15 U.S.C. § 78j–1 — Audit requirements

(a) In general — Every required audit of an issuer's financial statements must include: (1) steps designed to reasonably catch illegal acts that would materially affect the numbers in the financial statements; (2) steps designed to spot related-party transactions that matter to the financial statements or need disclosure; and (3) a check on whether there's real doubt the company can keep operating through the next year. (b) Required response to audit discoveries — (1) If the auditor learns of information suggesting an illegal act may have happened (even if it seems immaterial), the firm must: determine whether it's likely an illegal act occurred, and if so, figure out its possible effect on the financial statements, including fines and damages; and, unless the act is clearly minor, tell company management and make sure the audit committee (or board, if there's no committee) is properly informed. (2) If the firm decides — after telling the audit committee or board — that the illegal act has a material effect on the financial statements, that management and the board haven't taken proper fix-it steps, and that the failure to act will likely mean the auditor has to depart from a standard report or resign, then the firm must report this directly to the board of directors as soon as practical. (3) A company whose board gets this report must notify the SEC within one business day and give the auditor a copy of that notice. If the auditor doesn't get a copy in time, the auditor must either resign from the engagement, or send the SEC its own report (or documentation of an oral report) within one business day after that failure. (4) If the firm resigns under (3)(A), it must still send the SEC its report within one business day after the company's own failure to notify. (c) Auditor liability limitation — No auditor can be sued in a private lawsuit over any finding, conclusion, or statement made in a report filed under paragraph (3) or (4) of subsection (b), including rules made under it. (d) Civil penalties in cease-and-desist proceedings — If the SEC finds, after notice and a hearing, that an auditor willfully violated subsection (b)(3) or (4), the SEC can impose a civil penalty on the auditor and anyone else it finds caused the violation, on top of any cease-and-desist order. The penalty amount follows the standards in section 78u–2. (e) Preservation of existing authority — Except for subsection (d), nothing here limits or changes the SEC's authority under this chapter. (f) Definitions — "Illegal act" means any act or omission that breaks a law, rule, or regulation with legal force. "Issuer" means a company (as defined in section 78c) whose securities are registered under section 78l, or that must file reports under section 78o(d), or that has filed — and not withdrawn — a registration statement under the Securities Act of 1933 that hasn't yet taken effect. (g) Prohibited activities — Except as subsection (h) allows, it's illegal for an auditor doing a required audit to also provide, at the same time, non-audit services to that client, including: (1) bookkeeping or accounting-record services; (2) financial information systems design; (3) appraisal, valuation, or fairness-opinion services; (4) actuarial services; (5) internal audit outsourcing; (6) management or HR functions; (7) broker-dealer, investment adviser, or investment banking services; (8) legal services and expert services unrelated to the audit; and (9) any other service the Public Company Accounting Oversight Board (the "Board") decides by rule is off-limits. (h) Preapproval required for non-audit services — An auditor can provide a non-audit service not listed in (g)(1) through (9), including tax services, only if the audit committee approves it in advance, following subsection (i). (i) Preapproval requirements — (1)(A) All audit and non-audit services (except as (B) allows) must be preapproved by the audit committee. (B) This preapproval isn't required if: (i) all non-audit services together are no more than 5% of what the issuer paid its auditor that fiscal year; (ii) the issuer didn't realize at the time these were non-audit services; and (iii) the services are promptly brought to the audit committee, which approves them before the audit is finished. (2) Audit committee approval of a non-audit service must be disclosed to investors in periodic reports under section 78m(a). (3) The audit committee can delegate preapproval power to one or more independent-director members; any such approval must be reported to the full committee at its next scheduled meeting. (4) If the audit committee approves an audit service as part of the engagement's scope, that service counts as preapproved. (j) Audit partner rotation — It's illegal for an auditor to keep auditing an issuer if the lead or reviewing audit partner has worked on that issuer's audit for each of the past five years. (k) Reports to audit committees — Every auditor doing a required audit must timely report to the audit committee: (1) all critical accounting policies used; (2) any alternative accounting treatments discussed with management, their effects, and which one the auditor preferred; and (3) other important written communications between the auditor and management, like management letters. (l) Conflicts of interest — It's illegal for an auditor to audit an issuer if that issuer's CEO, controller, CFO, chief accounting officer, or someone in an equivalent role, used to work for that same audit firm and took part in that issuer's audit during the year before the current audit started. (m) Standards relating to audit committees — (1)(A) Within 270 days of July 30, 2002, the SEC must direct exchanges and associations to bar listing any issuer that doesn't meet the requirements of paragraphs (2) through (6). (B) The SEC's rules must let an issuer fix problems before that bar kicks in. (2) The audit committee, as a board committee, is directly responsible for hiring, paying, and overseeing the auditor — including resolving disputes between management and the auditor — and the auditor must report directly to the committee. (3)(A) Every audit committee member must be a board member and independent. (B) To count as independent, a member can't (outside their committee or board roles) accept consulting or advisory fees from the issuer, or be affiliated with the issuer or its subsidiaries. (C) The SEC can exempt a particular relationship from this rule if it decides that's appropriate. (4) Each audit committee must set up procedures for receiving and handling complaints about accounting or auditing issues, and for employees to submit concerns anonymously and confidentially. (5) Each audit committee can hire its own independent counsel and advisers as needed. (6) Each issuer must properly fund the audit committee to pay the auditor and any advisers the committee hires.