In re KPMG LLP

 
 
UNITED STATES OF AMERICA 
Before the 
SECURITIES AND EXCHANGE COMMISSION 
 
 
SECURITIES EXCHANGE ACT OF 1934 
Release No. 86118 / June 17, 2019 
 
ACCOUNTING AND AUDITING ENFORCEMENT 
Release No. 4051 / June 17, 2019 
 
ADMINISTRATIVE PROCEEDING 
File No. 3-19203 
 
 
 
In the Matter of 
 
KPMG LLP, 
 
Respondent. 
 
 
 
 
 
ORDER INSTITUTING PUBLIC 
ADMINISTRATIVE AND CEASE-AND- 
 AND- DESIST PROCEEDINGS PURSUANT TO 
SECTIONS 4C AND 21C OF THE 
SECURITIES EXCHANGE ACT OF 1934 
AND RULE 102(e) OF THE 
COMMISSION’S RULES OF PRACTICE, 
MAKING FINDINGS, AND IMPOSING 
REMEDIAL SANCTIONS AND A CEASE-
AND-DESIST ORDER 
   
 
I. 
 
 The Securities and Exchange Commission (“Commission”) deems it appropriate that public 
administrative and cease-and-desist proceedings be, and hereby are, instituted against Respondent 
KPMG LLP (“KPMG”) pursuant to Sections 4C
1
 and 21C of the Securities Exchange Act of 1934 
(“Exchange Act”) and Rules 102(e)(1)(ii) and 102(e)(1)(iii) of the Commission’s Rules of 
Practice.
2
 
                                                 
1
 Section 4C provides, in relevant part, that:  
 
The Commission may censure any person, or deny, temporarily or permanently, to any person the 
privilege of appearing or practicing before the Commission in any way, if that person is found . . . (1) 
not to possess the requisite qualifications to represent others; (2) to be lacking in character or integrity, 
or to have engaged in unethical or improper professional conduct; or (3) to have willfully violated, or 
willfully aided and abetted the violation of, any provision of the securities laws or the rules and 
regulations issued thereunder. 
 
2
 Rule 102(e)(1)(ii) provides, in pertinent part, that: 
 

2 
II. 
 
In anticipation of the institution of these proceedings, Respondent has submitted an Offer 
of Settlement (“Offer”) that the Commission has determined to accept.  Respondent admits the 
facts set forth in Section III below, acknowledges that its conduct violated PCAOB Rule 3500T 
and provides a basis for the Commission to impose remedies pursuant to Exchange Act Sections 
4C(a)(2) and (a)(3) and Rules 102(e)(1)(ii) and (iii) of the Commission’s Rules of Practice; admits 
the Commission’s jurisdiction over it and the subject matter of these proceedings; and consents to 
the entry of this Order Instituting Public Administrative and Cease-and-Desist Proceedings 
Pursuant to Sections 4C and 21C of the Securities Exchange Act of 1934 and Rule 102(e) of the 
Commission’s Rules of Practice, Making Findings, and Imposing Remedial Sanctions and a Cease-
and-Desist Order (“Order”), as set forth below. 
 
III. 
 
 On the basis of this Order and Respondent’s Offer, the Commission finds
3
 that: 
 
SUMMARY 
 
1. This matter involves two separate courses of misconduct that resulted in violations 
of the fundamental requirement that auditors act with integrity.   
2. First, from 2015 to 2017, now-former senior members of KPMG’s Audit Quality 
and Professional Practice group (“AQPP” or “National Office”) – which is responsible for the 
firm’s system of quality control – improperly obtained and used confidential information 
belonging to the Public Company Accounting Oversight Board (“PCAOB” or “Board”) in an effort 
to improve the results of the PCAOB’s annual inspections of KPMG audits.  The information 
obtained included lists of the specific audit engagements the PCAOB planned to inspect, the 
criteria the PCAOB used to select engagements for inspection, and the focus areas of the 
inspections.  The personnel sought the information because the firm had experienced a high rate of 
audit deficiency findings in prior PCAOB inspections and had made improving its inspection 
results a priority.   
                                                                                                                                                             
 
The Commission may . . . deny, temporarily or permanently, the privilege of appearing or practicing 
before it . . . to any person who is found to be lacking in character or integrity or to have engaged in 
unethical or improper professional conduct. 
 
 Rule 102(e)(1)(iii) provides, in pertinent part, that: 
 
The Commission may . . . deny, temporarily or permanently, the privilege of appearing or practicing 
before it . . . to any person who is found...to have willfully violated, or willfully aided and abetted the 
violation of any provision of the Federal securities laws or the rules and regulations thereunder. 
 
3
 The findings herein are made pursuant to Respondent’s Offer of Settlement and are not binding on any 
other person or entity in this or any other proceeding.   
 

3 
3. After obtaining the confidential list of the PCAOB’s planned inspections in 2016, 
the now-former KPMG personnel oversaw a program to review and revise certain audit 
workpapers after the audit reports had been issued to reduce the likelihood that the PCAOB would 
find deficiencies in those audits.  This effort resulted in a substantial improvement to KPMG’s 
2016 inspection results.  In 2017, the now-former KPMG personnel again obtained the list of audit 
engagements that the PCAOB planned to inspect, but the misconduct was discovered by others 
within the firm and reported to KPMG leadership before relevant workpapers could be changed.  
In addition, a now-former KPMG partner attempted to use improperly-obtained confidential 
information relating to the PCAOB’s inspection of another audit firm to win new business for 
KPMG. 
4. Second, before, during, and after the senior National Office professionals used 
confidential PCAOB information, KPMG audit professionals – at all levels of seniority – engaged 
in misconduct in connection with examinations on internally-administered training courses that 
were intended to test whether they understood a variety of accounting principles and other topics of 
importance.     
5. This misconduct took a variety of forms.  KPMG audit professionals shared exam 
answers with one another.  A number of audit partners gave exam answers to other partners, and a 
number also sent answers to and solicited answers from their subordinates.  In addition, for a 
period of time up to November 2015, certain audit professionals made unauthorized changes to 
KPMG’s server instructions that allowed them to manually select the scores necessary to pass the 
tests, which they often lowered to the point of passing exams with less than 25 percent of the 
questions answered correctly.  The exams related to a variety of subjects that were relevant to the 
test-takers’ audit practices, and included additional training required by a 2017 Commission Order 
after the Commission found that KPMG engaged in improper professional conduct and had caused 
a client’s reporting violations.
4
 
6. After discovering the training-related misconduct, KPMG reported the matter to 
Commission staff and appointed a Special Committee of its Board of Directors to oversee an 
internal investigation.  During that investigation, two now-former partners who had shared exam 
answers deleted relevant documents.  One of those partners and certain other audit professionals 
made misrepresentations to the firm’s investigators.     
7. KPMG is required, both by PCAOB rules and by the Code of Conduct of the 
American Institute of Certified Public Accountants (“AICPA”), to act with integrity in connection 
                                                 
4
  In August 2017, KPMG agreed to settle charges it engaged in improper professional conduct with respect 
to the audit of the financial statements of an oil and gas client and caused the company’s reporting violations.  As 
part of the settlement, the Commission ordered KPMG to ensure its audit staff complete specific training programs 
in various areas related to the Commission’s findings in that proceeding.  KPMG LLP and John Riordan, CPA, 
Exchange Act Release No. 81396 (Aug. 15, 2017).  KPMG has required all personnel subject to that training 
undertaking to re-test to ensure full compliance with the Commission’s 2017 Order. 
 

4 
with the professional services it provides its clients.
5
  Certified public accountants are required to 
“be, among other things, honest and candid within the constraints of client confidentiality.”
6
  By 
the misconduct described herein, these professionals caused KPMG’s failure to act with the 
integrity required of a public company auditor.
7
   
8. As indicated above, KPMG’s Board of Directors has formed a Special Committee 
led by an independent board member to oversee an investigation of the misconduct relating to 
training examinations.  The Special Committee has retained an outside law firm to investigate the 
extent of such conduct within the past three years, and will recommend employment actions to 
KPMG management as appropriate.  As set forth in the Undertakings below, KPMG will retain an 
independent consultant to review and assess the Special Committee’s investigation and whether 
the firm has taken appropriate employment actions or other remedial steps, and to ensure the firm 
has designed and implemented quality controls that reasonably assure compliance with all 
professional standards relating to ethics and integrity. 
RESPONDENT 
 
9. KPMG LLP is a Delaware limited liability partnership and PCAOB-registered 
accounting firm.  Headquartered in New York, New York, KPMG is the U.S. member firm of 
KPMG International Cooperative, a Swiss entity. 
OTHER RELEVANT PERSONS 
 
10. David Middendorf, 54, of Marietta, Georgia, was KPMG’s National Managing 
Partner for AQPP until March 2017, and was separated from the firm the following month.  
Middendorf is licensed as a CPA in Georgia, New York, and Ohio and was previously licensed in 
Texas.  The Commission has charged Middendorf for his role in the misconduct described in this 
Order. 
11. Thomas Whittle, 55, of Gladstone, New Jersey, was KPMG’s National Partner-In-
Charge for Quality Measurement until March 2017, and was separated from the firm the following 
month.  Whittle is licensed as a CPA in New York and New Jersey and was previously licensed in 
                                                 
5
  PCAOB Rule 3500T requires KPMG to maintain integrity when performing any professional service in 
connection with the preparation or issuance of any audit report.  As an AICPA member, KPMG was required to 
comply with the AICPA’s Code of Professional Conduct, which requires the firm to maintain integrity in connection 
with all professional services.  The AICPA also prohibits members from committing acts “discreditable to the 
profession.”  See AICPA Code of Conduct 1.400.001 (“Acts Discreditable Rule”).   
 
6
 See “Principles of Professional Conduct,” ET Section 54 (available at 
https://www.aicpa.org/Research/Standards/CodeofConduct/DownloadableDocuments/2011June1CodeOfProfessiona
lConduct.pdf).  Codified as AICPA Code 0.300.040. 
 
7
  KPMG’s conduct also failed to conform to the requirements of PCAOB Quality Control Standards (“QC”) 
requiring registered firms to “have a system of quality control for its accounting and auditing practice” that provides 
“reasonable assurance that (a) personnel . . . perform all professional responsibilities with integrity.”  QC 20.01 and 
20.09. 

5 
Pennsylvania and Connecticut.  The Commission has charged Whittle for his role in the 
misconduct described in this Order. 
12. David Britt, 55, of New Canaan, Connecticut, was a Partner in KPMG’s 
Department of Professional Practice within AQPP, in which he was the Banking and Capital 
Markets Group Co-Leader until March 2017, and was separated from the firm the following 
month.  Britt is licensed as a CPA in New York and California and was previously licensed in the 
District of Columbia.  The Commission has charged Britt for his role in the misconduct described 
in this Order. 
 
13. Brian Sweet, 41, of Fresno, California, was a Partner in KPMG’s Department of 
Professional Practice-Inspections group until March 2017.  He was separated from the firm at the 
end of March 2017.  Prior to joining KPMG, Sweet was an Associate Director in the PCAOB’s 
inspections group from March 2014 until April 2015.  Sweet was previously licensed as a CPA in 
New York, Illinois, and California.  The Commission has charged Sweet for his role in the 
misconduct described in this Order. 
14. Cynthia Holder, 52, of Houston, Texas was an Executive Director in KPMG’s 
Department of Professional Practice-Inspections group from August 2015 until April 2017, and 
was separated from the firm the following month.  Prior to joining KPMG, Holder was an 
Inspections Leader at the PCAOB from December 2011 until August 2015.  Holder was previously 
licensed as a CPA in Texas and New Jersey.  The Commission has charged Holder for her role in 
the misconduct described in this Order. 
15. Jeffrey Wada, 43, of Tustin, California was an Inspections Leader at the PCAOB 
from February 2012 until February 2017.  Wada is no longer at the PCAOB.  Wada is licensed as a 
CPA in California.  The Commission has charged Wada for his role in the misconduct described in 
this Order.   
FACTS 
 
I. THE MISAPPROPRIATION OF CONFIDENTIAL PCAOB INFORMATION 
 
A. The PCAOB’s Inspections Process and KPMG’s Efforts to Improve Its Results 
 
16. The PCAOB was created as part of the Sarbanes-Oxley Act of 2002 to oversee the 
audits of public companies that are subject to the federal securities laws in order to protect the 
interests of investors and further the public interest in the preparation of informative, accurate, and 
independent audit reports. 
17. One of the essential ways in which the PCAOB fulfills this mission is by inspecting 
audits of public companies conducted by registered public accounting firms.  Through these 
inspections, the PCAOB assesses the audit firms’ compliance with the statutes, regulations, and 
professional standards governing the accounting profession.  The PCAOB typically selects the 
audit engagements it will inspect based on confidential internal analyses and thereafter notifies 
firms of which audits it will inspect.  The PCAOB typically issues inspection reports, only parts of 

6 
which are made public, after all the inspections for a firm in a given cycle are complete.  To ensure 
the integrity of the inspection process, the PCAOB closely guards the confidentiality of both its 
inspection targets prior to firm notification and its methodology for selecting those targets.   
18. In September 2014, the PCAOB issued a report regarding its 2013 inspections of 
KPMG audits.  The report found that out of 50 audits the PCAOB inspected, 23 had deficiencies.  
This 46 percent deficiency rate reflected a significant decline from KPMG’s 34 percent deficiency 
rate the previous year.  David Middendorf, who then oversaw the National Office’s audit quality 
and professional practice work understood then that the Commission’s Office of the Chief 
Accountant had been highly critical of KPMG’s worsening inspection results.    
B. The Use of Confidential PCAOB Information Misappropriated by Sweet 
 
