Financial Regulator Flexes Its Weakness

The board that disciplines corporate auditors trumpeted a recent enforcement action as setting a record and sending a strong message, but the message it sent was mixed at best.

In some ways, the case showed how, as the Project On Government Oversight reported in 2019, the audit cop has been a weak enforcer of its own rules.

The new case involved the former head of the audit practice at KPMG, the accounting firm that in 2019 admitted to using confidential information stolen from the regulatory board to cheat on regulatory inspections. It was one of the biggest corporate scandals in years.

KPMG admitted obtaining advance word about which KPMG audits the regulator planned to inspect — conduct the Securities and Exchange Commission (SEC) has compared to “stealing the exam.”

Armed with that information, “KPMG personnel oversaw a program to review and revise certain audit work papers after the audit reports had been issued to reduce the likelihood of deficiencies being found during inspections,” the SEC said in a 2019 news release.

For their roles in the scheme, several former KPMG personnel pleaded guilty to or were convicted of crimes.

On April 5, the Public Company Accounting Oversight Board (PCAOB) issued an enforcement order against Scott Marcello, who headed KPMG’s audit business from 2015 until the scam was exposed in 2017.

The new enforcement order spelled out Marcello’s alleged failures in the matter.

“Specifically, Marcello failed to take appropriate and immediate steps when he learned that KPMG had received confidential PCAOB inspection information in both 2016 and 2017,” the order says.

“Marcello’s actions contributed to a culture in which KPMG personnel, including Marcello’s subordinates, perceived that improving the Firm’s inspection results took priority over improvements in overall audit quality,” the order says.

The board charged Marcello with failing to reasonably supervise lawbreakers on KPMG’s senior audit staff. The board also censured Marcello and fined him $100,000.

A Toothless Reprimand

In an April 5 news release, the board’s enforcement chief said, “This action sends a strong message that firm leadership must take their supervisory responsibilities seriously.”

But does it really?

Let’s break it down.

The censure is a written reprimand. It serves as a stain on Marcello’s reputation, but, by itself, has no bite.

The censure stands in contrast to sanctions the PCAOB has meted out in other cases. For example, in a February enforcement action, the one that immediately preceded the action against Marcello, the PCAOB disqualified an accountant from auditing public companies. More than that, it barred the accountant from being associated with a firm that audits public companies, but said he could apply for reinstatement after two years.

The fine of $100,000 may sound like a lot, but some perspective is needed. A KPMG employee who ranked rungs below Marcello in the KPMG hierarchy — a confessed participant in the conspiracy — was making $525,000 when he joined the accounting firm in 2015.

Partners at major accounting firms can make millions of dollars a year, according to the website Big4Bound.

Marcello’s title was vice chair of audit.

Of course, we don’t know how much money Marcello had on hand.

In its news release, the oversight board said the $100,000 fine was a PCAOB record — “the largest money penalty ever imposed on an individual in a settled case.”

That isn’t saying much. As POGO’s 2019 investigation found, the oversight board has imposed far fewer and smaller fines than its own inspection findings would appear to warrant.

Under federal law, the board can fine individuals up to $750,000 per violation if the violation involved “intentional or knowing conduct, including reckless conduct” or if the wrongdoer engaged in “repeated instances of negligent conduct.” For lesser violations, the oversight board has the authority to fine individuals up to $100,000 per violation.

The board’s enforcement order describes two instances in which Marcello acted inappropriately.

In March 2016, the PCAOB said, Marcello learned from a subordinate named David Middendorf that KPMG had obtained advance information about PCAOB inspection plans through a KPMG employee’s contacts at the oversight board.

“Marcello further understood that KPMG personnel intended to review the work papers for those audits and could enhance the documentation in an effort to improve inspection results,” the PCAOB said. 

“Marcello did not report or escalate the matter, or instruct Middendorf and other subordinates to refrain from using the PCAOB’s confidential information,” the board said. “In failing to take action in response to learning about the receipt and intended use of confidential information in 2016, Marcello missed an opportunity to change the tone at the top of the Firm, which could have helped prevent further violations.”

A year later, in February 2017, Marcello received similar information from Middendorf, the board said. Instead of reporting the breach to anyone at KPMG or the oversight board, “over the course of a week, he and Middendorf had several conversations about the list and what to do with the information, though they agreed that no one should use the information while they decided what to do with it,” the board said.

Marcello ultimately reported the receipt of the confidential information, but only after he learned that other KPMG personnel were troubled by it “and would report the issue themselves if Marcello did not,” the board said.

Despite that narrative, the board action against Marcello involved no admission of wrongdoing. Marcello agreed to settle the case on the terms set out in the enforcement order without admitting or denying the PCAOB’s charges. That’s standard practice in disciplinary settlements involving the PCAOB and the SEC — and an approach that has been widely criticized. It means the findings laid out in the enforcement order are, from a legal standpoint, only unproven allegations.

However, it contrasts with the SEC’s 2019 settlement with KPMG over the same scandal and other matters. The accounting firm, which agreed to pay a $50 million fine, admitted the facts laid out in the SEC’s enforcement order and acknowledged wrongdoing.

A Landmark Long Overdue

The oversight board said the recent action against Marcello was the first in which it had imposed sanctions for failure to supervise.

That makes it a landmark. It also makes it about 20 years overdue.

When Congress created the PCAOB in 2002, it gave the board the power to sanction supervisory personnel for failing to supervise. Concerns about supervision at audit firms are hardly new; in a 2010 speech, then board member Steven B. Harris said he was “struck by the volume of supervisory concerns brought to our attention” by PCAOB staff.

“There are, unfortunately, plenty of reasons to believe auditors may need a reminder of the Board’s disciplinary authority in this area,” Harris added.

Now, under Chair Erica Y. Williams, who took office in January, the PCAOB is issuing more of a minder than a reminder.

“This ‘first of its kind’ disciplinary action demonstrates that the PCAOB is committed to sanctioning top-level personnel at the largest firms when they fail to take sufficient supervisory steps aimed at preventing violations by their subordinates,” Williams said in the April 5 news release.

The board “believes it is important to hold Mr. Marcello accountable … for contributing to a culture that led to this serious misconduct,” Williams said.

We sent the PCAOB questions for this article. We also requested an interview with Williams.

Kent Bonham, the acting director of the board’s Office of External Affairs, said by email that Williams was unavailable. He offered to arrange an interview with a senior PCAOB official on the conditions that we not name or quote that official.

We asked why Williams was unavailable and why the PCAOB wouldn’t grant an on-the-record interview. We explained by phone that the answers to those questions would help POGO assess whether it would be appropriate to conduct an interview on the PCAOB’s terms. Bonham did not answer, and he did not provide answers to POGO’s other written questions.

Marcello and KPMG did not respond to messages for this article.

A lawyer for Middendorf declined to comment. As of March 10, Middendorf was on bail while appealing his March 2019 conviction on one count of conspiracy to commit wire fraud and three counts of wire fraud, according to a court filing.

Perhaps the stiffest penalty Marcello faced came not from the regulator but from KPMG.

In April 2017, five years before the recent PCAOB enforcement action and shortly after KPMG insiders sounded alarms, the Wall Street Journal and New York Times reported that Marcello had been fired.

For more on the scandal, see our 2020 story, “How Accountants Took Washington’s Revolving Door to a Criminal Extreme.”