Sarbanes-Oxley Final Rule:
Retention of Records Relevant to Audits and Reviews

Securities and Exchange Commission

17 CFR Part 210

[Release Nos. 33-8180; 34-47241; IC-25911; FR-66; File No. S7-46-02]

RIN 3235-AI74

Retention of Records Relevant to Audits and Reviews

Agency: Securities and Exchange Commission.

Action: Final rule.

Summary: We are adopting rules requiring accounting firms to retain for seven years certain records relevant to their audits and reviews of issuers' financial statements. Records to be retained include an accounting firm's workpapers and certain other documents that contain conclusions, opinions, analyses, or financial data related to the audit or review.

Dates: Effective Date: March 3, 2003. Compliance Date: Compliance is required for audits and reviews completed on or after October 31, 2003.

For Further Information Contact: Samuel L. Burke, Associate Chief Accountant, D. Douglas Alkema, Professional Accounting Fellow, or Robert E. Burns, Chief Counsel, at (202) 942-4400, Office of the Chief Accountant, U.S. Securities and Exchange Commission, 450 Fifth Street, NW, Washington, DC 20549-1103.

Supplementary Information: We are adding rule 2-06 to Regulation S-X.

I. Executive Summary

As mandated by section 802 of the Sarbanes-Oxley Act of 2002 ("Sarbanes-Oxley Act" or "the Act"),¹ we are amending Regulation S-X to require accountants who audit or review an issuer's financial statements to retain certain records relevant to that audit or review. These records include workpapers and other documents that form the basis of the audit or review, and memoranda, correspondence, communications, other documents, and records (including electronic records), which are created, sent or received in connection with the audit or review, and contain conclusions, opinions, analyses, or financial data related to the audit or review. To coordinate with forthcoming auditing standards concerning the retention of audit documentation, the rule requires that these records be retained for seven years after the auditor concludes the audit or review of the financial statements, rather than the proposed period of five years from the end of the fiscal period in which an audit or review was concluded. As proposed, ² the rule addresses the retention of records related to the audits and reviews of not only issuers' financial statements but also the financial statements of registered investment companies.

II. Discussion Of Final Rule

Section 802 of the Sarbanes-Oxley Act³ is intended to address the destruction or fabrication of evidence and the preservation of "financial and audit records."⁴ We are directed under that section to promulgate rules related to the retention of records relevant to the audits and reviews of financial statements that issuers file with the Commission.

Section 802 states that the record retention requirements should apply to audits of issuers of securities to which section 10A(a) of the Securities Exchange Act of 1934 ("Exchange Act") applies. The term "issuer" in this context is defined in section 10A(f) of the Exchange Act to include certain entities filing reports under that Act and entities that have filed and not withdrawn registration statements to sell securities under the Securities Act of 1933.⁵ As adopted, the record retention requirements also apply to any audit or review of the financial statements of any registered investment company.⁶ We believe that it is important for these record retention requirements, like our other record retention requirements, to apply consistently with respect to all registered investment companies, regardless of whether they fall within the periodic reporting requirements of the Exchange Act.⁷

Neither section 802 nor the final rule exempts auditors of foreign issuers' financial statements. Commenters, including the European Commission, noted that application of the rule to foreign auditors would place additional and differing layers of retention requirements on those firms.⁸ However, none of the commenters identified any direct conflicts with foreign requirements.

The availability of documents under this rule will assist in the oversight and quality of audits of an issuer's financial statements. Increased retention of identified records also may provide critical evidence of financial reporting impropriety or deficiencies in the audit process. In light of these benefits, and absent a direct conflict with foreign requirements, the retention requirements are to apply equally to domestic and foreign accounting firms auditing the financial statements of foreign issuers. Issues raised by commenters regarding Public Company Accounting Oversight Board ("the Oversight Board") oversight of foreign accounting firms and access by the SEC and the Oversight Board to the records retained by foreign accounting firms, as provided by Section 106 of the Sarbanes-Oxley Act, will be the subject of further discussion among staff, the Commission and the Oversight Board.⁹

In restricting the application of the rule to the audits and reviews of the financial statements of issuers and registered investment companies, we are not condoning more liberal document destruction policies for the audits and reviews of financial statements of other entities. For example, we would expect that auditors of the financial statements of those investment advisers, broker-dealers, and entities subject to Municipal Securities Rulemaking Board regulations that are not subject to the rule would retain relevant audit and review records consistent with applicable laws, regulations, and professional standards.

Documents to be Retained

Paragraph (a) of rule 2-06 identifies the documents that must be retained and the time period for retaining those documents.¹⁰ The final rule requires that the auditor¹¹ retain records relevant to the audit or review, including workpapers and other documents that form the basis of the audit or review of an issuer's financial statements, and memoranda, correspondence, communications, other documents, and records (including electronic records) that meet two criteria. The two criteria are that the materials (1) are created, sent or received in connection with the audit or review, and (2) contain conclusions, opinions, analyses, or financial data related to the audit or review.

Paragraph (a) of the proposed rule did not contain the phrase, "records relevant to the audit or review." The proposal listed the records to be retained without a reference to the general notion of relevance to the audit or review. In response to commenters,¹² and to track more closely the wording in section 802,¹³ we have added those words to the final rule.

In the Proposing Release, we stated that non-substantive materials that are not part of the workpapers, such as administrative records, and other documents that do not contain relevant financial data or the auditor's conclusions, opinions or analyses would not meet the second of the criteria in rule 2-06(a) and would not have to be retained. Commentators questioned whether the following documents would be considered substantive and have to be retained:

• Superseded drafts of memoranda, financial statements or regulatory filings,¹⁴
   
• Notes on superseded drafts of memoranda, financial statements or regulatory filings that reflect incomplete or preliminary thinking,¹⁵
   
• Previous copies of workpapers that have been corrected for typographical errors or errors due to training of new employees,¹⁶
   
• Duplicates of documents,¹⁷ or
   
• Voice-mail messages.¹⁸

These records generally would not fall within the scope of new rule 2-06 provided they do not contain information or data, relating to a significant matter, that is inconsistent with the auditor's final conclusions, opinions or analyses on that matter or the audit or review.¹⁹ For example, rule 2-06 would require the retention of an item in this list if that item documented a consultation or resolution of differences of professional judgment.

Commenters also questioned whether all of the issuer's financial information, records, databases, and reports that the auditor examines on the issuer's premises, but are not made part of the auditor's workpapers or otherwise currently retained by the auditor, would be deemed to be "received" by the auditor under rule 2-06(a)(1) and have to be retained by the auditor.²⁰ We do not believe that Congress intended for accounting firms to duplicate and retain all of the issuer's financial information, records, databases, and reports that might be read, examined, or reviewed by the auditor. Accordingly, we do not believe that the "received" criterion in rule 2-06(a)(1) requires that such records be retained.

Some commentators suggested that paragraph (a) of the proposed rule was overly broad and that the language in the rule, rather than following section 802 of the Sarbanes-Oxley Act, should conform to current auditing standards.²¹ It would appear, however, that by requiring the retention of documents in addition to audit workpapers required by generally accepted auditing standards ("GAAS") Congress has rejected this approach. Congress intended that accounting firms retain substantive materials that are relevant to the review or audit of financial statements filed with the Commission and enumerated the records described in the rule as being relevant to audits and reviews. Narrowing the scope of the rule to conform to the current auditing literature would be contrary to the apparent congressional purpose embodied in section 802.

Time of Retention

The final rule states that records must be retained for seven years. We proposed that these materials be retained for five years after the end of the fiscal period in which an accountant audits or reviews an issuer's financial statements,²² which is the period prescribed by section 802.²³ We also noted in the Proposing Release, however, that section 103 of the Sarbanes-Oxley Act directs the Oversight Board to require auditors to retain for seven years audit workpapers and other materials that support the auditor's conclusions in any audit report.²⁴ There may be fewer documents retained pursuant to section 103, which focuses more on workpapers that support the auditor's conclusions, than under section 802, which includes not only workpapers but also other documents that meet the criteria noted in this release. Many documents, however, may be covered by both retention requirements.²⁵

Some commenters suggested that we adopt a uniform seven-year retention period,²⁶ while others indicated that the longer period would increase audit costs without any commensurate benefit.²⁷ We anticipate that most accounting firms, for administrative convenience, would retain all relevant materials for the longer of the two periods prescribed by the Commission and by the Oversight Board.²⁸ Incremental costs associated with requiring a seven-year retention period, therefore, should not be significant. We also believe that adopting a seven-year retention period would reduce inconsistencies between the forthcoming Oversight Board rules and the Commission's rules and lessen any potential confusion related to the calculation of retention periods.²⁹ Accordingly, the final rule requires that auditors retain the required documents for seven years from the conclusion of the audit or review.