19. As part of its efforts to improve its PCAOB inspection results, KPMG hired Brian 
Sweet, an Associate Director at the PCAOB who had worked on the team inspecting KPMG 
audits.  Sweet joined KPMG as a partner in the group within the firm’s National Office responsible 
for PCAOB inspections.  Sweet reported to Thomas Whittle, who was then the KPMG partner 
responsible for overseeing the PCAOB’s inspections of the firm.  Whittle, in turn, reported to 
Middendorf. 
20. In April 2015, shortly before leaving the PCAOB, Sweet copied from an internal 
database to his office computer various confidential inspection-related materials he believed might 
be of use to him when he joined KPMG.  On his final day at the PCAOB, Sweet transferred these 
materials, along with the other files on his PCAOB computer, to a personal hard drive that he took 
with him.  Sweet also took from the PCAOB hard copy documents and retained other confidential 
PCAOB documents he had previously brought home.   
21. The documents Sweet improperly took included PCAOB inspection planning 
information, inspection guides and manuals, and drafts of confidential inspection comment forms.  
The planning materials included the confidential list of KPMG audit engagements the PCAOB 
intended to inspect in 2015, the focus areas for each inspection, and a list of all the quantitative and 
qualitative criteria the Board used in deciding which KPMG audit engagements to inspect.   
22. Upon joining KPMG in May 2015, Sweet transferred the PCAOB documents from 
his personal hard drive to his computer at the firm.    
The Use of the PCAOB’s Confidential List of 2015 Inspections 
 
23. On his first day at the firm in May 2015, Sweet had lunch with Middendorf and 
other partners in KPMG’s National Office, including David Britt, who was then a Partner in the 
National Office’s Department of Professional Practice and co-leader of KPMG’s Banking and 
Capital Markets Group.  Over lunch, Sweet’s new colleagues asked him various questions about 
the PCAOB’s inspections of KPMG.  Sweet testified that one of the questions Middendorf asked 
Sweet was whether the PCAOB intended to inspect a specific KPMG banking client that year.  
Without answering directly, Sweet indicated the PCAOB planned to do so.  Sweet testified that 
Middendorf told him the next day that Sweet needed “to share insight and add value and be fully 

7 
open when it came to that type of information,” and to “remember where [your] paycheck came 
from” and that Sweet had to be “completely loyal to KPMG and KPMG only.” 
24. Several days later, at Middendorf’s direction, Whittle asked Sweet to provide him 
the list of the PCAOB’s planned inspections for 2015.
8
  Sweet testified that he showed Whittle a 
hard copy of a PCAOB inspection planning document listing the KPMG banking and financial 
service audits the PCAOB intended to inspect that year. 
25. The next day, Whittle emailed Sweet, asking him to have an assistant “scan and 
send me the banking selection list,” i.e. KPMG’s bank holding company clients the PCAOB had 
selected for inspection.  Sweet complied by sending Whittle the complete list of planned 
inspections and asked Whittle to exercise discretion given the nature of the information.  Whittle 
forwarded this information to Middendorf the same day, writing, “The complete list.  Obviously, 
very sensitive.  We will not be broadcasting this.”  
26. Though Whittle immediately assigned Sweet to review the workpapers of one of 
the inspection targets, it does not appear that any workpapers were changed in response to Sweet 
providing the 2015 inspection list.  At the time Sweet provided this information to Middendorf and 
Whittle, KPMG had, pursuant to its policy, already locked the audit workpapers for all but two of 
the engagements from editing absent special circumstances.   
27. Whittle also instructed Sweet to speak to certain engagement partners responsible 
for audits on the 2015 list to explain the reasons for their selection.  By learning why they were 
selected, engagement partners could better tailor their responses to questions from PCAOB 
inspectors to mitigate concerns.  Middendorf and Whittle also assigned Sweet to one of the firm’s 
large audit engagements on the 2015 list to help prepare for the inspection.  Internal training 
materials KPMG created for audit staff undergoing PCAOB inspection stressed the importance of 
replying to inspectors’ questions – especially during the critical first meeting with PCAOB staff – 
with the “best first answer.”  KPMG’s National Office believed the audit staff’s ability to respond 
effectively to inspectors’ questions had a significant impact on whether the PCAOB would find 
deficiencies in the audit. 
28. In June 2015, Sweet identified for Britt a number of KPMG banking clients the 
PCAOB planned to inspect in 2015.  The next day, Britt asked Sweet to review his notes so he 
could give Britt the “last 3 Bank names.”  Sweet shared this information later that day, asking Britt 
to note its sensitivity and “use your discretion with this info.” 
The Use of the PCAOB’s Confidential Process for Selecting Audits to Inspect 
 
29. In April 2015, KPMG engaged an outside consultant to help it predict which audit 
engagements the PCAOB would inspect in 2016.  Sweet recalls that in June 2015 Middendorf and 
Whittle directed Sweet to share with the outside consultant everything he knew about how the 
                                                 
8
 By that time, the PCAOB had informed KPMG of less than half of the audit engagements it intended to 
inspect in 2015.   
 

8 
PCAOB selected audits to inspect, including the confidential information Sweet had taken.  Sweet 
understood this to be an instruction to give the consultant all of the information he took from the 
PCAOB. 
30. Sweet complied with Middendorf and Whittle’s directive by providing information 
about the Board’s selection criteria to a Director in KPMG’s National Office, who then gave that 
information to the consultant.  In September 2015, Sweet spoke directly with the consultant and 
gave the consultant additional confidential information regarding the inspections selection process, 
including how the PCAOB’s Inspections group used confidential information received from others 
at the Board and the Commission.  At the end of September, Sweet reported to Middendorf and 
Whittle that he had “spent quite a bit of time with [the outside consultant] trying to guide their 
modeling efforts.” 
The Use of Confidential PCAOB Information Regarding Another Audit Firm 
 
31. Sweet also provided confidential PCAOB information to an audit partner (who is 
no longer at KPMG) who was preparing a client pitch for a Spanish bank’s audit business.  
Securing this audit business was a high priority for KPMG.   
32. In April 2016, Sweet sent the audit partner confidential PCAOB comment forms 
related to the Board’s inspection of another Spanish bank’s audit, writing that he had attached 
“some examples of the types of issues that have been raised in the past.  I hope this helps!”  The 
comment forms discuss specific ways in which that bank’s auditor had failed to adequately test the 
valuation of its Allowance for Loan and Lease Losses. 
C. The Solicitation of Confidential PCAOB Information from Holder 
 
33. Before he left the PCAOB, Sweet had discussed with Cynthia Holder, a friend who 
was then a PCAOB Inspections Leader, the prospect of her joining him at KPMG.  On Sweet’s 
first day at KPMG (May 4, 2015), he informed Holder that he would be meeting with Whittle to 
push the firm to hire her.  On May 11, 2015, Sweet told Holder he was going to hand-deliver her 
resume to Whittle and “make a sell again” in person. 
34. On May 12, 2015, Sweet asked Holder to send him a confidential PCAOB 
document reflecting comments he had written about KPMG’s audits while he was at the Board.  At 
that time, KPMG personnel were preparing for a meeting with the PCAOB to discuss the firm’s 
performance on its audits, during which KPMG would make a presentation on the root causes of 
audit deficiencies.  Sweet asked Holder for a document he had written while he was at the PCAOB 
so he could review it before helping his KPMG colleagues with that presentation.  That day, 
Holder sent Sweet the confidential document he requested.   
35. On June 17, 2015, Holder again shared confidential PCAOB information with 
Sweet, telling him that the Board had decided to cancel its planned inspection of a KPMG audit 
client for 2015, and that the Board did not intend to replace it with another selection.  Sweet 
immediately relayed this information to Whittle.   

9 
36. KPMG sent Holder an employment offer in July 2015.  She joined the firm the 
following month as an Executive Director in KPMG’s National Office, performing internal 
inspections and advising banking engagement teams on their audits.   
D. The Use of Confidential PCAOB Information Obtained from Wada in 2016 
 
37. In early March 2016, Jeffrey Wada, an Inspections Leader at the PCAOB who had 
previously performed work on KPMG inspections but was then assigned to inspect another audit 
firm, learned that he had not been selected for a promotion.  Wada reacted angrily, telling a 
colleague the PCAOB had “screwed” him by passing him over.     
38. On March 28, 2016, Wada, who remained friends with Holder after she left the 
PCAOB, called her and read to her the names of thirteen KPMG clients the Board planned to 
inspect.
9
  Holder provided this information to Sweet, who then immediately relayed the list to 
Middendorf, Whittle, and Britt, informing them that it had come from a former colleague at the 
PCAOB.    
39. Wada sent the list of the PCAOB’s planned inspections at a critical time.  In early 
February 2016, Middendorf and other members of KPMG’s leadership team had met with staff 
from the Commission’s Office of the Chief Accountant.  During that meeting, Commission 
personnel expressed significant concerns about the firm’s audit quality and questioned whether 
KPMG was adequately addressing these issues.  Middendorf told Whittle, Sweet, and Britt they 
should use the list of inspection targets Wada had sent to protect KPMG from further criticism by 
its regulators. 
40. Middendorf, Whittle, Britt, and Sweet believed they could use Wada’s list in this 
way because they had learned of the audits that would be inspected at a time when firm personnel 
were still able to access and revise audit workpapers.  Though KPMG had already issued audit 
reports for each of these engagements, it was within the 45-day period in which professional audit 
standards and firm policy allowed audit teams to complete the administrative process of 
assembling final audit files.
10
  At the end of this 45-day period, KPMG locked audit workpapers 
from editing absent special circumstances.
11
 
                                                 
9
 Of the 13 clients, 11 were bank holding or other financial services companies and 2 were other issuers that 
Wada appears to have thought were also bank holding or other financial services companies.  It appears that Wada 
identified these engagements for Holder because her responsibilities at KPMG included advising banking 
engagement teams. 
 
10
  See Auditing Standard No. 3, Audit Documentation, paragraph 15. “Prior to the report release date, the 
auditor must have completed all necessary auditing procedures and obtained sufficient evidence to support the 
representations in the auditor’s report.  A complete and final set of audit documentation should be assembled for 
retention as of a date not more than 45 days after the report release date (documentation completion date).”  
References to PCAOB standards are to those that were in effect at the time of the relevant conduct. 
 
11
 KPMG has since revised its audit documentation policies, requiring electronic workpapers to be assembled 
and locked within two business days of issuance of the report. 
 

10 
41. Recognizing that the workpapers had not yet been locked per KPMG’s policy, 
Middendorf, Whittle, and Britt agreed to have Sweet and others conduct an additional review of 
the audit workpapers for the seven banks on the list Wada had provided that were part of a key 
monitoring program run by the National Office to determine whether anything could be done to 
minimize the risk of receiving inspection comments from the PCAOB.
12
  Middendorf and Whittle 
instructed that no one in the briefing should disclose that they had obtained confidential PCAOB 
information. 
42. To conceal the true purpose of their efforts, Britt falsely told others at KPMG that 
they were performing work in the ordinary course of business on all 35 banking engagements in 
the ALLL monitoring program.  On March 28, 2016, Britt sent the engagement partners for these 
audits an email stating that, “[a]s part of our wrap up and reporting of the results of the ALLL 
monitoring program we need to gather some additional information” from the audit workpapers.
13
 
43. Over the next few weeks, Sweet, Holder, and various partners and managing 
directors in the National Office engaged in a review of the audit workpapers of the seven banks in 
the monitoring program that were on the list Wada provided.  The National Office professionals 
suggested edits and proposed revisions to the engagement teams, which then decided what 
revisions to incorporate into the final audit workpapers.
14
   
44. In contrast to prior years, KPMG’s 2016 inspection results did not include any 
comments related to the general Allowance for Loan and Lease Losses – an area where KPMG had 
historically received criticism related to financial services audits.  The PCAOB did not publish the 
results because KPMG reported the misconduct to the PCAOB before the PCAOB issued the 2016 
report.  However, the PCAOB had designated two of the bank audits in the ALLL monitoring 
program whose workpapers Sweet had reviewed as “positive quality events,” which meant they 
were so successful the PCAOB wanted to understand the factors driving the audit’s quality.  
Indeed, the level of improvement in the inspection results led Whittle to be concerned that if 
                                                                                                                                                             
 
12
  As the PCAOB found an increasing number of audit deficiencies by KPMG beginning in 2013, KPMG’s 
National Office implemented “monitoring programs” that worked with audit engagement teams and reviewed 
workpapers to improve compliance with professional standards.  One of these programs focused on the audits of 
certain banking clients’ Allowance for Loan and Lease Losses.  KPMG further developed this monitoring program 
in 2015 in response to numerous deficiencies the PCAOB had identified in this area.  The success of this program 
was especially important to KPMG because the firm had promoted it as proof of the seriousness with which the firm 
was working to improve its audit quality. 
 
13
  Britt also asked a subordinate who previously had been in the Department of Professional Practice and was 
then assigned to an audit engagement on the list to conduct his own “stealth” review of workpapers for one KPMG 
audit client.   
 
14
  Middendorf, Whittle, Sweet, and Britt had agreed that Sweet would lead a team of National Office 
professionals to review the workpapers of the banks in the monitoring program, and that Middendorf, Whittle, and 
Britt would handle the other issuers on the list they received from Wada.   
 

