What's Changed: New Frontiers for Auditors Without Borders

Thank you for inviting me to this symposium. It is an honor and a pleasure to be here. The Public Company Accounting Oversight Board is engaged in several endeavors that I hope will be of interest to you.

Some would say that any Texan lucky enough to escape the Beltway and find himself in Dallas on a day the Rangers contend for the ALCS must be insane to go back to Washington. After all, the town made it through OU weekend, which some still consider the supreme threat to domestic tranquility. Why leave now?

On the other hand, as an audience of lawyers, you may be thinking, "This guy is fascinated by auditing? The wonder is that he is registering a pulse!"

Yes, I am riveted by auditing, by the challenges auditing faces in a rapidly transforming global economy, and by the fundamental role auditing has played, and I believe will play, in the global economy.

The rules and reference points for auditors are changing. I want to try to explain to you how my new commitment, the PCAOB, fits into that picture, and how it may intersect with the legal judgments you make on behalf of your firms and clients.

The PCAOB's mission is to protect the investing public's interest in informative, accurate and reliable audit reports for public companies, and since the Dodd-Frank amendments, brokers and dealers too. As corporate counsel, you too play an important role in protecting the investing public. I hope this information about the PCAOB's work will be useful to your own, and that it will help you find ways in your companies and at your clients to foster an appropriate culture for supporting reliable independent audits.

I will start by providing some background on the PCAOB's work, and then turn to focus on international matters. And finally I will touch on our current policy and legislative initiatives. Before I go further, though, I must say that the views I express are my own and should not be attributed to the PCAOB as a whole or any other members or staff.

I.  Overview of the PCAOB's Work

When I left law practice earlier this year, many of my law colleagues knew little about what I was going to do. They asked me if it would be a part-time job. (No!) They asked me if I was going back to government service. (No.) The PCAOB was indeed established by Congress, but as a non-profit. It has a full-time board, or shall I say over-time? The other night I was at the office at 9:00 and noticed three of five board members were also working late. (The other two were starting their day, in Asia, for meetings with foreign audit regulators.)

For those of you who, like my law partners, aren't as familiar with the work of the PCAOB, let me give you a brief overview. Prior to the creation of the PCAOB, public company auditors were subject to oversight by their professional association and to peer reviews conducted by other auditing firms.

After the revelation of the numerous high profile scandals earlier this decade that we all remember, the Sarbanes-Oxley Act of 2002 profoundly changed the environment in which public company auditors operate by providing for ongoing accountability to the PCAOB, for the benefit of investors. The Board exercises that oversight through four basic functions.

First, to establish the foundation for PCAOB oversight, the Act requires the PCAOB to maintain a registration system for auditors of securities issuers, as that term is defined in the Act, as well as (under the Dodd-Frank amendments) auditors of broker-dealers. No accounting firm may prepare, or substantially contribute to, an audit report for a public company that files financial statements with the SEC, or for a broker-dealer, without first registering with the PCAOB.

There are currently 2,411 accounting firms registered with the Board. This includes 907 non-U.S. firms and 507 firms that are registered only because they have broker-dealer audit clients. Registered firms must file annual and other reports that provide the Board and the public with updated information about the firm and its audit practice.

Contrary to what some believe, mere registration with the PCAOB does not reflect an examination of the firm's audit quality, which does not happen until we inspect the firm's audits. If a firm plays by the rules, it may easily register, and easily withdraw, if its business plans change and it hasn't violated the rules in the meantime.

That leads to our second basic function — inspection of firms and their public company audits. The PCAOB's inspection program is the core of its oversight of registered firms' public company audit work. The PCAOB's inspection staff accounts for approximately 400 of our 700 staff.

Since 2003, the PCAOB has conducted more than 1,700 inspections of firms' quality controls and reviewed aspects of more than 7,500 public company audits.

As required by the Act, the PCAOB conducts annual inspections of each of the firms that regularly audit the financial statements of more than 100 public companies. In 2011, the PCAOB will have inspected ten such firms in the course of the year.

