23 See Statement of Senator Leahy on the Senate floor: "[I]t is intended that the SEC promulgate rules and regulations that require the retention of such substantive material for such a period as is reasonable and necessary for effective enforcement of the securities laws and the criminal laws, most of which have a five-year statute of limitations." As mandated by section 802 of the Sarbanes-Oxley Act of 2002 ("Sarbanes-Oxley Act" or "the Act"),1 we are amending Regulation S-X to require accountants who audit or review an issuer's financial statements to retain certain records relevant to that audit or review. The records to be retained would include those relevant to the audit or review, including workpapers and other documents that form the basis of the audit or review and memoranda, correspondence, communications, other documents, and records (including electronic records), which are created, sent or received in connection with the audit or review, and contain conclusions, opinions, analyses, or financial data related to the audit or review. 52 Item 304 of Regulation S-K, 17 CFR 229.304. Section 23(a)(2) of the Exchange Act83 requires the Commission, when adopting rules under the Exchange Act, to consider the anti-competitive effects of any rule it adopts. If the retention requirements lead to more efficient oversight of the accounting profession then they may result in improved audit quality and enhanced investor confidence in the profession. Summary: We are adopting rules requiring accounting firms to retain for seven years certain records relevant to their audits and reviews of issuers' financial statements. The proposed rules do not require accounting firms to create any new records. Rec. "48 Another accounting firm stated that on many occasions correcting or redoing workpapers is not the result of differences of opinion but from on-the-job training and a normal learning process.49 One commenter stated that the "cast doubt" language in the proposed rule might deter auditors from asking legitimate questions.50, Some commenters suggested language to replace the provision in subparagraph (c) that documents be retained if they "cast doubt on the final conclusions reached by the auditor." 7 Cf. 31 Statement by Senator Leahy on the Senate floor, 148 Cong. For example, if a company has a calendar year-end fiscal year, for an audit of year 2002 financial statements that concludes in February or March 2003, under the proposal, the records would have been required to be retained until January 1, 2009. 93 Letter from Lynette Downing, HLB Tautges Redpath, Ltd., dated December 27, 2002. 78j-1(a)) applies, or of the financial statements of any investment company registered under section 8 of the Investment Company Act of 1940 (15 U.S.C. For Further Information Contact: Samuel L. Burke, Associate Chief Accountant, D. Douglas Alkema, Professional Accounting Fellow, or Robert E. Burns, Chief Counsel, at (202) 942-4400, Office of the Chief Accountant, U.S. Securities and Exchange Commission, 450 Fifth Street, NW, Washington, DC 20549-1103. Any issues identified during audits are to be documented against 9100:2009 requirements. Under section 802 of the Sarbanes-Oxley Act, accountants who audit or review an issuer's financial statements must retain certain records relevant to that audit or review. 1191 Retention Policies and Procedures - oag-bvg.gc.ca We received comments indicating that, based on the proposed rule, our cost estimate was low. In addition, Section 2(b) of the Securities Act of 1933,84 Section 3(f) of the Exchange Act,85 and Section 2(c) of the Investment Company Act86 require the Commission, when engaging in rulemaking that requires it to consider or determine whether an action is necessary or appropriate in the public interest, to consider whether the action will promote efficiency, competition, and capital formation. Rec. Fifteen thousand burden hours should be sufficient to cover the audits and reviews of not only public companies but also registered investment companies. The average hourly rate, therefore, would be about $110 per hour ([(3 x $65) + $250] / 4). Records described in the rule are to be retained whether the conclusions, opinions, analyses, or financial data in the records support the final conclusions reached by the auditor, or contain information or data, relating to a significant matter, that is inconsistent with the final conclusions of the auditor on that matter or the audit or review. "Other findings that could result in modification of the auditor's report." This commenter also suggested that the Commission address the application of rule 2-06 to documents prepared for a firm's internal inspection or outside peer review.67 Such documents generally would not be considered to be created, sent or received in connection with an audit or review engagement and, therefore, would not be within the new rule. 91 See, e.g., letter from BDO Seidman, LLP, dated December 27, 2002; letter from Grant Thornton LLP dated December 27, 2002; letter from KPMG LLP dated December 27, 2002; letter from Deloitte & Touche LLP dated December 27, 2002. Issues raised by commenters regarding Public Company Accounting Oversight Board ("the Oversight Board") oversight of foreign accounting firms and access by the SEC and the Oversight Board to the records retained by foreign accounting firms, as provided by Section 106 of the Sarbanes-Oxley Act, will be the subject of further discussion among staff, the Commission and the Oversight Board.9. In this commenter's view, having two retention periods would have increased costs associated with processing the records.82. In addition, because an already large and ever-increasing portion of the records required to be retained are kept electronically, we stated that the incremental increase in storage costs for documents would not be significant for any firm or for any single audit client. Another commenter suggested that the Commission require that all accounting firms registered with the Public Company Accounting Oversight Board comply with consultation requirements, and related documentation requirements, currently prescribed by the SEC Practice Section of the American Institute of Certified Public Accountants for large accounting firms.66 We believe these matters relate to quality control standards within the scope of the Oversight Board's standard setting authority and we encourage the Oversight Board to consider adoption of such requirements. The auditor in a variety of contexts may create materials related to differences of opinion. 