Workpapers Defined

Section 802 is intended to require the retention of more than what traditionally has been thought of as auditor's "workpapers."³⁰ To clarify the distinction between workpapers and other materials that would be retained, paragraph (b) of the final rule defines the term "workpapers." The legislative history to section 802 states that the term is to be used as it is "widely understood" by the Commission and by the accounting profession.³¹ We believe that the term is understood to refer to the documents required to be retained by GAAS.

GAAS does not use the specific term "workpapers,"³² but Statement on Auditing Standards No. 96, "Audit Documentation," states, in part:

The auditor should prepare and maintain audit documentation, the content of which should be designed to meet the circumstances of the particular audit engagement. Audit documentation is the principal record of the auditing procedures applied, evidence obtained, and conclusions reached by the auditor in the engagement.³³

We have placed the body of this provision into paragraph (b) and stated that "workpapers" means "documentation of auditing or review procedures applied, evidence obtained, and conclusions reached by the accountant in the audit or review engagement, as required by standards established or adopted by the Commission or by the Public Company Accounting Oversight Board."³⁴ The proposed rule, therefore, recognizes that the Oversight Board, subject to Commission oversight, has the ability to review and change the nature and scope of the required documentation of procedures, evidence, and conclusions related to audits and reviews of financial statements.³⁵

As noted by several commenters, there may be significant overlap of the documents falling within the definition of "workpapers" and the documents that would be retained pursuant to the description in paragraph (a) of the rule of "other documents that form the basis of the audit or review, and memoranda, correspondence, communications, other documents, and records (including electronic records), which (1) are created, sent or received in connection with the audit or review, and (2) contain conclusions, opinions, analyses, or financial data related to the audit or review."³⁶

Differences of Opinion

SAS 96 states that audit documentation serves mainly to provide the principal support for the auditor's report and to aid the auditor in the conduct and supervision of the audit.³⁷ Section 802, however, is intended to facilitate effective enforcement of the securities laws and criminal laws,³⁸ which requires the retention of not only records that support the auditor's report (as required by SAS 96) but also records that would be inconsistent with, or otherwise challenge, the conclusions in the auditor's report. In order to ensure that the purposes of the Act are fulfilled, we proposed that paragraph (c) of the rule include the specific requirement that the materials retained under paragraph (a) would include not only those that support an auditor's conclusions about the financial statements but also those materials that may "cast doubt" on those conclusions.³⁹ We stated in the Proposing Release that paragraph (c) was intended to ensure the preservation of those records that reflect differing professional judgments and views (both within the accounting firm and between the firm and the issuer) and how those differences were resolved. To better communicate what we intended by "cast doubt" on the auditor's conclusions, we included in the proposed rule the example of documentation of differences of opinion concerning accounting and auditing issues.

The auditor in a variety of contexts may create materials related to differences of opinion. For example, SAS No. 22, "Planning and Supervision," states in part:

The auditor with final responsibility for the audit and assistants should be aware of the procedures to be followed when differences of opinion concerning accounting and auditing issues exist among firm personnel involved in the audit. Such procedures should enable an assistant to document his disagreement with the conclusions reached if, after appropriate consultation, he believes it necessary to disassociate himself from the resolution of the matter. In this situation, the basis for the final resolution should also be documented.⁴⁰

An interpretation of this section issued by the AICPA's Auditing Standards Board emphasizes the professional obligation on each person involved in an audit engagement to bring his or her concerns to the attention of others in the firm and, as appropriate, to document those concerns. This interpretation states:

Accordingly, each assistant has a professional responsibility to bring to the attention of appropriate individuals in the firm, disagreements or concerns the assistant might have with respect to accounting and auditing issues that he believes are of significance to the financial statements or auditor's report, however those disagreements or concerns may have arisen. In addition, each assistant should have a right to document his disagreement if he believes it is necessary to disassociate himself from the resolution of the matter.⁴¹

In addition, SAS 96 states that the documentation for an audit should include the findings or issues that in the auditor's judgment are significant, the actions taken to address them (including any additional evidence obtained), and the basis for the final conclusions reached.⁴² For example, if a memorandum is prepared by a member of a large accounting firm's national office that is critical of the accounting used by an audit client, or of a position taken by the partner in charge of the audit of those financial statements, that memorandum should be retained.⁴³ Another example would be documentation related to an auditor's communications with an issuer's audit committee about alternative disclosures and accounting methods used by the issuer that are not the disclosures or accounting preferred by the auditor.⁴⁴

We continue to believe that retaining any materials that might cast doubt on the final conclusions reflected in the auditor's report, including those created under SAS 22 and SAS 96, would be consistent with the letter and spirit of the Sarbanes-Oxley Act. One commenter, the National Association of State Boards of Accountancy ("NASBA"), endorsed requiring the retention of documents that "cast doubt" on an auditor's audit or review because "state attorneys' general staff members assigned to accountancy boards often have complained of receiving only those documents that support the final report." NASBA also noted, however, that the Commission promptly should revise the rule if it becomes too burdensome or otherwise unworkable.⁴⁵

Several commentators stated that the proposed "cast doubt" language was unworkable. They indicated that the phrase was pejorative,⁴⁶ vague and unnecessary, and might be used to attribute doubt to virtually any remark made during an audit, regardless of its relevance or materiality.⁴⁷ One accounting firm stated that the proposed rule "could be read to require retention of every document reflecting an error however temporary - even typographical or addition errors made in preparing a workpaper.... It also could be read to require preservation of each and every exchange of differing views on any topic, however fleeting and trivial the differences."⁴⁸ Another accounting firm stated that on many occasions correcting or redoing workpapers is not the result of differences of opinion but from on-the-job training and a normal learning process.⁴⁹ One commenter stated that the "cast doubt" language in the proposed rule might deter auditors from asking legitimate questions.⁵⁰

Some commenters suggested language to replace the provision in subparagraph (c) that documents be retained if they "cast doubt on the final conclusions reached by the auditor." For example, commenters suggested that records be retained only if they would constitute a reportable "disagreement" under Item 304 of Regulation S-K.⁵¹ Item 304 indicates that a disagreement is reportable upon a change in an entity's principal accountant if, among other things, the disagreement occurs at the decision-making level on any matter of accounting principles or practices, financial statement disclosure, or auditing scope or procedure, which, if not resolved to the accountant's satisfaction, would cause the auditor to make reference to the matter in connection with his or her audit report.⁵²

We are reluctant, however, to follow Item 304 of Regulation S-K, which has a different purpose than the rule being adopted in this release. Item 304 requires disclosure to investors of potential "opinion shopping" situations and provides a forum for the registrant, the newly engaged auditor, and the former auditor to provide their views of "disagreements" and other "reportable events." New rule 2-06, on the other hand, addresses the retention of documents relevant to enforcement of the securities laws, Commission rules, and criminal laws.

In the proposing release we asked if, in place of the "cast doubt" language, a different test for retention of documents would be appropriate. We specifically asked if such a test should be documentation of "significant differences in professional judgment" or "differences of opinion on issues that are material to the issuer's financial statements or to the auditor's final conclusions regarding any audit or review." Several commenters supported using one or a combination of these tests.⁵³

In consideration of the comments received, we have revised paragraph (c) of the rule. We have removed the phrase "cast doubt" to reduce the possibility that the rule mistakenly would be interpreted to reach typographical errors, trivial or "fleeting" matters, or errors due to "on-the-job" training. We continue to believe, however, that records that either support or contain significant information that is inconsistent with the auditor's final conclusions would be relevant to an investigation of possible violations of the securities laws, Commission rules, or criminal laws and should be retained. Paragraph (c), therefore, now provides that the materials described in paragraph (a) shall be retained whether they support the auditor's final conclusions or contain information or data, relating to a significant matter, that is inconsistent with the final conclusions of the auditor on that matter or on the audit or review. Paragraph (c) also states that the documents and records to be retained include, but are not limited to, those documenting consultations on or resolutions of differences in professional judgment.