Each firm that regularly audit the financial statements of 100 or fewer public companies must be inspected at least once every three years. The PCAOB plans to inspect approximately 211 such firms in 2011, including 44 non-U.S. firms located in 16 foreign jurisdictions.

After completion of the inspections field work, PCAOB inspectors engage in a dialogue with firms, through written comments, and in certain cases, in-person meetings, about audit deficiencies they have identified. The PCAOB then issues a report after each inspection. The inspection report is not a complete report card on the firm's entire audit practice, but rather focuses on areas where inspectors found audit deficiencies.

The public portion of an inspection report describes matters that inspectors have identified as significant audit deficiencies. Counsel to corporate boards that engage auditors should understand what this means. These findings, presented in what we call Part I of the report, generally involve situations in which PCAOB inspectors believe that the auditor failed to obtain sufficient evidence to support the audit opinion or failed to identify a material departure from generally accepted accounting principles.

Consistent with restrictions in the Sarbanes-Oxley Act, the PCAOB does not publicly disclose the identity of the companies that are the subject of audits discussed in an inspection report. Nevertheless, you may find the general discussion of audit challenges useful if you're involved in counseling an audit committee or board.

Inspection reports also include discussion of any criticisms of or potential defects in a firm's system of quality control in Part II of its inspection reports. This portion of the report is non-public. The Act affords inspected firms one year within which to remediate Board criticisms or potential defects concerning firm quality controls. If the Board is not satisfied with a firm's remediation efforts, the portion of the report containing the discussion of the quality control deficiencies becomes public.^[1]

A word of advice to counsel who represent firms, or companies that use firms, that need to remediate quality concerns. The PCAOB staff are available to work with firms on evaluating remediation plans, but our help is most effective when the firm engages with us early in the process. Warn your clients of the perils of "going dark" on us for much of the remediation year.

Since 2003, PCAOB inspections have identified hundreds of audit failures, including failures by the largest U.S. and non-U.S. firms. These findings have led to changes in firm auditing processes, and, in some cases, more audit work performed after the fact or corrections of client financial statements.

The PCAOB also conducts investigations and disciplinary proceedings. The Board has broad authority to impose sanctions on registered firms and associated persons that have violated applicable laws and standards.

The PCAOB has publicly announced the resolution of 41 enforcement proceedings. Sanctions in these proceedings have included revocations of firms' registrations, bars on individuals' ability to participate in public company audits, monetary penalties, and appointment of an independent monitor.

One of the Board's more significant settled disciplinary orders relates to the PW India audit firms that audited the U.S.-listed, Indian-domiciled company, Satyam. The Board's order included a $1.5 million penalty for violations of PCAOB rules and standards in relation to an audit that failed to identity Satyam's billion-dollar overstatement of assets.

The announced decisions do not, however, reflect the full extent of PCAOB enforcement activity. Under the Sarbanes-Oxley Act, all Board investigations and all contested proceedings (i.e., cases in which the Board files charges and the respondent elects to litigate, rather than settle) are non-public.

The Board closely coordinates its enforcement efforts with the SEC. In certain instances, the PCAOB investigates the auditor's conduct and the SEC focuses its investigation on the public company, its management, and other parties. In other cases, the SEC's Division of Enforcement takes responsibility for an auditor investigation and requests that PCAOB defer to that investigation.

Finally, as I alluded, the PCAOB is responsible for establishing the auditing and related professional practice standards under which public company audits are performed.

The PCAOB has an active standard-setting agenda, which it pursues through extensive outreach in the form of public solicitation of comment at various stages of a project, public roundtable discussions, and regular discussions with the PCAOB's Standing Advisory and Investor Advisory Groups.

The groups are comprised of experts from diverse backgrounds as investor representatives, financial statement preparers, auditors, academics. They have also included several securities lawyers.

All of the Board's responsibilities are discharged under the oversight of the SEC, which among other things appoints PCAOB board members and approves PCAOB budgets, standards and rules, and hears appeals of PCAOB disciplinary proceedings.