11 
KPMG could not obtain confidential PCAOB information for the next inspection cycle, there could 
be a return of audit deficiencies that would be difficult to explain.    
45. After the misconduct was discovered, the PCAOB conducted inspections of ten 
additional banks for the 2016 inspection cycle to replace the ones for which improper advance 
notice had been obtained.  The PCAOB found that six of these audits had deficiencies with respect 
to auditing the ALLL. 
E. The Use of Confidential PCAOB Information Obtained from Wada in 2017 
 
46. In early January 2017, Wada provided Holder a “preliminary” list of PCAOB 
inspection targets for 2017.  On January 9, Holder relayed the names of the clients on the list to 
Sweet, and together, they briefed Whittle.  That night, Sweet, Whittle, and Britt discussed this 
information.  After that meeting, Sweet contacted the engagement partners for two of the audits on 
the January 2017 list to warn them about the potential inspections.  Whittle also discussed the 
January 2017 list with Middendorf.  As a result of that discussion, Middendorf and Whittle 
assigned additional National Office resources to assist with two of the active audits on that list.
15
 
47. In early February 2017, Wada conveyed to Holder a list of 47 ticker symbols that 
Holder understood to be the final list of KPMG audits the PCAOB would inspect that year.  Wada 
also provided Holder the inspection focus areas for the banks on the list (as well as for another 
KPMG engagement), and the PCAOB’s list of KPMG engagement partners with “poor 
performance evaluations.”   
48. Holder relayed the information to Sweet, who then shared it with Middendorf, 
Whittle, and Britt.  Though Sweet questioned what to do with that information, Middendorf 
replied, “this is information that’s too good not to use.”  Unlike the prior lists of PCAOB 
inspection targets, the audits on the February 2017 list were ongoing, thus providing substantially 
greater ability to improve the audit workpapers.   
49. Whittle instructed Sweet to warn certain engagement partners about the impending 
inspections.  Though Whittle had warned Sweet to be circumspect in how he communicated this to 
KPMG colleagues, Sweet’s notice to one KPMG engagement partner caused her to suspect that the 
firm may have received confidential PCAOB information.  These concerns were subsequently 
reported to the firm’s management, which then reported the matter to the PCAOB, and KPMG 
began an investigation. 
II. AUDIT PROFESSIONALS IMPROPERLY SHARED TRAINING EXAM ANSWERS 
 
A. Professional Education Requirements for KPMG Auditor Personnel  
 
                                                 
15
  Middendorf was the Engagement Quality Review partner on one of those audits.  In this role, he was 
responsible for evaluating the significant judgments and related conclusions the audit team made in reaching the 
overall conclusion reflected in the audit report.   
 

12 
50. As accountants licensed by state accountancy boards, many KPMG audit 
professionals are required to complete a minimum number of continuing professional education 
(“CPE”) courses periodically – typically 120 hours every three years.  KPMG requires its audit 
professionals to complete additional training in excess of state requirements.  These training 
requirements vary by position, role, and industry, and are designed by the firm to be relevant to the 
audit work its professionals are performing.  
51. In addition to state accountancy boards’ and KPMG’s own continuing education 
requirements, the Commission ordered KPMG audit professionals to complete a minimum of 12 
hours of training in specific audit areas as part of an August 2017 settlement of charges that KPMG 
failed to properly audit the financial statements of an oil and gas client.
16
  
52. To help its audit professionals satisfy these requirements, KPMG administers its 
own set of online training programs that also qualify for CPE credit.  KPMG requires its auditors to 
pass an examination at the conclusion of each online training program.  Audit professionals are 
given three opportunities to pass each examination.  If one of KPMG’s audit professionals is 
unable to pass after two attempts, their Performance Management Leader is notified.  If they are 
unable to pass after three attempts, the consequences are more significant:  they are required to re-
take the training; they are prohibited from conducting audit work until they pass the exam; and 
others at the firm may be notified.  Audit professionals also understood that failing to pass an exam 
could lead to their compensation being reduced. 
B. KPMG Audit Professionals Shared Answers to Training Exams  
 
53. On numerous occasions, KPMG audit professionals who had passed training exams 
sent their answers to colleagues to help them pass those exams.  They sent colleagues images of 
their answers primarily by email or printed their answers and gave them to their colleagues.  This 
conduct was committed by audit professionals at all levels of seniority, including lead audit 
engagement partners who were responsible for compliance with PCAOB standards in auditing 
their clients’ financial statements.  A number of lead audit engagement partners not only sent exam 
answers to other partners, but also solicited answers from and sent answers to their subordinates.
17
 
54. Upon learning of the potential cheating, KPMG leadership alerted the Commission 
staff and began an internal investigation.  Soon after, the firm’s Board of Directors formed a 
Special Committee led by an independent board member to oversee an independent investigation 
of this conduct.  The Special Committee hired an outside law firm to conduct this review.  The 
investigation has revealed extensive sharing of exam answers, with the bulk of this misconduct 
occurring among junior personnel.  While many of those who shared and/or received exam 
answers engaged in misconduct only once, others sent or received answers to multiple exams.  
                                                 
16
  KPMG LLP and John Riordan, CPA, Exchange Act Release No. 81396 (Aug. 15, 2017). 
 
17
  As KPMG itself has recognized, “[t]hose who manage others act as role models.”  KPMG Transparency 
Report (January 2019), available at https://audit.kpmg.us/content/dam/audit/pdfs/2018/2018-transparency-
report1.pdf.  
 

13 
Prior to the firm’s investigation, no one reported the improper sharing of exam answers to the 
firm’s Ethics and Compliance Hotline.  The firm has been taking disciplinary action against certain 
partners and other audit professionals in connection with its investigation.   
55. After KPMG began to investigate the misconduct, certain now-former audit 
professionals, including a few lead audit engagement partners, attempted to conceal what they had 
done.  For example, in September 2018, one engagement partner who is no longer with KPMG 
(“Former Partner 1”) solicited from a junior partner answers to the exam for a training program 
relating to leases.  The now-former junior partner sent Former Partner 1 the answers from his exam 
by text message.  After receiving a document preservation notice from the firm, Former Partner 1 
deleted the text messages the junior partner sent him, and encouraged his colleague to do the same.  
Former Partner 1 also encouraged the junior partner to say, falsely, that the texts were deleted by 
accident.  When Former Partner 1 was asked in a written questionnaire in December 2018 whether 
he had received any answers to KPMG training exams, he answered “no.”   
56. In another example, a lead audit engagement partner who is no longer with the firm 
(“Former Partner 2”) also answered “no” to the December 2018 questionnaire that asked whether 
he had sent or received answers to KPMG training programs.  In fact, Former Partner 2 had 
received answers to training exams on seven occasions and sent answers to training exams on three 
occasions – all within eight months of completing the survey, and all with junior members of his 
engagement team. 
C. KPMG Audit Professionals Manipulated the Scoring of Training Exams  
57. In addition to sharing answers to training examinations, certain audit professionals 
also manually changed the scores required to pass certain exams.  Prior to November 2015, KPMG 
hosted exams to training programs on an internal server with software provided by a third party.  
KPMG sent participants in training programs a hyperlink that directed them to the applicable 
exams.  Embedded in the hyperlink was an instruction to the server that specified the score 
necessary to pass the exam.  Thus, the characters “MasteryScore=70” meant participants were 
required to answer at least 70 percent of the answers accurately to pass the exam.
18
  By changing 
the number in the hyperlink, audit professionals could change the score required to pass. 
58. For a period of time up to November 2015, certain audit professionals, including 
one partner, altered the URLs for their exams to lower the scores required to pass.  Twenty-eight of 
these auditors did so on four or more occasions.  Certain audit professionals lowered the required 
score to the point of passing exams while answering less than 25 percent of the questions correctly. 
VIOLATIONS 
 
59. As a result of the conduct of personnel described above, KPMG willfully violated 
PCAOB Rule 3500T, which requires KPMG and associated persons to comply with ethics 
standards, including to maintain integrity, as described in the AICPA’s Code of Professional 
                                                 
18
  Some exams required a higher score to pass, while others allowed a lower score. 
 

14 
Conduct when performing any professional service in connection with the preparation or issuance 
of any audit report,
19
 within the meaning of Section 4C(a)(3) of the Exchange Act and Rule 
102(e)(1)(iii) of the Commission’s Rules of Practice. 
60. The AICPA Code of Conduct requires that a member not commit any act 
discreditable to the profession.  AICPA Code of Conduct 1.400.001.  As a result of the conduct of 
personnel described above, KPMG failed to comply with AICPA Code of Conduct 1.400.001 
within the meaning of Section 4C(a)(2) of the Exchange Act and Rule 102(e)(1)(ii) of the 
Commission’s Rules of Practice. 
61. PCAOB Quality Control Standards require that a registered firm “shall have a 
system of quality control for its accounting and auditing practice.”  QC 20.01.  Those quality 
control standards require further that firms should establish policies and procedures to provide 
“reasonable assurance that (a) personnel ... perform all professional responsibilities with integrity.”  
QC 20.09.  As a result of the conduct described above, KPMG failed to comply with QC 20 within 
the meaning of Section 4C(a)(2) of the Exchange Act and Rule 102(e)(1)(ii) of the Commission’s 
Rules of Practice. 
FINDINGS 
 
62. Based on the foregoing, the Commission finds that KPMG willfully violated 
PCAOB Rule 3500T within the meaning of Section 4C(a)(3) of the Exchange Act and Rule 
102(e)(1)(iii) of the Commission’s Rules of Practice. 
63. Based on the foregoing, the Commission finds that KPMG engaged in conduct that 
provides a basis to impose remedies against the firm pursuant to Section 4C(a)(2) of the Exchange 
Act and Rule 102(e)(1)(ii) of the Commission’s Rules of Practice. 
 
COOPERATION AND REMEDIAL EFFORTS 
 
64. In determining to accept KPMG’s Offer, the Commission considered that KPMG 
reported these matters to the Commission and/or to the PCAOB, initiated an investigation of the 
testing matter under the oversight of a Special Committee of the Board of Directors, has 
cooperated with the Commission staff, and has undertaken various remedial measures, including:  
revising its audit documentation policies to require that electronic workpapers be assembled and 
locked within two business days of issuance of the report notwithstanding the 45-day period 
allowed under professional auditing standards; retaining an advisory firm to conduct an 
                                                 
19
  The rule requires auditors to comply with the AICPA’s Code of Professional Conduct Rule 102, and 
interpretations and rulings thereunder, as in existence on April 16, 2003.  Although PCAOB Rule 3500T references 
the AICPA Code as in existence on April 16, 2003, the definition of integrity remains identical to the current 
definitions in the Code of Professional Conduct promulgated by the AICPA and applicable to current members of 
the AICPA. 
 

15 
independent cultural assessment; and retaining a learning and development consultant to conduct a 
current state assessment.  
UNDERTAKINGS 
 
 KPMG has undertaken to complete the following actions: 
 
65. KPMG’s Review.  Within 120 days after the entry of this Order, KPMG shall 
evaluate (“KPMG’s Review”) the sufficiency and adequacy of its quality controls relevant to ethics 
and integrity (hereinafter referred to as KPMG’s “Policies and Procedures”) to determine whether 
they are designed and implemented in a manner that provides reasonable assurance of compliance 
with all professional standards relating to ethics and integrity.  KPMG’s evaluation shall include 
assessing: 
a. the adequacy and sufficiency of ethics and integrity training and guidance, 
including regarding anti-retaliation and whistleblowing;   
b. whether KPMG’s culture is supportive of ethical and compliant conduct, 
including strong, explicit, and visible support and commitment by the firm’s management and 
Board of Directors; and 
c. whether KPMG deploys proper resources and oversight for compliance 
with ethics and integrity requirements, including seniority of executives and managers responsible 
for implementation and oversight of these responsibilities, reporting lines, autonomy and 
independence, compensation and rewards, consistent discipline, access to information and 
personnel. 
66. KPMG Report to the Commission.  Within 60 days of completing KPMG’s 
Review, KPMG shall deliver to the Commission staff a detailed written report (“KPMG Report to 
the Commission”) summarizing its review and any changes it has made to KPMG’s Policies and 
Procedures relating to the subjects described in paragraph 65.  The KPMG Report to the 
Commission shall provide written evidence of how the Policies and Procedures, including any 
changes, are designed and implemented in a manner that provides reasonable assurance of 
compliance with all professional standards relating to ethics and integrity in the form of a narrative 
and be supported by exhibits.  The Commission staff may request further evidence of how the 
Policies and Procedures provide such assurance, and KPMG agrees to provide such evidence. 
The KPMG Report to the Commission shall set forth the results of its assessment of the adequacy 
and sufficiency of its ethics and integrity training, including a description of the training.  The 
KPMG Report to the Commission should also include a description of any training courses added 
or modified as a result of the assessment conducted under this paragraph. 
 
