The PCAOB has three ongoing initiatives that could make fundamental changes in auditing: (1) Consideration of ways to promote auditor independence, including mandatory audit firm rotation; (2) Consideration of changes to the auditor's reporting model, including a possible Auditor's Discussion and Analysis requirement; and (3) Consideration of increasing audit transparency by requiring disclosure of the name of the engagement partner and of all audit firms that participated in the audit. Each project could have a significant impact on audit committees and their responsibilities. The speech outlines some questions audit committee members ought to be considering regarding each of the initiatives and urges them to participate in the PCAOB's decision-making by filing comments.
The PCAOB is also seeking to improve auditor/audit committee communications and to promote audit committee understanding of the relevance of PCAOB inspection observations to audit committee oversight. The speech suggests four broad questions that audit committee members should ask their auditor regarding the auditor's PCAOB inspection and how the inspection results might impact the company's financial reporting. In particular, if the auditor claims that an audit deficiency was merely the result of a failure to document procedures that were performed, or simply the product of a difference of professional judgment, the audit committee should be skeptical and should require the auditor to provide a very specific explanation.
Audit Committees and the Work of the PCAOB
I am very pleased to be here today. It is an especially good time to be talking to audit committee members about their role and that of the auditor. Both in the U.S. and abroad, some of the fundamental premises of auditing are under scrutiny, and changes that could profoundly affect both auditors and audit committees are on the agenda. It is critical that audit committee members — who are on the frontlines in maintaining investor confidence in financial reporting — play an active role in the debate.
Nine years ago the PCAOB was created, in the wake of Enron, WorldCom, and other financial reporting scandals, to inspect the audits of public companies and to write the auditing standards that govern those audits. At the same time, Congress put audit committees squarely at the center of the auditor/public company relationship. The result was a sea change — for the better, I believe — in how both auditors and audit committees perform their duties.
Now, the financial crisis and its aftermath have triggered another re-examination of the operation and oversight of our capital markets. The role of the auditor in providing investors with assurance regarding financial reporting is no exception. Financial statement users have asked whether, to promote independence and professional skepticism, time limits should be placed on the ability of large public companies to retain their auditor; whether the auditor's report continues to have value and relevance to users; and whether the report should expand to include new information. A related issue is whether and how auditor/audit committee communications could be strengthened in the post-crisis environment.
I am going to outline the Board's initiatives to address investors' concerns in these areas. All are controversial, and final decisions have not been made about any of them. However, whether you agree or disagree with them, these projects raise questions that audit committee members should care deeply about. If I leave you with nothing else today, I hope you will take away how important it is that those with practical experience on audit committees comment on our proposals so that the Board will have the benefit of your views.
Before I go further, I want to note that the views I express are my own, and not necessarily those of the Board, or of its other members or staff.
I. Independence/Audit Firm Rotation
I want to start with the most fundamental issue — auditor independence. Audits only have value if they are performed — and appear to users to be performed — by auditors that are independent and that approach their work with an attitude of professional skepticism.
Unfortunately, this is not always the case. The PCAOB's inspection program continues to uncover too many instances in which auditors did not approach some aspect of their work with the required independence, objectivity, and professional skepticism. A brief review of the public portions of the inspection reports we issue will provide you with numerous examples. The auditing of the valuations assigned to illiquid securities, of impairment determinations, and of management estimates, and going concern evaluations are examples of areas particularly prone to breakdowns in skepticism and unquestioning reliance on management.
To address this issue, in August, the Board issued a concept release seeking public comment on ways in which the Board could strengthen auditor independence, objectivity and professional skepticism. The release focuses particularly on mandatory rotation of audit firms. Audit firm rotation — that is, a term limit on how long an audit firm can serve a public company client — has been discussed since the 1970s. There are strongly-held views on both sides of the issue.
Proponents of rotation believe that setting a time limit on the audit relationship could free the auditor from the effects of pressure to keep the client happy in order to preserve the relationship. They also point out that rotation would build into auditing a periodic opportunity for a fresh look at the company's financial reporting by a firm that does not have a vested interest in standing by the prior opinions. Beyond that, many simply believe that auditor/public company relationships that go back many decades — 50 or 100 years in some cases — are just incompatible with skepticism and independence.
Rotation opponents have concerns about the costs of changing auditors — both in terms of the time and disruption imposed on the client's financial reporting staff and of the effort that the audit firm must devote to learning a new client's business and financial reporting system. Ultimately, of course, the company bears the cost of that effort. Some evidence also suggests that the risk of audit failure may increase in the early years of an engagement, while the new auditor is still moving up the learning curve, and that rotation could therefore actually reduce audit quality.
