UNITED STATES OF AMERICA

Before the

SECURITIES AND EXCHANGE COMMISSION

SECURITIES ACT OF 1933

Release No. 9725 / February 13, 2015

SECURITIES EXCHANGE ACT OF 1934

Release No. 74273 / February 13, 2015

ACCOUNTING AND AUDITING ENFORCEMENT

Release No. 3638 / February 13, 2015

ADMINISTRATIVE PROCEEDING

File No. 3-16386

In the Matter of

TRACI J. ANDERSON, CPA, 

TIMOTHY W. CARNAHAN,

AND

CYIOS CORPORATION

Respondents.

ORDER INSTITUTING 

ADMINISTRATIVE AND CEASEAND-DESIST PROCEEDINGS 

PURSUANT TO SECTION 8A OF THE 

SECURITIES ACT OF 1933, 

SECTIONS 4C AND 21C OF THE 

SECURITIES EXCHANGE ACT OF 

1934, AND RULE 102(e) OF THE 

COMMISSION’S RULES OF 

PRACTICE

I.

The Securities and Exchange Commission (“Commission”) deems it appropriate and in the 

public interest that public administrative and cease-and-desist proceedings be, and hereby are, 

instituted against: (i) Traci J. Anderson, CPA (“Anderson”) pursuant to Sections 4C1and 21C of 

the Securities Exchange Act of 1934 (“Exchange Act”) and 102(e)(1)(iii)2of the Commission’s 

 

1

Section 4C provides, in relevant part, that: 

The Commission may censure any person, or deny, temporarily or permanently, to any person the 

privilege of appearing or practicing before the Commission in any way, if that person is found . . . 

(1) not to possess the requisite qualifications to represent others . . . (2) to be lacking in character 

or integrity, or to have engaged in unethical or improper professional conduct; or (3) to have 

willfully violated, or willfully aided and abetted the violation of, any provision of the securities 

laws or the rules and regulations thereunder.

2 Rule 102(e)(1)(iii) provides, in pertinent part, that:

The Commission may censure a person or deny, temporarily or permanently, the privilege of 

appearing or practicing before it . . . to any person who is found...to have willfully violated, or 
2

Rules of Practice; and (ii) Timothy W. Carnahan (“Carnahan”) and CYIOS Corporation 

(“CYIOS”) pursuant to Section 8A of the Securities Act of 1933 (“Securities Act”) and Section 

21C of the Exchange Act. 

II.

After an investigation, the Division of Enforcement and the Office of the Chief Accountant 

allege that:

A. RESPONDENTS

1. Traci J. Anderson, CPA, age 46 and a resident of Charlotte, North Carolina, has 

functioned as a contract CFO to CYIOS Corporation since July 2007. From 2003 through August 

2010 Anderson was the sole proprietor of a PCAOB-registered public accounting firm and was 

engaged as CYIOS Corporation’s auditor from September 2005 until she resigned in July 2007 to 

become the company’s internal accountant. Anderson consented to a PCAOB order dated August 

12, 2010 pursuant to which she was barred from being an associated person of a registered public 

accounting firm. Additionally, Anderson consented in January 2012 to an order pursuant to which 

she forfeited her CPA license in North Carolina. Anderson remains licensed as a CPA in Florida.

2. Timothy W. Carnahan, age 47 and a resident of Pompano Beach, Florida, is the 

founder and is disclosed as the sole officer and director of CYIOS. Between 2006 and November 

2012, Carnahan signed and certified each of CYIOS’s periodic filings in the capacities of principal 

executive and principal financial officer.

3. CYIOS Corporation, a Nevada corporation headquartered in Washington D.C., is 

a Department of Defense contractor providing: systems integration; web and database 

development; business process management and improvement; and solutions for compliance with 

Sarbanes-Oxley regulations and Defense Contract Audit Agency and performance-based 

contracting for government contractors. Its common stock was registered under Section 12(g) of 

the Exchange Act and was traded on the OTC Bulletin Board (Symbol: CYIO). After receiving a 

letter dated May 12, 2014 from the Commission’s Division of Corporation Finance informing 

CYIOS that it was not in compliance with its reporting requirements under Section 13(a) of the 

Exchange Act, CYIOS filed a Form 15-12G on May 30, 2014 terminating the registration of its 

common stock.

