UNITED STATES OF AMERICA

Before the
SECURITIES AND EXCHANGE COMMISSION

SECURITIES EXCHANGE ACT OF 1934

Release No. 95167 / June 28, 2022

ACCOUNTING AND AUDITING ENFORCEMENT

Release No. 4313 / June 28, 2022

ADMINISTRATIVE PROCEEDING
File No. 3-20911
ORDER INSTITUTING PUBLIC
ADMINISTRATIVE AND CEASE-
In the Matter of AND-DESIST PROCEEDINGS PURSUANT TO
SECTIONS 4C AND 21C OF THE SECURITIES
Ernst & Young LLP, EXCHANGE ACT OF 1934 AND RULE 102(e)
OF THE COMMISSION’S RULES OF
Respondent. PRACTICE, MAKING FINDINGS, AND
IMPOSING REMEDIAL SANCTIONS AND A
CEASE-AND-DESIST ORDER

I.

The Securities and Exchange Commission (“SEC” or “Commission”) deems it appropriate

that public administrative and cease-and-desist proceedings be, and hereby are, instituted against
Respondent Ernst & Young LLP (“EY”) pursuant to Sections 4C1 and 21C of the Securities
Exchange Act of 1934 (“Exchange Act”) and Rules 102(e)(1)(ii) and 102(e)(1)(iii) of the
Commission’s Rules of Practice.2

1
Section 4C provides, in relevant part, that:

The Commission may censure any person, or deny, temporarily or permanently, to any person the
privilege of appearing or practicing before the Commission in any way, if that person is found . . . (1)
not to possess the requisite qualifications to represent others; (2) to be lacking in character or integrity,
or to have engaged in unethical or improper professional conduct; or (3) to have willfully violated, or
willfully aided and abetted the violation of, any provision of the securities laws or the rules and
regulations issued thereunder.
2
Rule 102(e)(1)(ii) provides, in pertinent part, that:

The Commission may . . . deny, temporarily or permanently, the privilege of appearing or practicing
before it . . . to any person who is found . . . to be lacking in character or integrity or to have engaged
in unethical or improper professional conduct.

Rule 102(e)(1)(iii) provides, in pertinent part, that:

 II.

In anticipation of the institution of these proceedings, Respondent has submitted an Offer

of Settlement (“Offer”) that the Commission has determined to accept. Respondent admits the
facts set forth in Sections III.B and III.C below, acknowledges its conduct violated PCAOB Rule
3500T and provides a basis for the Commission to impose remedies pursuant to Exchange Act
Sections 4C(a)(2) and (a)(3) and Rules 102(e)(1)(ii) and (iii) of the Commission’s Rules of
Practice; admits the Commission’s jurisdiction over it and the subject matter of these proceedings;
and consents to the entry of this Order Instituting Public Administrative and Cease-and-Desist
Proceedings Pursuant to Sections 4C and 21C of the Securities Exchange Act of 1934 and Rule
102(e) of the Commission’s Rules of Practice, Making Findings, and Imposing Remedial
Sanctions and a Cease-and-Desist Order (“Order”), as set forth below.

III.

On the basis of this Order and Respondent’s Offer, the Commission finds3 that:

A. SUMMARY

1. This case involves Ernst & Young’s failures to act with the integrity required of a
public company auditor. Over multiple years, a significant number of EY audit professionals
cheated on the ethics component of the Certified Public Accountant (CPA) exam, as well as on a
variety of other examinations required to maintain their CPA licenses. As this was ongoing, EY
withheld this misconduct from SEC staff conducting an investigation of potential cheating at the
firm. EY audit professionals’ repeated cheating on exams and the firm’s misrepresentations to the
SEC violated ethics and integrity standards and discredited the accounting profession.

2. To become licensed as a CPA, applicants in most states must pass ethics

examinations. These are designed to keep accountants who do not sufficiently understand their
ethical responsibilities from the essential role CPAs play in serving the public interest. State
accountancy boards require CPAs to complete continuing professional education (CPE) courses to
ensure they remain knowledgeable about their ethical obligations and current accounting standards.
CPAs must pass examinations designed to test their understanding of these materials in order to get
credit for these courses and maintain their licenses.

3. Over multiple years, a significant number of EY audit professionals cheated on

these exams by using answer keys and sharing them with their colleagues. From 2017 to 2021, 49
EY audit professionals sent and/or received answer keys to CPA ethics exams. In addition,
hundreds of other audit professionals cheated on CPE courses, including those addressing CPAs’

The Commission may . . . deny, temporarily or permanently, the privilege of appearing or practicing
before it . . . to any person who is found…to have willfully violated, or willfully aided and abetted the
violation of any provision of the Federal securities laws or the rules and regulations thereunder.
3
The findings herein are made pursuant to Respondent’s Offer of Settlement and are not binding on any
other person or entity in this or any other proceeding.
2
ethical obligations. And a significant number of EY professionals who did not cheat themselves,
but knew their colleagues were cheating and facilitating cheating, violated the firm’s Code of
Conduct by failing to report this misconduct.