67. KPMG’s Special Committee Review.  Within 360 days after the entry of this Order, 
a committee composed of independent members of KPMG’s Board of Directors and non-Audit 
Partners (the “Special Committee”) shall complete the steps reasonably necessary to identify, and 
to determine the extent to which, audit professionals violated ethics and integrity requirements in 

16 
connection with training examinations within the past three years (“Special Committee 
Investigation”), and to recommend any employment actions or other remedial steps to KPMG 
management that the Special Committee deems appropriate. 
68. Special Committee Report of Investigation.  Within 60 days of completing the 
Special Committee Investigation, the Special Committee shall deliver to KPMG’s Board of 
Directors and Chief Executive Officer a detailed report (“Special Committee Report of 
Investigation”) summarizing the investigative steps it has taken and any employment actions or 
other remedial steps it recommends be taken. 
69. Independent Consultant Review.  KPMG shall retain, within 60 days after the 
entry of this Order, an independent consultant (“Independent Consultant”), not unacceptable to 
the Commission staff.  The Independent Consultant shall have, at a minimum, the following 
qualifications:  (i) demonstrated expertise conducting ethics and integrity investigations; and (ii) 
experience designing or reviewing compliance policies, procedures, and controls relating to 
ethics and integrity.  KPMG shall provide to the Commission staff a copy of the engagement 
letter detailing the scope of the Independent Consultant’s responsibilities.  KPMG shall deliver to 
the Independent Consultant the KPMG Report to the Commission at the same time as KPMG 
provides such report to the Commission staff as specified in paragraph 66.  The Special 
Committee shall deliver to the Independent Consultant the Special Committee Report of 
Investigation at the same time as it provides such report to KPMG’s Board of Directors and 
Chief Executive Officer as specified in paragraph 68.  KPMG shall require that the Independent 
Consultant: 
a. perform a review (the “IC Review of Quality Controls”) of KPMG’s 
Policies and Procedures to determine whether they are designed and being implemented in a 
manner that provides reasonable assurance of compliance with all professional standards relating 
to ethics and integrity, including whether the firm’s ethics and integrity training and guidance is 
adequate and sufficient; the culture is supportive of ethical and compliant conduct, and KPMG is 
deploying proper resources and oversight for compliance with ethics and integrity requirements; 
and 
 
b. review and assess (the “IC Review of Investigation”) the Special 
Committee Investigation and whether KPMG (i) has taken reasonable steps to identify, and to 
determine the extent to which, those audit professionals who engaged in improper exam sharing 
within the past three years, and (ii) has followed the Special Committee’s recommended 
employment actions or other remedial steps.   
 
KPMG shall cooperate fully with the Independent Consultant and shall provide reasonable access 
to information and records as the Independent Consultant may reasonably request, subject to 
KPMG’s right to withhold from disclosure any information or records protected by any applicable 
protection or privilege such as the attorney-client privilege or the attorney work product doctrine.  
The Independent Consultant shall have the right to interview any partner, employee, agent, or 
consultant of KPMG concerning any matter within or relating to the IC Review of Quality Controls 
or the IC Review of Investigation. 
 

17 
70. Reports of IC Reviews.  After the IC Review of Quality Controls and the IC 
Review of Investigation are completed, but no later than 90 days after receiving the KPMG Report 
to the Commission and the Special Committee Report of Investigation, the Independent Consultant 
shall issue a detailed written report (the “IC Report”) to KPMG: (i) summarizing its work; (ii) 
making recommendations, as the Independent Consultant deems appropriate, reasonably designed 
to ensure that KPMG’s Policies and Procedures relating to the topics discussed in paragraph 65 are 
adequate and sufficient to provide reasonable assurance of compliance with all relevant 
professional standards relating to ethics and integrity; (iii) describing its review of KPMG’s 
training and making additional recommendations, as the Independent Consultant deems 
appropriate, regarding ethics and integrity training; (iv) making recommendations, as the 
Independent Consultant deems appropriate, reasonably designed to ensure that the Special 
Committee Investigation has taken reasonable steps to identify, and to determine the extent to 
which, audit professionals who engaged in improper exam sharing within the past three years, 
including recommending additional investigative steps for the Special Committee to take; and (v) 
making recommendations, where appropriate, reasonably designed to ensure that KPMG has taken 
appropriate employment actions or other remedial steps in light of the findings of the Special 
Committee Investigation.  KPMG shall require the Independent Consultant to provide a copy of the 
IC Report to the Commission staff and the PCAOB staff when the IC Report is issued. 
71. KPMG shall adopt, as soon as practicable, all recommendations of the Independent 
Consultant in the IC Report.  Provided, however, that within 30 days of issuance of the IC Report, 
KPMG may advise the Independent Consultant in writing of any recommendation that it considers 
to be unnecessary, unjust, outside the scope of this Order, unduly burdensome, or impractical.  
KPMG need not adopt any such recommendation at that time, but instead may propose in writing 
to the Independent Consultant an alternative approach designed to achieve the same objective or 
purpose.  If KPMG’s written proposal relates to an alternative policy, procedure, or investigative 
step, it will submit its proposal to the Commission staff at the same time.  KPMG and the 
Independent Consultant shall engage in good-faith negotiations in an effort to reach agreement on 
any recommendations objected to by KPMG.  In the event that the Independent Consultant and 
KPMG are unable to agree on an alternative proposal within 60 days of the issuance of the IC 
Report, KPMG shall abide by the determinations of the Independent Consultant. 
72. Ethics and Integrity Training.  For the period immediately following the completion 
of KPMG’s assessment of the adequacy and sufficiency of its ethics training and guidance as 
specified in paragraph 65, and ending no earlier than 36 months after submission of the final CEO 
certification required by paragraph 73, all audit professionals are required to complete a minimum 
of 12 hours of ethics and integrity training each year, with a minimum 3 hours of such training 
occurring every 3 months. 
73. Certification by Chief Executive Officer.  Within 60 days of issuance of the IC 
Report, but not sooner than 30 days after a copy of the IC Report is provided to the Commission 
staff, KPMG’s Chief Executive Officer must certify to the Commission staff in writing that (i) 
KPMG has adopted and has implemented or will implement all recommendations of the 
Independent Consultant, if any; and (ii) the Independent Consultant agrees with KPMG’s adoption 
and implementation of the recommendations.  To the extent that KPMG has not implemented all 
recommendations of the Independent Consultant within 60 days of issuance of the IC Report, 

18 
KPMG’s Chief Executive Officer must certify to the Commission staff in writing, 30 days after 
their implementation, that (i) KPMG has adopted and has implemented all recommendations of the 
Independent Consultant; and (ii) the Independent Consultant agrees that the recommendations have 
been adequately adopted and implemented by KPMG.  The certifications by KPMG’s Chief 
Executive Officer shall provide written evidence of the implementation of the Independent 
Consultant’s recommendations in the form of a narrative, and be supported by exhibits.  The 
Commission staff may request further evidence of the implementation of the Independent 
Consultant’s recommendations, and KPMG agrees to provide such evidence. 
74. Hiring Authority.  The Independent Consultant shall have the authority to employ 
legal counsel, consultants, investigators, experts, and other personnel necessary to assist in the 
proper discharge of the Independent Consultant’s duties. 
75. The Independent Consultant’s compensation and expenses shall be borne 
exclusively by KPMG.  To ensure the independence of the Independent Consultant, KPMG: (i) 
shall not have the authority to terminate the Independent Consultant or substitute another 
independent compliance consultant for the initial Independent Consultant, without the prior written 
approval of the Commission staff; and (ii) shall compensate the Independent Consultant and 
persons engaged to assist the Independent Consultant for services rendered pursuant to this Order 
at their reasonable and customary rates. 
76. KPMG shall require the Independent Consultant to enter into an agreement that 
provides that, for the period of engagement and for a period of two years from completion of the 
engagement, the Independent Consultant shall not enter into any employment, consultant, attorney-
client, auditing or other professional relationship with KPMG, or any of its present or former 
affiliates, directors, officers, employees, or agents acting in their capacity as such.  The agreement 
shall also provide that the Independent Consultant will require that any firm with which he/she is 
affiliated or of which he/she is a member, and any person engaged to assist the Independent 
Consultant in performance of his/her duties under this Order shall not, without prior written 
consent of the Division of Enforcement, enter into any employment, consultant, attorney-client, 
auditing or other professional relationship with KPMG, or any of its present or former affiliates, 
directors, officers, employees, or agents acting in their capacity as such for the period of the 
engagement and for a period of two years after the engagement. 
77. KPMG shall not be in, and shall not have an attorney-client relationship with the 
Independent Consultant and shall not seek to invoke the attorney-client privilege or any other 
doctrine or privilege to prevent the Independent Consultant from transmitting any information, 
reports, or documents to Commission staff. 
78. KPMG shall inform its audit professionals of the terms of the Order within ten 
business days after entry of the Order. 
79. By no later than 15 months after the entry of this Order, unless otherwise extended 
by the Commission staff, KPMG’s Chief Executive Officer shall certify, in writing, compliance 
with the undertakings set forth above.  The certification shall provide written evidence of 
compliance in the form of a narrative, and be supported by exhibits sufficient to demonstrate 

19 
compliance.  The Commission staff may request further evidence of compliance, and KPMG 
agrees to provide such evidence. 
80. Annual Certification.  With respect to calendar years 2020 and 2021, KPMG’s 
Chief Executive Officer shall certify that KPMG has assessed whether KPMG’s Policies and 
Procedures relating to the topics discussed in paragraph 65 are adequate and sufficient to provide 
reasonable assurance of compliance with all professional standards relating to ethics and integrity 
by, among other things, testing the firm’s implementation of KPMG’s Policies and Procedures 
during the twelve (12) months preceding the certification (“Annual Certification”).  The Annual 
Certification shall describe the nature and scope of KPMG’s testing.  The Annual Certification 
shall represent that the Chief Executive Officer has reviewed and evaluated the firm’s assessment 
and testing process and that, based on belief and after reasonable inquiry, the Chief Executive 
Officer believes that KPMG’s Policies and Procedures relating to the topics discussed in paragraph 
65 are adequate and sufficient to provide reasonable assurance of compliance with all professional 
standards relating to ethics and integrity.  If the Chief Executive Officer cannot represent that 
KPMG’s Policies and Procedures are adequate and sufficient, then the Chief Executive Officer 
shall describe in reasonable detail the reasons for the inability to so certify.  The Chief Executive 
Officer shall provide the Annual Certifications to the Commission’s staff within 60 days of the end 
of the annual period.  KPMG shall preserve and retain all documentation regarding the Chief 
Executive Officer’s Annual Certification for seven (7) years and will make it available to the staffs 
of the Commission or the PCAOB upon request. 
81. All reports and certifications mentioned in these undertakings shall be submitted to 
Melissa Hodgman, Associate Director, Division of Enforcement, Securities and Exchange 
Commission, 100 F Street, NE, Washington, DC 20549, or such other person as the Commission 
staff may request, with a copy to the Office of Chief Counsel of the Enforcement Division. 
82. For good cause shown, the Commission staff may extend any of the procedural 
dates relating to the undertakings.  Deadlines for procedural dates shall be counted in calendar 
days, except that if the last day falls on a weekend or federal holiday, the next business day shall be 
considered to be the last day. 
IV. 
 
 In view of the foregoing, the Commission deems it appropriate to impose the sanctions 
agreed to in Respondent KPMG’s Offer. 
 
 Accordingly, it is hereby ORDERED, effective immediately, that: 
 
A. KPMG shall cease and desist from committing or causing any violations and any 
future violations of PCAOB Rule 3500T. 
 
B. KPMG be, and hereby is, censured. 
 
C. KPMG shall comply with the undertakings enumerated in paragraphs 65 through 82 
above. 

20 
 
D. KPMG shall, within 10 days of the entry of this Order, pay a civil money penalty in 
the amount of $50 million to the Securities and Exchange Commission for transfer to the general 
fund of the United States Treasury, subject to Exchange Act Section 21F(g)(3). If timely payment 
is not made, additional interest shall accrue pursuant to 31 U.S.C. § 3717.   
 
E. Payment must be made in one of the following ways:   
 
(1) Respondent may transmit payment electronically to the Commission, 
which will provide detailed ACH transfer/Fedwire instructions upon 
request; 
 
(2) Respondent may make direct payment from a bank account via Pay.gov 
through the SEC website at http://www.sec.gov/about/offices/ofm.htm; or 
 
(3) Respondent may pay by certified check, bank cashier’s check, or United 
States postal money order, made payable to the Securities and Exchange 
Commission and hand-delivered or mailed to: 
 
Enterprise Services Center 
Accounts Receivable Branch 
HQ Bldg., Room 181, AMZ-341 
6500 South MacArthur Boulevard 
Oklahoma City, OK 73169 
 
Payments by check or money order must be accompanied by a cover letter 
identifying KPMG as a Respondent in these proceedings, and the file number of these proceedings; 
a copy of the cover letter and check or money order must be sent to Melissa Hodgman, Division of 
Enforcement, Securities and Exchange Commission, 100 F St., NE, Washington, DC 20549.  
 
F. Amounts ordered to be paid as civil money penalties pursuant to this Order shall be 
treated as penalties paid to the government for all purposes, including all tax purposes.  To 
preserve the deterrent effect of the civil penalty, Respondent agrees that in any Related Investor 
Action, it shall not argue that it is entitled to, nor shall it benefit by, offset or reduction of any 
award of compensatory damages by the amount of any part of Respondent’s payment of a civil 
penalty in this action (“Penalty Offset”).  If the court in any Related Investor Action grants such a 
Penalty Offset, Respondent agrees that it shall, within 30 days after entry of a final order granting 
the Penalty Offset, notify the Commission’s counsel in this action and pay the amount of the 
Penalty Offset to the Securities and Exchange Commission.  Such a payment shall not be deemed 
an additional civil penalty and shall not be deemed to change the amount of the civil penalty 
imposed in this proceeding.  For purposes of this paragraph, a “Related Investor Action” means a  
  

21 
private damages action brought against Respondent by or on behalf of one or more investors based 
on substantially the same facts as alleged in the Order instituted by the Commission in this 
proceeding. 
 
 By the Commission. 
 
