PCAOB Rule 3524 Requirements, Exceptions, and Penalties

PCAOB Rule 3524 requires a registered audit firm, before performing any permissible tax service for a public-company audit client, to do three things: give the audit committee a written description of the proposed engagement, discuss with the committee how the service could affect the firm’s independence, and document the substance of that discussion.¹ The rule does not ban tax services. It creates a procedural checkpoint so the audit committee can decide, with real information in front of it, whether a particular engagement threatens the auditor’s objectivity.

The Three Things the Firm Must Do

Each requirement has to be met before the tax work begins. Skipping any one, even for a service that would otherwise be entirely permissible, is itself a violation.

Written description of the engagement. The firm must describe, in writing, the scope of the service and the fee structure, along with any side letter, amendment, or other agreement between the firm and the client related to the service. Oral agreements count. The firm must also disclose any compensation arrangement, referral agreement, or fee-sharing deal between the firm (or an affiliate) and any third party involved in promoting or recommending a transaction covered by the service.¹
Independence discussion. The firm must discuss with the audit committee the potential effects of the proposed services on the firm’s independence.
Documentation. The firm must document the substance of that independence discussion.

The third-party disclosure piece is easy to overlook. If an audit firm’s affiliate has a referral arrangement with a financial advisor who recommended a transaction to the client, that relationship has to be put in front of the audit committee in writing before the firm begins tax work on the transaction. The purpose is to surface financial incentives that could bias the firm’s advice.

What the Written Description Should Cover

Read together, the elements above mean a Rule 3524 package to the audit committee is not a one-line summary. At a minimum, the committee needs to see:

The scope of the tax work the firm proposes to perform.
The fee arrangement, including how fees are calculated.
Every written and oral agreement between the firm and the client tied to the engagement, including side letters and amendments.
Any referral, fee-sharing, or compensation arrangement between the firm or an affiliate and a third party connected to a transaction covered by the service.

The committee then needs to hear from the firm how the engagement could affect independence, and the firm must keep a record of what was discussed. That record is what enforcement staff will ask for later.

Which Tax Services Rule 3524 Does Not Cover

Rule 3524’s pre-approval process only reaches tax services that are otherwise permissible. Three companion rules pull certain services off the table entirely, and no amount of audit committee discussion cures a violation of those rules.

Contingent Fees (Rule 3521)

An audit firm cannot provide any service or product to its audit client for a contingent fee or commission, or receive one from the client. A contingent fee is any arrangement where the amount depends on achieving a specific result, such as an IRS refund or a favorable ruling.¹

Aggressive and Confidential Transactions (Rule 3522)

A firm loses its independence if it helps a client market, plan, or advocate for the tax treatment of a confidential transaction, or of an aggressive tax position the firm itself recommended, where a significant purpose of the transaction is tax avoidance. For transactions subject to U.S. tax law, the prohibition also covers any “listed transaction” as defined in Treasury regulations.² The aggressive-position ban does not apply if the proposed treatment is “more likely than not” to be allowable under applicable tax law, meaning a greater than 50% likelihood of surviving a challenge. The firm must reach that conclusion through its own analysis, and the reasoning has to be objectively reasonable and well-founded at the time.³

Personal Tax Services to Company Insiders (Rule 3523)

Rule 3523 bars the firm from providing any tax service to individuals who hold a “financial reporting oversight role” at the issuer, or to their immediate family members. The SEC defines the role broadly to include the CEO, president, CFO, chief operating officer, general counsel, chief accounting officer, controller, director of internal audit, director of financial reporting, treasurer, and equivalent positions.⁴ A single prohibited engagement with one covered person impairs independence for the entire audit. Limited exceptions exist for outside directors, certain affiliate-based roles, and a 180-day wind-down for work already underway when a person moves into a covered role.¹

If a proposed service falls into any of these three categories, Rule 3524 does not offer a path forward. The committee cannot pre-approve what the rules already prohibit.

What the Audit Committee Is Supposed to Do With the Information

Rule 3524 makes the audit committee the gatekeeper, but the rule itself does not lay out an evaluation standard. The SEC has said committees should consider whether the service creates a mutual or conflicting interest between the auditor and the client, whether the auditor would end up reviewing its own work, whether the auditor would effectively be acting as management, and whether the arrangement puts the auditor in the position of advocating for the client.⁵

Advocacy is where tax services most often raise flags. Transfer pricing studies, tax planning around acquisitions, and international structuring advice can shade into advocacy if the auditor becomes deeply invested in a position the client later adopts. A committee treating the Rule 3524 discussion as a formality is not meeting the point of the requirement. The written description and independence discussion exist so the committee has enough information to push back.

Sarbanes-Oxley Section 202 lets the full committee delegate pre-approval authority to one or more independent directors, who then report their decisions to the full committee at its next scheduled meeting.⁶ Delegation does not shrink Rule 3524. The firm still owes the written description, the independence discussion, and the documentation to whoever holds the delegated authority.

Penalties for Skipping the Process

The PCAOB treats Rule 3524 failures as substantive violations, not paperwork lapses. In one enforcement sweep, four firms were sanctioned for violations related to audit committee communications, with total fines of $240,000. SW Audit was cited specifically for failing to obtain audit committee pre-approval of tax compliance services and received a $60,000 civil money penalty along with a censure.⁷ In a separate round, five more firms drew sanctions for similar violations, with individual penalties ranging from $30,000 to $45,000. Every firm in both sweeps also agreed to establish or revise its internal compliance policies and procedures.⁸

What Happens if Independence Is Impaired

The consequences reach past the firm’s penalty. If a firm’s independence is impaired, the SEC does not recognize it as a qualified auditor for the engagement. Financial statements previously filed under that impaired audit may no longer comply with SEC rules, which can force the company to retain a new, fully independent auditor to re-audit prior periods.⁹

SEC guidance is particularly unforgiving when the impairment stems from prohibited services rather than a prohibited financial relationship. Financial-relationship violations have a specific cure provision. Prohibited-service violations do not. The impaired firm cannot even re-audit the affected period. The company has to find a different firm, negotiate a new engagement, and go through the audit again, potentially missing SEC filing deadlines and facing the market consequences of delayed or restated financials. That is the teeth behind Rule 3524: the pre-approval steps exist so both the firm and the committee catch problems before they harden into an independence violation nobody can undo.