The Role of the Financial Statement Auditor, and Thoughts on the PCAOB Inspection Process and Its Contemplated Transformation

Remarks as prepared for delivery

Good evening. Thank you Scott [Asay] for the warm introduction. I am delighted to be with you at the University of Iowa and the Tippie College of Business to participate in the RSM National Speaker Series. I have truly enjoyed being on campus today and greatly appreciated the opportunity to meet with faculty members and students and to participate in the many engaging conversations we have had throughout the day. I look forward to continuing that engagement and dialogue this evening. I always appreciate the opportunity to speak about the indispensable role of the financial statement auditor in promoting investor confidence, supporting capital formation, and strengthening the public's trust in our markets, as well as the opportunity to speak about the PCAOB’s role in advancing audit quality.

Before I continue, please know that although my remarks this evening are provided in my official capacity as a PCAOB Board member, the views I express are my own and do not necessarily reflect the views of the full Board, my fellow Board members, or the PCAOB’s dedicated staff.

I want to begin my remarks by asking a question: Who is an auditor’s work for?

The audit engagement team spends most of its time interacting with company personnel. The audit committee hires the auditor and oversees the auditor’s work. But those who ultimately depend on an audit include investors whom the auditor will likely never meet. Investors include ordinary people making decisions about retirement, saving for education, and the future of their families.

That distance between the auditor and those who rely on the audit is a primary reason the auditing profession is unique. This distance is also why the auditor’s work demands more than just technical proficiency. It demands independence, professional skepticism, sound judgement, integrity, and a willingness to ask difficult questions. Or, said another way, auditors must be comfortable asking uncomfortable questions.

The obligations of the financial statement auditor to those that rely on their work will guide my remarks this evening. First, I will begin with this university and the accountant whose name this college bears. I will then discuss the public purpose of the financial statement audit and the key skills or attributes that I believe underpin the work of the auditor and that I hope today’s accounting students will strive to develop. And, finally, I will take a deep dive into an aspect of the PCAOB’s inspection program, in particular why I believe rigorous reviews of audit engagements remain important to support audit quality and the needs of investors and the capital markets.

The University of Iowa Tippie College of Business and the Value of an Accounting Degree

I know this audience is familiar with the history of the University of Iowa and its accounting program, but I took genuine interest as I explored the university’s history. The university was founded in 1847, less than two months after Iowa became a state.¹ Just eight years later, the university became the first public university in the United States to grant equal admission to both women and men.² 

The origin of the Tippie College of Business dates back to 1858. Its first business-related course was Moral Philosophy, which examined political economy.³ There is something fitting, and perhaps even profound, about a business school's origins being rooted in questions of ethics, society, and economics. Long before students could study contemporary finance, accounting, and auditing, they were studying questions about economics within a course concerned with moral reasoning.

Taken together, these early milestones reflect two enduring ideas: that opportunity should not be limited by gender, and that education for business should be grounded in an understanding of its ethical responsibilities to society. From its earliest years, the university was not simply preparing students to participate in economic life; it was also advancing a broader vision of who should have that opportunity and how they should use it. Those same values—opportunity and integrity—also provide a fitting lens through which to consider the person whose name this college bears: Henry B. Tippie.

Mr. Tippie grew up near Belle Plaine, attended a one-room schoolhouse, and obtained his parents’ consent to enlist in the U.S. Army Air Forces at the age of 17. He served in World War II, then used his G.I. Bill benefits to attend the University of Iowa. He earned an accounting degree in just two years and obtained his certified public accountant (CPA) license shortly thereafter. However, he struggled to find a job and lived in a shared room at the YMCA in Des Moines. After his fiancée abruptly called off their wedding, Mr. Tippee was desperate enough for a position to place a “situations wanted” classified ad in the Journal of Accountancy.⁴

That ad changed the course of his life after it caught the attention of John W. Rollins and Associates in Delaware. During his 68-year career there, he transformed a company that began with four small auto agencies and three small radio stations into Orkin, an international pest-control company that executed one of the first leveraged buyouts of a major corporation by a small company. Interestingly, Mr. Tippie was also instrumental in bringing NASCAR racing to Delaware.

