PCAOB Holds Heaton & Co. Accountable for Serious Failures in Audit Practices

Key Takeaways

• Sanctions Imposed: Heaton & Co. and partner Kristofer Heaton have been fined a total of $60,000 for violations related to audit documentation, engagement quality reviews, and quality control.
• Firm's Registration Revoked: Heaton & Co.'s PCAOB registration has been revoked, and the firm can only reapply after two years if it meets specific remedial measures.
• Audit Documentation Failures: Heaton & Co. failed to properly document five issuer audits, with incomplete or modified workpapers submitted late, violating PCAOB's audit documentation rules (AS 1215).
• Quality Review Violations: Heaton, as the engagement quality review partner, failed to appropriately evaluate the audit documentation and did not ensure that significant risks were properly addressed in the audits.
• Quality Control Deficiencies: The firm violated PCAOB quality control standards by not having adequate procedures in place to ensure compliance with professional standards, with Heaton responsible for these failures.

Deep Dive

The Public Company Accounting Oversight Board (PCAOB) took a strong stand today, holding Heaton & Co. and one of its partners, Kristofer Heaton, accountable for a series of significant violations. These lapses, which spanned audit documentation, quality control, and engagement reviews, have led to penalties, a firm registration revocation, and a professional ban for Heaton.

In a settled disciplinary order, the PCAOB announced that the firm would face a $60,000 fine, $35,000 of which would go to Heaton & Co., and the remaining $25,000 to Heaton himself. But the financial penalties don't end there: Heaton & Co. will have its registration revoked, and it can only reapply after two years, provided the firm takes concrete steps toward improving its processes. As for Heaton, he's now barred from associating with any registered public accounting firm for at least two years, though he can petition the PCAOB to lift this ban if he completes the required continuing education.

The heart of the issue lies in Heaton & Co.'s mishandling of critical audit documentation. The PCAOB investigation found that the firm violated its own documentation rules (AS 1215), leaving several audits incomplete or improperly documented. For two of these audits, Heaton & Co. scrambled to revise and add to their workpapers right before a PCAOB inspection, a move that was flagged for lacking sufficient justification. In the case of three other audits, the firm failed to provide final workpapers altogether, or they submitted documents that weren’t even related to the client. Worse still, for one audit, over 90% of the documentation was created almost two years after the fact, long after the completion date.

Kristofer Heaton, the partner responsible for quality review on these audits, dropped the ball in his role as well. As per the PCAOB’s Engagement Quality Review Standard (AS 1220), Heaton was expected to ensure that the audit team had addressed significant risks appropriately and that their conclusions were well-supported by the documentation. Instead, Heaton gave his approval for the audits even though many of the critical work-papers didn’t even exist or were insufficient.

Integrity is Non-Negotiable

Erica Y. Williams, PCAOB Chair, made it clear that this kind of behavior undermines the entire purpose of auditing. "Failing, not once, but multiple times to properly document audit work, calls the integrity of the entire audit into question," Williams said. "The PCAOB will take action to protect investors by holding firms accountable for failing to adhere to professional standards."

Robert E. Rice, Director of the PCAOB’s Division of Enforcement and Investigations, also emphasized the board's commitment to holding the auditing profession to its highest standards. "We will continue to bring enforcement actions to address these violations and ensure that accountability is upheld at every level of the profession," Rice stated.

For Heaton & Co., the road ahead is anything but smooth. The firm has two years to reapply for registration, but this will only happen if it takes significant steps to overhaul its internal processes. As for Heaton, his two-year ban will give him time to reflect on the gravity of his role in the firm’s missteps. He will also need to complete 40 hours of continuing professional education before being eligible to petition for reinstatement.

Proper documentation, thorough reviews, and a strong commitment to quality control aren’t just recommended, they’re required. The PCAOB's actions reinforce its mission to safeguard the integrity of the financial system and protect investors from the risks posed by negligent auditing practices.

The GRC Report is your premier destination for the latest in governance, risk, and compliance news. As your reliable source for comprehensive coverage, we ensure you stay informed and ready to navigate the dynamic landscape of GRC. Beyond being a news source, the GRC Report represents a thriving community of professionals who, like you, are dedicated to GRC excellence. Explore our insightful articles and breaking news, and actively participate in the conversation to enhance your GRC journey.