The PCAOB is not alone in considering the possibility of mandatory rotation. Recent press reports suggest that the EC is about to publish several far-reaching proposals aimed at enhancing professional skepticism, including mandatory firm rotation after nine years; required joint audits (i.e., two firms must participate in every audit); and the divestiture of audit firm consulting businesses, so that auditors engage only in auditing.
Mandatory rotation would obviously have a major impact on audit committees, as well as on auditors. The committee would no longer have unfettered discretion over whether and when to change auditors. When rotation was required, the burdens of soliciting proposals and hiring a new firm would be unavoidable. Beyond that, some issues raised in the PCAOB independence concept release on which audit committees should speak up include —
- From an audit committee perspective, would audit firm rotation enhance auditor independence and professional skepticism? You see the auditor/company relationship firsthand. Do you believe that term-limiting the auditor would make for better auditing? Would it increase your confidence in the auditor's objectivity?
- Has your audit committee considered implementing audit firm rotation voluntarily? If so, what was the result? If not, why not?
- What is your experience with the cost impact of changing auditors? Does an auditor change impose burdens on the company's financial reporting staff? Are there “learning curve” audit fees associated with a new engagement?
- Are there approaches other than rotation that would enhance audit committee oversight in a way that would meaningfully improve auditor independence?
I have serious doubts that across-the-board mandatory rotation is a practical or cost-effective way of strengthening independence. More tailored approaches, such as requiring rotation of a long-tenured auditor when a PCAOB inspection finds a lack of professional skepticism, or giving audit committees a choice between rotation of a long-serving auditor or periodic joint audits, might be avenues worth exploring. However, after nearly nine years of inspections experience, it is the appropriate time for the PCAOB to examine independence. And, it is hard to get away from the idea that we need to do more to promote professional skepticism.
II. Auditor's Reporting Model
The second fundamental premise of auditing under review is what the auditor should report — that is, what the end product of the audit should be. Today, the only visible result of the thousands of hours (and sometimes millions of dollars) that go into the audit is a short, boilerplate, pass-fail report. Few financial statement users bother to read that report — except to make sure that it is in fact the standard, unqualified report.
As in the case of independence, the financial crisis has caused investors to question the traditional approach. Fairly or unfairly, many feel that, in the run-up to the crisis, auditors could and should have provided more information about the risks and uncertainties financial institutions faced. Clean audit opinions, issued just a few months before major institutions either collapsed or required multi-billion dollar government bailouts have understandably raised questions about the value of those opinions.
An informal survey conducted by the Board's Investor Advisory Group illustrates these concerns. The survey found that 45 percent of investor respondents believe the current audit report does not provide valuable information that is integral to understanding financial statements. Almost one in five thought that the standard, unqualified report was of no use to them at all.
In light of this dissatisfaction with the traditional pass-fail report, in 2010 the Board undertook a project to explore whether and how the auditor's reporting responsibilities could expand. Last year and in early 2011, we held a series of focus group meetings with investors, preparers, auditors, and others to get ideas about how to improve auditor reporting. Based on that work, in June, the Board issued for public comment a concept release that focuses on four alternatives.
- Auditor's Discussion and Analysis : The most far-reaching approach would be to require the auditor to provide an auditor's discussion and analysis, similar to management's discussion and analysis. The AD&A would be a narrative report and would provide the auditor with a vehicle to discuss his or her views regarding significant financial reporting and auditing issues. The AD&A might discuss the audit itself, such as risks identified, the audit procedures that addressed those risks, and their results. However, the AD&A could also include a discussion of the auditor's views regarding the company's financial statements, such as an assessment of management's judgments and estimates, of its selection and application of accounting principles and policies, and of difficult or contentious issues that had to be resolved, including "close calls" — decisions that could have gone either way -- and their effect on the financial statements.
- Emphasis Paragraphs : Another alternative would be to require the use of emphasis paragraphs. The auditing standards already permit auditors to include additional paragraphs in their opinions to emphasize the importance of particular matters, such as related party transactions or events subsequent to the end of the reporting periods. It might be possible to super-charge the emphasis paragraph concept by requiring auditors to highlight the matters in the financial statements or in the management disclosures that, in the auditor's view, are the most critical to an understanding of the company and its financial position. Emphasis paragraphs could be tied to items disclosed elsewhere or could be used to introduce new information.
- Auditor Assurance on Other Information Outside the Financial Statements : A third possibility would be to require auditors to audit information outside the financial statements, such as management's discussion and analysis, earnings announcements, or non-GAAP information in company releases. This approach would take the auditor's traditional role of attesting to management assertions, but extend it into new areas.