B. ANDERSON WAS UNLAWFULLY ASSOCIATED WITH CYIOS AFTER THE 

PCAOB BARRED HER FROM ASSOCIATING WITH A REGISTERED 

PUBLIC ACCOUNTING FIRM

4. Section 105(c)(7)(B) of the Sarbanes-Oxley Act of 2002 (“Sarbanes-Oxley”) states 

that it is “unlawful for any person that is ... barred from being associated with a registered public 

accounting firm [...] willfully to become or remain associated with any issuer [...] in an 

accountancy or financial management capacity [...] without the consent of the [PCAOB] or the 

 

willfully aided and abetted the violation of any provision of the Federal securities laws or the rules 

and regulations thereunder.
3

Commission.” Section 105(c)(7)(B) also states that it is unlawful for any “issuer [...] that knew, or 

in the exercise of reasonable care should have known, of such suspension or bar, to permit such an 

association, without the consent of the Board or the Commission.” 

5. On August 12, 2010, the PCAOB filed a settled action against Anderson and her 

firm, Traci Jo Anderson, for multiple deficiencies in audit work performed between 2007 and 2009 

on public companies engagements unrelated to CYIOS (the “PCAOB Order”).3 The PCAOB 

Order, which was and is available on its website, revoked the registration of her accounting firm 

and barred Anderson from being an associated person of a registered public accounting firm. 

6. Following the issuance of the PCAOB Order, Anderson advised each of her firm’s 

public company audit clients that she must withdraw because she had been barred by the PCAOB 

as a result of violations of PCAOB rules and auditing standards.

7. Around the same time, Anderson orally notified Carnahan—who was already aware 

of the PCAOB’s investigation of Anderson— and CYIOS’s then Director of Finance about the 

existence of the PCAOB Order and directed him to the PCAOB website. Consequently, CYIOS 

and Carnahan knew or, in the exercise of reasonable care, should have known that Anderson had 

been barred from associating with a registered public accounting firm.

8. After the PCAOB Order was issued, Anderson continued to perform accountancy 

and financial management services for CYIOS. It was Carnahan’s decision to maintain CYIOS’s 

business relationship with Anderson. Anderson’s services included providing CFO and general 

accounting services, assisting CYIOS’s CEO in preparing Commission filings – including Forms 

10-Q and 10-K – as well as other prohibited services. CYIOS paid Anderson at least $244,035 for 

her services between August 2010 and June 2014.

9. Anderson never requested or received consent from the PCAOB or the Commission 

to remain associated with CYIOS in this capacity. 

C. CYIOS FAILED TO MAKE PERIODIC FILINGS REQUIRED UNDER 

SECTION 13(A) OF THE EXCHANGE ACT 

10. Section 13(a) of the Exchange Act and the rules promulgated thereunder require 

issuers with classes of securities registered pursuant to Section 12 of the Exchange Act to file 

periodic and other reports with the Commission. Rules 13a-1 and 13a-13 require, respectively, the 

filing of accurate annual and quarterly reports (i.e., Forms 10-K and 10-Q).

11. CYIOS ceased making filings required under Section 13(a) of the Exchange Act 

after it filed its third quarter 2012 Form 10-Q in November 2012. Specifically, CYIOS failed to 

file its 2012 Form 10-K, its 2013 Forms 10-Q and 10-K, and its first quarter 2014 Form 10-Q.4 

CYIOS filed a Form 15-12g on May 30, 2014 which terminated the registration of its common 

 

3

See PCAOB Release No. 105-2010-007, available at 

http://pcaobus.org/Enforcement/Decisions/Documents/Traci_Jo_Anderson.pdf.

4 CYIOS filed Forms 12b-25 to disclose it was unable to file its 2012 Form 10-K or first quarter 2013 Form 

10-Q when due, but did not do so for subsequently due filings.
4

stock. Carnahan authorized each filing CYIOS made with the Commission and was responsible 

for CYIOS not making filings required under Section 13(a) of the Exchange Act.

D. CARNAHAN FAILED TO ASSESS INTERNAL CONTROLS

i. Legal Requirements

12. In relevant part, Rule 13a-15(a) states that every issuer with a class of securities 

registered under Section 12 of the Exchange Act and was either required to file an annual report 

pursuant to Section 13(a) or 15(d) of the Exchange Act for the prior fiscal year or had filed an 

annual report for the prior fiscal year, must maintain internal control over financial reporting

(“ICFR”). Rule 13a-15(f) defines ICFR as process designed by the issuer’s executive management 

to provide reasonable assurance regarding the reliability of financial reporting and the preparation 

of financial statements for external purposes in accordance with generally accepted accounting 

principles. 