77f, 77g, 77h, 77j, 77s, 77z-2, 77aa(25), 77aa(26), 78j-1, 78l, 78m, 78n, 78o(d), 78u-5, 78w(a), 78ll(d), 79e(b), 79j(a), 79n, 79t(a), 80a-8, 80a-20, 80a-29, 80a-30, 80a-31, 80a-37(a), unless otherwise noted. For example, we would expect that auditors of the financial statements of those investment advisers, broker-dealers, and entities subject to Municipal Securities Rulemaking Board regulations that are not subject to the rule would retain relevant audit and review records consistent with applicable laws, regulations, and professional standards. Record retention requirements for indoor air quality documents and This section requires large firms to have policies on internal consultations and to document: the matter, the action taken to address the matter, and the basis for the final conclusion reached. 96, "Audit Documentation," states, in part: The auditor should prepare and maintain audit documentation, the content of which should be designed to meet the circumstances of the particular audit engagement. It also is important to note that decisions about the retention of records currently are made as a part of each audit or review. We do not have any customer specific requirements for any of our records really, can I put it all at 1 year and be done with it? Section 802 of the Sarbanes-Oxley Act3 is intended to address the destruction or fabrication of evidence and the preservation of "financial and audit records. "Results of auditing procedures that indicate that (a) the financial statements or disclosures could be materially misstated or (b) auditing procedures need to be significantly modified. Rule 2-06 requires that accountants retain certain records relevant to an audit or review of an issuer's or registered investment company's financial statements for seven years. Final Rule: Retention of Records Relevant to Audits and Reviews The SOX Act is governed by the SEC ( The US Securities and Exchange Commission ). The requirements listed under SOX Section 802: Criminal Penalties for Altering Documents, focus on business data retention and protection. 87 Letter from Lynette Downing, HLB Tautges Redpath, Ltd., dated December 27, 2002. 75 We estimate that associates would perform three-fourths of the required work, with a partner performing about one-fourth of the work. Auditing Standards AS 1215: Audit Documentation Amendments to paragraphs .03, .18, and .19 have been adopted by the PCAOB and approved by the U.S. Securities and Exchange Commission. 48 Letter from Ernst & Young LLP, dated December 27, 2002. As a result of these revisions and clarifications, we believe that implementation of the revised rule should be less costly for accounting firms than anticipated by the commenters. Please note that this table should only be used as a guide. Topic No. 305, Recordkeeping S7419 (July 26, 2002). Workpaper Retention Presents Internal Audit With Its Own Compliance The Codification is a separate publication of the Commission. The rule does not include this sentence, but instead notes that the Commission or the Oversight Board may reexamine these requirements in the auditing standards. Section 10A(a) of the Securities Exchange Act of 1934 ("Exchange Act") states, "Each audit required pursuant to this title of the financial statements of an issuer by an independent public accountant shall include" designated procedures. This paragraph also states: "The quality, type, and content of audit documentation are matters of the auditor's professional judgment." 98 Letter from PricewaterhouseCoopers dated December 27, 2002. 90 Letter from Grant Thornton LLP, dated December 27, 2002. Quality Record Retention (Internal Audits, CA's) - The Elsmar Cove The establishment of differing compliance or reporting requirements or timetables that take into account the resources of small entities; The clarification, consolidation, or simplification of compliance and reporting requirements under the rule for small entities; The use of performance rather than design standards; and. "Circumstances that cause significant difficulty in applying auditing procedures that the auditor considered necessary. 14 See, e.g., letter from BDO Seidman, LLP, dated December 27, 2002; letter from Ernst & Young LLP, dated December 27, 2002; letter from PricewaterhouseCoopers dated December 27, 2002. Section 1520 also provides that any person who knowingly and willfully violates subsection (a)(1), or any rule or regulation promulgated by the Securities and Exchange Commission under subsection (a)(2), may be fined, imprisoned for not more than 10 years, or both. 53 See, e.g., letter from Sullivan & Cromwell dated December 26, 2002; letter from Lynette Downing, HLB Tautges Redpath, Ltd. dated December 27, 2002; letter from Grant Thornton LLP dated December 27, 2002; letter from KPMG LLP dated December 27, 2002; letter from the American Institute of Certified Public Accountants dated December 27, 2002. Chart 2: RM-3 Form Process OBJECTIVES Objectives of the audit were to: Evaluate CCPS compliance with LVA record retention requirements. Such documents and records include, but are not limited to, those documenting a consultation on or resolution of differences in professional judgment. It is important to note, however, that the proposed rules do not require the creation of any record; they require only that existing records be maintained for the prescribed time period. The records to be retained include records relevant to the audit or review, including workpapers and other documents that form the basis of the audit or review, and memoranda, correspondence, communications, other documents, and records (including electronic records), which are created, sent or received in connection with the audit or review, and contain conclusions, opinions, analyses, or financial data related to the audit or review. 