- Clarification of the Standard Auditor's Report : A final idea is to expand and clarify some of the key language in the standard audit report. Some of the terminology that could be clarified includes the meaning of providing “reasonable assurance”; the extent of, and limitations on, the auditor's responsibility to detect fraud; the auditor's responsibility for footnote disclosures; the extent of the auditor's responsibility for financial information accompanying, but outside of, the financial statements; and the meaning of auditor independence.
Changes in the auditor's reporting model could have a profound affect on auditing. They could also have a profound effect on audit committees. Here are a few of the issues you might want to think about and give us your thoughts on —
- Today, auditors communicate to the audit committee much of the information that might appear in an auditor's discussion and analysis. How would audit committee oversight be affected if the auditor's views on such things as management's judgments and choices regarding accounting principles became public? Would the substance and candor of auditor/audit committee communications change?
- In light of the committee's responsibility to oversee company financial reporting, how would an audit committee react to a situation in which the auditor raised questions, in an AD&A report, about some aspect of the company's financial reporting? Would it be necessary to conform to the auditor's preferences? Would the effect be to put the auditor, rather than management, in charge of making the difficult calls?
- How would a requirement that the auditor prepare a free-written narrative report on the company's financial reporting affect the level of audit effort and the nature of the relationship between the auditor and the audit committee? Would the content of these reports be negotiated between the auditor, the committee, and management? Would the lawyers have to become involved?
In my view, it is doubtful whether financial reporting would benefit from requiring auditors to create their own information about the company's financial reporting or to publish their own views about matters that are within the realm of management judgment. However, even without requiring auditor-created commentary, there is still considerable room to expand the scope and relevance of auditor communications, such as through requiring the auditor to attest to portions of the MD&A or to emphasize the importance of information that management itself has disclosed. As in the case of independence, however, it is hard to conclude that nothing at all should change, given the dissatisfaction of investors -- those for whose benefit the audit is performed — with the current reporting model.
Before I leave auditor reporting, I want to mention another Board initiative relating to what is in the auditor's report. While more limited in scope, this project — which we refer to as increasing audit transparency — could also make significant changes in the information users receive about audits. The transparency project has two aspects.
First, some time ago, the Board asked for public comment on whether the engagement partner should sign the audit report in his or her own name, along with the name of the firm. (Partner signature is already the norm in Europe and some other parts of the world.) Views were mixed. Auditors were generally opposed to the idea, but there was strong support among investors. Many feel that, at minimum, disclosure in the audit opinion of the name of the engagement partner would be in keeping with modern concepts of transparency and would promote a sense of personal responsibility.
In addition, the Board is considering requiring disclosure by the principal auditor of all of the other audit firms that participated in the audit. Today, in most cases, the audit opinion leaves the impression that all of the work was done by the firm that signed the opinion. That is often not the case.
For example, most large companies conduct operations around the world, and work on their audits is therefore performed in many countries. Typically, the auditors in each country are separate, semi-autonomous firms, even though they are part of the same global network as the principal auditor. At the other end of the spectrum, we are increasingly seeing cases in which a small U.S. accounting firm purports to audit a foreign company with most of its operations in an emerging market, such as in China. The U.S. firm accomplishes this feat by contracting with an accounting firm in the company's home country. Disclosure of participating firms would shine a light on these relationships and give users a better idea of whose work they are relying on when. It would also afford users the opportunity to determine whether particular participating firms have had PCAOB inspections and, if so, what the results were.
This type of information should also be important to audit committees. We know from our inspections that firm quality varies from country to country, even when the firms in question have the same name and are part of the same global network. The extent to which the engagement partner at the signing firm understands these quality differences and exercises strong supervision over the work of his or her foreign colleagues also varies. If your company's audit entails work that is performed by multiple firms, including affiliates of the principal auditor, I would recommend that you ask questions about the role of these other firms and how the engagement partner will monitor the quality of their work. This is particularly important if portions of the audit will be performed in emerging markets.
The Board will be making formal proposals on both of these topics later this month. I hope you will consider how these disclosures would impact audit committees and provide us with your comments.
IV. PCAOB Inspections and Audit Committees
The final area I want to mention is the importance that the Board places on the work of audit committees. The Sarbanes-Oxley Act had two broad goals — to create the PCAOB to oversee public company auditing and to strengthen the role of audit committees. We see those goals as linked and inter-dependent. With that in mind, the Board has two initiatives underway designed to support audit committees.
First, we have proposed to update and expand the information that auditors are required to communicate to audit committees. This project clarifies and brings together in one place existing communication requirements. In addition, the proposal would require the auditor to discuss overall audit strategy and risks with the audit committee and to make inquiries to the audit committee regarding matters relevant to the audit. The new standard would also enhance auditor communications regarding the company's policies, practices, and estimates, and the auditor's evaluation of the company's financial reporting. The trick is to accomplish these goals without turning the communication process into a check-the box exercise or burdening the audit committee with detailed information that is not useful.