The reference in paragraph (c) to "significant" matters is intended to refer to the documentation of substantive matters that are important to the audit or review process or to the financial statements of the issuer or registered investment company.⁵⁴ Rule 2-06(c) requires that the documentation of such matters, once prepared, must be retained even if it does not "support" the auditor's final conclusions, because it may be relevant to an investigation.⁵⁵ Similarly, the retention of records regarding a consultation about, and resolution of, differences in professional judgment would be relevant to such an investigation and must be retained. We intend for Rule 2-06 to be incremental to, and not to supersede or otherwise affect, any other legal or procedural requirement related to the retention of records or potential evidence in a legal, administrative, disciplinary, or regulatory proceeding.

Finally, we recognize that audits and reviews of financial statements are interactive processes and views within an accounting firm on accounting, auditing or disclosure issues may evolve as new information or data comes to light during the audit or review. We do not view "differences in professional judgment" within subparagraph (c) to include such changes in preliminary views when those preliminary views are based on what is recognized to be incomplete information or data.

Response to Other Significant Comments

In response to our request in the Proposing Release, commenters addressed whether issuers and registered investment companies should be required to retain documents that the auditor examines, reviews or otherwise considers during the audit or review but are not made part of the auditor's records. Commenters generally opposed such a requirement.⁵⁶ One commenter indicated that it was unclear whether section 802 of the Sarbanes-Oxley Act applies to such records and that, if such a requirement was imposed, it would go beyond those documents that are relevant to the audit or review or that contain the auditor's conclusions, opinions, or analyses.⁵⁷ An accounting firm similarly stated that it was not practical for an issuer to keep track of the documents examined by the auditor and then apply the retention requirements to those documents.⁵⁸ An issuer commented that, due to the host of documents, databases, and other material provided to an auditor, it is impossible for an issuer to determine what, if any, documents provided to the auditor were relevant to the auditor or provided the basis for the auditor's conclusions.⁵⁹ Accordingly, we are not instituting such a requirement at this time.

We also requested comments on whether a transition period was necessary or appropriate in implementing the rule. Accounting firms⁶⁰ and a law firm⁶¹ noted that time may be required to develop systems related to the retention of documents (particularly electronic documents) and to train people to use them. Accordingly, we have indicated in the beginning of this release that accounting firms should comply with the rule no later than October 31, 2003.

Several items were raised in the comment letters that may be addressed more appropriately by the Public Company Accounting Oversight Board. For example, one commenter suggested that the Commission adopt the standard promulgated by the General Accounting Office, or a previously proposed draft auditing standard, related to the form and content of audit workpapers.⁶² This commenter also suggested that the Commission adopt standards requiring accounting firms to: document differences of opinion on issues that are material to the audit; have written documentation and destruction policies; document significant relationships regarding the auditor and issuer; and have auditors performing audit or review work related to the issuer's subsidiaries or foreign affiliates document all work performed and certify in writing that such documentation is complete and available for inspection.⁶³ These matters are more appropriately within the purview of setting auditing standards and should be addressed, in the first instance, by the Oversight Board.⁶⁴

The same commenter suggested that the Commission provide that if audit work is not documented in the workpapers then the burden of proof shifts to the auditor to prove by a preponderance of evidence that the work in fact was performed.⁶⁵ We note that the retention requirements under SAS 96, as discussed above, and new rule 2-06 should provide documentation of all significant matters considered during the audit. If such work is performed but not documented, the auditor generally would violate GAAS or new rule 2-06.

Another commenter suggested that the Commission require that all accounting firms registered with the Public Company Accounting Oversight Board comply with consultation requirements, and related documentation requirements, currently prescribed by the SEC Practice Section of the American Institute of Certified Public Accountants for large accounting firms.⁶⁶ We believe these matters relate to quality control standards within the scope of the Oversight Board's standard setting authority and we encourage the Oversight Board to consider adoption of such requirements. This commenter also suggested that the Commission address the application of rule 2-06 to documents prepared for a firm's internal inspection or outside peer review.⁶⁷ Such documents generally would not be considered to be created, sent or received in connection with an audit or review engagement and, therefore, would not be within the new rule. We would encourage the Oversight Board to consider, however, whether there are circumstances in which certain of the records prepared for inspection purposes may be considered part of the audit or review workpapers.

III. Paperwork Reduction Act

Certain provisions of rule 2-06 contain "collections of information" requirements within the meaning of the Paperwork Reduction Act of 1995 ("PRA") (44 U.S.C. 3501 et seq.), and the Commission submitted them to the Office of Management and Budget ("OMB") for review in accordance with 44 U.S.C. 3507(d) and 5 CFR 1320.11. The title for the collection of information is "Regulation S-X-Record Retention." The request for approval of the rule's collection of information requirements is pending at OMB.

An agency may not conduct or sponsor, and a person is not required to respond to, a collection of information unless it displays a currently valid control number. Compliance with the proposed requirements would be mandatory. Rule 2-06 requires that accounting firms retain certain records for seven years. Retained information would be kept confidential unless or until made public during an enforcement, disciplinary or other legal or administrative proceeding.

The final rule, which is included in Regulation S-X, requires accountants to retain certain records for a period of seven years after the accountant concludes an audit or review of an issuer's or registered investment company's financial statements. The proposed rules do not require accounting firms to create any new records. It also is important to note that decisions about the retention of records currently are made as a part of each audit or review.

The records to be retained include records relevant to the audit or review, including workpapers and other documents that form the basis of the audit or review, and memoranda, correspondence, communications, other documents, and records (including electronic records), which are created, sent or received in connection with the audit or review, and contain conclusions, opinions, analyses, or financial data related to the audit or review. Records described in the rule are to be retained whether the conclusions, opinions, analyses, or financial data in the records support the final conclusions reached by the auditor, or contain information or data, relating to a significant matter, that is inconsistent with the final conclusions of the auditor on that matter or the audit or review. The required retention of audit and review records should discourage the destruction, and assist in the availability, of records that may be relevant to investigations conducted and litigation brought under the securities laws, Commission rules or criminal laws.

In the proposing release, we estimated that approximately 850 accounting firms audit and review the financial statements of approximately 20,000 public companies and registered investment companies filing financial statements with the Commission.⁶⁸ Each firm currently is required to perform its audits and reviews in accordance with generally accepted auditing standards ("GAAS"), which require auditors to retain certain documentation of their work.⁶⁹ Accounting firms, therefore, currently make decisions about the retention of each record created during the audit or review. GAAS, however, currently does not require explicitly that auditors retain documents that do not support their opinions and GAAS does not set definite retention periods. As a result, rule 2-06 might result in the retention of more records than currently required under GAAS, and might result in some accounting firms keeping those records for a longer period of time.

To cover all increases in burden hours, we estimated in the proposing release that, on average, the incremental burden on firms would be no more than one hour for each public company audit client, or approximately 15,000 hours.⁷⁰

We received comments on the proposed collection of information requirements indicating that, in view of the possible breadth of the proposed rule, the estimated burden hours appeared to be low.⁷¹ These commenters suggested that this burden would be mitigated by revising the portion of the proposed rule related to the retention of records that "cast doubt" on the final conclusions reached by the auditor on the audit or review.⁷² In view of the revisions made to the rule and the clarifications in this release provided in response to commenters' concerns, we believe that the estimated burden is reasonable.

IV. Cost - Benefit Analysis

The record retention requirements in rule 2-06 implement a congressional mandate. We recognize that any implementation of the Sarbanes-Oxley Act likely will result in costs as well as benefits and will have an effect on the economy. We are sensitive to the costs and benefits imposed by our rules and, in the Proposing Release, we identified certain costs and benefits of the proposed rule.

A. Background

Under section 802 of the Sarbanes-Oxley Act, accountants who audit or review an issuer's financial statements must retain certain records relevant to that audit or review. Rule 2-06 implements this provision and indicates the records to be retained, but it does not require accounting firms to create any new records.

