately upon enactment on July 30. But Section 202 imposes the pre-approval requirement on "non-audit services," and Section 2(a)(8) of the Act states that "non-audit services" refers to services provided to an issuer by "a registered public accounting firm." Accordingly, the 450-day "outer limits" applies. The Senate Report confirms this view, stating, in explaining Section 202, that it requires pre-approval of "the services, both audit and non-audit, provided to that company by a registered public accounting firm."32 The second caveat is that the SEC is required by Section 208 to issue "final regulations" to carry out the Title II requirements "[n]ot later than 180 days after the date of the enactment of this Act" (which is another reason why the pre-approval provisions of the Act cannot be construed as effective immediately). The Act seems to contemplate that the SEC will establish "final regulations" applicable to "registered public accounting firms," in which case (as noted) the regulations would not take effect for up to 450 days. On the other hand, there is nothing to prevent the SEC from making its rules take effect immediately after the 180 days. After all, the SEC could (and did in 2000) promulgate auditor independence rules without needing the authority provided under the Act.

The SEC might establish early deadlines for the new statutory restrictions on "financial systems design and implementation," "internal audit outsourcing," and "expert" services. It might also provide some guidelines for the pre-approval process. Aside from those areas, the legislative history indicates (as noted above) that the SEC would appropriately leave the existing independence rules intact and allow the new Board to modify them if necessary.