 
 
 
 
 
       Vanessa A. Countryman 
       Acting Secretary 

UNITED STATES OF AMERICA 

Before the 

SECURITIES AND EXCHANGE COMMISSION 

 

 

SECURITIES EXCHANGE ACT OF 1934 

Release No. 86118 / June 17, 2019 

 

ACCOUNTING AND AUDITING ENFORCEMENT 

Release No. 4051 / June 17, 2019 

 

ADMINISTRATIVE PROCEEDING 

File No. 3-19203 

 

 

 

In the Matter of 

 

KPMG LLP, 

 

Respondent. 

 

 

 

 

 

ORDER INSTITUTING PUBLIC 

ADMINISTRATIVE AND CEASE-AND- 

 AND- DESIST PROCEEDINGS PURSUANT TO 

SECTIONS 4C AND 21C OF THE 

SECURITIES EXCHANGE ACT OF 1934 

AND RULE 102(e) OF THE 

COMMISSION’S RULES OF PRACTICE, 

MAKING FINDINGS, AND IMPOSING 

REMEDIAL SANCTIONS AND A CEASE-

AND-DESIST ORDER 

   

 

I. 
 

 The Securities and Exchange Commission (“Commission”) deems it appropriate that public 

administrative and cease-and-desist proceedings be, and hereby are, instituted against Respondent 

KPMG LLP (“KPMG”) pursuant to Sections 4C1 and 21C of the Securities Exchange Act of 1934 

(“Exchange Act”) and Rules 102(e)(1)(ii) and 102(e)(1)(iii) of the Commission’s Rules of 

Practice.2 

                                                 
1
 Section 4C provides, in relevant part, that:  

 

The Commission may censure any person, or deny, temporarily or permanently, to any person the 

privilege of appearing or practicing before the Commission in any way, if that person is found . . . (1) 

not to possess the requisite qualifications to represent others; (2) to be lacking in character or integrity, 

or to have engaged in unethical or improper professional conduct; or (3) to have willfully violated, or 

willfully aided and abetted the violation of, any provision of the securities laws or the rules and 

regulations issued thereunder. 

 
2
 Rule 102(e)(1)(ii) provides, in pertinent part, that: 

 



2 

II. 

 

In anticipation of the institution of these proceedings, Respondent has submitted an Offer 

of Settlement (“Offer”) that the Commission has determined to accept.  Respondent admits the 

facts set forth in Section III below, acknowledges that its conduct violated PCAOB Rule 3500T 

and provides a basis for the Commission to impose remedies pursuant to Exchange Act Sections 

4C(a)(2) and (a)(3) and Rules 102(e)(1)(ii) and (iii) of the Commission’s Rules of Practice; admits 

the Commission’s jurisdiction over it and the subject matter of these proceedings; and consents to 

the entry of this Order Instituting Public Administrative and Cease-and-Desist Proceedings 

Pursuant to Sections 4C and 21C of the Securities Exchange Act of 1934 and Rule 102(e) of the 

Commission’s Rules of Practice, Making Findings, and Imposing Remedial Sanctions and a Cease-

and-Desist Order (“Order”), as set forth below. 

 

III. 

 

 On the basis of this Order and Respondent’s Offer, the Commission finds3 that: 

 

SUMMARY 

 

1. This matter involves two separate courses of misconduct that resulted in violations 

of the fundamental requirement that auditors act with integrity.   

2. First, from 2015 to 2017, now-former senior members of KPMG’s Audit Quality 

and Professional Practice group (“AQPP” or “National Office”) – which is responsible for the 

firm’s system of quality control – improperly obtained and used confidential information 

belonging to the Public Company Accounting Oversight Board (“PCAOB” or “Board”) in an effort 

to improve the results of the PCAOB’s annual inspections of KPMG audits.  The information 

obtained included lists of the specific audit engagements the PCAOB planned to inspect, the 

criteria the PCAOB used to select engagements for inspection, and the focus areas of the 

inspections.  The personnel sought the information because the firm had experienced a high rate of 

audit deficiency findings in prior PCAOB inspections and had made improving its inspection 

results a priority.   

                                                                                                                                                             
 

The Commission may . . . deny, temporarily or permanently, the privilege of appearing or practicing 

before it . . . to any person who is found to be lacking in character or integrity or to have engaged in 

unethical or improper professional conduct. 

 

 Rule 102(e)(1)(iii) provides, in pertinent part, that: 

 

The Commission may . . . deny, temporarily or permanently, the privilege of appearing or practicing 

before it . . . to any person who is found…to have willfully violated, or willfully aided and abetted the 

violation of any provision of the Federal securities laws or the rules and regulations thereunder. 

 
3
 The findings herein are made pursuant to Respondent’s Offer of Settlement and are not binding on any 

other person or entity in this or any other proceeding.   

 



3 

3. After obtaining the confidential list of the PCAOB’s planned inspections in 2016, 

the now-former KPMG personnel oversaw a program to review and revise certain audit 

workpapers after the audit reports had been issued to reduce the likelihood that the PCAOB would 

find deficiencies in those audits.  This effort resulted in a substantial improvement to KPMG’s 

2016 inspection results.  In 2017, the now-former KPMG personnel again obtained the list of audit 

engagements that the PCAOB planned to inspect, but the misconduct was discovered by others 

within the firm and reported to KPMG leadership before relevant workpapers could be changed.  

In addition, a now-former KPMG partner attempted to use improperly-obtained confidential 

information relating to the PCAOB’s inspection of another audit firm to win new business for 

KPMG. 

4. Second, before, during, and after the senior National Office professionals used 

confidential PCAOB information, KPMG audit professionals – at all levels of seniority – engaged 

in misconduct in connection with examinations on internally-administered training courses that 

were intended to test whether they understood a variety of accounting principles and other topics of 

importance.     

5. This misconduct took a variety of forms.  KPMG audit professionals shared exam 

answers with one another.  A number of audit partners gave exam answers to other partners, and a 

number also sent answers to and solicited answers from their subordinates.  In addition, for a 

period of time up to November 2015, certain audit professionals made unauthorized changes to 

KPMG’s server instructions that allowed them to manually select the scores necessary to pass the 

tests, which they often lowered to the point of passing exams with less than 25 percent of the 

questions answered correctly.  The exams related to a variety of subjects that were relevant to the 

test-takers’ audit practices, and included additional training required by a 2017 Commission Order 

after the Commission found that KPMG engaged in improper professional conduct and had caused 

a client’s reporting violations.4 

6. After discovering the training-related misconduct, KPMG reported the matter to 

Commission staff and appointed a Special Committee of its Board of Directors to oversee an 

internal investigation.  During that investigation, two now-former partners who had shared exam 

answers deleted relevant documents.  One of those partners and certain other audit professionals 

made misrepresentations to the firm’s investigators.     

7. KPMG is required, both by PCAOB rules and by the Code of Conduct of the 

American Institute of Certified Public Accountants (“AICPA”), to act with integrity in connection 

                                                 
4  In August 2017, KPMG agreed to settle charges it engaged in improper professional conduct with respect 

to the audit of the financial statements of an oil and gas client and caused the company’s reporting violations.  As 

part of the settlement, the Commission ordered KPMG to ensure its audit staff complete specific training programs 

in various areas related to the Commission’s findings in that proceeding.  KPMG LLP and John Riordan, CPA, 

Exchange Act Release No. 81396 (Aug. 15, 2017).  KPMG has required all personnel subject to that training 

undertaking to re-test to ensure full compliance with the Commission’s 2017 Order. 

 



4 

with the professional services it provides its clients.5  Certified public accountants are required to 

“be, among other things, honest and candid within the constraints of client confidentiality.”6  By 

the misconduct described herein, these professionals caused KPMG’s failure to act with the 

integrity required of a public company auditor.7   

8. As indicated above, KPMG’s Board of Directors has formed a Special Committee 

led by an independent board member to oversee an investigation of the misconduct relating to 

training examinations.  The Special Committee has retained an outside law firm to investigate the 

extent of such conduct within the past three years, and will recommend employment actions to 

KPMG management as appropriate.  As set forth in the Undertakings below, KPMG will retain an 

independent consultant to review and assess the Special Committee’s investigation and whether 

the firm has taken appropriate employment actions or other remedial steps, and to ensure the firm 

has designed and implemented quality controls that reasonably assure compliance with all 

professional standards relating to ethics and integrity. 

RESPONDENT 

 

9. KPMG LLP is a Delaware limited liability partnership and PCAOB-registered 

accounting firm.  Headquartered in New York, New York, KPMG is the U.S. member firm of 

KPMG International Cooperative, a Swiss entity. 

OTHER RELEVANT PERSONS 

 

10. David Middendorf, 54, of Marietta, Georgia, was KPMG’s National Managing 

Partner for AQPP until March 2017, and was separated from the firm the following month.  

Middendorf is licensed as a CPA in Georgia, New York, and Ohio and was previously licensed in 

Texas.  The Commission has charged Middendorf for his role in the misconduct described in this 

Order. 

11. Thomas Whittle, 55, of Gladstone, New Jersey, was KPMG’s National Partner-In-

Charge for Quality Measurement until March 2017, and was separated from the firm the following 

month.  Whittle is licensed as a CPA in New York and New Jersey and was previously licensed in 

                                                 
5  PCAOB Rule 3500T requires KPMG to maintain integrity when performing any professional service in 

connection with the preparation or issuance of any audit report.  As an AICPA member, KPMG was required to 

comply with the AICPA’s Code of Professional Conduct, which requires the firm to maintain integrity in connection 

with all professional services.  The AICPA also prohibits members from committing acts “discreditable to the 

profession.”  See AICPA Code of Conduct 1.400.001 (“Acts Discreditable Rule”).   

 
6 See “Principles of Professional Conduct,” ET Section 54 (available at 

https://www.aicpa.org/Research/Standards/CodeofConduct/DownloadableDocuments/2011June1CodeOfProfessiona

lConduct.pdf).  Codified as AICPA Code 0.300.040. 

 
7  KPMG’s conduct also failed to conform to the requirements of PCAOB Quality Control Standards (“QC”) 

requiring registered firms to “have a system of quality control for its accounting and auditing practice” that provides 

“reasonable assurance that (a) personnel . . . perform all professional responsibilities with integrity.”  QC 20.01 and 

20.09. 

https://www.aicpa.org/Research/Standards/CodeofConduct/DownloadableDocuments/2011June1CodeOfProfessionalConduct.pdf
https://www.aicpa.org/Research/Standards/CodeofConduct/DownloadableDocuments/2011June1CodeOfProfessionalConduct.pdf


5 

Pennsylvania and Connecticut.  The Commission has charged Whittle for his role in the 

misconduct described in this Order. 

12. David Britt, 55, of New Canaan, Connecticut, was a Partner in KPMG’s 

Department of Professional Practice within AQPP, in which he was the Banking and Capital 

Markets Group Co-Leader until March 2017, and was separated from the firm the following 

month.  Britt is licensed as a CPA in New York and California and was previously licensed in the 

District of Columbia.  The Commission has charged Britt for his role in the misconduct described 

in this Order. 

 

13. Brian Sweet, 41, of Fresno, California, was a Partner in KPMG’s Department of 

Professional Practice-Inspections group until March 2017.  He was separated from the firm at the 

end of March 2017.  Prior to joining KPMG, Sweet was an Associate Director in the PCAOB’s 

inspections group from March 2014 until April 2015.  Sweet was previously licensed as a CPA in 

New York, Illinois, and California.  The Commission has charged Sweet for his role in the 

misconduct described in this Order. 

14. Cynthia Holder, 52, of Houston, Texas was an Executive Director in KPMG’s 

Department of Professional Practice-Inspections group from August 2015 until April 2017, and 

was separated from the firm the following month.  Prior to joining KPMG, Holder was an 

Inspections Leader at the PCAOB from December 2011 until August 2015.  Holder was previously 

licensed as a CPA in Texas and New Jersey.  The Commission has charged Holder for her role in 

the misconduct described in this Order. 

15. Jeffrey Wada, 43, of Tustin, California was an Inspections Leader at the PCAOB 

from February 2012 until February 2017.  Wada is no longer at the PCAOB.  Wada is licensed as a 

CPA in California.  The Commission has charged Wada for his role in the misconduct described in 

this Order.   

FACTS 

 

I. THE MISAPPROPRIATION OF CONFIDENTIAL PCAOB INFORMATION 

 

A. The PCAOB’s Inspections Process and KPMG’s Efforts to Improve Its Results 

 

16. The PCAOB was created as part of the Sarbanes-Oxley Act of 2002 to oversee the 

audits of public companies that are subject to the federal securities laws in order to protect the 

interests of investors and further the public interest in the preparation of informative, accurate, and 

independent audit reports. 

17. One of the essential ways in which the PCAOB fulfills this mission is by inspecting 

audits of public companies conducted by registered public accounting firms.  Through these 

inspections, the PCAOB assesses the audit firms’ compliance with the statutes, regulations, and 

professional standards governing the accounting profession.  The PCAOB typically selects the 

audit engagements it will inspect based on confidential internal analyses and thereafter notifies 

firms of which audits it will inspect.  The PCAOB typically issues inspection reports, only parts of 



6 

which are made public, after all the inspections for a firm in a given cycle are complete.  To ensure 

the integrity of the inspection process, the PCAOB closely guards the confidentiality of both its 

inspection targets prior to firm notification and its methodology for selecting those targets.   

18. In September 2014, the PCAOB issued a report regarding its 2013 inspections of 

KPMG audits.  The report found that out of 50 audits the PCAOB inspected, 23 had deficiencies.  

This 46 percent deficiency rate reflected a significant decline from KPMG’s 34 percent deficiency 

rate the previous year.  David Middendorf, who then oversaw the National Office’s audit quality 

and professional practice work understood then that the Commission’s Office of the Chief 

Accountant had been highly critical of KPMG’s worsening inspection results.    