73 These estimates are based on information in Commission databases. PDF Records Management retention scheduling - The National Archives The objective of the rule is to implement section 802 of the Sarbanes-Oxley Act in order to increase investor confidence in the audit process and in the reliability of reported financial information. As a result, rule 2-06 might result in the retention of more records than currently required under GAAS, and might result in some accounting firms keeping those records for a longer period of time. Results of Any SAQs or Tests Performed Between Audits - Sometimes businesses are required to perform testing, such as pen tests and vulnerability scans, or do self-assessments between audits. The legislative history to section 802 states that the term is to be used as it is "widely understood" by the Commission and by the accounting profession.31 We believe that the term is understood to refer to the documents required to be retained by GAAS. information access. We also requested comments on whether a transition period was necessary or appropriate in implementing the rule. ISO have a problem with that? Rec. T his guidance is not intended to add or take away from the stated standard requirements, but provide examples and thought stimulation on how auditors can: identify applicable objective evidence ("What to look for"); and Furthermore, one commenter noted that records management procedures for smaller accounting firms should be the same as they are for larger firms.93 This commenter indicated that "the cost of implementing a [formalized records management] program at any-sized firm will be surpassed by the benefits received and the future cost savings."94. Commenters also questioned whether all of the issuer's financial information, records, databases, and reports that the auditor examines on the issuer's premises, but are not made part of the auditor's workpapers or otherwise currently retained by the auditor, would be deemed to be "received" by the auditor under rule 2-06(a)(1) and have to be retained by the auditor.20 We do not believe that Congress intended for accounting firms to duplicate and retain all of the issuer's financial information, records, databases, and reports that might be read, examined, or reviewed by the auditor. 8 Letter from the European Commission dated December 20, 2002; letter from PricewaterhouseCoopers dated December 27, 2002; letter from KPMG LLP dated December 27, 2002; letter from the American Institute of Certified Public Accountants dated December 27, 2002. "Assistants," in the context of the first sentence of the quoted paragraph, is intended to include other partners who are on the audit engagement team. Some commentators suggested that paragraph (a) of the proposed rule was overly broad and that the language in the rule, rather than following section 802 of the Sarbanes-Oxley Act, should conform to current auditing standards.21 It would appear, however, that by requiring the retention of documents in addition to audit workpapers required by generally accepted auditing standards ("GAAS") Congress has rejected this approach. Superseded drafts of memoranda, financial statements or regulatory filings. 58 Letter from BDO Seidman, LLP dated December 27, 2002. This interpretation states: Accordingly, each assistant has a professional responsibility to bring to the attention of appropriate individuals in the firm, disagreements or concerns the assistant might have with respect to accounting and auditing issues that he believes are of significance to the financial statements or auditor's report, however those disagreements or concerns may have arisen. Section 1520(a)(2) directs the Commission to promulgate, by January 26, 2003: such rules and regulations, as are reasonably necessary, relating to the retention of relevant records such as workpapers, documents that form the basis of an audit or review, memoranda, correspondence, communications, other documents, and records (including electronic records) which are created, sent, or received in connection with an audit or review and contain conclusions, opinions, analyses, or financial data relating to such an audit or review, which is conducted by an accountant who conducts an audit of an issuer of securities to which section 10A(a) of the Securities Exchange Act of 1934 (15 U.S.C. "34 The proposed rule, therefore, recognizes that the Oversight Board, subject to Commission oversight, has the ability to review and change the nature and scope of the required documentation of procedures, evidence, and conclusions related to audits and reviews of financial statements.35, As noted by several commenters, there may be significant overlap of the documents falling within the definition of "workpapers" and the documents that would be retained pursuant to the description in paragraph (a) of the rule of "other documents that form the basis of the audit or review, and memoranda, correspondence, communications, other documents, and records (including electronic records), which (1) are