F. Concluding Observations The Act's most significant impact on audit quality will be through the establishment of the new public accounting board, with its significant new inspection and disciplining powers. As for non-audit services, Congress established a "clear line" between permissible and prohibited non-audit services, but there already was such a line under the existing SEC rule. The impact of the Act in this area, therefore, will be to (1) add information technology and internal audit work to the prohibited list (although the SEC was already headed in that direction on its own), and (2) require greater audit committee scrutiny of non-audit services (although the NASD and exchanges were headed there as well). Audit committees will need to pre-approve non-audit services, but they will have flexibility in the procedures for doing so. ________________________________________1 Not all of this understanding of the history was accurate. The accounting profession is not a monolith, and the Levitt independence rule proposals deeply divided the accounting profession. Two of the Big Five firms supported the bulk of the Levitt proposals--these firms had by mid-2000 sold, or were in the process of selling, their information technology consulting practices, at least in part because of a recognition that such consulting work can create independence problems (or at least an appearance of an independence impairment).2 Many people would not think that these types of activities are "non-audit," but they are so ified under the existing SEC proxy disclosure rules.3 In the committee report on the bill sponsored by Representative Oxley, which the House passed, the House Financial Services Committee stated: "[T]he Committee heard testimony that a broader ban on nonaudit services could undermine rather than improve audit quality, since certain such services can improve the auditor's understanding of the audit client's business activities. Likewise, a broader ban could reduce corporate efficiencies and impair auditing firms' ability to attract and retain tax and other nonaudit personnel who are essential to the audit process." H. Rept. No. 107-414, at 17 (2002).4 S. Amdts. 4193, 4238, 4239, to S. 2673 (offered by Senator McCain); "Auditor Independence Act of 2002," S. 1896, 107th Cong., Section 3 (2002) (introduced by Senator Boxer).5 "Investor Confidence in Public Accounting Act of 2002," S.2004, 107th Cong., Section 201 (2002) (introduced by Senators Dodd, Corzine, et al.) (would have required that the audit committee make a determination that hiring the audit firm to perform the non-audit service "would be in the best interest of investors and would have no adverse effects on the independence of the accounting firm").6 "Corporate and Auditing Accountability, Responsibility, and Transparency Act of 2002," H.R. 3763, 107th Cong., Section 2 (2002) (introduced by Representative Oxley, et al.). However, the NASD and exchanges on their own are intending to impose pre-approval requirements. See Summary of NASDAQ Corporate Governance Proposals, available at and Corporate Governance Rule Proposals as Approved by NYSE Board of Directors August 1, 2002 , available at 148 Cong. Rec. S6327, S6332 (daily ed. July 8, 2002 ) statement of Senator Sarbanes).8 S. Rept. No. 107-205, at 18 (2002) [hereinafter "Senate Report"].9Id.10 Revision of Commission's Auditor Independence Requirements, 65 Fed. Reg. 76,008 ( November 21, 2000 ) (codified at 17 C.F.R. pts. 210 and 240).11 Revision of Commission's Auditor Independence Requirements, 65 Fed. Reg. 43,148 (proposed June 30, 2000).12 The wording changes are as follows: the Act includes a reference to "contribution-in-kind" reports, while the rule does not (the SEC in its final rulemaking release stated that contribution-in-kind reports are akin to fairness opinions which are restricted under the final rule); and the Act bans "investment adviser" and "investment banking" services, while the SEC's rule only bars "broker-dealer" services (the SEC in its final rulemaking release stated that it believed that that term was broad enough to encompass impermissible investment advisory and banking activities).13 Markup on the Public Company Accounting Reform and Investor Protection Act of 2002 Before the Committee on Banking, Housing and Urban Affairs, 107th Cong. (2002) (unofficial transcript dated June 18, 2002 ).The rejection of Section 201(c) also indicates why it would make no sense to read the Act as establishing ironclad restrictions that require overturning of the SEC's final independence rule. Even the SEC's "proposed" independence rule (which would essentially have been codified by Section 201(c) ) had exceptions and exclusions for certain non-audit services. It is implausible that the "rejection" of Section 201(c) could result in a "more" restrictive regime than would have been permitted under the SEC's proposed rule. Certainly, if that had been the intent, Senator Sarbanes or another bill supporter would have said so.14 Revision of Commission's Auditor IndependenceRequirements, 65 Fed. Reg. at 76,044.15 Id. at 76,046.16 For example, when asked what services he thought should be prohibited that were not already barred by the SEC rule, Arthur Levitt mentioned only the two services that the SEC tried and failed to ban in 2000--information technology consulting and internal audit outsourcing--together with the "structuring" of certain transactions (an activity that was not addressed by the SEC in 2000). The Fall of Enron: How Could It Have Happened? Hearing of the Senate Committee on Governmental Affairs, 107th Cong. (Jan. 24, 2002) (statement of Arthur Levitt) ("Auditors, I believe, should also be barred from consulting on precisely how to structure transactions such as the kinds of special purpose entities that Enron engaged in.").17 The SEC also has broad exemptive powers under the Exchange Act, which were not limited by the Act, and the SEC could rely on that authority in this context.18 See Section 202(i)(1)(A). There are, however, three statutory differences between the procedures for audit and non-audit pre-approval. Section 202(i)(1)(B) provides a "de minimus" exception whereby the pre-approval requirement is waived if the "aggregate amount" of non-audit fees is less than 5 percent of the total fees paid to the auditor and the "services were not recognized by the issuer at the time of the engagement to be non-audit services." In addition, although its precise scope is unclear, Section 202(i)(4) allows retroactive audit committee approval for "an audit service within the scope of the engagement of the auditor." Finally, Section 201(b) of the Act also has a provision for "case-by-case exemptions," whereby the Board can provide exemptions for the nine specifically prohibited non-audit services. 19 Audit committees were already playing an important role with respect to non-audit services pursuant to the SEC proxy rules; ISB Standard No. 1; and SRO requirements. The SEC's proxy rule requires disclosure of aggregate fees for audit and non-audit services and disclosure of whether the audit committee (or the board if there is no such committee) "has considered" whether the provision of non-audit services "is compatible with maintaining the principal accountant's independence." Revision of Commission's Auditor Independence Requirements, 65 Fed. Reg. at 76,078. ISB Standard No. 1, Independence Discussions with Audit Committees, states that, at least annually, an auditor shall disclose to the audit committee, in writing, all relationships between the auditor and its related entities and the company and its related entities that in the auditor's professional judgment may reasonably be thought to bear on independence. The auditor must confirm that, in its professional judgment, it is independent and must also discuss the auditor's independence with the audit committee. Independence Standards Board, Standard No. 1 (January 1999).20 Senate Report, at 20.21Id.22Id.23Id.24Id.25 Section 202(i)(3).26 Senate Report, at 19.27 Revision of Commission's Auditor IndependenceRequirements, 65 Fed. Reg. at 76,052.28 Thomas R. May, Sarbanes-Oxley Accounting Reform Act Affects Corporate Tax Departments, 160 DTR J-1 (BNA) ( August 19, 2002 ).29 Transfer pricing services are tax services that assistclients in applying Internal Revenue Code Section 482, which requires the allocation of income among various related-party cross-border transactions.30 Senate Report, at 18.31 See Revision of Commission's Auditor IndependenceRequirements, 65 Fed. Reg. at 43,172 (stating that the restriction would address situations where "[c]lients retain experts [at accounting firms] to lend authority to their contentions in various proceedings by virtue of the expert's specialized knowledge and experience"). See also 65 Fed. Reg. 76,051 (stating that the proposed rule was not intended "to prohibit an auditor from testifying as a fact witness to its audit work for a particular audit client.").32 Senate Report, at 19 (emphasis added).

Copyright © 2002 by The Bureau of National Affairs, Inc., Washington D.C.