B. The Use of Confidential PCAOB Information Misappropriated by Sweet 

 

19. As part of its efforts to improve its PCAOB inspection results, KPMG hired Brian 

Sweet, an Associate Director at the PCAOB who had worked on the team inspecting KPMG 

audits.  Sweet joined KPMG as a partner in the group within the firm’s National Office responsible 

for PCAOB inspections.  Sweet reported to Thomas Whittle, who was then the KPMG partner 

responsible for overseeing the PCAOB’s inspections of the firm.  Whittle, in turn, reported to 

Middendorf. 

20. In April 2015, shortly before leaving the PCAOB, Sweet copied from an internal 

database to his office computer various confidential inspection-related materials he believed might 

be of use to him when he joined KPMG.  On his final day at the PCAOB, Sweet transferred these 

materials, along with the other files on his PCAOB computer, to a personal hard drive that he took 

with him.  Sweet also took from the PCAOB hard copy documents and retained other confidential 

PCAOB documents he had previously brought home.   

21. The documents Sweet improperly took included PCAOB inspection planning 

information, inspection guides and manuals, and drafts of confidential inspection comment forms.  

The planning materials included the confidential list of KPMG audit engagements the PCAOB 

intended to inspect in 2015, the focus areas for each inspection, and a list of all the quantitative and 

qualitative criteria the Board used in deciding which KPMG audit engagements to inspect.   

22. Upon joining KPMG in May 2015, Sweet transferred the PCAOB documents from 

his personal hard drive to his computer at the firm.    

The Use of the PCAOB’s Confidential List of 2015 Inspections 

 

23. On his first day at the firm in May 2015, Sweet had lunch with Middendorf and 

other partners in KPMG’s National Office, including David Britt, who was then a Partner in the 

National Office’s Department of Professional Practice and co-leader of KPMG’s Banking and 

Capital Markets Group.  Over lunch, Sweet’s new colleagues asked him various questions about 

the PCAOB’s inspections of KPMG.  Sweet testified that one of the questions Middendorf asked 

Sweet was whether the PCAOB intended to inspect a specific KPMG banking client that year.  

Without answering directly, Sweet indicated the PCAOB planned to do so.  Sweet testified that 

Middendorf told him the next day that Sweet needed “to share insight and add value and be fully 



7 

open when it came to that type of information,” and to “remember where [your] paycheck came 

from” and that Sweet had to be “completely loyal to KPMG and KPMG only.” 

24. Several days later, at Middendorf’s direction, Whittle asked Sweet to provide him 

the list of the PCAOB’s planned inspections for 2015.8  Sweet testified that he showed Whittle a 

hard copy of a PCAOB inspection planning document listing the KPMG banking and financial 

service audits the PCAOB intended to inspect that year. 

25. The next day, Whittle emailed Sweet, asking him to have an assistant “scan and 

send me the banking selection list,” i.e. KPMG’s bank holding company clients the PCAOB had 

selected for inspection.  Sweet complied by sending Whittle the complete list of planned 

inspections and asked Whittle to exercise discretion given the nature of the information.  Whittle 

forwarded this information to Middendorf the same day, writing, “The complete list.  Obviously, 

very sensitive.  We will not be broadcasting this.”  

26. Though Whittle immediately assigned Sweet to review the workpapers of one of 

the inspection targets, it does not appear that any workpapers were changed in response to Sweet 

providing the 2015 inspection list.  At the time Sweet provided this information to Middendorf and 

Whittle, KPMG had, pursuant to its policy, already locked the audit workpapers for all but two of 

the engagements from editing absent special circumstances.   

27. Whittle also instructed Sweet to speak to certain engagement partners responsible 

for audits on the 2015 list to explain the reasons for their selection.  By learning why they were 

selected, engagement partners could better tailor their responses to questions from PCAOB 

inspectors to mitigate concerns.  Middendorf and Whittle also assigned Sweet to one of the firm’s 

large audit engagements on the 2015 list to help prepare for the inspection.  Internal training 

materials KPMG created for audit staff undergoing PCAOB inspection stressed the importance of 

replying to inspectors’ questions – especially during the critical first meeting with PCAOB staff – 

with the “best first answer.”  KPMG’s National Office believed the audit staff’s ability to respond 

effectively to inspectors’ questions had a significant impact on whether the PCAOB would find 

deficiencies in the audit. 

28. In June 2015, Sweet identified for Britt a number of KPMG banking clients the 

PCAOB planned to inspect in 2015.  The next day, Britt asked Sweet to review his notes so he 

could give Britt the “last 3 Bank names.”  Sweet shared this information later that day, asking Britt 

to note its sensitivity and “use your discretion with this info.” 

The Use of the PCAOB’s Confidential Process for Selecting Audits to Inspect 

 

29. In April 2015, KPMG engaged an outside consultant to help it predict which audit 

engagements the PCAOB would inspect in 2016.  Sweet recalls that in June 2015 Middendorf and 

Whittle directed Sweet to share with the outside consultant everything he knew about how the 

                                                 
8 By that time, the PCAOB had informed KPMG of less than half of the audit engagements it intended to 

inspect in 2015.   

 



8 

PCAOB selected audits to inspect, including the confidential information Sweet had taken.  Sweet 

understood this to be an instruction to give the consultant all of the information he took from the 

PCAOB. 

30. Sweet complied with Middendorf and Whittle’s directive by providing information 

about the Board’s selection criteria to a Director in KPMG’s National Office, who then gave that 

information to the consultant.  In September 2015, Sweet spoke directly with the consultant and 

gave the consultant additional confidential information regarding the inspections selection process, 

including how the PCAOB’s Inspections group used confidential information received from others 

at the Board and the Commission.  At the end of September, Sweet reported to Middendorf and 

Whittle that he had “spent quite a bit of time with [the outside consultant] trying to guide their 

modeling efforts.” 

The Use of Confidential PCAOB Information Regarding Another Audit Firm 

 

31. Sweet also provided confidential PCAOB information to an audit partner (who is 

no longer at KPMG) who was preparing a client pitch for a Spanish bank’s audit business.  

Securing this audit business was a high priority for KPMG.   

32. In April 2016, Sweet sent the audit partner confidential PCAOB comment forms 

related to the Board’s inspection of another Spanish bank’s audit, writing that he had attached 

“some examples of the types of issues that have been raised in the past.  I hope this helps!”  The 

comment forms discuss specific ways in which that bank’s auditor had failed to adequately test the 

valuation of its Allowance for Loan and Lease Losses. 

C. The Solicitation of Confidential PCAOB Information from Holder 

 

33. Before he left the PCAOB, Sweet had discussed with Cynthia Holder, a friend who 

was then a PCAOB Inspections Leader, the prospect of her joining him at KPMG.  On Sweet’s 

first day at KPMG (May 4, 2015), he informed Holder that he would be meeting with Whittle to 

push the firm to hire her.  On May 11, 2015, Sweet told Holder he was going to hand-deliver her 

resume to Whittle and “make a sell again” in person. 

34. On May 12, 2015, Sweet asked Holder to send him a confidential PCAOB 

document reflecting comments he had written about KPMG’s audits while he was at the Board.  At 

that time, KPMG personnel were preparing for a meeting with the PCAOB to discuss the firm’s 

performance on its audits, during which KPMG would make a presentation on the root causes of 

audit deficiencies.  Sweet asked Holder for a document he had written while he was at the PCAOB 

so he could review it before helping his KPMG colleagues with that presentation.  That day, 

Holder sent Sweet the confidential document he requested.   

35. On June 17, 2015, Holder again shared confidential PCAOB information with 

Sweet, telling him that the Board had decided to cancel its planned inspection of a KPMG audit 

client for 2015, and that the Board did not intend to replace it with another selection.  Sweet 

immediately relayed this information to Whittle.   



9 

36. KPMG sent Holder an employment offer in July 2015.  She joined the firm the 

following month as an Executive Director in KPMG’s National Office, performing internal 

inspections and advising banking engagement teams on their audits.   

D. The Use of Confidential PCAOB Information Obtained from Wada in 2016 

 

37. In early March 2016, Jeffrey Wada, an Inspections Leader at the PCAOB who had 

previously performed work on KPMG inspections but was then assigned to inspect another audit 

firm, learned that he had not been selected for a promotion.  Wada reacted angrily, telling a 

colleague the PCAOB had “screwed” him by passing him over.     

38. On March 28, 2016, Wada, who remained friends with Holder after she left the 

PCAOB, called her and read to her the names of thirteen KPMG clients the Board planned to 

inspect.9  Holder provided this information to Sweet, who then immediately relayed the list to 

Middendorf, Whittle, and Britt, informing them that it had come from a former colleague at the 

PCAOB.    

39. Wada sent the list of the PCAOB’s planned inspections at a critical time.  In early 

February 2016, Middendorf and other members of KPMG’s leadership team had met with staff 

from the Commission’s Office of the Chief Accountant.  During that meeting, Commission 

personnel expressed significant concerns about the firm’s audit quality and questioned whether 

KPMG was adequately addressing these issues.  Middendorf told Whittle, Sweet, and Britt they 

should use the list of inspection targets Wada had sent to protect KPMG from further criticism by 

its regulators. 

40. Middendorf, Whittle, Britt, and Sweet believed they could use Wada’s list in this 

way because they had learned of the audits that would be inspected at a time when firm personnel 

were still able to access and revise audit workpapers.  Though KPMG had already issued audit 

reports for each of these engagements, it was within the 45-day period in which professional audit 

standards and firm policy allowed audit teams to complete the administrative process of 

assembling final audit files.10  At the end of this 45-day period, KPMG locked audit workpapers 

from editing absent special circumstances.11 

                                                 
9 Of the 13 clients, 11 were bank holding or other financial services companies and 2 were other issuers that 

Wada appears to have thought were also bank holding or other financial services companies.  It appears that Wada 

identified these engagements for Holder because her responsibilities at KPMG included advising banking 

engagement teams. 

 
10  See Auditing Standard No. 3, Audit Documentation, paragraph 15. “Prior to the report release date, the 

auditor must have completed all necessary auditing procedures and obtained sufficient evidence to support the 

representations in the auditor’s report.  A complete and final set of audit documentation should be assembled for 

retention as of a date not more than 45 days after the report release date (documentation completion date).”  

References to PCAOB standards are to those that were in effect at the time of the relevant conduct. 
 
11 KPMG has since revised its audit documentation policies, requiring electronic workpapers to be assembled 

and locked within two business days of issuance of the report. 

 



10 

41. Recognizing that the workpapers had not yet been locked per KPMG’s policy, 

Middendorf, Whittle, and Britt agreed to have Sweet and others conduct an additional review of 

the audit workpapers for the seven banks on the list Wada had provided that were part of a key 

monitoring program run by the National Office to determine whether anything could be done to 

minimize the risk of receiving inspection comments from the PCAOB.12  Middendorf and Whittle 

instructed that no one in the briefing should disclose that they had obtained confidential PCAOB 

information. 

42. To conceal the true purpose of their efforts, Britt falsely told others at KPMG that 

they were performing work in the ordinary course of business on all 35 banking engagements in 

the ALLL monitoring program.  On March 28, 2016, Britt sent the engagement partners for these 

audits an email stating that, “[a]s part of our wrap up and reporting of the results of the ALLL 

monitoring program we need to gather some additional information” from the audit workpapers.13 

43. Over the next few weeks, Sweet, Holder, and various partners and managing 

directors in the National Office engaged in a review of the audit workpapers of the seven banks in 

the monitoring program that were on the list Wada provided.  The National Office professionals 

suggested edits and proposed revisions to the engagement teams, which then decided what 

revisions to incorporate into the final audit workpapers.14   

44. In contrast to prior years, KPMG’s 2016 inspection results did not include any 

comments related to the general Allowance for Loan and Lease Losses – an area where KPMG had 

historically received criticism related to financial services audits.  The PCAOB did not publish the 

results because KPMG reported the misconduct to the PCAOB before the PCAOB issued the 2016 

report.  However, the PCAOB had designated two of the bank audits in the ALLL monitoring 

program whose workpapers Sweet had reviewed as “positive quality events,” which meant they 

were so successful the PCAOB wanted to understand the factors driving the audit’s quality.  

Indeed, the level of improvement in the inspection results led Whittle to be concerned that if 

                                                                                                                                                             

 
12  As the PCAOB found an increasing number of audit deficiencies by KPMG beginning in 2013, KPMG’s 

National Office implemented “monitoring programs” that worked with audit engagement teams and reviewed 

workpapers to improve compliance with professional standards.  One of these programs focused on the audits of 

certain banking clients’ Allowance for Loan and Lease Losses.  KPMG further developed this monitoring program 

in 2015 in response to numerous deficiencies the PCAOB had identified in this area.  The success of this program 

was especially important to KPMG because the firm had promoted it as proof of the seriousness with which the firm 

was working to improve its audit quality. 

 
13  Britt also asked a subordinate who previously had been in the Department of Professional Practice and was 

then assigned to an audit engagement on the list to conduct his own “stealth” review of workpapers for one KPMG 

audit client.   

 
14  Middendorf, Whittle, Sweet, and Britt had agreed that Sweet would lead a team of National Office 

professionals to review the workpapers of the banks in the monitoring program, and that Middendorf, Whittle, and 

Britt would handle the other issuers on the list they received from Wada.   

 



11 

KPMG could not obtain confidential PCAOB information for the next inspection cycle, there could 

be a return of audit deficiencies that would be difficult to explain.    