4. This sharing of answer keys is not the first time in recent years that a large number
of EY audit professionals cheated on exams. From 2012 to 2015, over 200 EY audit professionals
across the country exploited a software flaw in EY’s CPE testing platform to pass exams while
answering only a low percentage of questions correctly. Following EY’s discovery of that earlier
cheating scheme, the firm took disciplinary actions and repeatedly warned its audit professionals
not to cheat on exams. Still, the cheating continued.

5. Just as many of its audit professionals failed to report their colleagues’ cheating as
required, EY withheld this misconduct from the SEC during an investigation about cheating at the
firm. In June 2019, the SEC’s Division of Enforcement sent EY a formal request for information
about complaints the firm had received regarding cheating on training exams. On the same day EY
received this request, the firm received a tip that an audit professional had shared an answer key to
a CPA ethics exam. EY did not disclose this information to the SEC. To the contrary, its
submission indicated that the firm did not have any current issues with cheating. In light of the tip
it had received, EY’s June 20 submission was materially misleading. But EY never corrected its
submission. Even after the firm began an internal investigation, confirmed there had been
cheating, and the matter was discussed among senior lawyers at the firm and with members of the
firm’s senior management, EY still did not correct its misleading submission.

6. Investors rely on independent audit firms to serve critical gatekeeping roles with
respect to financial reporting. This gatekeeping role depends on the integrity not only of the
independent audit firms’ audit personnel, but of its management and its attorneys. Thus, the
federal securities laws provide remedies for those accountants, audit firms, and attorneys found to
be lacking in integrity.4 Moreover, EY is required by PCAOB rules and the Code of Professional
Conduct of the American Institute of Certified Public Accountants (“AICPA”) to act with integrity
in connection with the professional services it provides its clients.5 PCAOB Quality Control
Standards require EY to have a system of quality control that provides reasonable assurance that its
audit personnel “perform all professional responsibilities with integrity.”6 Subject to maintaining
client confidences, certified public accountants are required to be “honest and candid.”7 And the

4
See Commission Rule of Practice 102(e)(1)(ii), 17 C.F.R. § 201.102(e)(1)(ii); see also Exchange Act
Section 4C(a)(2).
5
PCAOB Rule 3500T requires EY to maintain integrity when performing any professional service in
connection with the preparation or issuance of any audit report. As an AICPA member, EY was required to comply
with the AICPA’s Code of Professional Conduct, which requires the firm to maintain integrity in connection with all
professional services.
6
QC § 20, System of Quality Control for a CPA Firm’s Accounting and Auditing Practice, at §§ 20.01 and
20.09.
7
See “Principles of Professional Conduct,” ET Section 54 (codified as AICPA Code of Professional Conduct
0.300.040).

3
AICPA prohibits members from committing acts “discreditable to the profession.”8 EY violated
all of these strictures.

B. RESPONDENT

7. Ernst & Young LLP is a limited liability partnership and professional services firm
headquartered in New York, New York. It is a member firm of Ernst & Young Global Limited, a
UK entity.

C. FACTS

EY AUDIT PROFESSIONALS EXPLOIT SOFTWARE FLAW TO CHEAT

8. In December 2014, an internal EY whistleblower reported a flaw in the firm’s

software that allowed professionals to pass CPE exams without the required number of correct
responses. This vulnerability allowed exam takers to achieve a passing score while answering as
little as one question correctly. The firm’s investigation of this matter determined that from 2012
to 2015, over 200 EY audit professionals in multiple offices exploited this flaw to pass CPE
exams.

9. EY took a variety of disciplinary actions against the audit professionals who

engaged in this misconduct. To prevent further cheating, EY added prominent warnings to CPE
exams reminding test-takers that assessments must be taken independently, and that a failure to do
so reflected a lack of integrity.9 The firm repeatedly reminded its personnel that cheating on exams
was highly improper and violates EY’s Code of Conduct, which requires professionals to act with
integrity and requires those who become aware of misconduct to report any deviations or
violations of the Code to the firm.

10. However, EY learned that, despite these warnings, certain audit personnel were
continuing to cheat. For example, in 2016, EY learned that professionals in its Denver office
improperly shared answer keys. In response, the office’s managing partner warned staff that these
actions constituted a serious violation of the firm’s Code of Conduct and underscored the
importance of ethical behavior in connection with CPE. After the firm learned of two employees
who had cheated on a CPA ethics exam in 2017, EY issued the following warning to U.S.
personnel:

8
See AICPA Code of Professional Conduct 1.400.001 (“Acts Discreditable Rule”).
9
For example, one warning stated:

You must complete the assessment without assistance from others. Adherence to that
requirement is part of your acceptance of and commitment to the EY Global Code of
Conduct which includes acting with integrity in connection with professional education.
Acting with integrity also means that you should not share or discuss the contents of the
assessment, or your responses, with anyone who has yet to complete it. Failure to adhere
to these requirements may result in disciplinary action.
4
 “Cheating” on internal or external tests, assessments or evaluations can result in
disciplinary action, including termination. You must complete them without
assistance from others. Assessments will further your professional development.
Not completing a test on your own or sharing or soliciting answers from others during
an assessment, is CHEATING. This conduct is contrary to our Global Code of
Conduct and our values. Take it seriously!