Chairman Mary Schapiro, the SEC Commissioners, and Chief Accountant James Kroeker have taken a deep interest in the PCAOB's development and work. To their credit, they have carefully crafted a board of diverse and complementary expertise that functions with collegiality and technical excellence. I am grateful to them for their support and for the strong working relationship they have fostered between our organizations.

This is a very high level overview. It would not be complete without mentioning that one of the jewels in the PCAOB's crown is right here in Dallas. The PCAOB has a Dallas office that is led by one of the leaders in the inspection division, John Fiebig.

John also leads the team that inspects one of the four largest accounting firms. Based in Dallas, he supervises a team that circles the globe. Our inspectors need not be in Washington to inspect even the most challenging and complex audits for the largest companies in the world.

I've seen Dallas grow from a Texas financial center to a national center, and now a global center. The PCAOB staff in Dallas are every bit a part of the globalization Dallas has seen.

II.  Audits Without Borders

Let me tell you about some of the things we've seen in those global audits. Since we began inspecting, we have observed that the U.S.-based firms that we oversee — both large and small — are increasingly engaged in audits with an international component.

Moreover, as I mentioned, the PCAOB has registered a significant number of non-U.S. firms that audit or wish to participate in audits of issuers. Many of these non-U.S. firms are affiliated with one or another of the large U.S. firms through a global network.

These affiliates can be quite large, measured by number of professionals as well as by market capitalization of audit clients. Substantial portions of the audits of many of the largest U.S. companies are performed by such affiliated firms.

You may think of these firms as merely local offices of one of the large accounting firms. But because of their legal structure, they are separately registered and subject to their own inspection. To date, we have conducted 296 inspections of non-U.S. registered firms located in 36 jurisdictions.

To best protect investors, inspections of cross-border audits need to be as seamless as the audits are supposed to be. At the PCAOB, we have seen first hand the benefits of evaluating the various pieces of audits performed by different registered firms in multiple jurisdictions.

Our inspectors often see more than the principal auditor — or signing firm — does. In many cases principal auditors rely on high-level reports from affiliated auditors. They don't in every case review the work papers of the other auditors. When our inspectors have done so, in many cases they have found problems in that work and focused the firms involved on the need to address them.

As has been widely reported, the PCAOB remains unable to inspect registered firms that perform or participate in U.S. audits but reside in China or some parts of Europe. I remain hopeful that we will be able to resolve concerns raised by authorities in these countries.

This is not to say that we haven't made progress: we are recently back in the U.K.; we have begun inspections in Switzerland; and we will soon begin inspections in Norway. In each of these inspections, we will not only review audit work for foreign private issuers, but we will also look at audit work performed on subsidiaries of U.S. companies.

We also hope to make progress on a joint inspection arrangement with Chinese authorities, but there the progress is slower. Unfortunately, the risks to investors are every bit as great. For example there have been numerous reports of auditors for Chinese and other emerging-market issuers resigning because of concerns about management misrepresentations.

Earlier this month, the PCAOB staff issued an Audit Practice Alert that provided auditors guidance on a number of audit questions related to risks in emerging markets.^[2] The alert is based on observations from PCAOB inspections and other oversight activities, as well as other situations that have come to light in recent corporate filings with the SEC and SEC orders suspending trading in certain emerging market companies.

It highlights conditions that indicate heightened fraud risk, such as fraud in bank confirmations, including through forgery or collusion. It also discusses risks involved in auditing variable interest entities.

While the alert is intended for auditors, it is a general guide to the fraud risks that anyone in international business might face, including audit committees and corporate counsel. Indeed, the role of audit committees and their counsel in combating fraud is particularly important given the PCAOB's inability to protect investors through inspections in other countries.

While we work toward accords in China and elsewhere, it's going to be important to do what we can to protect investors in companies that have operations in countries where we can't inspect. The PCAOB is looking harder at how U.S. firms get comfortable that they can rely on the work of affiliates in countries that have resisted inspection. Through the audit committee, your corporate clients too should take pains to understand how their auditor is handling foreign audit work.

