Audit Firm Leadership: Navigating the Future

Remarks as prepared for delivery

Thank you, Jose, for that kind introduction and for the invitation to speak today. Good day! Bom dia!

Before I go any further, everyone should understand that the views I express today are my own. They do not necessarily reflect the views of the PCAOB, my fellow Board members, or the staff of the PCAOB.

The CMVM has arranged a very timely and important webinar. To paraphrase, the Conference asks us to consider “how to build the audit of tomorrow in times of uncertainty.” Given the subject matter, I am glad that today’s audience includes not only auditors but also audit committee members and those who study auditing.

Auditors have a special – a foundational - role in the world’s capital markets. Your clients and their investors rely on you. In an extraordinarily complex world, the challenges that lie ahead apply to audit firms, both small and large. These challenges also apply to firms that audit private entities, as well as to those that audit public interest entities. The scale may be different, but the issues are the same. Investors, audit committees, and even management depend on your skill, your care, and your judgment – together with what we might call your leadership – as auditors.

We are now at a moment in history when auditors are on the cusp of a technological revolution, and potentially also a governance revolution. Embracing new techniques and tools is going to be vital to allowing us to build the audit of tomorrow. In many ways, audit firms today are like the great explorers of old – navigating the vast and often uncertain waters of transformation.

Of course, that’s nothing new for you, as inheritors of the great traditions of the Portuguese explorers. Successful oceangoing voyages depended on technological ingenuity and a capable crew. But they also depended on the vision, care, and good judgment of the captain. In other words, leadership.

At the outset, let’s remember that the oceans of auditing public companies can be rough. To be clear, the work you do is both vitally important and difficult. Like the seafaring captains of old, if audit firm leaders don’t guide their ships carefully, the result can be shipwrecks on dangerous rocky shoals.

Let’s briefly consider some of those audit shipwrecks because their lessons are still relevant today. In the late 1930s, one of the major U.S. audit firms failed to uncover a far-reaching fraud at a pharmaceutical company called McKesson Robbins. The audit firm failed to audit inventory and accounts payable. In fact, some of the senior officers of the issuer were even using phony names. The effects of this fraud helped start a series of changes to the audit requirements for public interest entities. These included most importantly a requirement that the certifying accountant state that the audit “was made in accordance with generally accepted auditing standards” and indicate whether and why any necessary procedures had been omitted. What was then called the American Institute of Accountants also mandated the auditing of inventory and accounts receivable, which up until that point had not been required.

At the beginning of this century, scandals accompanied the dot-com bubble, including the infamous Enron and WorldCom failures. But there was also a raft of other hundred-million-dollar restatements of the financials of U.S. listed companies. Together, the need for independent supervision of the auditors of those listed companies led to the enactment in 2002 of the Sarbanes-Oxley Act.

The Sarbanes-Oxley legislation, first and foremost, created the organization on whose board I sit: the Public Company Accounting Oversight Board, or PCAOB. The law gives the PCAOB authority to register audit firms that wish to audit public interest entities—PIEs, or what we in the U.S. generally call “public companies.” It also requires the PCAOB to issue audit and related standards, to inspect audit reports of PIEs, and to investigate and bring disciplinary proceedings against audit firms and their personnel that seriously breached PCAOB audit standards.

Sarbanes-Oxley also imposed significant new requirements, in connection with the audit and issuance of financial statements. These included: a ban for audit firms on the provision of specified types of consulting services to audit clients, a requirement that an independent audit committee be responsible for retaining and overseeing the auditor, requiring CEO and CFO certification of financial statements, and requiring maintenance and audit of the PIE’s internal controls over financial reporting.

Additional changes were made to the PCAOB’s authority in the wake of the 2007-08 financial crisis and the uncovering of the Bernie Madoff fraud, especially expanding the work of the PCAOB to audits of securities broker-dealers registered with the SEC. Further changes were made in recent years to enhance the PCAOB’s authority to inspect auditors of companies listed on American stock exchanges located in foreign jurisdictions, especially China.

Fast forward to today’s “auditing oceans.” Audit firms and the PIEs they audit often operate globally. And so do we. The PCAOB registers audit firms from around the world, including four from Portugal. We conduct inspections in more than 50 non-U.S. jurisdictions and have entered into cooperation agreements with about 30 foreign audit regulators. You can find all our inspection reports and cooperation agreements on our website. As chair of the Global Audit Quality (GAQ) Working Group of the International Forum of Independent Audit Regulators (IFIAR), I also get to see the ways that firms are tackling challenges in multiple jurisdictions.