11. These recurring instances of cheating reflected that the problem was persisting
notwithstanding the firm’s warnings. Though EY continued to warn its personnel not to cheat, it
did not implement any additional controls to detect this misconduct during the relevant period.

EY’S SUBMISSION TO THE SEC’S ENFORCEMENT DIVISION

12. On June 17, 2019, the SEC issued an order finding that another large audit firm
engaged in misconduct that included, among other things, cheating on internal training exams. The
SEC imposed a $50 million penalty on that firm.10

13. On June 19, 2019, EY’s U.S. Chair and Managing Partner sent a message to all
U.S. personnel regarding that matter. The message warned, “[s]haring answers on internal or
external tests or evaluations is highly unethical behavior, in violation of our Code of Conduct, and
will not be tolerated at EY.” The SEC’s action against the other firm, she wrote, “serves as an
important reminder of our responsibility to serve the public interest and the need to always act with
integrity and honesty.”

14. That day, the SEC’s Division of Enforcement sent EY a formal request asking
whether EY had received any ethics or whistleblower complaints regarding testing associated with
any EY training program or continuing professional education course.

15. As requested, EY responded on June 20. EY provided a narrative submission that

described five matters “related to cheating or other misconduct on training programs and
assessments.” One of those matters was the 2017 tip about two employees cheating on a CPA
ethics exam. None of the matters in EY’s submission involved potentially ongoing misconduct by
current employees or misconduct that the firm did not appear to have appropriately addressed.

16. EY’s June 20 submission created the impression that EY did not have current issues
with cheating – either on training programs and assessments or CPA ethics exams. However, on
June 19, the day before EY made its submission, an employee reported to a manager that a
professional in the firm’s audit group had emailed the employee answers to a CPA ethics exam.
That afternoon, the manager informed an EY human resources employee of the tip, which was then
relayed to others in EY’s human resources group.

10
See In the Matter of KPMG LLP, Exchange Act Rel. No. 86118 (June 17, 2019).

5
 17. Various senior EY attorneys received the SEC Division of Enforcement’s June 19
request. They reviewed EY’s June 20 submission, which conveyed that the firm’s personnel were
not cheating on exams. And by no later than June 21, they were apprised of the employee’s June
19 tip about receiving an answer key to a CPA ethics exam.

18. The tip EY’s submission failed to include involved cheating on a CPA ethics exam.
It was sufficiently concerning to the firm that it began an extensive investigation. Yet, despite the
message from EY’s U.S. Chair and Managing Partner only two days earlier about the importance
of integrity and honesty, EY did not correct its submission to the SEC’s Enforcement Division.

EY FAILS TO CORRECT SUBMISSION AS IT LEARNS OF MORE CHEATING

19. By the fall of 2019, EY’s investigation revealed significant misconduct: despite all
of the warnings, EY audit professionals had continued to cheat by using answer keys they had
received from colleagues to pass exams and sharing answer keys with others. The investigation
confirmed that audit professionals in multiple offices cheated on CPA ethics exams. They also
cheated on a wide variety of CPE courses, including courses on ethics and other topics, such as the
Summary of Audit Differences, which are designed to ensure that audit professionals can properly
evaluate whether clients’ financial statements are presented fairly in all material respects and
comply with Generally Accepted Accounting Principles.

20. Many professionals acknowledged during the firm’s investigation that they knew
their conduct violated EY’s Code of Conduct, but they cheated because of work commitments or
an inability to pass training exams after multiple attempts.11

21. Notably, 91 audit professionals requested, used, or shared answer keys with
colleagues after EY’s U.S. Chair and Managing Partner sent the message highlighting the SEC
enforcement action against the other large audit firm, yet again reminding personnel not to cheat,
and yet again discussing the importance of integrity.

22. Despite the requirement in EY’s Code of Conduct and the firm-wide warnings that
audit professionals are obligated to report unethical conduct, a significant number of audit
professionals who knew their colleagues were using and sharing answer keys failed to report this
misconduct. Many of these EY professionals attributed their silence to a lack of appreciation that
sharing exam answers constituted cheating and violated EY’s Code of Conduct, and a desire to
avoid getting colleagues in trouble.

23. EY’s General Counsel’s Office discussed the firm’s investigation as it was ongoing
with the firm’s Executive Committee in October 2019. By then, members of the firm’s senior
management and various EY senior attorneys understood that (i) the SEC had sanctioned another
large audit firm for exam cheating by its professionals, (ii) SEC staff had asked EY about tips it
had received involving exam-related misconduct, (iii) EY had received a tip about sharing answer

11
Based on its investigation, the firm has imposed a range of disciplinary actions on numerous professionals
depending on the severity of the violations and other factors.
6
keys to a CPA ethics exam, (iv) the cheating involved more than a small number of individuals in a
single office; and (v) the firm had not disclosed the tip to the SEC.

24. Following these discussions, EY broadened its investigation. Yet, despite the U.S.
Chair and Managing Partner’s message to others about integrity,12 EY did not correct its
submission to the SEC.

25. Instead, EY decided to inform the PCAOB. However, it would not do so yet. EY
decided to delay disclosing the misconduct even to the PCAOB until “the extent of the misconduct
within the Firm was clearer and EY had a credible plan in place to address the problem.” That
took four more months.