III.  The PCAOB's Policy Agenda to Enhance the Relevance, Credibility and Transparency of Audits

Let me turn now to the PCAOB's policy initiatives. We have an active standards-setting agenda that aims to improve auditing and related professional practice standards as we find the need to do so in our inspections. Arching over this work, though, the Board is engaged in several high profile initiatives to address lessons learned in the financial crisis.

These initiatives relate to (i) the relevance and value of audits, (ii) the relationship of the auditor to the audit client, and (iii) the role of various participants in the audit. These projects are founded on the principle that audit regulation should foster conduct and a culture consistent with the franchise that the securities regulatory regime accords the audit profession. I'll briefly describe them, but I encourage you to read the recent papers and proposals that the Board has published on our website.

A.  The Auditor's Reporting Model

First, the PCAOB has initiated a broad debate on the form and content of the standard auditor's report. In June, the PCAOB released a concept release on potential changes to the auditor's reporting model.

We issued this paper to seek broad public input on whether the auditor's report could better serve investor needs. Given the effort involved in an audit of a large company, and the complexity of many financial statements, investors have called for deeper insight from the auditor.

The concept release invited discussion on four, broad alternatives, ranging from expanding use of emphasis paragraphs and clarifying terms in the current standard audit report, to providing for a narrative discussion of the auditor's views on significant matters relating to the audit or the financial statements, to requiring auditor assurance on certain information outside the financial statements, such as Management's Discussion and Analysis and earnings releases.

We have received more than 150 comment letters to date. In addition, in September we held a public roundtable to foster further discussion.

From the PCAOB's recent roundtable, one takes away an emerging consensus shared by the profession and stakeholders that the audit report can and should provide more than simply the pass-fail opinion. Differences develop over whether auditor communications should include non-financial statement information, how to assure consistency and yet avoid boilerplate, whether broader auditor communication will chill the nuances of auditor-audit committee communication, and (conversely) why if auditors are now required to form judgments about accounting practices and policies, the stakeholders cannot have that knowledge.

One point I have emphasized throughout is that, if we make changes, they will be focused on enhancing the relevance of the auditor's communication to investors. They may require auditors to communicate more, or different, things, such as the auditor's assessment of management's estimates and judgments, of significant unusual transactions, or accounting changes. They might require the auditor to discuss the quality of a company's accounting practices and policies.

Such new communications might, or might not, require new audit procedures. But they would not change the fundamental role of the auditor to perform an audit and attest to management's assertions as embodied in management's financial statements.

This initiative will be of particular interest to disclosure counsel, but others as well. I encourage you to follow.

B.  Auditor Independence

The PCAOB is also focused on auditor independence. Our inspectors have conducted annual inspections of the largest U.S. audit firms for eight years. They have reviewed more than 2,800 engagements of such firms and discovered and analyzed hundreds of cases involving what they determined to be audit failures.^[3]

Every now and then, inspectors can trace an audit failure to a competence issue, such as in the design of the audit methodology or in its execution. But on the whole, these firms are highly competent. And yet the failures continue to occur, in spite of firms' remediation efforts. I am left with the inescapable question whether the root of the problem is auditor skepticism, coming to ground in the bedrock of independence. The loss of independence destroys skepticism.

Inspections by other audit regulators have also given rise to concerns about auditor skepticism, as reported by the U.K.'s Audit Inspection Unit, the Dutch AFM, the Australian Securities and Investments Commission, the Canadian Public Accountability Board, the Swiss Federal Audit Oversight Authority and the German Auditor Oversight Commission.^[4] Based on such concerns, the European Commission is also reportedly considering reforms to enhance auditor independence. I understand a draft of proposals from the EC is expected in November.

In August, the PCAOB issued a concept release to seek public comment on how to enhance auditor independence, including whether audit firms should be subject to term limits.

Under existing U.S. rules, all but the smallest audit firms are required to rotate engagement and quality review partners. This requirement dates back to the profession's self-imposed quality control requirements. But it was imposed and strengthened by law as part of the Sarbanes-Oxley Act's independence reforms. My understanding is that it is now widely accepted globally as a best practice.