The records to be retained would include those relevant to the audit or review, including workpapers and other documents that form the basis of the audit or review and memoranda, correspondence, communications, other documents, and records (including electronic records), which are created, sent or received in connection with the audit or review, and contain conclusions, opinions, analyses, or financial data related to the audit or review. Records described in the rule would be retained whether the conclusions, opinions, analyses, or financial data in the records support the final conclusions reached by the auditor, or contain information or data, relating to a significant matter, that is inconsistent with the final conclusions of the auditor on that matter or the audit or review. The required retention of audit and review records should discourage the destruction, and assist in the availability, of records that may be relevant to investigations conducted under the securities laws, Commission rules or criminal laws.

B. Potential Benefits of the Retention Requirements

Rule 2-06 requires that accountants retain certain records relevant to an audit or review of an issuer's or registered investment company's financial statements for seven years. To the extent that the rule increases the availability of documents beyond current professional practices, the rule may benefit investigations and litigation conducted by the Commission and others. Increased retention of these records will preserve evidence reflecting significant accounting judgments and may provide important evidence of financial reporting improprieties or deficiencies in the audit process.

One of the most important factors in the successful operation of our securities markets is the trust that investors have in the reliability of the information used to make voting and investment decisions. In addition to providing materials for investigations, the availability of the documents subject to rule 2-06 might facilitate greater oversight of audits and improved audit quality, which, in turn, ultimately could increase investor confidence in the reliability of reported financial information.

C. Potential Costs of the Proposal

In the proposing release, we estimated that approximately 850 accounting firms audit and review the financial statements of approximately 20,000 public companies and registered investment companies filing financial statements with the Commission.⁷³ Each firm currently is required to perform its audits and reviews in accordance with generally accepted auditing standards ("GAAS"), which require auditors to retain certain documentation of their work.⁷⁴ Accounting firms, therefore, currently make decisions about the retention of each record created during the audit or review. GAAS explicitly requires that auditors retain documents that support their audit reports, but it does not set definite retention periods. As noted above, to ensure the purposes of the Act are achieved, the final rule requires the retention of materials that not only support the auditor's report but also records that are inconsistent with that report, and sets a seven-year retention period. As a result, rule 2-06 might result in the retention of more records than currently required under GAAS, and might result in some accounting firms keeping those records for a longer period of time.

It is important to note, however, that the proposed rules do not require the creation of any record; they require only that existing records be maintained for the prescribed time period. It also is important to note that decisions about the retention of records currently are made as a part of each audit or review.

In the proposing release, we estimated that adoption of the rule would not result in any significant increase in costs for accounting firms or issuers because the rule would not require the creation of records, would not significantly increase procedures related to the review of documents, and minimal, if any, work would be associated with the retention of these records. We indicated that the disposal of those records, which would occur in any event, merely would be delayed. In addition, because an already large and ever-increasing portion of the records required to be retained are kept electronically, we stated that the incremental increase in storage costs for documents would not be significant for any firm or for any single audit client. We recognize, however, that firms may incur some cost to retain access to older technologies as electronic storage technology advances.

For purposes of the Paperwork Reduction Act, we estimated in the proposing release the total burden to be 15,000 burden hours. We further estimated that, assuming an accounting firm's average cost of in-house staff is $110 per hour,⁷⁵ the total cost would be $1,650,000.

We received comments indicating that, based on the proposed rule, our cost estimate was low. Due to revisions made to the rule the cost estimates provided by the commenters, however, may no longer be accurate. For example, a large accounting firm stated that if it would be required to retain all financial data "received" from the issuer in the course of the audit, its current document retention costs of approximately $4.5 million would double.⁷⁶ This firm questioned whether all of the issuer's financial information, records, databases, and reports that the auditor examines on the issuer's premises, but are not made part of the auditor's workpapers or otherwise retained by the auditor, would be deemed to be "received" by the auditor and subject to the retention requirements in rule 2-06. As noted previously in this release, we do not believe that Congress intended for accounting firms to duplicate and retain all of the issuer's financial information, records, databases, and reports that might be read, examined, or reviewed by the auditor. Accordingly, we do not believe that the "received" criterion in rule 2-06(a)(1) requires that auditors retain such records and the firm's anticipated document retention costs, therefore, should be significantly reduced.

Another accounting firm indicated that administrative costs of retaining records, based on the proposed rule, could include a one-time cost of $1 million and ongoing annual costs of $500,000 to $1 million.⁷⁷ This firm also estimated that increased litigation costs associated with complying with discovery requests and payment of damages would increase annual audit costs by at least five percent and perhaps as much as fifteen to twenty percent.⁷⁸ As noted above, we believe that revisions to the rule in response to commenters' concerns should lessen the administrative costs anticipated by this commenter. Regarding the commenter's cost estimates related to potential litigation, we recognize that one purpose of section 802 is to facilitate investigations of potential violations of securities laws and criminal laws,⁷⁹ which could impact a firm's litigation costs. Nonetheless, the firm's estimate would appear to be speculative. If the retention requirements lead to more efficient oversight of the accounting profession then they may result in improved audit quality and enhanced investor confidence in the profession.

Other accounting firms noted that many variables would affect the costs related to the rule, and that the ultimate increase in costs is difficult to quantify.⁸⁰ One commenter indicated that the amount of changes to be made to current record retention systems, and the related costs, depends on whether the accounting firm has a good record management system already in place.⁸¹ For those firms with established records management programs, this commenter indicated that the rule would require a review and possibly fine-tuning of the firms' existing policies and procedures. This commenter also noted that adopting the proposed five-year retention requirement would have been more costly than adopting the seven-year retention requirement that is consistent with the forthcoming auditing standard to be promulgated by the Public Company Accounting Oversight Board. In this commenter's view, having two retention periods would have increased costs associated with processing the records.⁸²

V. Consideration of Impact on the Economy, Burden on Competition, and Promotion of Efficiency, Competition, and Capital Formation

Section 23(a)(2) of the Exchange Act⁸³ requires the Commission, when adopting rules under the Exchange Act, to consider the anti-competitive effects of any rule it adopts. In addition, Section 2(b) of the Securities Act of 1933,⁸⁴ Section 3(f) of the Exchange Act,⁸⁵ and Section 2(c) of the Investment Company Act⁸⁶ require the Commission, when engaging in rulemaking that requires it to consider or determine whether an action is necessary or appropriate in the public interest, to consider whether the action will promote efficiency, competition, and capital formation.

We believe that rule 2-06 would not have an adverse impact on competition. To the extent the proposed rules would increase the quality of audits and the efficiency of enforcement and disciplinary proceedings, there might be an increase in investor confidence in the efficacy of the audit process and the efficiency of the securities markets.

One commenter agreed that the rule should have no adverse effect on competition.⁸⁷ This commenter also noted that those firms with good records management systems should have more efficient services and more secure information.⁸⁸

In any event, to the extent the rule has any anti-competitive effect, or impacts efficiency, competition, or capital formation, we believe those effects are necessary and appropriate in furtherance of the goals of implementing section 802 of the Sarbanes-Oxley Act.

We received no comments indicating that the rule would impact efficiency or capital formation.

VI. Final Regulatory Flexibility Act Analysis

This Final Regulatory Flexibility Act Analysis has been prepared in accordance with 5 U.S.C. 604. It relates to new rule 2-06 of Regulation S-X, which requires auditors to retain certain audit and review documentation.

A. Reasons for and Objectives of the New Rule

The rule generally carries out a congressional mandate. The rule, in general, prohibits the destruction for seven years of certain records related to the audit or review of an issuer's or registered investment company's financial statements.⁸⁹ The rule, however, would not require accounting firms to create any new records.

The objective of the rule is to implement section 802 of the Sarbanes-Oxley Act in order to increase investor confidence in the audit process and in the reliability of reported financial information. This is accomplished by defining the records to be retained related to an audit or review of an issuer's financial statements. Having these records available should enhance oversight of corporate reporting and of the performance of auditors and facilitate the enforcement of the securities laws.