Managing the audits of global public companies whose operations are located around the world is hard enough. But we are entering a new era of technology and audit firm governance, as today’s agenda shows. Advances in technology, especially the deployment of artificial intelligence, are changing the way financial statements are being prepared and audited. Some audit firms needing more capital are engaging in novel financing transactions. These include: taking on significant debt; raising capital through the creation of alternative practice structures in which the attest function is linked by a services agreement to the rest of the firm, which is at least partially owned by private equity investors; mergers among mid-size firms; combined management of some firms to create cross-border “platforms” within global networks; and purchases of some firms within a global network by larger firms in that network.

Additionally, new types of assets are appearing on corporate balance sheets. These include digital assets and private market instruments, such as syndicated private debt obligations. Some of these new assets present a range of complexities for auditors. For example, digital assets may utilize smart contracts, decentralization, and a range of custody relationships.

Furthermore, there are concerns about the attractiveness of the audit profession to young people in many countries.

With these and other changes going on, leading an audit firm has never been more challenging. Firm leadership has to start with instilling a firm culture of audit excellence and professional skepticism for every engagement. Firm leadership must also include emphasizing training and professionalism and encouraging young auditors to speak up. But it can’t stop there. Audit firm leaders must look into the future and navigate complex and difficult waters. Forward-looking audit firm governance is essential.

Let’s go back to my ocean voyage metaphor. Consider two great Portuguese innovations, the Caravel Ship and the Astrolabe. As we sail into the changes we know lie ahead, what can tell us – like the Astrolabe – where we are? How does the captain know where he or she is? And what does the captain use as a North Star?

If you accept my metaphor, I think that a firm’s quality control is in many ways the Astrolabe of audit quality. Quality control standards – whether the IAASB’s ISQM 1 or the PCAOB’s QC 1000 – could have been written for this moment. Each places a firm’s risk assessment process, along with its governance and leadership, at the top of the firm’s quality objectives. In many ways, these requirements come together in the idea of firm culture. In other words: the way senior management fosters a high-quality audit.

Ultimately, how can we create the culture of professional skepticism and critical thinking needed to protect our markets and those who invest in them? How does a firm use a variety of methods to incentivize appropriate behavior, especially when time for the audit is compressed? How does a firm, through its systems, policies, and procedures, cultivate and support audit quality? The goal, to borrow from a recent speech by my colleague George Botic, is to build a firm on the principle that “financial statement auditing is more than a technical exercise. It is broadly rooted in the auditor’s integrity and ability to exercise sound judgment.”¹

An effective quality control system is there to support these qualities in an auditor and allow you to exercise your good judgement. You also need to keep learning to stay on top of your game. All of this is not easy. Modern firm leadership requires looking out across the range of issues the firm confronts and knowing where you want to navigate the firm for the future. It also requires vigorous efforts to involve employees at all levels of the firm in the drive for excellence, especially by maintaining a “listening atmosphere” so that you hear a wide range of views.

Consider how these principles might apply to the developments I just discussed.

The deployment of artificial intelligence affects the entire financial statement landscape. We know AI can be a tool that can enhance audit quality, but we also know that it can be used to create false data and documents at breakneck speed and to commit fraud. How does the auditor understand an AI-produced or aided financial statement, especially from a global company whose data systems don’t talk to one another or where data is siloed or is not clean? How does one audit the controls on such a system, or understand how it gathers the information that is to be audited? And if the auditor uses AI tools themselves, how can the human reviewer within the firm exercise meaningful oversight, let alone professional skepticism? 

These are exactly the questions that both ISQM-1 and QC-1000 ask you to deal with. For example, how do you assess the risks of a new AI tool and create a system of governance that mitigates those risks? 

The growing costs of technology, hiring new staff, and fulfilling firm retirement obligations have led a number of firms to seek funding from the private markets in some of the ways I noted earlier. Whether you are an audit firm leader or a regulator, the first question to consider is whether a proposed transaction and its terms are consistent with the professional obligations of auditors.