26. The SEC did not learn about the issue until March 2020 – almost nine months after
the June 19, 2019 request – when the PCAOB notified the SEC that EY had disclosed that a
significant number of its employees had cheated on training exams.

D. EY’S CONDUCT DURING THE INVESTIGATION

27. EY conducted a robust investigation of the underlying cheating and provided

substantial information to the Commission about that misconduct. EY has also taken remedial
steps to reduce the risk of the conduct recurring, including various employment actions (up to and
including terminating employees).

28. However, with respect to its misleading submission to the SEC, EY did not self-
police, self-report, remediate, or cooperate in the Commission’s investigation. For example, EY
did not “do a thorough review of the nature, extent, origins and consequences of the conduct and
related behavior;” “voluntarily disclose information our staff did not directly request and otherwise
might not have uncovered;” or adopt “new and more effective [policies and procedures] designed
to prevent a recurrence of the misconduct.”13

29. To the contrary, by withholding information about misconduct that EY knew SEC
staff was investigating, EY’s continued misrepresentations to the SEC’s Division of Enforcement
significantly hindered the SEC’s ability to take action that would protect investors from audit
professionals who do not understand their ethical obligations, fail to act with appropriate

12
The June 19 message from EY’s U.S. Chair and Managing Partner warned, “No client or external
relationship and no metric is more important than the ethics, integrity and reputation of EY. We all play a vital role
in instilling confidence in capital markets. We must always be committed to each other as colleagues, holding
ourselves and each other accountable and maintaining zero tolerance of those who do not live our values. As stated
in our Global Code of Conduct, we are people who demonstrate integrity, respect and always doing the right thing.”
13
See Report of Investigation Pursuant to Section 21(a) of the Securities Exchange Act of 1934 and
Commission Statement on the Relationship of Cooperation to Agency Enforcement Decisions, Rel. No. 34-44969
(Oct. 23, 2001).

7
professional integrity, and have not met – or needed to cheat in order to meet – minimum
professional requirements to demonstrate their knowledge of important accounting principles.

E. VIOLATIONS

30. As a result of the conduct of personnel described above, EY willfully14 violated

PCAOB Rule 3500T, which requires EY and associated persons to comply with ethics standards,
including to maintain integrity, as described in the AICPA’s Code of Professional Conduct when
performing any professional service in connection with the preparation or issuance of any audit
report,15 within the meaning of Section 4C(a)(3) of the Exchange Act and Rule 102(e)(1)(iii) of the
Commission’s Rules of Practice.

31. The AICPA Code of Professional Conduct requires that a member not commit any
act discreditable to the profession. AICPA Code of Professional Conduct 1.400.001. As a result
of the conduct of personnel described above, EY failed to comply with AICPA Code of
Professional Conduct 1.400.001 within the meaning of Section 4C(a)(2) of the Exchange Act and
Rule 102(e)(1)(ii) of the Commission’s Rules of Practice.

32. PCAOB Quality Control Standards require that a registered firm “shall have a
system of quality control for its accounting and auditing practice.” QC 20.01. Those quality
control standards require further that firms should establish policies and procedures to provide
“reasonable assurance that (a) personnel ... perform all professional responsibilities with integrity.”
QC 20.09.

33. PCAOB Quality Control Standards also direct the firm on the professional
development of its staff. A firm should have policies and procedures to provide it with reasonable
assurance that “[w]ork is assigned to personnel having the degree of technical training and
proficiency required in the circumstances” and that “personnel participate in general and industry-
specific continuing professional education and other professional development activities that
enable them to fulfill responsibilities assigned, and satisfy applicable continuing professional
education requirements of regulatory agencies.”16

14
“Willfully” for purposes of imposing relief under Exchange Act Section 4C and Rule 102(e) of the
Commission’s Rules of Practice “‘means no more than that the person charged with the duty knows what he is
doing.’” Wonsover v. SEC, 205 F.3d 408, 414 (D.C. Cir. 2000) (quoting Hughes v. SEC, 174 F.2d 969, 977 (D.C.
Cir. 1949)). There is no requirement that the actor “also be aware that he is violating one of the Rules or Acts.”
Tager v. SEC, 344 F.2d 5, 8 (2d Cir. 1965).
15
The rule requires auditors to comply with the AICPA’s Code of Professional Conduct Rule 102, and
interpretations and rulings thereunder, as in existence on April 16, 2003. Although PCAOB Rule 3500T references
the AICPA Code as in existence on April 16, 2003, the definition of integrity remains identical to the current
definitions in the Code of Professional Conduct promulgated by the AICPA and applicable to current members of
the AICPA.
16
QC § 20.13.b-.c.

8
 34. To provide reasonable assurance that the policies and procedures underlying a
firm’s system of quality control are suitably designed and being effectively applied, PCAOB
quality control standards recognize the necessity of “Monitoring,” which involves “an ongoing
consideration and evaluation of, among other things, the effectiveness of professional development
activities and compliance with the firm’s policies and procedures.”17

35. As a result of the conduct described above, EY failed to comply with QC 20 within
the meaning of Section 4C(a)(2) of the Exchange Act and Rule 102(e)(1)(ii) of the Commission’s
Rules of Practice.