created, sent or received in connection with the audit or review, and (2) contain conclusions, opinions, analyses, or financial data related to the audit or review."36. Having these records available should enhance oversight of corporate reporting and of the performance of auditors and facilitate the enforcement of the securities laws. Based on these amounts, the in-house cost of an associate's time would be approximately $65 per hour, and the in-house cost of a partner's time would be approximately $250 per hour. Under the new rule,96 accountants who audit or review an issuer's or registered investment company's financial statements must retain certain records for a period of seven years from conclusion of the audit or review. To the extent that the rule increases the availability of documents beyond current professional practices, the rule may benefit investigations and litigation conducted by the Commission and others. Performance Standards 22 The proposed retention period was not based on the fiscal period covered by the financial statements being audited or reviewed, but when the audit or review would occur. ). The Regulatory Flexibility Act directs us to consider significant alternatives that would accomplish the stated objective, while minimizing any significant adverse impact on small entities. Accordingly, we do not believe that the "received" criterion in rule 2-06(a)(1) requires that auditors retain such records and the firm's anticipated document retention costs, therefore, should be significantly reduced. Narrowing the scope of the rule to conform to the current auditing literature would be contrary to the apparent congressional purpose embodied in section 802. This commenter also noted that adopting the proposed five-year retention requirement would have been more costly than adopting the seven-year retention requirement that is consistent with the forthcoming auditing standard to be promulgated by the Public Company Accounting Oversight Board. 3 Section 802 of the Sarbanes-Oxley Act, among other things, adds sections 1519 and 1520 to Chapter 73 of Title 18 of the United States Code. Under this provision, the auditor must either follow the position taken by the person consulted or appeal any disagreement to a higher level of authority within the firm for ultimate resolution. 47 See, e.g., letter from BDO Seidman, LLP, dated December 27, 2002; letter from Grant Thornton LLP dated December 27, 2002; letter from KPMG LLP dated December 27, 2002; letter from Deloitte & Touche LLP dated December 27, 2002. 44 Section 204 of the Sarbanes-Oxley Act adds section 10A(k) to the Exchange Act and requires auditors to report certain matters to audit committees, including: "(a) all critical accounting policies and practices to be used, (2) all alternative treatments of financial information within generally accepted accounting principles that have been discussed with management officials of the issuer, ramifications of the use of such alternative disclosures and treatments, and the treatment preferred by the registered public accounting firm; and (3) other material written communications between the registered public accounting firm and the management of the issuer, such as the management letter or schedule of unadjusted differences.". 1 Pub. As noted above, to ensure the purposes of the Act are achieved, the final rule requires the retention of materials that not only support the auditor's report but also records that are inconsistent with that report, and sets a seven-year retention period. 61 Letter from Sullivan & Cromwell dated December 26, 2002. New rule 2-06, on the other hand, addresses the retention of documents relevant to enforcement of the securities laws, Commission rules, and criminal laws. We recognize that any implementation of the Sarbanes-Oxley Act likely will result in costs as well as benefits and will have an effect on the economy. The request for approval of the rule's collection of information requirements is pending at OMB. Letter from Grant Thornton LLP dated December 27, 2002. Records described in the rule would be retained whether the conclusions, opinions, analyses, or financial data in the records support the final conclusions reached by the auditor, or contain information or data, relating to a significant matter, that is inconsistent with the final conclusions of the auditor on that matter or the audit or review. In the Initial Regulatory Flexibility Analysis we requested comment on the number of firms with less than $6 million in revenue in order to determine the number of small firms potentially affected by the rule, but we received no response. The reference in paragraph (c) to "significant" matters is intended to refer to the documentation of substantive matters that are important to the audit or review process or to the financial statements of the issuer or registered investment company.54 Rule 2-06(c) requires that the documentation of such matters, once prepared, must be retained even if it does not "support" the auditor's final conclusions, because it may be relevant to an investigation.55 Similarly, the retention of records regarding a consultation about, and resolution of, differences in professional judgment would be relevant to such an investigation and must be retained. These revisions include removing the "cast doubt" language from the rule, which commenters generally viewed as requiring the auditor to retain virtually all documents generated or reviewed during an audit or review, regardless of their relevance or materiality.91 We have replaced this language with language that focuses on documents that contain information or data relating to a significant matter that are inconsistent with the auditor's final conclusions regarding that matter or the audit or review. You must keep