Second, the Board wants to make sure that audit committees understand the role that PCAOB inspections play and how Board inspections observations may assist audit committees in their oversight and evaluation of their auditor. To this end, the Board is considering publishing guidance to help committees in understanding our inspections. There are statutory limits on how much the Board can publicly disclose about an inspection. But, there are no limits on what any audit committee can ask its auditor about the firm's inspection and its impact on the company's audit. We would like to give audit committees a road map that will lead them through those discussions.
Our guidance is still a work-in-process. However, in my view, there are four broad questions audit committees should ask about their PCAOB inspection.
- Is the PCAOB reviewing our engagement as part of its inspection of your firm?
The Board does not notify the company when its audit is being reviewed as part of an inspection of the audit firm. Therefore, in order to avoid surprises, audit committees should make sure they will be informed by their auditor if the company's audit is selected for PCAOB inspection. Of course, you might hear about the inspection in another way. As part of reviewing an audit, the Board sometimes interviews the audit committee chair to assess the accounting firm's relationship and communications with the committee. These interviews are usually conducted by telephone. Inspectors are not trying to assess the audit committee, but are trying to understand auditor/audit committee communications and the relationship between the committee and the auditor.
- Did the PCAOB identify issues with our audit in your inspection report?
If the inspections staff concludes that an audit opinion was issued without proper evidentiary support or, worse still, that the financial statements were materially inaccurate, the audit failure will be described in the public portion of the firm's PCAOB inspection report. In many cases, the Board also reports the company to the SEC. Having your engagement cited as deficient in an inspection report should be a significant concern to the audit committee.
Companies are not identified by name in PCAOB inspection reports and the Board does not communicate directly with managements or audit committees. Therefore, you can only learn that we have a problem with your audit or your financial statements from your auditor. Make sure to ask. Many auditors would likely take the initiative to notify the client if it is the subject of an adverse PCAOB inspection finding. Even so, you might prefer to have an early warning. During the course of an inspection and long before the inspection report is released, the PCAOB staff issues comment forms to the audit firm raising questions and seeking more information when something about an audit seems questionable. It may be prudent for audit committees to ask to be notified if a comment is issued regarding their audit. Firms will not necessarily volunteer that information, unless asked.
- If the Board did find a problem with the company's audit, what is the firm's response?
If the PCAOB identified your company's audit as deficient, the auditing standards require the firm to consider the need to cure the problem by performing additional work. Audit committees should understand what the firm intends to do about the deficiency, particularly if the firm's conclusion is that no action is needed. In that regard, two explanations that we commonly hear in response to inspection findings are that the PCAOB's findings are merely the result of a failure to document in the audit work papers procedures that were actually performed, or that the inspection deficiency is simply the product of a difference of opinion on a matter of professional judgment.
Based on nine years of reading inspection findings and discussing them with the PCAOB staff, I would advise audit committees to take both of these explanations with a grain of salt. It is unusual for significant work to be performed, but not documented. And, in the PCAOB's view, we do not include matters as audit deficiencies in our reports if we believe that reasonable professionals could reach different judgments concerning them. At minimum, I would urge that, when you hear the words “it was just a documentation problem” or “it was a matter of professional judgment” that your antennae go up and that you require the auditor to provide a very specific explanation of the nature of the problem and why the PCAOB inspectors concluded it was an audit failure. You may well come to the conclusion — as we often do — that there is more involved than a failure to write something down or a difference in professional judgments.
- Did the Board identify any issues with your firm's quality controls that could affect our audit?
The non-public part of an inspection report discusses the Board's conclusions regarding quality control deficiencies at the firm. Examples include inadequate supervision, weak firm procedures in specific audit areas, or an unhealthy “tone-at-the-top.” This part of the report may also cite specific audits that illustrate quality control breakdowns. Audit committees should be curious whether their engagement is referred to in that discussion. More broadly, it would be prudent to ask how the firm plans to satisfy the PCAOB that it is addressing quality control matters, and how the resulting changes in firm procedures and controls will affect your audit in the future.
These questions are just my suggestions. As I noted earlier, however, the Board wants to help audit committees understand the PCAOB inspection process and what it means for audit committee oversight. You are likely to see some guidance on these topics in the near future. I would be interested in any suggestions you might have for what would be helpful to audit committees.
As I said at the beginning, the financial crisis and its aftermath have triggered a re-examination of the role of the auditor and of how we can strengthen and maintain public confidence in the credibility and utility of the profession's work. The PCAOB has several important initiatives that are designed to accomplish that goal. I look forward to hearing your views on the initiatives, and would also, of course, welcome any questions.