With his financial success, Mr. Tippie became a significant philanthropist, with gifts that included a $30 million gift supporting students and faculty at his alma matter in 1999. The university renamed the College of Business Administration in his honor that same year.

Mr. Tippie’s story offers a lesson not only in where a career in accounting can lead, but also how overcoming setbacks and honing professional skills can yield lasting rewards. His path from accounting student to accomplished business leader was not a straight line; it was shaped by resilience, initiative, and perseverance.

That brings me back to my opening question: Who is an auditor’s work for? The answer lies not merely in who engages or oversees the auditor, but in the public trust the auditor accepts on behalf of people who may never enter the room. That is what gives the work of the financial statement auditor its nobility and sets it apart from other professions.

The Nobility of the Financial Statement Auditor

An investor cannot ordinarily inspect a company’s underlying records, question its personnel, test its controls, or independently evaluate the evidence behind its financial statements. The investor depends on a system of financial reporting in which an independent auditor has a defined role to perform these functions.

Former SEC Chairman Arthur Levitt described the auditing profession as “one of the most noble in our marketplace.”⁵ He emphasized that the auditor’s mandate concerns the integrity of the numbers, but he did not romanticize the job. It could be hard and thankless, he said, precisely because an auditor sometimes must tell a paying client something the client does not want to hear.

I believe that is the heart of the profession’s nobility. The auditor’s work serves individuals who are not in the room. The auditor must remain objective when a relationship, a deadline, or a difficult conversation might make agreement easier than challenge.

In essence, the independent audit requirement involves both a private franchise and a public trust. An auditor provides a service that the law requires public companies to obtain. But “the franchise is conditional,” and “comes in return for the CPA’s assumption of a public duty and obligation.”⁶

For the accounting students here, I hope you will carry both sides of that requirement into your careers. You can earn a solid living as an auditor. You can take pride in developing expertise and meeting the challenges of demanding work. But those opportunities come with an obligation to keep the public trust at the forefront as you carry out your responsibilities.

Attributes of an Effective Financial Statement Auditor 

Having discussed the importance of the auditor's role, let me now turn to what I believe are the defining attributes of an effective financial statement auditor. I have previously spoken about the “DNA of a Financial Statement Auditor”⁷ and identified four interdependent attributes: first, a commitment to investors and the public interest; second, the ability and readiness to understand a company’s business, operations, and strategy; third, a dedication to lifelong curiosity; and fourth, a commitment to professional skepticism. Given the speed of change happening across the entire financial reporting ecosystem due to the ever-expanding use of artificial intelligence (AI), I continue to believe it is important that someone who enters the profession be focused on developing those four attributes. Since speaking about those four attributes, I have come to view two more attributes as equally necessary: strong critical thinking skills and strong communication skills. I will briefly discuss each attribute.

First, commitment to investors and the public interest. Auditing requires technical excellence. You must master the craft – accounting principles and auditing standards – and learn how to gather, assess, and challenge evidence. But never lose sight of why that work matters. Every audit contributes to the trust that investors place in our markets and the confidence that underpins our economic system.

William D. Hall said it well when he wrote: “The auditor is continually confronted with temptations. He wants to see his clients succeed. He wants their owners and managers to like him. He wants to retain his clients and obtain others. But his real success lies in how effectively he discharges his public trust – how conscientiously he serves the public interest. That is why he has been licensed to practice.”⁸

Second, understanding a company’s business, operations, and strategies. The value of each member of the audit engagement team taking the time to understand the company’s business cannot be overstated. A junior audit team member should focus on this attribute as soon they are assigned to an audit engagement team. For example, they could read the company’s annual report and understand how it earns revenue. In addition, they can ask detailed and specific questions to understand more. What must go right for the company’s strategy to succeed and what is the likelihood of it occurring? What could cause cash flows to differ from expectations? Which developments might put pressure on management’s assumptions? How susceptible are the company’s operations to interest rate movements? A good audit depends on the auditor having a practical outlook and knowing what questions to ask.