45. After the misconduct was discovered, the PCAOB conducted inspections of ten 

additional banks for the 2016 inspection cycle to replace the ones for which improper advance 

notice had been obtained.  The PCAOB found that six of these audits had deficiencies with respect 

to auditing the ALLL. 

E. The Use of Confidential PCAOB Information Obtained from Wada in 2017 

 

46. In early January 2017, Wada provided Holder a “preliminary” list of PCAOB 

inspection targets for 2017.  On January 9, Holder relayed the names of the clients on the list to 

Sweet, and together, they briefed Whittle.  That night, Sweet, Whittle, and Britt discussed this 

information.  After that meeting, Sweet contacted the engagement partners for two of the audits on 

the January 2017 list to warn them about the potential inspections.  Whittle also discussed the 

January 2017 list with Middendorf.  As a result of that discussion, Middendorf and Whittle 

assigned additional National Office resources to assist with two of the active audits on that list.15 

47. In early February 2017, Wada conveyed to Holder a list of 47 ticker symbols that 

Holder understood to be the final list of KPMG audits the PCAOB would inspect that year.  Wada 

also provided Holder the inspection focus areas for the banks on the list (as well as for another 

KPMG engagement), and the PCAOB’s list of KPMG engagement partners with “poor 

performance evaluations.”   

48. Holder relayed the information to Sweet, who then shared it with Middendorf, 

Whittle, and Britt.  Though Sweet questioned what to do with that information, Middendorf 

replied, “this is information that’s too good not to use.”  Unlike the prior lists of PCAOB 

inspection targets, the audits on the February 2017 list were ongoing, thus providing substantially 

greater ability to improve the audit workpapers.   

49. Whittle instructed Sweet to warn certain engagement partners about the impending 

inspections.  Though Whittle had warned Sweet to be circumspect in how he communicated this to 

KPMG colleagues, Sweet’s notice to one KPMG engagement partner caused her to suspect that the 

firm may have received confidential PCAOB information.  These concerns were subsequently 

reported to the firm’s management, which then reported the matter to the PCAOB, and KPMG 

began an investigation. 

II. AUDIT PROFESSIONALS IMPROPERLY SHARED TRAINING EXAM ANSWERS 

 

A. Professional Education Requirements for KPMG Auditor Personnel  

 

                                                 
15  Middendorf was the Engagement Quality Review partner on one of those audits.  In this role, he was 

responsible for evaluating the significant judgments and related conclusions the audit team made in reaching the 

overall conclusion reflected in the audit report.   

 



12 

50. As accountants licensed by state accountancy boards, many KPMG audit 

professionals are required to complete a minimum number of continuing professional education 

(“CPE”) courses periodically – typically 120 hours every three years.  KPMG requires its audit 

professionals to complete additional training in excess of state requirements.  These training 

requirements vary by position, role, and industry, and are designed by the firm to be relevant to the 

audit work its professionals are performing.  

51. In addition to state accountancy boards’ and KPMG’s own continuing education 

requirements, the Commission ordered KPMG audit professionals to complete a minimum of 12 

hours of training in specific audit areas as part of an August 2017 settlement of charges that KPMG 

failed to properly audit the financial statements of an oil and gas client.16  

52. To help its audit professionals satisfy these requirements, KPMG administers its 

own set of online training programs that also qualify for CPE credit.  KPMG requires its auditors to 

pass an examination at the conclusion of each online training program.  Audit professionals are 

given three opportunities to pass each examination.  If one of KPMG’s audit professionals is 

unable to pass after two attempts, their Performance Management Leader is notified.  If they are 

unable to pass after three attempts, the consequences are more significant:  they are required to re-

take the training; they are prohibited from conducting audit work until they pass the exam; and 

others at the firm may be notified.  Audit professionals also understood that failing to pass an exam 

could lead to their compensation being reduced. 

B. KPMG Audit Professionals Shared Answers to Training Exams  

 

53. On numerous occasions, KPMG audit professionals who had passed training exams 

sent their answers to colleagues to help them pass those exams.  They sent colleagues images of 

their answers primarily by email or printed their answers and gave them to their colleagues.  This 

conduct was committed by audit professionals at all levels of seniority, including lead audit 

engagement partners who were responsible for compliance with PCAOB standards in auditing 

their clients’ financial statements.  A number of lead audit engagement partners not only sent exam 

answers to other partners, but also solicited answers from and sent answers to their subordinates.17 

54. Upon learning of the potential cheating, KPMG leadership alerted the Commission 

staff and began an internal investigation.  Soon after, the firm’s Board of Directors formed a 

Special Committee led by an independent board member to oversee an independent investigation 

of this conduct.  The Special Committee hired an outside law firm to conduct this review.  The 

investigation has revealed extensive sharing of exam answers, with the bulk of this misconduct 

occurring among junior personnel.  While many of those who shared and/or received exam 

answers engaged in misconduct only once, others sent or received answers to multiple exams.  

                                                 
16  KPMG LLP and John Riordan, CPA, Exchange Act Release No. 81396 (Aug. 15, 2017). 

 
17  As KPMG itself has recognized, “[t]hose who manage others act as role models.”  KPMG Transparency 

Report (January 2019), available at https://audit.kpmg.us/content/dam/audit/pdfs/2018/2018-transparency-

report1.pdf.  

 

https://audit.kpmg.us/content/dam/audit/pdfs/2018/2018-transparency-report1.pdf
https://audit.kpmg.us/content/dam/audit/pdfs/2018/2018-transparency-report1.pdf


13 

Prior to the firm’s investigation, no one reported the improper sharing of exam answers to the 

firm’s Ethics and Compliance Hotline.  The firm has been taking disciplinary action against certain 

partners and other audit professionals in connection with its investigation.   

55. After KPMG began to investigate the misconduct, certain now-former audit 

professionals, including a few lead audit engagement partners, attempted to conceal what they had 

done.  For example, in September 2018, one engagement partner who is no longer with KPMG 

(“Former Partner 1”) solicited from a junior partner answers to the exam for a training program 

relating to leases.  The now-former junior partner sent Former Partner 1 the answers from his exam 

by text message.  After receiving a document preservation notice from the firm, Former Partner 1 

deleted the text messages the junior partner sent him, and encouraged his colleague to do the same.  

Former Partner 1 also encouraged the junior partner to say, falsely, that the texts were deleted by 

accident.  When Former Partner 1 was asked in a written questionnaire in December 2018 whether 

he had received any answers to KPMG training exams, he answered “no.”   

56. In another example, a lead audit engagement partner who is no longer with the firm 

(“Former Partner 2”) also answered “no” to the December 2018 questionnaire that asked whether 

he had sent or received answers to KPMG training programs.  In fact, Former Partner 2 had 

received answers to training exams on seven occasions and sent answers to training exams on three 

occasions – all within eight months of completing the survey, and all with junior members of his 

engagement team. 

C. KPMG Audit Professionals Manipulated the Scoring of Training Exams  

57. In addition to sharing answers to training examinations, certain audit professionals 

also manually changed the scores required to pass certain exams.  Prior to November 2015, KPMG 

hosted exams to training programs on an internal server with software provided by a third party.  

KPMG sent participants in training programs a hyperlink that directed them to the applicable 

exams.  Embedded in the hyperlink was an instruction to the server that specified the score 

necessary to pass the exam.  Thus, the characters “MasteryScore=70” meant participants were 

required to answer at least 70 percent of the answers accurately to pass the exam.18  By changing 

the number in the hyperlink, audit professionals could change the score required to pass. 

58. For a period of time up to November 2015, certain audit professionals, including 

one partner, altered the URLs for their exams to lower the scores required to pass.  Twenty-eight of 

these auditors did so on four or more occasions.  Certain audit professionals lowered the required 

score to the point of passing exams while answering less than 25 percent of the questions correctly. 

VIOLATIONS 

 

59. As a result of the conduct of personnel described above, KPMG willfully violated 

PCAOB Rule 3500T, which requires KPMG and associated persons to comply with ethics 

standards, including to maintain integrity, as described in the AICPA’s Code of Professional 

                                                 
18  Some exams required a higher score to pass, while others allowed a lower score. 

 



14 

Conduct when performing any professional service in connection with the preparation or issuance 

of any audit report,19 within the meaning of Section 4C(a)(3) of the Exchange Act and Rule 

102(e)(1)(iii) of the Commission’s Rules of Practice. 

60. The AICPA Code of Conduct requires that a member not commit any act 

discreditable to the profession.  AICPA Code of Conduct 1.400.001.  As a result of the conduct of 

personnel described above, KPMG failed to comply with AICPA Code of Conduct 1.400.001 

within the meaning of Section 4C(a)(2) of the Exchange Act and Rule 102(e)(1)(ii) of the 

Commission’s Rules of Practice. 

61. PCAOB Quality Control Standards require that a registered firm “shall have a 

system of quality control for its accounting and auditing practice.”  QC 20.01.  Those quality 

control standards require further that firms should establish policies and procedures to provide 

“reasonable assurance that (a) personnel ... perform all professional responsibilities with integrity.”  

QC 20.09.  As a result of the conduct described above, KPMG failed to comply with QC 20 within 

the meaning of Section 4C(a)(2) of the Exchange Act and Rule 102(e)(1)(ii) of the Commission’s 

Rules of Practice. 

FINDINGS 
 

62. Based on the foregoing, the Commission finds that KPMG willfully violated 

PCAOB Rule 3500T within the meaning of Section 4C(a)(3) of the Exchange Act and Rule 

102(e)(1)(iii) of the Commission’s Rules of Practice. 

63. Based on the foregoing, the Commission finds that KPMG engaged in conduct that 

provides a basis to impose remedies against the firm pursuant to Section 4C(a)(2) of the Exchange 

Act and Rule 102(e)(1)(ii) of the Commission’s Rules of Practice. 

 

COOPERATION AND REMEDIAL EFFORTS 

 

64. In determining to accept KPMG’s Offer, the Commission considered that KPMG 

reported these matters to the Commission and/or to the PCAOB, initiated an investigation of the 

testing matter under the oversight of a Special Committee of the Board of Directors, has 

cooperated with the Commission staff, and has undertaken various remedial measures, including:  

revising its audit documentation policies to require that electronic workpapers be assembled and 

locked within two business days of issuance of the report notwithstanding the 45-day period 

allowed under professional auditing standards; retaining an advisory firm to conduct an 

                                                 
19

  The rule requires auditors to comply with the AICPA’s Code of Professional Conduct Rule 102, and 

interpretations and rulings thereunder, as in existence on April 16, 2003.  Although PCAOB Rule 3500T references 

the AICPA Code as in existence on April 16, 2003, the definition of integrity remains identical to the current 

definitions in the Code of Professional Conduct promulgated by the AICPA and applicable to current members of 

the AICPA. 

 



15 

independent cultural assessment; and retaining a learning and development consultant to conduct a 

current state assessment.  

UNDERTAKINGS 

 

 KPMG has undertaken to complete the following actions: 

 

65. KPMG’s Review.  Within 120 days after the entry of this Order, KPMG shall 

evaluate (“KPMG’s Review”) the sufficiency and adequacy of its quality controls relevant to ethics 

and integrity (hereinafter referred to as KPMG’s “Policies and Procedures”) to determine whether 

they are designed and implemented in a manner that provides reasonable assurance of compliance 

with all professional standards relating to ethics and integrity.  KPMG’s evaluation shall include 

assessing: 

a. the adequacy and sufficiency of ethics and integrity training and guidance, 

including regarding anti-retaliation and whistleblowing;   

b. whether KPMG’s culture is supportive of ethical and compliant conduct, 

including strong, explicit, and visible support and commitment by the firm’s management and 

Board of Directors; and 

c. whether KPMG deploys proper resources and oversight for compliance 

with ethics and integrity requirements, including seniority of executives and managers responsible 

for implementation and oversight of these responsibilities, reporting lines, autonomy and 

independence, compensation and rewards, consistent discipline, access to information and 

personnel. 

66. KPMG Report to the Commission.  Within 60 days of completing KPMG’s 

Review, KPMG shall deliver to the Commission staff a detailed written report (“KPMG Report to 

the Commission”) summarizing its review and any changes it has made to KPMG’s Policies and 

Procedures relating to the subjects described in paragraph 65.  The KPMG Report to the 

Commission shall provide written evidence of how the Policies and Procedures, including any 

changes, are designed and implemented in a manner that provides reasonable assurance of 

compliance with all professional standards relating to ethics and integrity in the form of a narrative 

and be supported by exhibits.  The Commission staff may request further evidence of how the 

Policies and Procedures provide such assurance, and KPMG agrees to provide such evidence. 

The KPMG Report to the Commission shall set forth the results of its assessment of the adequacy 

and sufficiency of its ethics and integrity training, including a description of the training.  The 

KPMG Report to the Commission should also include a description of any training courses added 

or modified as a result of the assessment conducted under this paragraph. 

 

67. KPMG’s Special Committee Review.  Within 360 days after the entry of this Order, 

a committee composed of independent members of KPMG’s Board of Directors and non-Audit 

Partners (the “Special Committee”) shall complete the steps reasonably necessary to identify, and 

to determine the extent to which, audit professionals violated ethics and integrity requirements in 



16 

connection with training examinations within the past three years (“Special Committee 

Investigation”), and to recommend any employment actions or other remedial steps to KPMG 

management that the Special Committee deems appropriate. 

68. Special Committee Report of Investigation.  Within 60 days of completing the 

Special Committee Investigation, the Special Committee shall deliver to KPMG’s Board of 

Directors and Chief Executive Officer a detailed report (“Special Committee Report of 

Investigation”) summarizing the investigative steps it has taken and any employment actions or 

other remedial steps it recommends be taken. 