B. Significant Issues Raised by Public Comments

One commenter anticipated that the record retention requirements, if adopted as proposed, would have placed an "enormous" burden on small accounting firms, and could have resulted in some firms deciding to no longer audit public companies.⁹⁰ The final rule, however, contains several revisions designed to lower the costs on all firms, including smaller accounting firms. These revisions include removing the "cast doubt" language from the rule, which commenters generally viewed as requiring the auditor to retain virtually all documents generated or reviewed during an audit or review, regardless of their relevance or materiality.⁹¹ We have replaced this language with language that focuses on documents that contain information or data relating to a significant matter that are inconsistent with the auditor's final conclusions regarding that matter or the audit or review. We also have adopted a seven-year retention period to coincide with a forthcoming retention requirement to be promulgated by the Public Company Accounting Oversight Board, which, according to one commenter, should reduce processing costs associated with the rule.⁹² Also, as noted above, we have clarified in this release that the auditor need not retain every document read, examined or reviewed as part of the audit or review process. As a result of these revisions and clarifications, we believe that implementation of the revised rule should be less costly for accounting firms than anticipated by the commenters.

Furthermore, one commenter noted that records management procedures for smaller accounting firms should be the same as they are for larger firms.⁹³ This commenter indicated that "the cost of implementing a [formalized records management] program at any-sized firm will be surpassed by the benefits received and the future cost savings."⁹⁴

C. Small Entities Subject to the Rule

Our rules do not define "small business" or "small organization" for purposes of accounting firms. The Small Business Administration defines small business, for purposes of accounting firms, as those with under $6 million in annual revenues.⁹⁵ We have only limited data indicating revenues for accounting firms, and we cannot estimate the number of firms with less than $6 million in revenues that practice before the Commission.

In the Initial Regulatory Flexibility Analysis we requested comment on the number of firms with less than $6 million in revenue in order to determine the number of small firms potentially affected by the rule, but we received no response.

D. Projected Reporting, Recordkeeping and Other Compliance Requirements

Under the new rule,⁹⁶ accountants who audit or review an issuer's or registered investment company's financial statements must retain certain records for a period of seven years from conclusion of the audit or review. The records to be retained include records relevant to the audit or review, such as workpapers and other documents that form the basis of the audit or review and memoranda, correspondence, communications, other documents, and records (including electronic records), which are created, sent or received in connection with the audit or review, and contain conclusions, opinions, analyses, or financial data related to the audit or review. Records described in the rule would be retained whether the conclusions, opinions, analyses, or financial data in the records support the final conclusions reached by the auditor, or contain information or data, relating to a significant matter, that is inconsistent with the final conclusions of the auditor on that matter or the audit or review. The required retention of audit and review records should discourage the destruction, and assist in the availability, of records that may be relevant to investigations conducted under the securities laws.

In the Proposing Release, we estimated that adoption of the rule would not result in any significant increase in costs for accounting firms or issuers because the rule would not require the creation of records, would not significantly increase procedures related to the review of documents, and minimal, if any, work would be associated with the retention of these records. We indicated that the disposal of those records, which would occur in any event, merely would be delayed. In addition, because an already large and ever-increasing portion of the records required to be retained are kept electronically, we stated that the incremental increase in storage costs for documents would not be significant for any firm or for any single audit client.

For purposes of the Paperwork Reduction Act, we estimated in the proposing release the total burden to be 15,000 burden hours. We further estimated that, assuming an accounting firm's average cost of in-house staff is $110 per hour,⁹⁷ the total cost would be $1,650,000.

We received comments indicating that, based on the proposed rule, our cost estimate was low. Due to revisions made to the rule the cost estimates provided by the commenters, however, may no longer be accurate. For example, a large accounting firm stated that if it would be required to retain all financial data "received" from the issuer in the course of the audit, its current document retention costs of approximately $4.5 million would double.⁹⁸ This firm questioned whether all of the issuer's financial information, records, databases, and reports that the auditor examines on the issuer's premises, but are not made part of the auditor's workpapers or otherwise retained by the auditor, would be deemed to be "received" by the auditor and subject to the retention requirements in rule 2-06. As noted previously in this release, we do not believe that Congress intended for accounting firms to duplicate and retain all of the issuer's financial information, records, databases, and reports that might be read, examined, or reviewed by the auditor.⁹⁹ Accordingly, we do not believe that the "received" criterion in rule 2-06(a)(1) requires that the auditor retain such records and the firm's anticipated document retention costs, therefore, should be significantly reduced.

Another accounting firm indicated that administrative costs of retaining records, based on the proposed rule, could include a one-time cost of $1 million and ongoing annual costs of $500,000 to $1 million.¹⁰⁰ This firm also estimated that increased litigation costs associated with complying with discovery requests and payment of damages would increase annual audit costs by at least five percent and perhaps as much as fifteen to twenty percent.¹⁰¹ As noted above, we believe that revisions to the rule in response to commenters' concerns should lessen the administrative costs anticipated by this commenter. Regarding the commenter's cost estimates related to potential litigation, we recognize that one purpose of section 802 is to facilitate investigations of potential violations of securities laws, Commission rules and criminal laws,¹⁰² which could impact a firm's litigation costs. Nonetheless, the firm's estimate would appear to be speculative. If the retention requirements lead to more efficient oversight of the accounting profession then they may result in improved audit quality and enhanced investor confidence in the profession.

Other accounting firms noted that many variables would affect the costs related to the rule, and that the ultimate increase in costs is difficult to quantify.¹⁰³ One commenter indicated that the amount of changes to be made to current record retention systems, and the related costs, depends on whether the accounting firm has a good record management system already in place.¹⁰⁴ For those firms with established records management programs, this commenter indicated that the rule would require a review and possibly fine-tuning of the firms' existing policies and procedures. This commenter also noted that adopting the proposed five-year retention requirement would have been more costly than adopting the seven-year retention requirement that is consistent with the forthcoming auditing standard to be promulgated by the Public Company Accounting Oversight Board. In this commenter's view, having two retention periods would have increased costs associated with processing the records.¹⁰⁵

E. Agency Action to Minimize Effect on Small Entities

The Regulatory Flexibility Act directs us to consider significant alternatives that would accomplish the stated objective, while minimizing any significant adverse impact on small entities. In connection with the proposed amendments, we considered the following alternatives:

1. The establishment of differing compliance or reporting requirements or timetables that take into account the resources of small entities;
    
2. The clarification, consolidation, or simplification of compliance and reporting requirements under the rule for small entities;
    
3. The use of performance rather than design standards; and
    
4. An exemption from coverage of the proposed amendments, or any part thereof, for small entities.

The Sarbanes-Oxley Act provides the basis for the requirements and timetables for the record retention rules. The rule is designed to require the retention of those records necessary for oversight of the audit process, to enhance the reliability and credibility of financial statements for all public companies, and to facilitate enforcement of the securities laws.

We considered not applying the proposals to small accounting firms. We believe, however, that investors would benefit if accountants subject to the proposed record retention rules, regardless of their size, audit all companies. We do not believe that it is feasible to further clarify, consolidate, or simplify the proposed rules for small entities.

VII. Codification Update

The "Codification of Financial Reporting Policies" announced in Financial Reporting Release No. 1 (April 15, 1982) is amended as follows:

By amending section 602 to add a new discussion at the end of that section under Financial Reporting Release Number 66 (FR-66) that includes the text in Section II of this release.

The Codification is a separate publication of the Commission. It will not be published in the Code of Federal Regulations.

VIII. Statutory Bases and Text of Amendments

We are adopting amendments to Regulation S-X under the authority set forth in sections 3(a) and 802 of the Sarbanes-Oxley Act, and Schedule A and Sections 7, 8, 10, 19 and 28 of the Securities Act, Sections 3, 10A, 12, 13, 14, 17, 23 and 36 of the Exchange Act, Sections 5, 10, 14 and 20 of the Public Utility Holding Company Act of 1935, Sections 8, 30, 31, 32 and 38 of the Investment Company Act of 1940.

List of Subjects in Part 210

Accountants, Accounting.

TEXT OF AMENDMENTS

In accordance with the foregoing, Title 17, Chapter II of the Code of Federal Regulations is amended as follows:

1. The authority citation for Part 210 is revised to read as follows:

Authority: 15 U.S.C. 77f, 77g, 77h, 77j, 77s, 77z-2, 77aa(25), 77aa(26), 78j-1, 78l, 78m, 78n, 78o(d), 78u-5, 78w(a), 78ll(d), 79e(b), 79j(a), 79n, 79t(a), 80a-8, 80a-20, 80a-29, 80a-30, 80a-31, 80a-37(a), unless otherwise noted.

2. By adding § 210.2-06 to read as follows:

§ 210.2-06 Retention of audit and review records.