F. FINDINGS

36. Based on the foregoing, the Commission finds that EY willfully violated PCAOB
Rule 3500T within the meaning of Section 4C(a)(3) of the Exchange Act and Rule 102(e)(1)(iii) of
the Commission’s Rules of Practice.

37. Based on the foregoing, the Commission finds that EY engaged in conduct that
provides a basis to impose remedies against the firm pursuant to Exchange Act Section 4C(a)(2)
and Rule 102(e)(1)(ii).

G. UNDERTAKINGS

EY has undertaken to complete the following actions:

EY Review of Policies and Procedures

38. EY Review. Within 120 days after the entry of this Order, EY shall evaluate (“EY
Review”) the sufficiency and adequacy of its quality controls, policies, and procedures relevant to
ethics and integrity and to responding to Information Requests18 (collectively, EY’s “Policies and
Procedures”) to determine whether they are designed and implemented in a manner that provides
reasonable assurance of compliance with all professional standards, including those relating to
ethics and integrity applicable to accountants and attorneys, related to the subjects below. EY’s
evaluation shall include assessing:

a. the adequacy and sufficiency of ethics and integrity training and guidance,
including regarding anti-retaliation and whistleblowing;

17
QC § 20.20.c-.d.
18
As used in this Order, “Information Requests” means any solicitation of information from the Commission,
including from the Division of Enforcement, and irrespective of form – for example, including solicitations of
information pursuant to oral voluntary requests, written subpoenas, or any other solicitation of information from the
Commission and its staff.
9
 b. whether EY’s culture is supportive of ethical and compliant conduct and
maintaining integrity, including strong, explicit, and visible support and commitment by the firm’s
management;

c. whether the firm has designed and implemented appropriate policies and
procedures relating to responding to Information Requests, including those relating to analyzing
Information Requests, collecting responsive information, producing the information requested,
communicating accurately, and correcting false or misleading statements or omissions in
submissions responsive to Information Requests; and

d. whether EY has designed and implemented appropriate policies and

procedures and deploys proper resources and oversight to comply with all professional standards
relating to the subjects discussed in paragraph 38, including (i) monitoring to detect non-
compliance; (ii) having appropriate reporting lines, compensation, and rewards; (iii) assigning
responsibility for overseeing compliance to senior executives and managers with access to relevant
information and personnel; and (iv) ensuring consistent discipline.

39. EY Report to the Commission. Within 60 days of completing the EY Review, EY

shall deliver to the Commission staff a detailed written report (“EY Report to the Commission”)
summarizing its review and any changes it has made to EY’s Policies and Procedures relating to
the subjects described in paragraph 38. The EY Report to the Commission shall provide written
evidence of how the Policies and Procedures, including any changes, are designed and
implemented in a manner that provides reasonable assurance of compliance with all professional
standards relating to the subjects discussed in paragraph 38 in the form of a narrative and be
supported by exhibits. The Commission staff may request further evidence of how the Policies and
Procedures provide such assurance, and EY agrees to provide such evidence.

The EY Report to the Commission shall set forth the results of its assessment of the adequacy and
sufficiency of its ethics and integrity training, including a description of the training. The EY
Report to the Commission should also include a description of any training courses added or
modified as a result of the assessment conducted under this paragraph.

Independent Review of EY’s Policies and Procedures

40. Independent Consultant Review of Policies and Procedures. EY shall retain,

within 60 days after the entry of this Order, an independent consultant (the “Policies and
Procedures IC”) not unacceptable to the Commission staff. The Policies and Procedures IC shall
have, at a minimum, demonstrated expertise designing or reviewing compliance policies,
procedures, and controls relating to ethics and integrity. EY shall provide to the Commission
staff a copy of the engagement letter detailing the scope of the Policies and Procedures IC’s
responsibilities. EY shall deliver to the Policies and Procedures IC the EY Report to the
Commission at the same time as EY provides such report to the Commission staff as specified in
paragraph 39. EY shall require that the Policies and Procedures IC conduct a review of EY’s
Policies and Procedures to determine whether they are designed and being implemented in a
manner that provides reasonable assurance of compliance with all professional standards relating
to the subjects described in paragraph 38 (the “Policies and Procedures IC Review”).
10
 41. EY shall cooperate fully with the Policies and Procedures IC and shall provide
reasonable access to information and records as the Policies and Procedures IC may reasonably
request, subject to EY’s right to withhold from disclosure any information or records protected by
any applicable protection or privilege, such as the attorney-client privilege or the attorney work
product doctrine. The Policies and Procedures IC shall have the right to interview any partner,
employee, agent, or consultant of EY concerning any matter within or relating to the Policies and
Procedures IC Review. The Policies and Procedures IC will not have access to EY’s client
materials or materials that reflect client confidential information.

42. Report of Policies and Procedures IC. After the Policies and Procedures IC Review
is completed, but no later than 90 days after Commission staff receives the EY Report, the Policies
and Procedures IC shall issue a detailed written report (the “Policies and Procedures IC Report”) to
EY: (i) summarizing its work; (ii) making recommendations, as the Policies and Procedures IC
deems appropriate, reasonably designed to ensure that EY’s Policies and Procedures relating to the
subjects described in paragraph 38 are adequate and sufficient to provide reasonable assurance of
compliance with all professional standards relating to the subjects described in paragraph 38; and
(iii) describing its review of EY’s training and making additional recommendations, as the Policies
and Procedures IC deems appropriate. EY shall require the Policies and Procedures IC to provide
a copy of the Policies and Procedures IC Report to the Commission staff when it is issued.

