Background

As required under the Sarbanes-Oxley Act of the U.S., the registered public accounting firms that audit the books of any issuers (including foreign ones) in the U.S., have to be subject to inspections and investigations by the PCAOB, which includes the inspection of all audit work papers such as the engagement-specific documentation of the audit work related to the issuer’s financial statements. As reaffirmed under the Holding Foreign Companies Accountable Act of 2020 (HFCAA), if the PCAOB is “unable” to inspect or investigate “completely” the registered public accounting firms located in foreign jurisdictions, issuers that use those firms which have been identified by the SEC for three consecutive “non-inspection” years will face prohibitions on their securities trading in the U.S. In 2021, the PCAOB made determinations that the positions taken by Chinese authorities prevented the PCAOB from inspecting and investigating its member firms which have presence in mainland China and Hong Kong completely. On June 22, 2021, the U.S. Senate passed a bill which, if passed by the U.S. House of Representatives and signed into law, would reduce the number of consecutive non-inspection years required for triggering the prohibitions under the HFCAA from three years to two.

As the Securities and Exchange Commission of the U.S. (SEC) and PCAOB have alleged[1], CSRC’s imposition of a cooperative agreement and pre-approval requirement for cross-border data transfer on accounting firms operating in China (including Hong Kong) for more than a decade, impaired their ability to inspect and investigate these accounting firms as mandated under the Sarbanes-Oxley Act and HFCAA. However, as disclosed by CSRC on April 27, 2020, it had provided the PCAOB with audit work papers for a total of 14 US-listed Chinese companies up to that time, in the light of the cooperative framework under the International Organization of Securities Commissions, as well as the Enforcement Memorandum of Understanding in 2013 and the Agreement on Pilot Inspection in 2016 between the PCAOB, CSRC and MOF. 

As of 28 September 2022, 163 Chinese issuers have been designated on the conclusive list of issuers identified under the HFCAA, which will be subject to additional submission and disclosure obligations to establish that it is not owned or controlled by a governmental entity in the foreign jurisdiction with respect to that registered public accounting firm, and the percentage of the shares of the issuer owned by governmental entities in the foreign jurisdiction in which the issuer is incorporated or otherwise organized, etc.. If the PCAOB continues to be prohibited from conducting complete inspections and investigations of these PCAOB-registered public accounting firms in mainland China and Hong Kong, these China-based issuers may face trading prohibitions in the U.S.

Key takeaways

As of the date of this alert, the full text of this SOP Agreement is not publicly available. Set forth below is a summary of the key highlights as respectively outlined in the fact sheets/official statements issued by the SEC, PCAOB, and CSRC, with our notes on the important content introduced therein.

Content of SOP

• U.S.: Complete access to the audit work papers, audit personnel, and other information needed to inspect and investigate any firm PCAOB chooses, with no loopholes and no exceptions.
• China: The SOP outlines the target, scope, and forms of the cooperation, as well as the use of information and special data protection measures, in the course of this cooperative inspection and enforcement mechanism.
• HL Note: CSRC defines this SOP Agreement as a bilateral supervision mechanism, upon which the domestic entities may provide relevant data to foreign governmental agencies via Chinese authorities, in accordance with the Data Security Law (“DSL”), Personal Information Protection Law (“PIPL”), and other industry-specific relevant provisions[2].

Target

• U.S.: PCAOB registered public accounting firms headquartered in mainland China and Hong Kong. Potential violations of PCAOB standards, rules, and related federal securities laws by accounting firms and their associated persons.
• China: The internal control system of the relevant accounting firms and their audit work papers in connection to certain listed companies.
• HL Note: It is mutually agreed that the SOP Agreement is intended for the accounting firms and relevant audit work papers.