Third, dedication to lifelong curiosity. The accounting and auditing that students study today will not answer every question encountered later in their careers. Businesses are changing. Technology is rapidly advancing. Risks are evolving. A successful auditor must keep learning and inquiring.

To be clear, curiosity is more than an interest in new technology tools. It is the habit of asking about what you do not yet understand. Why did the relationship between two accounts change? What assumptions drive a valuation? What information does a specialist’s conclusion depend upon? What information went into an analysis, and how reliable is it?

Technology can help auditors examine information with tools that were unavailable to earlier generations. But a sophisticated output is not self-validating. The auditor still needs to understand the data, the method, its limitations, and whether the result answers the audit question and addresses the applicable audit risk. Curiosity keeps technology in its proper place: a means of improving inquiry, not a reason to stop inquiring.

I want to encourage auditors, when they have questions, to ask without embarrassment, “Help me understand.” It is a simple sentence. Used sincerely, it can open a conversation that a more elaborate question might close.

Fourth, commitment to professional skepticism. Professional skepticism is not a presumption that everyone is dishonest. It is a questioning mind and a critical evaluation of evidence. It requires the auditor to notice when a response does not address the question asked. It requires the auditor to distinguish an explanation from evidence supporting that explanation. And it requires the auditor to keep working when the evidence does not yet support a conclusion and to keep pressing when the explanations offered are not clear.

There may be pressure to move on. There may be a deadline. The person providing the explanation may be experienced, confident, and entirely sincere. None of those circumstances changes the auditor’s obligation to skeptically evaluate the data used and the evidence obtained.

Fifth, critical thinking. Auditors rarely encounter questions that can be resolved by simply applying a checklist. They must consider and analyze information from different sources, identify what is relevant, recognize inconsistencies, consider alternative explanations, and determine whether the evidence supports the conclusion. These skills are especially important as technology and AI produce more information and increasingly sophisticated analyses. An auditor must still assess the reliability of the inputs, understand the limitations of the methods used, and decide whether the output makes sense in light of the business and the audit risks. Critical thinking focused on the right information results in sound professional judgment—and sound professional judgment is essential to a well-supported audit opinion.

And lastly, communication is the skill that activates and connects the other five. Auditors must ask clear questions, listen carefully, explain their judgments and the evidence supporting them, document conclusions with sufficient clarity that another professional can follow their reasoning, and raise concerns to supervisors, management, and audit committees. Without those abilities, the benefits of the other attributes I have described may not fully emerge.

The PCAOB: Inspection-related Developments

I would like to turn now to current events involving the PCAOB, specifically a discussion of the PCAOB inspection process. As you may know, the PCAOB has been publicly talking about transforming its approach to inspections. Toward that end, the PCAOB established earlier this year a new advisory body designated as the Inspections Modernization Council, or IMC. In July, the Board announced the twelve IMC members, selected from more than 100 people who had responded to the Board’s public solicitation of interest.⁹

In broad terms, the IMC has been tasked with considering potential changes relating to a range of inspection-related matters. They include, among other things, how the PCAOB leverages technological innovations, including AI, in its inspection work; how the Board might provide more useful information to the public concerning the results of inspections; and how to shift the focus of inspections more heavily to reviewing the inspected firm’s system of quality control.¹⁰

I want to highlight that the Board’s interest in public input on these issues is not limited to the input of IMC members. Anyone, including any of you, who has questions or ideas regarding the inspections modernization effort is encouraged to contact the PCAOB by sending an email to [email protected].¹¹

All of the potential transformations that have been framed for public discussion involve important aspects of the inspection process. In my remarks this evening, though, I want to isolate for discussion one of those potential transformations. Before coming to that specific potential transformation, let me provide some relevant background. 

The PCAOB performs inspections pursuant to the authority set out in section 104 of the Sarbanes-Oxley Act (Act) and in accordance with the responsibilities set out there. Some of those responsibilities are set out in section 104(d), which is captioned “Conduct of Inspections.” The first provision of that section, (d)(1), provides that the Board shall “inspect and review selected audit and review engagements of the firm . . . performed at various offices and by various associated persons of the firm.” The second provision, (d)(2), provides that the Board shall “evaluate the sufficiency of the quality control system of the firm, and the manner of the documentation and communication of that system by the firm.”