43. Adoption of Recommendations. EY shall adopt, as soon as practicable, all

recommendations of the Policies and Procedures IC in its report. Provided, however, that within
30 days of issuance of the Policies and Procedures IC Report, EY may advise the Policies and
Procedures IC in writing of any recommendation that it considers to be unnecessary, unjust,
outside the scope of this Order, unduly burdensome, or impractical. EY need not adopt any such
unnecessary, unjust, outside the scope of this Order, unduly burdensome, or impractical
recommendation at that time, but instead may propose in writing to the Policies and Procedures IC
an alternative recommendation (an “Alternative Recommendation”) designed to achieve the same
objective or purpose. EY will provide any such Alternative Recommendation(s) to the
Commission staff at the same time that EY submits such Alternative Recommendation(s) to the
Policies and Procedures IC. EY and the Policies and Procedures IC shall engage in good faith
negotiations in an effort to reach agreement on any recommendations objected to by EY. In the
event that the Policies and Procedures IC and EY are unable to agree on any Alternative
Recommendation(s) within 60 days of the issuance of the Policies and Procedures IC Report, EY
shall abide by the determinations of the Policies and Procedures IC.

44. Privilege. EY shall not be in, and shall not have or claim an attorney-client
relationship with the Policies and Procedures IC. Accordingly, EY shall not seek to invoke the
attorney-client privilege or any other doctrine or privilege to prevent the Policies and Procedures
IC from transmitting any information, reports, or documents to Commission staff.

45. Certification by Principal Executive Officer.19 Within 60 days of issuance of the

Policies and Procedures IC Report as described in paragraph 42, but not sooner than 30 days after a
copy of the Policies and Procedures IC Report is provided to the Commission staff, EY’s Principal

19
As used in this Order, “Principal Executive Officer” means the Chief Executive Officer or equivalent.
11
Executive Officer must certify to the Commission staff in writing that (i) EY has adopted and has
implemented or will implement all recommendations of the Policies and Procedures IC in its
report, if any; and (ii) the Policies and Procedures IC agrees with EY’s adoption and
implementation of the recommendations. To the extent that EY has not implemented all
recommendations of the Policies and Procedures IC within 60 days of issuance of the Policies and
Procedures IC Report, EY’s Principal Executive Officer must certify to the Commission staff in
writing, 30 days after their implementation, that (i) EY has adopted and has implemented all
recommendations of the Policies and Procedures IC; and (ii) the Policies and Procedures IC agrees
that the recommendations have been adequately adopted and implemented by EY. The
certification(s) by EY’s Principal Executive Officer shall provide written evidence of the
implementation of the Policies and Procedures IC’s recommendations in the form of a narrative
description, and be supplemented with supporting exhibits. The Commission staff may request
further evidence of the implementation of any of the Policies and Procedures IC’s
recommendations, and EY agrees to provide such evidence within a reasonable time period to the
satisfaction of Commission staff. If, because of changed circumstances, EY determines during the
pendency of these Undertakings that certain changes are necessary to recommendations already
implemented, EY should notify the Commission staff in advance of making any such changes, and
the Commission staff may determine, in their discretion, whether to permit such modification.

Independent Review of EY’s Disclosure Failures

46. Independent Consultant Review of EY’s Conduct Relating to the Commission

Staff’s June 2019 Information Request. EY shall, within 30 days after the entry of this Order,
designate a three-person committee of EY senior personnel who had no involvement in EY’s
conduct relating to the June 2019 Enforcement Division Request, including its failure to correct its
submission, and who will have authority to direct and oversee employment and other remedial
actions on behalf of the firm (the “Special Review Committee”). The Special Review Committee
shall retain, within 60 days after the entry of this Order, an independent consultant (the
“Remedial IC”), not unacceptable to the Commission staff. The Remedial IC shall have, at a
minimum, demonstrated expertise: (i) conducting investigations; and (ii) assessing the
reasonableness of how entities and attorneys have responded to subpoenas, document requests,
and/or information requests. EY’s Special Review Committee shall provide to the Commission
staff a copy of the engagement letter detailing the scope of the Remedial IC’s responsibilities,
which the Commission understands will provide that the Remedial IC is to conduct a review
covered by the attorney-client privilege. EY’s Special Review Committee shall require that the
Remedial IC conduct a review (the “Remedial IC Review”) of EY’s conduct relating to the
Commission staff’s June 2019 Information Request, including whether any member of EY’s
executive team, General Counsel’s Office, compliance staff, or other EY employees contributed to
the firm’s failure to correct its misleading submission.

47. Privilege. EY shall cooperate fully with the Remedial IC and shall provide
reasonable access to information and records as the Remedial IC may reasonably request.
Consistent with EY’s right to enter into an attorney-client relationship with the Remedial IC, this
access shall not exclude any information or records protected by any privilege such as the attorney-
client privilege or the attorney work product doctrine. The Remedial IC shall have the right to
interview any partner, employee, agent, or consultant of EY concerning any matter within or
12
relating to the Remedial IC Review. The Commission will not have a right to access any
information obtained or produced by the Remedial IC.