13. Rule 13a-15(c) requires management of such issuers to evaluate, with the 

participation of the principal executive and principal financial officers (or persons performing 

similar functions) the effectiveness of the issuer’s ICFR as of the end of each fiscal year. Rule 

13a-15(c) states that there are many different ways to conduct an evaluation of internal controls 

over financial reporting to meet the requirements of this rule, and that an issuer can comply with 

this requirement by conducting an evaluation in accordance with interpretive guidance issued by 

the Commission in Release No. 34-55929, Commission Guidance Regarding Management’s 

Report on Internal Control Over Financial Reporting Under Section 13(a) or 15(d) of the 

Securities Exchange Act of 1934, (the “2007 Guidance”). 

14. The registrant “must maintain evidential matter, including documentation, to 

provide reasonable support for management’s assessment of the effectiveness of the registrant’s 

internal control over financial reporting,” as stated in the instructions to Regulation SK, Item 308, 

Internal Control over Financial Reporting. The 2007 Guidance similarly states “Management is 

responsible for maintaining evidential matter, including documentation to provide reasonable

support for its assessment. 

15. Rule 13a-14, Certification of Disclosure in Annual and Quarterly Reports, requires 

each Form 10-Q and 10-K to include certifications signed by each principal executive and 

principal financial officer of the issuer (or persons performing similar functions). Among other 

things, the certifying officers must confirm that the report does not contain any untrue statement of 

a material fact or omit to state a material fact necessary to make the statements made, in light of the 

circumstances under which such statements were made, not misleading with respect to the period 

covered by [the] report.

ii. Carnahan’s Assessments of Internal Control over Financial Reporting

16. CYIOS’s Forms 10-K for the fiscal years ended December 31, 2009, 2010, and 

2011 include management’s report on ICFR, as required by Exchange Act Rule 13a-15(c) and Item 

308 of Regulation S-K. CYIOS also included management’s report on ICFR in its 2010, 2011, and 
5

2012 Forms 10-Q. 5 CYIOS stated in each report that management had assessed ICFR using the 

criteria set forth by the Committee of Sponsoring Organizations of the Treadway Commission in 

Internal Control – Integrated Framework (the “COSO Framework”).

17. These statements were false. CYIOS either did not evaluate ICFR, or did not

evaluate ICFR using the COSO Framework.

18. In addition, CYIOS did not maintain any documentation of management’s 

assessments of ICFR. As discussed in the 2007 Guidance and stated in the instructions to 

Regulation S-K, Item 308, a registrant “must maintain evidential matter, including documentation, 

to provide reasonable support for management's assessment of the effectiveness of the registrant's 

internal control over financial reporting.”

19. For these reasons, Carnahan’s certifications that CYIOS had assessed ICFR using 

the COSO Framework were false. 

E. OFFERS AND SALES OF SECURITIES

20. After filing its 2009 Form 10-K on February 26, 2010, CYIOS issued, in exchange 

for consulting services and debt conversions, common stock under a registration statement filed on 

Form S-8 (No. 333-147695, filed November 29, 2007). This registration statement incorporated by 

reference subsequent filings, including CYIOS’s 2009 Form 10-K and 2010 Forms 10-Q.

F. VIOLATIONS

21. As a result of the conduct described above, Anderson willfully violated, CYIOS

violated, and Carnahan caused CYIOS’s violation of, Section 105(c)(7)(B) of Sarbanes-Oxley, 

which prohibits a person barred from associating with a registered public accounting firm from 

willfully becoming or remaining associated with an issuer in an accountancy or financial 

management capacity without consent of the PCAOB or the Commission and prohibits an issuer 

that knew or, in the exercise of reasonable care, should have known of such a bar, to permit such

an association, without the consent of the PCAOB or the Commission.

22. As a result of the conduct described above, CYIOS violated, and Carnahan caused 

CYIOS’s violations of, Sections 17(a)(2) and 17(a)(3) of the Securities Act. Section 17(a)(2)

makes it unlawful to, in the offer or sale of securities, obtain money or property by means of any 

untrue statement of a material fact or any omission to state a material fact necessary in order make 

the statements made, in light of the circumstances under which they were made, not 

misleading. Section 17(a)(3) makes it unlawful to engage in any transaction, practice, or course of 

business which operates or would operate as a fraud or deceit upon the purchaser.

23. As a result of the conduct described above, CYIOS violated, and Carnahan caused 

CYIOS’s violations of, Section 13(a), and Rules 13a-1 and 13a-13 thereunder, which require 

 

5

Issuers are not required to disclose its assessment of ICFR in quarterly filings, but CYIOS nonetheless 

included and asserted in each 2012 Form 10-Q that management had conducted an assessment of ICFR and 

concluded that it was “effective.” 
6

issuers with classes of securities registered pursuant to Section 12 of the Exchange Act to file 

periodic and other reports with the Commission.