The Board’s longstanding approach to section 104(d)(1) has been to inspect individual audits – or, as they are sometimes referred to in this context, “files” – that we select based principally on what we label “risk” criteria.¹² We consider a broad range of criteria that help us identify the audits, and areas of those audits, that present the most significant and consequential challenges for an auditor. Then, through a detailed review of the firm’s audit work in those areas, and related discussion with the firm, we assess the firm’s compliance with auditing standards.

Separately, our longstanding approach to evaluating the sufficiency of a firm’s system of quality control, or QC, pursuant to section 104(d)(2) has involved two components. One component is our work to obtain an understanding of the firm’s documented system of quality control and to identify any respects in which the system as documented may not fully comply with quality control standards. The other component involves consideration of whether our review of individual audits has revealed any potential QC weaknesses that are not discernible from a review of the documented system on its face. This component of our approach is grounded in the fact that an adequate system of quality control needs to do more than merely reflect that a firm’s leadership understands and documents what is necessary to comply with audit performance standards. An adequate system of quality control also entails a firm’s “responsibility to ensure that its personnel comply with” those standards, and must “provide the firm with reasonable assurance that the work performed by engagement personnel meets” those standards.¹³ This component of our approach effectively involves holding the firm and its leadership accountable when audit deficiencies in the aggregate fairly suggest a failure to meet those QC responsibilities.

Time and again, our section 104(d)(1) reviews of audits selected through our risk criteria have revealed weaknesses in how well a firm’s QC system causes its personnel to perform appropriately, thereby informing our section 104(d)(2) evaluation of the QC system. This has been the case even at firms with the most extensive and sophisticated QC systems. These are QC weaknesses that would not be detected through a review of the QC system on its face.

Against that background, I would now like to focus on one aspect of the contemplated changes to the inspection process – specifically, contemplated changes to how the PCAOB carries out its section 104(d)(1) responsibility to select and review individual audit engagements. I want to make very clear that my remarks are not related to any inside, nonpublic information about the details of a contemplated change. My remarks are prompted by my reflection on things that have been said publicly about a general direction, and on what might also be gleaned from a slide deck prepared, for IMC discussion purposes, by PCAOB staff who are regularly engaged with the IMC.¹⁴

A Deep Dive into the Current Practice

Before addressing the potential changes, I would like to take a somewhat deep dive into how the PCAOB has carried out its section 104(d)(1) responsibility up to the present time. In doing so, I aim to illuminate details of our current approach that I think have been crucial to the improvements in audit quality that are widely recognized to have resulted from the PCAOB’s inspection process. I aim to do so as background for some thoughts on the topic of potentially changing that approach.

I want to emphasize that my remarks here are wholly distinct from anything to do with the question of how the Board communicates inspection information to the public. I have observed that issues concerning public inspection reporting, while important, can easily become a distraction from other important points. My remarks here relate exclusively to fundamental points about how the PCAOB engages with firms through the inspection process in ways that can be expected to lead to increased audit quality.

As I noted earlier, the PCAOB’s approach to implementing section 104(d)(1) has always involved selecting audits based on risk criteria. Those criteria have long included “considerations related to the particular audit firm, practice office, or partner, including prior inspection results,”¹⁵ – in effect, any relevant information about quality management issues at the firm. But they have also included a range of other factors, broadly relating to the firm’s issuer audit clients and the auditing challenges posed by their financial reporting – considerations that are viewed as heightening the risk, and the potential consequences, of an audit deficiency. 

When an audit and the relevant focus areas have been selected for inspection, the inspection team carefully reviews all relevant information, including, among other things, the issuer’s SEC filings and the firm’s audit documentation regarding the selected focus areas. In many cases, that review is sufficient to satisfy the inspection team that there are no issues with the audit work that require further exploration.