48. Report of the Remedial IC Review. After the Remedial IC Review is completed,
but in no event later than 90 days after the Remedial IC is retained, the Remedial IC shall issue a
detailed written report (the “Remedial IC Report”) to the Special Review Committee (i)
summarizing its work and (ii) making recommendations, as the Remedial IC deems appropriate, as
to employment actions or other remedial steps.

49. Adoption of Remedial IC Recommendations. The Special Review Committee shall

ensure that the firm adopts, as soon as practicable, all recommendations of the Remedial IC in the
Remedial IC Report. Provided, however, that within 14 days of issuance of the Remedial IC
Report, the Special Review Committee may advise the Remedial IC in writing of any
recommendation that it disagrees with. EY need not adopt any such recommendation at that time,
but the Special Review Committee instead may propose in writing to the Remedial IC an
alternative approach. The Special Review Committee and the Remedial IC shall engage in good
faith negotiations in an effort to reach agreement on any recommendations objected to by the
Special Review Committee. In the event that the Remedial IC and the Special Review Committee
are unable to agree on an alternative proposal within 30 days of the issuance of the Remedial IC
Report, the Special Review Committee shall abide by the determinations of the Remedial IC.

50. Certification by Principal Executive Officer and the Special Review Committee.
Within 60 days of issuance of the Remedial IC Report, but not sooner than 30 days after a copy of
the Remedial IC Report is provided to the Special Review Committee, EY’s Principal Executive
Officer and the Special Review Committee must certify to the Commission staff in writing that (i)
EY has adopted and has implemented or will implement all recommendations of the Remedial IC,
if any; and (ii) the Remedial IC agrees with EY’s adoption and implementation of the
recommendations. To the extent that EY has not implemented all recommendations of the
Remedial IC within 60 days of issuance of the Remedial IC Report, EY’s Principal Executive
Officer and Special Review Committee must certify to the Commission staff in writing, 30 days
after their implementation, that (i) EY has adopted and has implemented all recommendations of
the Remedial IC; and (ii) the Remedial IC agrees that the recommendations have been adequately
adopted and implemented by EY. The certifications by EY’s Principal Executive Officer and
Special Review Committee shall provide written evidence of all employment or other disciplinary
actions taken following the Remedial IC’s work.

The Independent Consultants’ Hiring Authority and Compensation

51. Hiring Authority and Compensation. The Policies and Procedures IC and the
Remedial IC (collectively, the “Independent Consultants”) shall have the authority to employ legal
counsel, consultants, investigators, experts, and other personnel necessary to assist in the proper
discharge of the Independent Consultants’ duties. The Independent Consultants’ compensation
and expenses shall be borne exclusively by EY. To ensure the independence of the Independent
Consultants, EY: (i) shall not have the authority to terminate the Independent Consultants or
substitute other independent consultants for the initial Policies and Procedures IC or Remedial IC,
without the prior written approval of the Commission staff; and (ii) shall compensate the
13
Independent Consultants and persons engaged to assist the Independent Consultants for services
rendered pursuant to this Order at their reasonable and customary rates.

52. Independence. EY shall require the Independent Consultants to enter into

agreements that provide that, for the period of their engagement and for a period of two years from
completion of each of their engagements, the Independent Consultants shall not enter into any
employment, consultant, attorney-client, auditing or other professional relationship with EY, or
any of its present or former affiliates, directors, officers, employees, or agents acting in their
capacity as such. The agreements shall also provide that the Independent Consultants will require
that any firm with which either is affiliated or of which either is a member, and any person
engaged to assist the Independent Consultants in performance of their duties under this Order shall
not, without prior written consent of the Division of Enforcement, enter into any employment,
consultant, attorney-client, auditing or other professional relationship with EY, or any of its present
or former affiliates, directors, officers, employees, or agents acting in their capacity as such for the
period of their engagement and for a period of two years after each of their engagements.

Notice to Audit Clients, Training, and Certifications

53. Notification. Within 10 business days after entry of this Order, EY shall provide all
of its issuer audit clients and SEC-registered broker-dealer audit clients a copy of this Order.

54. First Certification. By no later than 15 months after the entry of this Order, unless
otherwise extended by the Commission staff, EY’s Principal Executive Officer shall certify, in
writing, compliance with the undertakings set forth above. The certification shall provide written
evidence of compliance in the form of a narrative, and be supported by exhibits sufficient to
demonstrate compliance. The Commission staff may request further evidence of compliance, and
EY agrees to provide such evidence in a reasonable period of time to the satisfaction of
Commission staff, subject to EY’s right to withhold information and records relating to the
Remedial IC’s work based on applicable protections or privileges, such as the attorney-client
privilege or the attorney work product doctrine.