69. Independent Consultant Review.  KPMG shall retain, within 60 days after the 

entry of this Order, an independent consultant (“Independent Consultant”), not unacceptable to 

the Commission staff.  The Independent Consultant shall have, at a minimum, the following 

qualifications:  (i) demonstrated expertise conducting ethics and integrity investigations; and (ii) 

experience designing or reviewing compliance policies, procedures, and controls relating to 

ethics and integrity.  KPMG shall provide to the Commission staff a copy of the engagement 

letter detailing the scope of the Independent Consultant’s responsibilities.  KPMG shall deliver to 

the Independent Consultant the KPMG Report to the Commission at the same time as KPMG 

provides such report to the Commission staff as specified in paragraph 66.  The Special 

Committee shall deliver to the Independent Consultant the Special Committee Report of 

Investigation at the same time as it provides such report to KPMG’s Board of Directors and 

Chief Executive Officer as specified in paragraph 68.  KPMG shall require that the Independent 

Consultant: 

a. perform a review (the “IC Review of Quality Controls”) of KPMG’s 

Policies and Procedures to determine whether they are designed and being implemented in a 

manner that provides reasonable assurance of compliance with all professional standards relating 

to ethics and integrity, including whether the firm’s ethics and integrity training and guidance is 

adequate and sufficient; the culture is supportive of ethical and compliant conduct, and KPMG is 

deploying proper resources and oversight for compliance with ethics and integrity requirements; 

and 

 

b. review and assess (the “IC Review of Investigation”) the Special 

Committee Investigation and whether KPMG (i) has taken reasonable steps to identify, and to 

determine the extent to which, those audit professionals who engaged in improper exam sharing 

within the past three years, and (ii) has followed the Special Committee’s recommended 

employment actions or other remedial steps.   

 

KPMG shall cooperate fully with the Independent Consultant and shall provide reasonable access 

to information and records as the Independent Consultant may reasonably request, subject to 

KPMG’s right to withhold from disclosure any information or records protected by any applicable 

protection or privilege such as the attorney-client privilege or the attorney work product doctrine.  

The Independent Consultant shall have the right to interview any partner, employee, agent, or 

consultant of KPMG concerning any matter within or relating to the IC Review of Quality Controls 

or the IC Review of Investigation. 

 



17 

70. Reports of IC Reviews.  After the IC Review of Quality Controls and the IC 

Review of Investigation are completed, but no later than 90 days after receiving the KPMG Report 

to the Commission and the Special Committee Report of Investigation, the Independent Consultant 

shall issue a detailed written report (the “IC Report”) to KPMG: (i) summarizing its work; (ii) 

making recommendations, as the Independent Consultant deems appropriate, reasonably designed 

to ensure that KPMG’s Policies and Procedures relating to the topics discussed in paragraph 65 are 

adequate and sufficient to provide reasonable assurance of compliance with all relevant 

professional standards relating to ethics and integrity; (iii) describing its review of KPMG’s 

training and making additional recommendations, as the Independent Consultant deems 

appropriate, regarding ethics and integrity training; (iv) making recommendations, as the 

Independent Consultant deems appropriate, reasonably designed to ensure that the Special 

Committee Investigation has taken reasonable steps to identify, and to determine the extent to 

which, audit professionals who engaged in improper exam sharing within the past three years, 

including recommending additional investigative steps for the Special Committee to take; and (v) 

making recommendations, where appropriate, reasonably designed to ensure that KPMG has taken 

appropriate employment actions or other remedial steps in light of the findings of the Special 

Committee Investigation.  KPMG shall require the Independent Consultant to provide a copy of the 

IC Report to the Commission staff and the PCAOB staff when the IC Report is issued. 

71. KPMG shall adopt, as soon as practicable, all recommendations of the Independent 

Consultant in the IC Report.  Provided, however, that within 30 days of issuance of the IC Report, 

KPMG may advise the Independent Consultant in writing of any recommendation that it considers 

to be unnecessary, unjust, outside the scope of this Order, unduly burdensome, or impractical.  

KPMG need not adopt any such recommendation at that time, but instead may propose in writing 

to the Independent Consultant an alternative approach designed to achieve the same objective or 

purpose.  If KPMG’s written proposal relates to an alternative policy, procedure, or investigative 

step, it will submit its proposal to the Commission staff at the same time.  KPMG and the 

Independent Consultant shall engage in good-faith negotiations in an effort to reach agreement on 

any recommendations objected to by KPMG.  In the event that the Independent Consultant and 

KPMG are unable to agree on an alternative proposal within 60 days of the issuance of the IC 

Report, KPMG shall abide by the determinations of the Independent Consultant. 

72. Ethics and Integrity Training.  For the period immediately following the completion 

of KPMG’s assessment of the adequacy and sufficiency of its ethics training and guidance as 

specified in paragraph 65, and ending no earlier than 36 months after submission of the final CEO 

certification required by paragraph 73, all audit professionals are required to complete a minimum 

of 12 hours of ethics and integrity training each year, with a minimum 3 hours of such training 

occurring every 3 months. 

73. Certification by Chief Executive Officer.  Within 60 days of issuance of the IC 

Report, but not sooner than 30 days after a copy of the IC Report is provided to the Commission 

staff, KPMG’s Chief Executive Officer must certify to the Commission staff in writing that (i) 

KPMG has adopted and has implemented or will implement all recommendations of the 

Independent Consultant, if any; and (ii) the Independent Consultant agrees with KPMG’s adoption 

and implementation of the recommendations.  To the extent that KPMG has not implemented all 

recommendations of the Independent Consultant within 60 days of issuance of the IC Report, 



18 

KPMG’s Chief Executive Officer must certify to the Commission staff in writing, 30 days after 

their implementation, that (i) KPMG has adopted and has implemented all recommendations of the 

Independent Consultant; and (ii) the Independent Consultant agrees that the recommendations have 

been adequately adopted and implemented by KPMG.  The certifications by KPMG’s Chief 

Executive Officer shall provide written evidence of the implementation of the Independent 

Consultant’s recommendations in the form of a narrative, and be supported by exhibits.  The 

Commission staff may request further evidence of the implementation of the Independent 

Consultant’s recommendations, and KPMG agrees to provide such evidence. 

74. Hiring Authority.  The Independent Consultant shall have the authority to employ 

legal counsel, consultants, investigators, experts, and other personnel necessary to assist in the 

proper discharge of the Independent Consultant’s duties. 

75. The Independent Consultant’s compensation and expenses shall be borne 

exclusively by KPMG.  To ensure the independence of the Independent Consultant, KPMG: (i) 

shall not have the authority to terminate the Independent Consultant or substitute another 

independent compliance consultant for the initial Independent Consultant, without the prior written 

approval of the Commission staff; and (ii) shall compensate the Independent Consultant and 

persons engaged to assist the Independent Consultant for services rendered pursuant to this Order 

at their reasonable and customary rates. 

76. KPMG shall require the Independent Consultant to enter into an agreement that 

provides that, for the period of engagement and for a period of two years from completion of the 

engagement, the Independent Consultant shall not enter into any employment, consultant, attorney-

client, auditing or other professional relationship with KPMG, or any of its present or former 

affiliates, directors, officers, employees, or agents acting in their capacity as such.  The agreement 

shall also provide that the Independent Consultant will require that any firm with which he/she is 

affiliated or of which he/she is a member, and any person engaged to assist the Independent 

Consultant in performance of his/her duties under this Order shall not, without prior written 

consent of the Division of Enforcement, enter into any employment, consultant, attorney-client, 

auditing or other professional relationship with KPMG, or any of its present or former affiliates, 

directors, officers, employees, or agents acting in their capacity as such for the period of the 

engagement and for a period of two years after the engagement. 

77. KPMG shall not be in, and shall not have an attorney-client relationship with the 

Independent Consultant and shall not seek to invoke the attorney-client privilege or any other 

doctrine or privilege to prevent the Independent Consultant from transmitting any information, 

reports, or documents to Commission staff. 

78. KPMG shall inform its audit professionals of the terms of the Order within ten 

business days after entry of the Order. 

79. By no later than 15 months after the entry of this Order, unless otherwise extended 

by the Commission staff, KPMG’s Chief Executive Officer shall certify, in writing, compliance 

with the undertakings set forth above.  The certification shall provide written evidence of 

compliance in the form of a narrative, and be supported by exhibits sufficient to demonstrate 



19 

compliance.  The Commission staff may request further evidence of compliance, and KPMG 

agrees to provide such evidence. 

80. Annual Certification.  With respect to calendar years 2020 and 2021, KPMG’s 

Chief Executive Officer shall certify that KPMG has assessed whether KPMG’s Policies and 

Procedures relating to the topics discussed in paragraph 65 are adequate and sufficient to provide 

reasonable assurance of compliance with all professional standards relating to ethics and integrity 

by, among other things, testing the firm’s implementation of KPMG’s Policies and Procedures 

during the twelve (12) months preceding the certification (“Annual Certification”).  The Annual 

Certification shall describe the nature and scope of KPMG’s testing.  The Annual Certification 

shall represent that the Chief Executive Officer has reviewed and evaluated the firm’s assessment 

and testing process and that, based on belief and after reasonable inquiry, the Chief Executive 

Officer believes that KPMG’s Policies and Procedures relating to the topics discussed in paragraph 

65 are adequate and sufficient to provide reasonable assurance of compliance with all professional 

standards relating to ethics and integrity.  If the Chief Executive Officer cannot represent that 

KPMG’s Policies and Procedures are adequate and sufficient, then the Chief Executive Officer 

shall describe in reasonable detail the reasons for the inability to so certify.  The Chief Executive 

Officer shall provide the Annual Certifications to the Commission’s staff within 60 days of the end 

of the annual period.  KPMG shall preserve and retain all documentation regarding the Chief 

Executive Officer’s Annual Certification for seven (7) years and will make it available to the staffs 

of the Commission or the PCAOB upon request. 

81. All reports and certifications mentioned in these undertakings shall be submitted to 

Melissa Hodgman, Associate Director, Division of Enforcement, Securities and Exchange 

Commission, 100 F Street, NE, Washington, DC 20549, or such other person as the Commission 

staff may request, with a copy to the Office of Chief Counsel of the Enforcement Division. 

82. For good cause shown, the Commission staff may extend any of the procedural 

dates relating to the undertakings.  Deadlines for procedural dates shall be counted in calendar 

days, except that if the last day falls on a weekend or federal holiday, the next business day shall be 

considered to be the last day. 

IV. 

 

 In view of the foregoing, the Commission deems it appropriate to impose the sanctions 

agreed to in Respondent KPMG’s Offer. 

 

 Accordingly, it is hereby ORDERED, effective immediately, that: 

 

A. KPMG shall cease and desist from committing or causing any violations and any 

future violations of PCAOB Rule 3500T. 

 

B. KPMG be, and hereby is, censured. 

 

C. KPMG shall comply with the undertakings enumerated in paragraphs 65 through 82 

above. 



20 

 

D. KPMG shall, within 10 days of the entry of this Order, pay a civil money penalty in 

the amount of $50 million to the Securities and Exchange Commission for transfer to the general 

fund of the United States Treasury, subject to Exchange Act Section 21F(g)(3). If timely payment 

is not made, additional interest shall accrue pursuant to 31 U.S.C. § 3717.   

 

E. Payment must be made in one of the following ways:   

 

(1) Respondent may transmit payment electronically to the Commission, 

which will provide detailed ACH transfer/Fedwire instructions upon 

request; 

 

(2) Respondent may make direct payment from a bank account via Pay.gov 

through the SEC website at http://www.sec.gov/about/offices/ofm.htm; or 

 

(3) Respondent may pay by certified check, bank cashier’s check, or United 

States postal money order, made payable to the Securities and Exchange 

Commission and hand-delivered or mailed to: 

 

Enterprise Services Center 

Accounts Receivable Branch 

HQ Bldg., Room 181, AMZ-341 

6500 South MacArthur Boulevard 

Oklahoma City, OK 73169 

 

Payments by check or money order must be accompanied by a cover letter 

identifying KPMG as a Respondent in these proceedings, and the file number of these proceedings; 

a copy of the cover letter and check or money order must be sent to Melissa Hodgman, Division of 

Enforcement, Securities and Exchange Commission, 100 F St., NE, Washington, DC 20549.  

 

F. Amounts ordered to be paid as civil money penalties pursuant to this Order shall be 

treated as penalties paid to the government for all purposes, including all tax purposes.  To 

preserve the deterrent effect of the civil penalty, Respondent agrees that in any Related Investor 

Action, it shall not argue that it is entitled to, nor shall it benefit by, offset or reduction of any 

award of compensatory damages by the amount of any part of Respondent’s payment of a civil 

penalty in this action (“Penalty Offset”).  If the court in any Related Investor Action grants such a 

Penalty Offset, Respondent agrees that it shall, within 30 days after entry of a final order granting 

the Penalty Offset, notify the Commission’s counsel in this action and pay the amount of the 

Penalty Offset to the Securities and Exchange Commission.  Such a payment shall not be deemed 

an additional civil penalty and shall not be deemed to change the amount of the civil penalty 

imposed in this proceeding.  For purposes of this paragraph, a “Related Investor Action” means a  

  

http://www.sec.gov/about/offices/ofm.htm21 

private damages action brought against Respondent by or on behalf of one or more investors based 

on substantially the same facts as alleged in the Order instituted by the Commission in this 

proceeding. 

 

 By the Commission. 

 

 

 

 

 

 

       Vanessa A. Countryman 

       Acting Secretary