(a) For a period of seven years after an accountant concludes an audit or review of an issuer's financial statements to which section 10A(a) of the Securities Exchange Act of 1934 (15 U.S.C. 78j-1(a)) applies, or of the financial statements of any investment company registered under section 8 of the Investment Company Act of 1940 (15 U.S.C. 80a-8), the accountant shall retain records relevant to the audit or review, including workpapers and other documents that form the basis of the audit or review, and memoranda, correspondence, communications, other documents, and records (including electronic records), which:

(1) Are created, sent or received in connection with the audit or review, and

(2) Contain conclusions, opinions, analyses, or financial data related to the audit or review.

(b) For the purposes of paragraph (a) of this section, workpapers means documentation of auditing or review procedures applied, evidence obtained, and conclusions reached by the accountant in the audit or review engagement, as required by standards established or adopted by the Commission or by the Public Company Accounting Oversight Board.

(c) Memoranda, correspondence, communications, other documents, and records (including electronic records) described in paragraph (a) of this section shall be retained whether they support the auditor's final conclusions regarding the audit or review, or contain information or data, relating to a significant matter, that is inconsistent with the auditor's final conclusions regarding that matter or the audit or review. Significance of a matter shall be determined based on an objective analysis of the facts and circumstances. Such documents and records include, but are not limited to, those documenting a consultation on or resolution of differences in professional judgment.

(d) For the purposes of paragraph (a) of this section, the term issuer means an issuer as defined in section 10A(f) of the Securities Exchange Act of 1934 (15 U.S.C. 78j-1(f)).

By the Commission.

Margaret H. McFarland
Deputy Secretary

January 24, 2003

Endnotes

¹ Pub. L. 107-204, 116 Stat. 745 (2002).

² These amendments were proposed in Securities Act Release No. 8151 (November 21, 2002) (the "Proposing Release") [67 Federal Register 71017 (November 27, 2002)].

³ Section 802 of the Sarbanes-Oxley Act, among other things, adds sections 1519 and 1520 to Chapter 73 of Title 18 of the United States Code. Section 1519 states, among other things, that anyone who knowingly alters, destroys, mutilates, conceals, covers up, falsifies, or makes a false entry in any record, document, or tangible object with the intent to impede, obstruct, or influence an investigation or proper administration of any matter within the jurisdiction of any department or agency of the United States or any case filed under the bankruptcy code, or in relation to or contemplation of any such matter or case, may be fined, imprisoned for not more than 20 years, or both.

Section 1520(a)(1) specifies that: "Any accountant who conducts an audit of an issuer of securities to which section 10A(a) of the Securities Exchange Act of 1934 applies, shall maintain all audit or review workpapers for a period of 5 years from the end of the fiscal period in which the audit or review was concluded." Section 1520(a)(2) directs the Commission to promulgate, by January 26, 2003:

... such rules and regulations, as are reasonably necessary, relating to the retention of relevant records such as workpapers, documents that form the basis of an audit or review, memoranda, correspondence, communications, other documents, and records (including electronic records) which are created, sent, or received in connection with an audit or review and contain conclusions, opinions, analyses, or financial data relating to such an audit or review, which is conducted by an accountant who conducts an audit of an issuer of securities to which section 10A(a) of the Securities Exchange Act of 1934 (15 U.S.C. 78j-1(a)) applies. The Commission may, from time to time, amend or supplement the rules and regulations that it is required to promulgate under this section, after adequate notice and an opportunity for comment, in order to ensure that such rules and regulations adequately comport with the purposes of this section.

Section 1520 also provides that any person who knowingly and willfully violates subsection (a)(1), or any rule or regulation promulgated by the Securities and Exchange Commission under subsection (a)(2), may be fined, imprisoned for not more than 10 years, or both. It further provides that nothing in section 1520 shall be deemed to diminish or relieve any person of any other duty or obligation imposed by Federal or State law or regulation to maintain, or refrain from destroying, any document.

⁴ Floor statement by Senator Leahy, 148 Cong. Rec. S7418 (July 26, 2002).

⁵ Section 802 states that the record retention requirement applies to "an audit of an issuer of securities to which section 10A(a) of the Securities Exchange Act of 1934 (15 U.S.C. 78j-1(a)) applies." Section 10A(a) of the Securities Exchange Act of 1934 ("Exchange Act") states, "Each audit required pursuant to this title of the financial statements of an issuer by an independent public accountant shall include" designated procedures. Section 10A(f), which has been added to the Exchange Act by section 205(d) of the Sarbanes-Oxley Act, states: "As used in this section the term `issuer' means an issuer (as defined in section 3 [of the Exchange Act]), the securities of which are registered under section 12, or that is required to file reports pursuant to section 15(d), or that files or has filed a registration statement that has not yet become effective under the Securities Act of 1933 (15 U.S.C. 77a et seq.), and that it has not withdrawn." Section 3(a)(8) of the Exchange Act, 15 U.S.C. 78c(a)(8), states that, with certain exceptions, an "issuer" is "any person who issues or proposes to issue any security...." Accordingly, the definition of "issuer" includes entities that have filed and not withdrawn a registration statement for an initial public offering.

Because investment advisers and broker-dealers are not necessarily issuers, audits of their financial statements required for regulatory purposes are not subject to the rule. In other words, only the audits of the financial statements of investment advisers and broker-dealers meeting the definition of "issuer" in section 10A(f) are subject to the retention requirements in rule 2-06. One commenter suggested that investment advisers and broker-dealers be included within the scope of the rule. Letter from Lynette Downing, HLB Tautges Redpath, Ltd., dated December 27, 2002. Another commenter noted, however, that broadening some but not all rules under the Sarbanes-Oxley Act beyond "issuers" as defined in the Act would be confusing. Letter from Grant Thornton LLP dated December 27, 2002.

⁶ See section 8 of the Investment Company Act of 1940, 15 U.S.C. 80a-8.

⁷ Cf. rules 31a-1 and 31a-2 under the Investment Company Act of 1940, 17 CFR 270.31a-1 and 31a-2 (record-keeping and record-retention requirements for registered investment companies).

⁸ Letter from the European Commission dated December 20, 2002; letter from PricewaterhouseCoopers dated December 27, 2002; letter from KPMG LLP dated December 27, 2002; letter from the American Institute of Certified Public Accountants dated December 27, 2002.

⁹ We also note that this rule is not intended to expand or restrict the Commission exisiting authority to investigate cross-border violations of the federal securities laws.

¹⁰ Rule 2-06 is not intended to pre-empt or supersede any other federal or state record retention requirements.

¹¹ Rule 2-06 uses the term "accountant," which is defined in rule 2-01(f)(1) of the Commission's auditor independence rules, 17 CFR 210.2-01(f)(1), to mean "a certified public accountant or public accountant performing services in connection with an engagement for which independence is required. References to the accountant include any accounting firm with which the certified public or public accountant is affiliated." In a companion release, the Commission proposed to amend this definition to include the term "registered public accounting firm." We will apply the definition in rule 2-01(f)(1), as amended, to rule 2-06.

¹² See, e.g., letter from Deloitte & Touche dated December 27, 2002, and letter from McGladrey & Pullen dated December 31, 2002, which states, in part, "The key to promulgating record retention rules that enhance audit quality lies in the word `relevant'."

¹³ See note 3, supra.

¹⁴ See, e.g., letter from BDO Seidman, LLP, dated December 27, 2002; letter from Ernst & Young LLP, dated December 27, 2002; letter from PricewaterhouseCoopers dated December 27, 2002.

¹⁵ See letter from BDO Seidman, LLP, dated December 27, 2002.

¹⁶ See letter from Gelfond Hochstadt Pangburn, P.C. dated November 26, 2002.

¹⁷ See letter from Ernst & Young LLP, dated December 27, 2002, and letter from Gelfond Hochstadt Pangburn, P.C. dated November 26, 2002.

¹⁸ Letter from Sullivan & Cromwell dated December 26, 2002.

¹⁹ Senator Leahy stated on the Senate floor, "Non-substantive materials, however, which are not relevant to the conclusions or opinions expressed (or not expressed), need not be included in such retention regulations." 148 Cong. Rec. S7419 (July 26, 2002).

²⁰ See, e.g., letter from PricewaterhouseCoopers dated December 27, 2002.