55. Ethics and Integrity Training for EY Audit Professionals. Beginning within 30
days and ending no earlier than 36 months after the entry of this Order, all audit professionals and
all EY partners and employees who, at any time prior to March 3, 2020, were aware (i) of the
Division of Enforcement’s June 19, 2019 request, (ii) of EY’s June 20, 2019 response, and (iii) that
an employee had made a tip on June 19, 2019 concerning cheating shall complete a minimum of 6
hours every 6 months of ethics and integrity training by an independent training provider not
unacceptable to the Commission staff.

56. Annual Certification. With respect to calendar years 2023, 2024, and 2025, EY’s
Principal Executive Officer shall certify that EY has assessed whether EY’s Policies and
Procedures relating to the topics discussed in paragraph 38 are adequate and sufficient to provide
reasonable assurance of compliance with all professional standards relating to the subjects
described in paragraph 38 by, among other things, testing the firm’s implementation of EY’s
Policies and Procedures during the twelve (12) months preceding the certification (“Annual
Certification”). The Annual Certification shall describe the nature and scope of EY’s testing. The

14
Annual Certification shall represent that the Principal Executive Officer has reviewed and
evaluated the firm’s assessment and testing process and that, based on belief and after reasonable
inquiry, the Principal Executive Officer believes that EY’s Policies and Procedures relating to the
topics discussed in paragraph 38 are adequate and sufficient to provide reasonable assurance of
compliance with all relevant professional standards. EY’s Principal Executive Officer shall also
certify that the training requirements discussed in paragraph 55 have been completed. If the
Principal Executive Officer cannot represent that EY’s Policies and Procedures are adequate and
sufficient or that the training requirements have been completed, then the Principal Executive
Officer shall describe in reasonable detail the reasons for the inability to so certify. The Principal
Executive Officer shall provide the Annual Certifications to the Commission’s staff within 60 days
of the end of the annual period. EY shall preserve and retain all documentation regarding the
Principal Executive Officer’s Annual Certification for 7 years and will make it available to the
staffs of the Commission or the PCAOB upon request.

57. All reports and certifications mentioned in these undertakings shall be submitted to
Melissa Hodgman, Associate Director, Division of Enforcement, Securities and Exchange
Commission, 100 F Street, NE, Washington, DC 20549, or such other person as the Commission
staff may request, with a copy to the Office of Chief Counsel of the Enforcement Division.

58. For good cause shown, the Commission staff may extend any of the procedural
dates relating to the undertakings. Deadlines for procedural dates shall be counted in calendar
days, except that if the last day falls on a weekend or federal holiday, the next business day shall be
considered to be the last day.

IV.

In view of the foregoing, the Commission deems it appropriate to impose the sanctions
agreed to in Respondent EY’s Offer.

Accordingly, it is hereby ORDERED, effective immediately, that:

A. EY shall cease and desist from committing or causing any violations and any future
violations of PCAOB Rule 3500T.

B. EY be, and hereby is, censured.

C. EY shall comply with the undertakings enumerated in paragraphs 38 through 58

above.

D. EY shall, within 10 days of the entry of this Order, pay a civil money penalty in the
amount of $100 million to the Securities and Exchange Commission for transfer to the general
fund of the United States Treasury, subject to Exchange Act Section 21F(g)(3). If timely payment
is not made, additional interest shall accrue pursuant to 31 U.S.C. § 3717.

E. Payment must be made in one of the following ways:

15
 (1) Respondent may transmit payment electronically to the Commission,
which will provide detailed ACH transfer/Fedwire instructions upon
request;

(2) Respondent may make direct payment from a bank account via Pay.gov
through the SEC website at http://www.sec.gov/about/offices/ofm.htm; or

(3) Respondent may pay by certified check, bank cashier’s check, or United
States postal money order, made payable to the Securities and Exchange
Commission and hand-delivered or mailed to:

Enterprise Services Center

Accounts Receivable Branch
HQ Bldg., Room 181, AMZ-341
6500 South MacArthur Boulevard
Oklahoma City, OK 73169

Payments by check or money order must be accompanied by a cover letter

identifying EY as a Respondent in these proceedings, and the file number of these proceedings; a
copy of the cover letter and check or money order must be sent to Melissa Hodgman, Division of
Enforcement, Securities and Exchange Commission, 100 F St., NE, Washington, DC 20549.

F. Amounts ordered to be paid as civil money penalties pursuant to this Order shall be
treated as penalties paid to the government for all purposes, including all tax purposes. To
preserve the deterrent effect of the civil penalty, Respondent agrees that in any Related Investor
Action, it shall not argue that it is entitled to, nor shall it benefit by, offset or reduction of any
award of compensatory damages by the amount of any part of Respondent’s payment of a civil
penalty in this action (“Penalty Offset”). If the court in any Related Investor Action grants such a
Penalty Offset, Respondent agrees that it shall, within 30 days after entry of a final order granting
the Penalty Offset, notify the Commission’s counsel in this action and pay the amount of the
Penalty Offset to the Securities and Exchange Commission. Such a payment shall not be deemed
an additional civil penalty and shall not be deemed to change the amount of the civil penalty
imposed in this proceeding. For purposes of this paragraph, a “Related Investor Action” means a
private damages action brought against Respondent by or on behalf of one or more investors based
on substantially the same facts as alleged in the Order instituted by the Commission in this
proceeding.

By the Commission.

Vanessa A. Countryman
Secretary

16