In a stunning announcement, the SEC announced an enforcement action against the international auditing firm EY. The enforcement action could not have been more directly in the ethical wheelhouse, with significant compliance implications. In its Press Release the SEC stated, it had “charged Ernst & Young LLP (EY) for cheating by its audit professionals on exams required to obtain and maintain Certified Public Accountant (CPA) licenses, and for withholding evidence of this misconduct from the SEC’s Enforcement Division during the Division’s investigation of the matter.”

Gurbir S. Grewal, Director of the SEC’s Enforcement Division, said in the Press Release, “This action involves breaches of trust by gatekeepers within the gatekeeper entrusted to audit many of our Nation’s public companies. It’s simply outrageous that the very professionals responsible for catching cheating by clients cheated on ethics exams of all things. And it’s equally shocking that Ernst & Young hindered our investigation of this misconduct. This action should serve as a clear message that the SEC will not tolerate integrity failures by independent auditors who choose the easier wrong over the harder right.

In an agreed Order, EY admitted that “over multiple years, a significant number of EY audit professionals cheated on the ethics component of CPA exams and various continuing professional education courses required to maintain CPA licenses, including ones designed to ensure that accountants can properly evaluate whether clients’ financial statements comply with Generally Accepted Accounting Principles.” But EY’s conduct did not stop there as the accounting firm also admitted “during the Enforcement Division’s investigation of potential cheating at the firm, EY made a submission conveying to the Division that EY did not have current issues with cheating when, in fact, the firm had been informed of potential cheating on a CPA ethics exam. EY also admits that it did not correct its submission even after it launched an internal investigation into cheating on CPA ethics and other exams and confirmed there had been cheating, and even after its senior lawyers discussed the matter with members of the firm’s senior management. And as the Order finds, EY did not cooperate in the SEC’s investigation regarding its materially misleading submission.” For all of these actions, EY was fined $100 million.

Why does all this sound so familiar? It is because KPMG was caught engaging in similar conduct back in 2091. I wrote at the time, “How bad was KPMG’s conduct? … the conduct outlined in the Order is so egregious, detailing a culture which is completely unmoored from any ethical foundation, that any company using KPMG as an auditor must ask some very serious questions about not only the quality of the services they have received but also the very foundation of those services.” KPMG was fined $50 million.

Yet the EY fine was double the KPMG fine. Why? One clue comes from the Order which stated, “This case involves Ernst & Young’s failures to act with the integrity required of a public company auditor. Over multiple years, a significant number of EY audit professionals cheated on the ethics component of the Certified Public Accountant (CPA) exam, as well as on a variety of other examinations required to maintain their CPA licenses. As this was ongoing, EY withheld this misconduct from SEC staff conducting an investigation of potential cheating at the firm. EY audit professionals’ repeated cheating on exams and the firm’s misrepresentations to the SEC violated ethics and integrity standards and discredited the accounting profession.” In other words, as bad as cheating on exams is, withholding information from the SEC, while it is conducting an investigation on that issues is equally if not worse conduct.

Regarding this additional misconduct, the Order stated, “EY withheld this misconduct from the SEC during an investigation about cheating at the firm. In June 2019, the SEC’s Division of Enforcement sent EY a formal request for information about complaints the firm had received regarding cheating on training exams. On the same day EY received this request, the firm received a tip that an audit professional had shared an answer key to a CPA ethics exam. EY did not disclose this information to the SEC. To the contrary, its submission indicated that the firm did not have any current issues with cheating. In light of the tip it had received, EY’s June 20 submission was materially misleading. But EY never corrected its submission. Even after the firm began an internal investigation, confirmed there had been cheating, and the matter was discussed among senior lawyers at the firm and with members of the firm’s senior management, EY still did not correct its misleading submission.”

The SEC’s ire was reflected in the remedy which mandated not one but three oversight roles on an ongoing basis. The EY oversight requires EY to evaluate the sufficiency and adequacy of its quality controls, policies, and procedures relevant to ethics and integrity and to responding to Information Request to determine whether they are designed and implemented in a manner that provides reasonable assurance of compliance with all professional standards, including those relating to ethics and integrity applicable to accountants and attorneys, in the following areas:

1. The adequacy and sufficiency of ethics and integrity training and guidance,
2. Whether EY’s culture is supportive of ethical and compliant conduct and maintaining integrity,
3. Whether EY has designed and implemented appropriate policies and procedures relating to responding to Information Requests, and
4. Whether EY has designed and implemented appropriate policies and procedures and deploys proper resources and oversight to comply with all professional standards relating to (i) monitoring to detect non- compliance; (ii) having appropriate reporting lines, compensation, and rewards; (iii) assigning responsibility for overseeing compliance to senior executives and managers with access to relevant information and personnel; and (iv) ensuring consistent discipline.

Even more damning is the requirement for two external monitors (called Independent Consultants). The first is review EY Policies and Procedures and issue a detailed written report: (i) summarizing its work; (ii) making recommendations, as the Policies and Procedures IC deems appropriate, reasonably designed to ensure that EY’s Policies and Procedures are adequate and sufficient to provide reasonable assurance of compliance with all professional standards. The second Independent Consultant is to review EY’s conduct relating to the Commission staff’s June 2019 Information Request, including whether any member of EY’s executive team, General Counsel’s Office, compliance staff, or other EY employees contributed to the firm’s failure to correct its misleading submission. They are to recommend discipline. Does that sound like the SEC trust EY to follow through with its obligations about now?

EY, like KPMG before it, acted as gatekeepers in the eyes of the law and the SEC. To see this level of fraud and then hiding of it is extremely disconcerting. Perhaps it is no wonder EY is about to split into two different entities: auditing and consulting. I wonder how many EY audits will be reviewed through the eyes of this Order.