²¹ See, e.g., letter from BDO Seidman, LLP, dated December 27, 2002; letter from Deloitte & Touche dated December 27, 2002; letter from Ernst & Young LLP, dated December 27, 2002; letter from Grant Thornton LLP dated December 27, 2002; letter from KPMG LLP dated December 27, 2002. See the discussion of Statement on Auditing Standards No. 96, "Audit Documentation," infra.

²² The proposed retention period was not based on the fiscal period covered by the financial statements being audited or reviewed, but when the audit or review would occur. For example, if a company has a calendar year-end fiscal year, for an audit of year 2002 financial statements that concludes in February or March 2003, under the proposal, the records would have been required to be retained until January 1, 2009.

²³ See Statement of Senator Leahy on the Senate floor: "[I]t is intended that the SEC promulgate rules and regulations that require the retention of such substantive material ... for such a period as is reasonable and necessary for effective enforcement of the securities laws and the criminal laws, most of which have a five-year statute of limitations." 148 Cong. Rec. S7419 (July 26, 2002).

²⁴ The Oversight Board is required under section 103(a)(2)(A)(i) of the Sarbanes-Oxley Act to adopt an auditing standard that requires accounting firms registered with the Oversight Board to "... prepare, and maintain for a period of not less than 7 years, audit work papers, and other information related to any audit report, in sufficient detail to support the conclusions reached in such report." The standard to be adopted by the Oversight Board, therefore, is to be both a documentation and retention standard.

²⁵ See, e.g., letter from KPMG LLP, dated December 27, 2002, which states, in part: "Clearly, the documents to be retained under both Sections [103 and 802] overlap to a large extent."

²⁶ See, e.g., letter from Wendy Perez, President of California Board of Accountancy dated December 23, 2002; letter from Grant Thornton LLP dated December 27, 2002; letter from Lynette Downing, HLB Tautges Redpath, Ltd., dated December 27, 2002.

²⁷ See, e.g., letter form Donald G. DeBuck, Controller, Computer Sciences Corporation dated December 26, 2002; letter from PricewaterhouseCoopers dated December 27, 2002; letter from the American Institute of Certified Public Accountants dated December 27, 2002.

²⁸ See e.g., letter from Grant Thornton LLP dated December 27, 2002, which states, "We believe that most firms will adopt a policy of retaining all audit documentation for the longer period of seven years."

²⁹ Id.

³⁰ Senator Leahy stated on the Senate floor that section 802 "requires the SEC to promulgate reasonable and necessary regulations ... regarding the retention of categories of electronic and non-electronic audit records, which contain opinions, conclusions, analysis or financial data, in addition to the actual work papers." 148 Cong. Rec. S7418 (July 26, 2002).

³¹ Statement by Senator Leahy on the Senate floor, 148 Cong. Rec. S7418 (July 26, 2002).

³² American Institute of Certified Public Accountants ("AICPA"), Statement on Auditing Standards No. ("SAS") 96, "Audit Documentation," at footnote 1, however, acknowledges that: "Audit Documentation also may be referred to as working papers"; Codification of Statements on Auditing Standards ("AU") § 339.

³³ SAS 96, at ¶ 1; AU § 339.01. This paragraph also states: "The quality, type, and content of audit documentation are matters of the auditor's professional judgment." The rule does not include this sentence, but instead notes that the Commission or the Oversight Board may reexamine these requirements in the auditing standards.

³⁴ Prior to the establishment or adoption of auditing standards by the Oversight Board, "workpapers" would continue to mean the documentation of auditing or review procedures applied, evidence obtained, and conclusions reached by the accountant in the audit or review engagement as required by GAAS.

³⁵ See section 103(a) of the Sarbanes-Oxley Act.

³⁶ See, e.g., letter from PricewaterhouseCoopers dated December 27, 2002.

³⁷ SAS 96, at ¶ 3; AU § 339.03.

³⁸ See Statement of Senator Leahy on the Senate floor, 148 Cong. Rec. S7419 (July 26, 2002).

³⁹ Senator Leahy stated on the Senate floor:

In light of the apparent massive document destruction by Andersen, and the company's apparently misleading document retention policy, even in light of its prior SEC violations, it is intended that the SEC promulgate rules and regulations that require the retention of such substantive material, including material that casts doubt on the views expressed in the audit or review, for such a period as is reasonable and necessary for effective enforcement of the securities laws and the criminal laws, most of which have a five-year statute of limitations.

148 Cong. Rec. S7419 (July 26, 2002).

⁴⁰ SAS 22, ¶ 22 (as amended by SAS 47, 48 and 77); AU § 311.22. "Assistants," in the context of the first sentence of the quoted paragraph, is intended to include other partners who are on the audit engagement team.

⁴¹ "Planning and Supervision: Auditing Interpretations of Section 311," AU § 9311.37. "Assistants," in the context of this interpretation, includes other partners who are on the audit engagement team.

⁴² SAS 96, ¶ 9; AU §339.09, which states:

In addition, the auditor should document findings or issues that in his or her judgment are significant, actions taken to address them (including any additional evidence obtained), and the basis for the final conclusions reached.

See also, SAS 96, ¶ 6; AU § 339.06, which states:

Audit documentation should be sufficient to (a) enable members of the engagement team with supervision and review responsibilities to understand the nature, timing, extent, and results of auditing procedures performed, and the evidence obtained; (b) indicate the engagement team member(s) who performed and reviewed the work; and (c) show that the accounting records agree or reconcile with the financial statements or other information being reported on.

⁴³ Such a memorandum might be prepared in connection with the consultation process that is part of an accounting firm's quality controls. See, e.g., Section 103(a)(2)(B)(ii) of the Sarbanes-Oxley Act.

⁴⁴ Section 204 of the Sarbanes-Oxley Act adds section 10A(k) to the Exchange Act and requires auditors to report certain matters to audit committees, including: "(a) all critical accounting policies and practices to be used, (2) all alternative treatments of financial information within generally accepted accounting principles that have been discussed with management officials of the issuer, ramifications of the use of such alternative disclosures and treatments, and the treatment preferred by the registered public accounting firm; and (3) other material written communications between the registered public accounting firm and the management of the issuer, such as the management letter or schedule of unadjusted differences."

⁴⁵ Letter from K. Michael Conaway, Chair, NASBA, and David A. Costello, President and CEO, NASBA, dated December 23, 2002.

⁴⁶ Letter from Donald G. DeBuck, Computer Sciences Corporation, dated December 26, 2002.

⁴⁷ See, e.g., letter from BDO Seidman, LLP, dated December 27, 2002; letter from Grant Thornton LLP dated December 27, 2002; letter from KPMG LLP dated December 27, 2002; letter from Deloitte & Touche LLP dated December 27, 2002.

⁴⁸ Letter from Ernst & Young LLP, dated December 27, 2002.

⁴⁹ Letter from Donald D. Pangburn, Director, Gelfond Hochstadt Pangburn, P.C., dated November 26, 2002.

⁵⁰ Letter from Sullivan & Cromwell dated December 26, 2002.

⁵¹ See, e.g., letter from Ernst & Young LLP, dated December 27, 2002; letter from PricewaterhouseCoopers dated December 27, 2002; letter from Deloitte & Touche dated December 27, 2002.

⁵² Item 304 of Regulation S-K, 17 CFR 229.304.

⁵³ See, e.g., letter from Sullivan & Cromwell dated December 26, 2002; letter from Lynette Downing, HLB Tautges Redpath, Ltd. dated December 27, 2002; letter from Grant Thornton LLP dated December 27, 2002; letter from KPMG LLP dated December 27, 2002; letter from the American Institute of Certified Public Accountants dated December 27, 2002.

⁵⁴ SAS 96 requires the auditor to document findings or issues that in his or her judgment are significant. It states that "significant audit findings or issues" include:

• "Matters that both (a) are significant and (b) involve issues regarding the appropriate selection, application, and consistency of accounting principles with regard to the financial statements, including related disclosures. Such matters often relate to (a) accounting for complex or unusual transactions or (b) estimates and uncertainties and, if applicable, the related management assumptions.
   
• "Results of auditing procedures that indicate that (a) the financial statements or disclosures could be materially misstated or (b) auditing procedures need to be significantly modified.
   
• "Circumstances that cause significant difficulty in applying auditing procedures that the auditor considered necessary.
   