In other cases, the inspection team identifies potential issues with the audit work. The inspection team works to formulate precise questions for discussion with the firm’s audit engagement team. Typically, those questions are provided to the firm with time for the engagement team to consider them and prepare for a discussion. Other firm representatives, such as senior personnel in the firm’s audit practice, often participate in those discussions along with the engagement team. Through careful, detailed dialogue, perspectives on the relevant issues come into focus. Frequently, the discussion allays the inspection team’s concerns about the possibility of a deficiency.

In some cases, however, the discussion leads the inspection team to conclude that there is a deficiency. When that happens, the inspection team provides the firm with a written "comment form" describing its concern in detail. The firm has an opportunity to respond in writing, and the process for evaluating the firm's responses may include further dialogue with the audit engagement team or other senior firm personnel. It also routinely includes internal PCAOB review by senior inspections personnel who are not on the inspection team, and potentially by other PCAOB staff, which can and sometimes does result in the eventual decision that the matter should not be judged to be a deficiency.

In a large majority of the audit focus areas that our inspection teams have reviewed over the years, they have ultimately not identified deficiencies that cast doubt on whether the audit opinion was sufficiently supported. But where they have identified such deficiencies, it is my view that the process I have been describing has had tremendous value in advancing the goal of improved audit quality.

It is understandable that an audit engagement team would not necessarily relish discussions about identified deficiencies, but when the process is at its healthiest, as I believe it typically is, the engagement team members and the firm take something away that contributes to better audit quality in the future. In addition, even when an audit partner is particularly resistant to the staff’s conclusions, it is not unusual that, through this process, senior firm personnel learn about an issue that would not otherwise have come to their attention and they agree with the inspection team’s conclusions. This, too, can lead the firm to take steps that contribute to better audit quality in the future.

In addition, the process can have, and in some cases has had, more immediate and obvious benefits. In some cases, when the firm recognizes that it did not do sufficient audit work in an area, it undertakes, as required by the auditing standards, to perform that additional work and to consider whether its previously expressed opinion is supported. That additional work, prompted only by the inspection process that I have been describing, has sometimes led a firm to discover that there was in fact a material misstatement that it had failed to detect, or to discover that it erred in providing an unqualified opinion on an issuer’s internal control over financial reporting.

Separate from all of those considerations, there is another, equally important, dimension to how the process promotes and sustains improved audit quality over time. That dimension involves the reasonably predictable effect on an audit engagement team’s performance of an audit if the prospect of a later PCAOB inspection review looms sufficiently large. A significant benefit to audit quality very likely flows directly from an audit engagement team’s awareness of the real possibility that the PCAOB will select the audit for inspection.

Underscoring that point, we also know that accounting firms are motivated to avoid PCAOB findings in inspected audits and that they try to incentivize their professionals accordingly. Many firms choose to motivate their partners, in part, through the prospect of a financial penalty in the event of a PCAOB inspection finding. Positive reinforcement is also employed: I recently met with an academic who previously worked for one of the larger firms, and she happened to note the recognition and positive reinforcement she had received from the firm when the PCAOB inspected and found no deficiencies in a focus area on which she had worked.

It therefore seems to me, as I have said elsewhere,¹⁶ that a meaningful prospect of PCAOB review stands as an effective counterweight to business pressures that might otherwise marginalize the good intentions of honest, capable auditors and compromise audit quality. Indeed, there is evidence that this behavioral impact of section 104(d)(1) was very much intended and front-of-mind for the drafters of the Sarbanes-Oxley Act. At the May meeting of our Standards and Emerging Issues Advisory Group, or SEIAG, Chairman Logothetis described a discussion he had recently had with an individual who had a significant role in drafting the Act, recounting that “he said the concept, the idea that we visualized, was we would put a cop, a police car, at the corner of these intersections where there’s a lot of accidents and then we would change behavior because people then would be more careful in what they do, how they audit.”¹⁷

Stepping back, and viewing all of that as the way the current process contributes to improving audit quality, I want to emphasize what I view as a very important point: The value of the process does not in any way depend upon applying the process to audits selected with a view to providing a statistical sample. The PCAOB has never suggested that its approach to section 104(d)(1) file reviews was intended to provide, or even to stand in as a rough surrogate for, a statistical sample of a firm’s work. Indeed, the Board made very clear from the beginning that that was not the case.¹⁸

Rather, the purpose of file reviews has been to generate audit quality improvement through the process described above, and by repeating that process on as many of a firm’s most challenging audits as our resources could support our doing with appropriate rigor. Very simply, the benefits described above are such that the more audits to which we can apply the process, the more opportunity there is for those benefits to flow. That is the point of and reason for the process.

