Ernst & Young Securities Enforcement Case: Cheating on Ethics, Then Misleading the SEC

In the Ernst & Young securities enforcement case, the firm agreed to a $100 million civil penalty over ethics-exam cheating and its misleading response to Securities and Exchange Commission investigators. The Commission described the penalty as its largest against an audit firm at that date. EY admitted the facts about the cheating and the information it withheld. For an audit or compliance insider, the case follows a familiar divide: what a firm learns internally and what it chooses to tell the people asking questions.

The Commission’s June 28, 2022 order concerned Ernst & Young LLP, the New York professional services firm. This page follows EY’s examination cheating and disclosure failures. Our broader page on auditors as securities fraud gatekeepers follows the work and evidence behind an audit opinion.

Ernst & Young’s Ethics Exams and the Shared Answers

EY admitted that its audit professionals shared answers to examinations meant to establish their professional competence and ethical understanding. From 2017 through 2021, 49 audit professionals sent or received answer keys to CPA ethics exams. Hundreds of other audit professionals cheated on continuing professional education courses, including courses about their ethical obligations.

These examinations had a purpose beyond the firm’s training calendar. As the Commission explained, most states require applicants to pass an ethics examination to become licensed CPAs, and state accountancy boards require continuing education to maintain those licenses. Passing the course examinations is supposed to show that the accountant understands the material. We see the absurdity in an ethics credential supported by somebody else’s answers.

The firm had already encountered a different way to pass without doing the work. An internal whistleblower reported a software flaw that allowed a passing score with as little as one correct answer. EY’s investigation found that more than 200 audit professionals in multiple offices had exploited the flaw from 2012 through 2015.

EY disciplined personnel and added prominent warnings that assessments had to be completed independently. Its Code of Conduct also required people who knew of misconduct to report it. But the firm learned that professionals in its Denver office were sharing answer keys, and a later CPA ethics-exam incident prompted another warning to U.S. personnel:

The Commission found that EY kept warning personnel without adding controls to detect the continuing misconduct during the relevant period. For someone responsible for training or compliance, that is a concrete difference between the message sent and the control actually operating. The warning got capital letters. Detection got no new controls.

The Tip Ernst & Young Left Out of Its SEC Response

EY received a report of current exam cheating on the same day the Commission asked about such complaints, but omitted it from its response. The Commission’s Division of Enforcement requested information about ethics or whistleblower complaints involving training and continuing education tests. That day, an employee told a manager that someone in the audit group had emailed answers to a CPA ethics exam. The manager passed the tip to human resources that afternoon.

That inquiry followed an enforcement action against another large audit firm for exam cheating. EY’s U.S. Chair and Managing Partner warned all U.S. personnel against sharing answers on the same day as the new inquiry and tip.

EY’s submission described earlier matters in a way that created the impression it had no current cheating problem. Senior members of the firm’s legal team reviewed that submission and knew of the new tip. EY considered the tip serious enough to launch an extensive investigation, yet left its response to the Commission uncorrected.

By the fall, the investigation had confirmed answer sharing across multiple offices and courses. The order identified 91 audit professionals who requested, used or shared answer keys after the managing partner’s warning.

One affected course, Summary of Audit Differences, was designed to help audit professionals evaluate whether clients’ financial statements were fairly presented and followed Generally Accepted Accounting Principles. Many professionals acknowledged knowing that cheating violated the firm’s code, but cited work commitments or difficulty passing after repeated attempts.

The reporting failure reached senior management. The General Counsel’s Office discussed the investigation with the Executive Committee. Senior management and senior members of the legal team understood that the Commission had asked about exam misconduct, that EY had received a tip, that cheating extended beyond a few people in one office, and that the tip had been omitted. EY broadened its investigation and still did not correct its submission.

Instead, EY decided to tell the Public Company Accounting Oversight Board, but postponed that disclosure until it had a clearer picture and a plan. The Commission learned of the issue when the Board notified it of EY’s disclosure. The employee’s report had reached the firm. The Commission’s question had reached the firm. The answer sent back left the report out.