• "Other findings that could result in modification of the auditor's report." SAS 96, ¶ 9, AU §339.09 (Footnote omitted.)

This literature may provide helpful guidance as to the scope of the term "significant." However, the term significant as used in this rule is not limited to items identified in SAS 96. Moreover, we do not intend for the auditor's subjective judgment of whether a matter is significant to be determinative. Instead, we believe that the more objective test of what may be significant to a reasonable investor should be applied in evaluating whether information is "significant."

⁵⁵ See letter from Deloitte & Touche dated December 27, 2002, quoting Statement of Senator Orrin Hatch before the Senate Judiciary Committee (April 25, 2002): "I anticipate that the SEC will exercise its discretion to promulgate only those rules and regulations that are necessary to ensure that documents material to an audit or review, as well as any future investigation, are retained."

⁵⁶ One commenter supported such a requirement. Letter from Lynette Downing, HLB Tautges Redpath, Ltd. dated December 27, 2002.

⁵⁷ Letter from Sullivan & Cromwell dated December 26, 2002.

⁵⁸ Letter from BDO Seidman, LLP dated December 27, 2002. See also letter from the American Institute of Certified Public Accountants dated December 27, 2002.

⁵⁹ Letter from Mr. Donald G. DeBuck, Computer Sciences Corporation, dated December 26, 2002.

⁶⁰ See, e.g., letter from BDO Seidman, LLP dated December 27, 2002 and letter from KPMG LLP dated December 27, 2002.

⁶¹ Letter from Sullivan & Cromwell dated December 26, 2002.

⁶² Letter from Wendy S. Perez, President, California Board of Accountancy, dated December 23, 2002.

⁶³ Id.

⁶⁴ Sections 103(a) and 103(c) of the Sarbanes-Oxley Act empower the Oversight Board to establish auditing standards, including, to the extent it determines appropriate, adopting standards proposed by professional groups of accountants or by expert advisory groups convened by the Oversight Board.

⁶⁵ Id.

⁶⁶ Letter from BDO Seidman, LLP dated December 27, 2002. See Section 1000.08(q) of the SECPS membership requirements. This section requires large firms to have policies on internal consultations and to document: the matter, the action taken to address the matter, and the basis for the final conclusion reached. Under this provision, the auditor must either follow the position taken by the person consulted or appeal any disagreement to a higher level of authority within the firm for ultimate resolution.

⁶⁷ Id.

⁶⁸ These estimates are based on information in Commission databases. The number of public companies includes those filing annual reports and those filing registration statements to conduct initial public offerings. The same auditors also audit the financial statements of approximately 5,587 investment companies.

⁶⁹ See American Institute of Certified Public Accountants ("AICPA"), Statement on Auditing Standards No. ("SAS") 96, "Audit Documentation"; Codification of Statements on Auditing Standards ("AU") 339. GAAS does not specify a required retention period. The documents to be retained under SAS 96 include those indicating the auditing procedures applied, the evidence obtained during the audit, and the conclusions reached by the auditor in the engagement.

⁷⁰ This burden accounts for incidental reading and implementation of the rule. Fifteen thousand burden hours should be sufficient to cover the audits and reviews of not only public companies but also registered investment companies. Because of the nature and scope of the audits of investment companies, there would be an even smaller and insignificant incremental burden imposed on those audits than on the audits of public companies.

⁷¹ See letter from Lynette Downing, HLB Tautges Redpath, Ltd. dated December 27, 2002; letter from PricewaterhouseCoopers dated December 27, 2002; letter from Deloitte & Touche dated December 27, 2002.

⁷² See letter from PricewaterhouseCoopers dated December 27, 2002 and letter from Deloitte & Touche dated December 27, 2002.

⁷³ These estimates are based on information in Commission databases. The number of public companies includes those filing annual reports and those filing to conduct an initial public offering. The same auditors also audit the financial statements of approximately 5,587 investment companies.

⁷⁴ See American Institute of Certified Public Accountants ("AICPA"), Statement on Auditing Standards No. ("SAS") 96, "Audit Documentation"; Codification of Statements on Auditing Standards ("AU") 339.

⁷⁵ We estimate that associates would perform three-fourths of the required work, with a partner performing about one-fourth of the work. We also estimate that, on average, an associate's annual salary would be approximately $125,000 and a partner's annual compensation would be approximately $500,000. Based on these amounts, the in-house cost of an associate's time would be approximately $65 per hour, and the in-house cost of a partner's time would be approximately $250 per hour. The average hourly rate, therefore, would be about $110 per hour ([(3 x $65) + $250] / 4).

⁷⁶ Letter from PricewaterhouseCoopers dated December 27, 2002.

⁷⁷ Letter from BDO Seidman, LLP dated December 27, 2002.

⁷⁸ Id.

⁷⁹ See Statement of Senator Leahy on the Senate floor: "[I]t is intended that the SEC promulgate rules and regulations that require the retention of such substantive material ... for such a period as is reasonable and necessary for effective enforcement of the securities laws and the criminal laws...." 148 Cong. Rec. S7419 (July 26, 2002).

⁸⁰ See, e.g., letter from Grant Thornton, dated December 27, 2002.

⁸¹ Letter from Lynette Downing, HLB Tautges Redpath, Ltd., dated December 27, 2002. This commenter estimated that, depending on the information systems and staff currently in place, to maintain electronic records "an investment of $100,000 to $250,000 for each $5 million in net fees is likely with ongoing annual expenses of $50,000 to $100,000."

⁸² Id.

⁸³ 15 U.S.C. 78w(a)(2).

⁸⁴ 15 U.S.C. 77b(b).

⁸⁵ 15 U.S.C. 78c(f).

⁸⁶ 15 U.S.C. 80a-2(c).

⁸⁷ Letter from Lynette Downing, HLB Tautges Redpath, Ltd., dated December 27, 2002.

⁸⁸ Id.

⁸⁹ See section 802 of the Sarbanes-Oxley Act.

⁹⁰ Letter from Grant Thornton LLP, dated December 27, 2002.

⁹¹ See, e.g., letter from BDO Seidman, LLP, dated December 27, 2002; letter from Grant Thornton LLP dated December 27, 2002; letter from KPMG LLP dated December 27, 2002; letter from Deloitte & Touche LLP dated December 27, 2002.

⁹² Letter from Lynette Downing, HLB Tautges Redpath, Ltd., dated December 27, 2002.

⁹³ Letter from Lynette Downing, HLB Tautges Redpath, Ltd., dated December 27, 2002.

⁹⁴ Id.

⁹⁵ 13 CFR 121.201.

⁹⁶ See section 802 of the Sarbanes-Oxley Act of 2002.

⁹⁷ We estimate that associates would perform three-fourths of the required work, with a partner performing about one-fourth of the work. We also estimate that, on average, an associate's annual salary would be approximately $125,000 and a partner's annual compensation would be approximately $500,000. Based on these amounts, the in-house cost of an associate's time would be approximately $65 per hour, and the in-house cost of a partner's time would be approximately $250 per hour. The average hourly rate, therefore, would be about $110 per hour ([(3 x $65) + $250] / 4).

⁹⁸ Letter from PricewaterhouseCoopers dated December 27, 2002.

⁹⁹ See letter from Deloitte & Touche dated December 27, 2002, quoting Statement of Senator Orrin Hatch before the Senate Judiciary Committee (April 25, 2002): "I anticipate that the SEC will exercise its discretion to promulgate only those rules and regulations that are necessary to ensure that documents material to an audit or review, as well as any future investigation, are retained."

¹⁰⁰ Letter from BDO Seidman, LLP dated December 27, 2002.

¹⁰¹ Id.

¹⁰² See Statement of Senator Leahy on the Senate floor: "[I]t is intended that the SEC promulgate rules and regulations that require the retention of such substantive material ... for such a period as is reasonable and necessary for effective enforcement of the securities laws and the criminal laws...." 148 Cong. Rec. S7419 (July 26, 2002).

¹⁰³ Letter from Grant Thornton, dated December 27, 2002.

¹⁰⁴ Letter from Lynette Downing, HLB Tautges Redpath, Ltd., dated December 27, 2002. This commenter estimated that, depending on the information systems and staff currently in place, to maintain electronic records "an investment of $100,000 to $250,000 for each $5 million in net fees is likely with ongoing annual expenses of $50,000 to $