Moving Forward

The recent attention given to revising the PCAOB’s inspection approach has been labeled “modernization” of the approach. In important respects that is a fair description.

In 2024, the Board adopted QC 1000, A Firm’s System of Quality Control, recognizing that the new standard would have consequences for how the Board carried out the section 104(d)(2) obligation to evaluate the sufficiency of a firm’s system of quality control.¹⁹ With QC 1000 set to become effective shortly, that change is upon us and necessitates corresponding modernization to our approach to evaluating QC systems. It is also important that we leverage advances in technology, including AI, as aggressively as we responsibly can. In addition, taking a fresh look at how we publicly communicate inspection results, including based on public input, may well contribute to worthwhile updating of our inspection reporting.

I would put in a different category, however, the possibility of the contemplated changes to how we carry out the section 104(d)(1) obligation to select and review individual audit engagements. It is not clear to me in what sense the type of change being contemplated for that process is a modernization, as distinct from simply being a change.

Although details remain to be finally determined, I am wary of a possible direction suggested by the Staff IMC slide deck. While that slide deck identifies the possibility that future inspections would still involve some number of file reviews according to the process described above, it suggests that the number of such reviews at the largest firms could be reduced to levels that are well below 50% of the 2025 levels if the firm is judged to be a “Firm with Lower Risks.”²⁰ 

I am concerned that such a change to the existing approach to file reviews could be counterproductive. To be clear, I am in no sense an absolutist on this point, nor am I reflexively wedded to old ways of doing things. I also recognize that healthy regulatory activity most often involves identifying the right trade-offs rather than perfect solutions. But I see a risk that such a change could diminish the value that our current process provides for sustaining audit quality. My concern is that I do not see that this risk has yet been clearly and fully considered in the push to transform the inspection process, or that reasons for the potential change have been persuasively laid out, or that the trade-offs have been carefully assessed.

I am aware, certainly, that some have highlighted that our section 104(d)(1) review of individual audits is extremely unwelcome by at least some individual auditors whose work is reviewed. This was raised, for example, at the SEIAG meeting in May of this year.²¹ Knowing what I know first-hand about the inspection process, however, I think that concerns expressed about such inspection-related anxiety gloss over an important nuance.

From my experience in our Division of Registration and Inspections and my more recent experience occasionally sitting in to observe inspection interactions with firms, I know that our inspections are conducted respectfully, professionally, and constructively. Of course, even in the best of circumstances, it is easy to understand that, for individual auditors, an inspection review is an unwelcome distraction. But to the extent there is anxiety and stress, that is unlikely to be due to the conduct of inspectors. It is more likely due to the prospect of firm-imposed consequences – a matter between the firm and the individual – if the inspection has the effect of bringing to the attention of firm leadership something that the firm agrees is a deficiency in the audit.²²

On balance, from the standpoint of the goal of promoting and sustaining high audit quality, that dynamic strikes me as validating the effectiveness of our current approach to selecting and reviewing audits. It is additional reason to believe that our approach likely has a beneficial effect on audit partner behavior in performing audits.

The Board’s inspection transformation efforts and the work of the IMC are ongoing. I hope that there may yet be more focused deliberation concerning this potential change, including the reasons for considering it, and including whether it would pose a risk of diminishing the value of inspections.

Conclusion

I want to conclude now by returning to where I began: with the students in this room.

You are entering a profession with remarkable possibilities. An accounting education can take you into public practice, business, research, standard setting, regulation, or other paths you cannot yet see.

If you pursue a career as a financial statement auditor, I hope you will develop the attributes that I described and that, above all, you will remember the public trust. These are not merely ways to build a successful career. They are ways to honor the purpose that makes auditing a profession.

Thank you and I look forward to your questions and comments.