records, such as receipts, canceled checks, and other documents that support an item of income, a deduction, or a credit appearing on a . L. 107-204, 116 Stat. 745 (2002). The availability of documents under this rule will assist in the oversight and quality of audits of an issuer's financial statements. Introduction 1.1 This guide has been produced for all government organisations that are required to comply with the Government Internal Audit Standards (GIAS)1 and covers information collected. The number of public companies includes those filing annual reports and those filing registration statements to conduct initial public offerings. To cover all increases in burden hours, we estimated in the proposing release that, on average, the incremental burden on firms would be no more than one hour for each public company audit client, or approximately 15,000 hours.70. However, the term significant as used in this rule is not limited to items identified in SAS 96. Retention periods for audit files are as follows: financial audits7 years, audits of the annual summary financial statements of the Government of Canada7 years, special examinations15 years, performance audits and studies of departments and agencies15 years, sustainable development monitoring activities and environmental petitions15 years, and Paragraph (a) of rule 2-06 identifies the documents that must be retained and the time period for retaining those documents.10 The final rule requires that the auditor11 retain records relevant to the audit or review, including workpapers and other documents that form the basis of the audit or review of an issuer's financial statements, and memoranda, correspondence, communications, other documents, and records (including electronic records) that meet two criteria. We also have adopted a seven-year retention period to coincide with a forthcoming retention requirement to be promulgated by the Public Company Accounting Oversight Board, which, according to one commenter, should reduce processing costs associated with the rule.92 Also, as noted above, we have clarified in this release that the auditor need not retain every document read, examined or reviewed as part of the audit or review process. ("SAS") 96, "Audit Documentation"; Codification of Statements on Auditing Standards ("AU") 339. In light of these benefits, and absent a direct conflict with foreign requirements, the retention requirements are to apply equally to domestic and foreign accounting firms auditing the financial statements of foreign issuers. Some commenters suggested that we adopt a uniform seven-year retention period,26 while others indicated that the longer period would increase audit costs without any commensurate benefit.27 We anticipate that most accounting firms, for administrative convenience, would retain all relevant materials for the longer of the two periods prescribed by the Commission and by the Oversight Board.28 Incremental costs associated with requiring a seven-year retention period, therefore, should not be significant. PDF Federal Record Retention Requirements - Society for Human Resource 2000 - Managing the Internal Audit Activity 2010 - Planning 2020 - Communication and Approval 2030 - Resource Management 2040 - Policies and Procedures 2050 - Coordination and Reliance The Small Business Administration defines small business, for purposes of accounting firms, as those with under $6 million in annual revenues.95 We have only limited data indicating revenues for accounting firms, and we cannot estimate the number of firms with less than $6 million in revenues that practice before the Commission. Internal audit document retention | Managing internal audit - IIA "30 To clarify the distinction between workpapers and other materials that would be retained, paragraph (b) of the final rule defines the term "workpapers." (b) For the purposes of paragraph (a) of this section, workpapers means documentation of auditing or review procedures applied, evidence obtained, and conclusions reached by the accountant in the audit or review engagement, as required by standards established or adopted by the Commission or by the Public Company Accounting Oversight Board. Another commenter noted, however, that broadening some but not all rules under the Sarbanes-Oxley Act beyond "issuers" as defined in the Act would be confusing. 305 Recordkeeping. Finally, we recognize that audits and reviews of financial statements are interactive processes and views within an accounting firm on accounting, auditing or disclosure issues may evolve as new information or data comes to light during the audit or review. Rule 2-06 requires that accounting firms retain certain records for seven years. GAAS does not specify a required retention period. "Matters that both (a) are significant and (b) involve issues regarding the appropriate selection, application, and consistency of accounting principles with regard to the financial statements, including related disclosures. Our rules do not define "small business" or "small organization" for purposes of accounting firms. We also estimate that, on average, an associate's annual salary would be approximately $125,000 and a partner's annual compensation would be approximately $500,000. We continue to believe, however, that records that either support or contain significant information that is inconsistent with the auditor's final conclusions would be relevant to an investigation of possible violations of the securities laws, Commission rules, or criminal laws and should be retained. To better communicate what we intended by "cast doubt" on the auditor's conclusions, we included in the proposed rule the example of documentation of differences of opinion concerning accounting and auditing issues. 100 Letter from BDO Seidman, LLP dated December 27, 2002.