What Are the Legal Liabilities of an Auditor?

An audit firm can face SEC enforcement over failures of professional integrity and quality control. In EY’s case, the Commission found that the conduct violated professional ethics standards, discredited the accounting profession and exposed failures in the firm’s system for ensuring that personnel performed their responsibilities with integrity. EY acknowledged the ethics-rule violation as part of the settlement.

The industry context explains why exam cheating reached the securities regulator. Management prepares a company’s financial reports, its audit committee oversees the external auditor, and the auditor must support its opinion with sufficient evidence. Under the Public Company Accounting Oversight Board’s general auditing standard, the objective is reasonable assurance that financial statements are free of material misstatement from error or fraud. The people testing those numbers need the knowledge and integrity their qualifications represent.

The EY order connected that responsibility to staff training, assignments and monitoring. It described requirements for personnel to have the technical proficiency their work demanded and for the firm to evaluate whether its professional development and compliance controls worked. An audit insider may recognize the difference between a completed training entry and a course whose answers circulated around the office.

Ernst & Young’s Required Changes Reached Management

The Commission’s order required EY to examine both its ethics controls and its handling of information requests. The review covered training, management’s support for ethical conduct and the controls for detecting and reporting misconduct. It also covered how the firm gathered requested information, communicated it accurately and corrected misleading statements or omissions.

The order required an independent consultant to review those policies and procedures. A separate consultant, overseen by a committee of senior personnel uninvolved in the disclosure failure, had to examine the response to the SEC’s request. That review specifically reached whether the executive team, General Counsel’s Office, compliance personnel or other employees contributed to the failure to correct the submission.

EY also had to give the order to its public-company and SEC-registered broker-dealer audit clients. The order required independent ethics and integrity training for all audit professionals and for other specified personnel who knew about the request, response and tip.

Those requirements addressed the same decisions an insider might have seen: who received a report, who controlled the response and whether later findings changed what the regulator was told. The Commission required scrutiny of the people handling the answer as well as the people sharing the answers.

What Ernst & Young’s Internal Reports Revealed

An internal report can expose misconduct and show how the firm responds once it knows. In EY’s case, the early whistleblower identified a flaw in the testing system, while the later employee’s report identified an emailed answer key. The investigation then showed a wider problem than the initial tip described.

Broader fraud research helps explain the value of that inside view. In The Significance of Whistleblowing as an Anti-Fraud Measure, published in the Journal of Forensic & Investigative Accounting in 2018, researchers examined 4,943 occupational frauds with complete detection information. The study reported that whistleblowers detected 35.9% of the sample, compared with 21.4% detected through internal controls.

The paper also found that whistleblower detection became more likely as more people participated in a scheme. Its point about what happens after someone speaks fits the question the EY order makes unavoidable:

At EY, the firm did investigate the cheating. The Commission also credited it with providing substantial information about that misconduct, while finding that it failed to investigate and address its own misleading submission adequately. Following up on the exam answers and correcting the answer to the regulator were separate responsibilities.

For an insider, the evidence connecting knowledge to a decision may include the original report, its passage through management and human resources, the response sent to the SEC and the later findings known to those responsible for it. We work through that connection with you. Questions about an auditor’s or compliance employee’s eligibility belong in that conversation, together with how you learned what you know.

Eligible whistleblowers under the SEC program can receive 10% to 30% of qualifying sanctions collected in an action exceeding $1 million. For a separate matter involving false claims for government money, a whistleblower case under the False Claims Act can pay 15% to 30% of what the government recovers. We assess the program and the evidence with you and SEC whistleblower lawyers who know audit-firm cases.

You Know What the Firm Knew

If you saw an answer key circulate or a regulator receive a response that left out a known complaint, speak with our whistleblower experts about what the firm knew and left out. We develop your strongest SEC whistleblower case with you, bring in securities fraud whistleblower lawyers who understand audit-firm conduct, and stay alongside you through the decisions that follow.