Cooperation mode

• U.S.: Sole discretion to select the firms, audit engagements and potential violations, without consultation with, nor input from, Chinese authorities. Direct access to interview and take testimony from all personnel associated with the audits that the PCAOB inspects or investigates.
• China: Pre-communication: Audit work papers and other documents shall be made available through the Chinese regulatory authorities. With the participation and assistance of the Chinese authorities, the U.S. regulators could conduct interviews and question the relevant personnel of the accounting firm.
• HL Note: The PCAOB cautioned that the signing of the SOP Agreement was only the first step toward complete access for inspection in mainland China and Hong Kong. As a prudent way, the accounting firms situated within mainland China and Hong Kong shall not respond directly to PCAOB/SEC without involvement of the CSRC or MOF.

Data issue

• U.S.: Complete access: No redaction: Redactions or withholding are not permitted. For a limited set of “Restricted Data” including Personally Identifiable Information, a “view only” process for PCAOB to view the data in camera. Procedures are in place for PCAOB to view complete audit work papers with all information included and for the PCAOB to retain information as needed, including the Restricted Data. PCAOB can transfer information to the SEC in the normal course, for all statutory obligations and routine uses.
• China: The audit work paper does not generally include restricted data such as state secrets, personal privacy, or a company’s underlying data. The review of the audit work paper and other documents would be collected and provided to U.S. regulators via Chinese counterparts. In particular, special measures and procedures have been set out to handle and use the restricted data. 
• HL Note: CSRC remains silent on its “special measures to handle the restricted data”, in particular in terms of whether the provision of such restricted data by any accounting firms shall go through any governmental security assessment as provided under the current data exportation control regime, whether the onward sharing of data at issue would be subject to any pre-approval/restrictions, or if it is CSRC and other related authorities who will conduct any redaction/withholding and transfer the redacted version directly to Hong Kong, to control the PCAOB/SEC’s access to restricted data. As a matter of fact, data processing requirements have been embedded in many other PCAOB cooperative arrangements with non-U.S. regulators, including but not limited to the purpose limitation, data proportionality, data subject rights, as well as sensitive data transfer prohibition/restriction. On the contrary, the PCAOB presents a more forceful position and states that it will review, retain and share the data with the SEC for statutory obligations at its sole discretion, without any redaction or withholding. Notably, CSRC emphasized the information security responsibility of the listed Chinese enterprise in its SOP Agreement-related announcement^[3], which will restrict the data sharing between the listed Chinese enterprises and onshore or offshore securities service providers (like accounting firms), in particular for the state secret and designated archives. That said, certain restricted data may never end up with the accounting firm for PCAOB’s random inspection and investigation.

Next Steps

• U.S.: PCAOB’s inspection and investigation team arrived in Hong Kong in mid-September 2022 to start their work. Inspection: PCAOB will notify the audit firms of its plans to inspect, including the specific engagements. Investigation: PCAOB has issued document requests to audit firms in China, and the testimony notifications have been sent to witnesses. These audit firms must provide the requested documents to the PCAOB, through the CSRC, on a timely basis.
• China: To be implemented shortly.
• HL Note: It looks that the inspections and investigations under the SOP Agreement will be carried out in Hong Kong and the U.S. side somehow admits the CSRC’s pre-approval to a certain extent.

To be expected

Apart from the uncertainty of the cooperation level contemplated by each party, it is advised to follow up on how would this SOP Agreement be implemented in conjunction with the domestic data protection regulations, such as DSL and PIPL. For instance, whether the data provided under the SOP Agreement via Chinese authorities would still be subject to any prior governmental exportation formalities, and whether the draft cross-border securities regulatory cooperation mechanism^[4] that was recently introduced by CSRC would be finalized to include any detailed guidance for domestic accounting firms in this regard. 

Separately, PCAOB will reassess its determination by the end of 2022 on account of the Chinese authorities’ performance of the SOP Agreement and whether PCAOB has been granted complete and timely access to jurisdiction-wide information in its work in Hong Kong. Otherwise, as contemplated by PCAOB, the relevant China-based companies will face trading prohibitions and likely delisting in the U.S.

Authored by Roy Zou, Sherry Gong, Stephanie Tang, Flora Feng.