The 2024 IFIAR statement on private equity investment in audit firms states simply that:

“commitment to audit quality; independence; integrity; and a culture of professional ethical behavior . . . apply regardless of [a] firm’s source of capital, and a firm [considering outside investment] must ensure that . . . these key attributes are not harmed by excessive commercial incentives. . . .”²

In this context, quality control means carefully considering the potential effects of the transaction on audit quality, in particular, on the firm’s independence, and whether the proposed transaction is the best way to meet the firm’s professional needs. Considerations around the risks of debt, access to resources, and local control may also be relevant. In dealing with a potential outside investor, risk assessment – for the firm and its audit clients – leadership and governance should determine your response.

Digital assets are another example. This is a case in which firms and regulators must work together to determine what standards need to be modernized and how best to do it. Many of you are on the front lines of these developments. If accounting and auditing standards need to be updated, they should be updated. Audit firms also will need to lead the way in assessing the risks of various balance sheet and income statement presentations and making sure that financial statements are fairly and accurately presented.

Finally, the “accounting pipeline” problem. Firm leadership must play a primary role here. The first job is to assess honestly the reasons that, although accounting and auditing can be intellectually fascinating and socially essential, young people have been moving away from the field. Work-life balance, competition from other fields, and compensation are all part of the puzzle. Might that change in the future? Perhaps. But only by confronting these issues head on can you attract the crew you need for successful audit voyages. Make no mistake, making audit firms attractive places to work, consistent with the time demands of auditing, is an essential part of firm leadership.

The critical question is how audit firm leaders judge whether they are taking the right steps in these rapidly changing times. All of us – whether audit firm leaders, audit committee members, academics, or regulators – are thinking about this question. In effect, if audit quality is our North Star, how does one measure it?

The search for a workable definition of audit quality has been hotly debated. It is thought that many measures are relevant: independence, tone-at-the top, and a history of audit outcomes are among them. Portugal has been a leader in this quest - in implementing quality indicators. And I am not surprised that the CMVM is leading a task force on quality indicators for the Committee of European Auditing Bodies.

As this audience well knows, the 11 Portuguese firms that audit PIEs must report a group of indicators and metrics at the firm and engagement level. These include audit hours, partner workload, experience, training, employee turnover, hours per audit phases, results of quality controls, and hours spent on quality control functions.

The PCAOB’s own performance metrics project considered eight metrics. Six of the eight were at both the firm and engagement level: partner and manager involvement, partner and manager workload, training hours, audit experience, industry experience, and allocation of audit hours during and following the end of the issuer’s fiscal year. Two of the eight—retention of personnel and restatements—were firm-level-only.

In either formulation, indicators or metrics are not a magic formula. But they can provide vital “navigational” information to audit firms, audit committees, investors, and regulators about conditions that lead to, or away from, the likelihood of quality audits. They can also provide data over time about how the audit process works and how it might be improved.

Of course, there are limits to indicators or metrics. They don’t directly measure firm culture, how a firm makes itself a great place to work, or how it innovates to meet today’s challenges. But they are a starting point.

Auditing is an honorable profession. And it’s a business. Finding the right balance between business and the public interest is the fundamental challenge of audit firm governance. That’s why conferences such as today’s can be so fruitful; only by reflecting on the challenges can you as leaders continually refresh that balance. Sustaining the balance requires everyone in this virtual room and beyond to think about, wrestle with, and mutually reinforce the ethics and values that make auditing so vitally important.

I want to leave you with a story that tells both how much things have changed and yet how much they have stayed the same. In 1933, the U.S. Congress was considering requiring audited financial statements for companies issuing securities to the public. One of the witnesses at a Congressional hearing was Colonel Arthur Carter, President of the New York Society of CPAs and a partner of Haskins and Sells. He opposed the idea of government auditors. He explained the auditors audit “the controllers,” by which he meant preparers. One Senator asked: “who audits you”? Carter famously replied: “our conscience.” 

While we have replaced that today with a far more robust oversight function, to some extent, it remains true. The judgment and leadership of the past great explorers was foundational to their success. Today, the same is true in the field of auditing. Your commitment to the North Star of audit quality—for investors, audit committees, management, and your own economics—must be reflected in far-seeing firm governance, a strong quality control system, and an attractive place for young people to work. All of these are grounded in your firm culture; in other words your conscience, ethics, and integrity.

In a world of vast technological change, leadership is not easy. But in our increasingly complex and interconnected world, it’s more important than ever. Keep being inquisitive, growing, and learning, and you will continue to be able to steer your own destiny. Thank you. And I now would be happy to answer any questions.