24. As a result of the conduct described above, Carnahan violated Rule 13a-14 of the 

Exchange Act, which requires an issuer’s principal executive and principal financial officer to 

attest that the company’s “report does not contain any untrue statement of a material fact.”

25. As a result of the conduct described above, Carnahan violated Rule 13a-15(c) of the 

Exchange Act, which requires each issuer’s management, with the participation of the principal 

executive and principal financial officer, or persons performing similar functions, to perform an 

evaluation of the company’s ICFR as of the end of each fiscal year.

III.

In view of the allegations made by the Division of Enforcement and the Office of the Chief 

Accountant, the Commission deems it necessary and appropriate in the public interest that public 

administrative and cease-and-desist proceedings be instituted to determine:

A. Whether the allegations set forth in Section II hereof are true and, in connection 

therewith, to afford each Respondent an opportunity to establish any defenses to such allegations; 

B. Whether, pursuant to Section 21C of the Exchange Act, Respondents should be 

ordered to cease and desist from committing or causing any violation and any future violation of 

Section 105(c)(7)(B) of Sarbanes-Oxley.

C. Whether, pursuant to Section 8A of the Securities Act, CYIOS and Carnahan should 

be ordered to cease and desist from committing or causing any violation and any future violation of 

Sections 17(a)(2) and 17(a)(3) of the Securities Act;

D. Whether, pursuant to Section 21C of the Exchange Act, CYIOS and Carnahan should 

be ordered to cease and desist from committing or causing any violation and any future violation of

Section 13(a) of the Exchange Act and Rules 13a-1 and 13a-13 thereunder;

E. Whether, pursuant to Section 21C of the Exchange Act, Carnahan should be ordered 

to cease and desist from committing or causing any violation and any future violation of Rules 13a14 and 13a-15; 

F. Whether, pursuant to Section 4C of the Exchange Act and Rule 102(e) of the 

Commission’s Rules of Practice, Anderson should be censured or denied, temporarily or permanently, 

the privilege of appearing or practicing before the Commission as an accountant; 

G. Whether, pursuant to Section 8A of the Securities Act and Section 21B of the 

Exchange Act, civil penalties should be levied against Respondents; and

H. Whether, pursuant to Section 8A of the Securities Act and Sections 21B and 21C, 

respectively, of the Exchange Act, CYIOS and Anderson should be subject to disgorgement with 

prejudgment interest.
7

IV.

IT IS ORDERED that a public hearing for the purpose of taking evidence on the questions 

set forth in Section III hereof shall be convened not earlier than 30 days and not later than 60 days 

from service of this Order at a time and place to be fixed, and before an Administrative Law Judge 

to be designated by further order as provided by Rule 110 of the Commission's Rules of Practice, 17 

C.F.R. § 201.110.

IT IS FURTHER ORDERED that Respondents shall file an Answer to the allegations 

contained in this Order within twenty (20) days after service of this Order, as provided by Rule 220 

of the Commission's Rules of Practice, 17 C.F.R. § 201.220. 

If a Respondent fails to file the directed answer, or fails to appear at a hearing after being 

duly notified, the Respondent may be deemed in default and the proceedings may be determined 

against him upon consideration of this Order, the allegations of which may be deemed to be true as 

provided by Rules 155(a), 220(f), 221(f) and 310 of the Commission's Rules of Practice, 17 C.F.R. 

§§ 201.155(a), 201.220(f), 201.221(f) and 201.310.

This Order shall be served forthwith upon Respondents as provided for in the 

Commission’s Rules of Practice.

IT IS FURTHER ORDERED that the Administrative Law Judge shall issue an initial 

decision no later than 300 days from the date of service of this Order, pursuant to Rule 360(a)(2) of 

the Commission’s Rules of Practice.

In the absence of an appropriate waiver, no officer or employee of the Commission engaged 

in the performance of investigative or prosecuting functions in this or any factually related 

proceeding will be permitted to participate or advise in the decision of this matter, except as witness 

or counsel in proceedings held pursuant to notice. Since this proceeding is not “rule making” within 

the meaning of Section 551 of the Administrative Procedure Act, it is not deemed subject to the 

provisions of Section 553 delaying the effective date of any final Commission action.

By the Commission.

Brent J. Fields

Secretary