Partner rotation allows a firm to become aware of a partner's decisions in the audit. But a new partner may feel the need to live with those decisions and agreements; he may have little motivation to reopen them. What is lost is the true "fresh pair of eyes."

I recognize that audit firm rotation presents considerable operational challenges. I am interested in hearing about them in specific terms.

Like any professional service firm, audit firms invest considerable resources in pitching new clients. And in the early years of an engagement, they may even take in less in fees than it costs them to do the audit. Alright, law firms wouldn't do that unless they had to. But why would they? Because they hope to make up these costs and more in a long stream of future fees.

That future stream of fees may be cut off if the company is displeased. That, some would say, is the risk inherent in the client's payment of the fee. The auditor may perceive that displeasing management on a substantive accounting or auditing issue — one of those so-called "close calls" — may increase the risk of losing those future fees.

For the record, I do not by these voiced concerns impugn the ethics, integrity and good faith of the entire profession. To recognize the complexity of transactions, the velocity of financial reporting schedules and the pressures of competition does not, cannot, blind us to the risks and the "predictable surprises" — in this case unpleasant predictable surprises.

Skepticism can fail in spite of high ethical standards, when the cited pressures, for example, result in the audit team skipping over disconfirming evidence. In short, we are not talking about the ethics, integrity and good faith of the profession. We are talking about causalities of judgment in the heat of the moment. As standard-setters, the PCAOB should try to find ways to counter the pressures, and fortify the judgment.

If the audit firm were seeking a finite engagement, say ten years, would they feel the same incentives? Would audits be more objective, in early years and all years, if the auditor knew within the reasonably foreseeable future another firm would take over the audit?

We have a long comment period, extending to December 14. We will then hold a public roundtable to further discuss the subject in March of 2012.

C.  Audit Transparency

The third policy initiative I want to talk about is audit transparency. Earlier this week, the Board proposed amendments to its auditing standards to improve audit transparency by enhancing disclosure about the participants in audits, including disclosure about the partner in charge of the audit as well as other firms involved in the audit.

This proposal stems from a concept release that the Board issued in July 2009 to obtain comment on whether the Board should require engagement partners to sign audit reports.

The names of key management executives, not to mention corporate board members, have long been disclosed. The names of audit engagement partners are also disclosed in many countries, but to this point not in the United States.

As I said at the PCAOB's open meeting on Tuesday, I fail to see why shareholders in large European banks and other companies should be able to see the name of the engagement partner in the audit report, but shareholders in U.S. banks and companies should not.

Indeed, the names of engagement partners for some European companies that are listed on the NYSE are disclosed in U.S. filings. Why are their shareholders to be favored over shareholders in U.S. companies?

At the concept release stage, the Board received certain objections to requiring engagement partner signature, most notably that the change could unintentionally imply a reduction in the firm's overall responsibility for the audit and the audit opinion. The proposal is intended to address those concerns.

Our audit standards set forth the responsibilities of the auditor. The proposal does not change the responsibilities of the audit firm or the engagement partner.

The proposal would also provide investors disclosure about other accounting firms and certain other participants in the audit, given the nature of cross-border audits today. Enhanced transparency into the composition of cross-border audits should help investors gain a better understanding of how an audit was conducted and make more informed decisions about how to use the audit report. Investors will see, for example, the significant participation of audit firms from jurisdictions where we cannot inspect.

Our comment period for this proposal extends through January 9.

IV.  Secrecy of Enforcement Proceedings

Before I close, I would like to touch on one more initiative that I believe will be of interest to you as counsel to companies and boards that engage auditors.

As I mentioned at the outset, both PCAOB investigations and any contested disciplinary proceedings we bring are by law under Sarbanes-Oxley non-public unless the respondents consent to publication of our complaints and decisions. We have asked Congress to change this.

In the years since Sarbanes-Oxley passed, the PCAOB has built an active enforcement program, but unfortunately for investors, audit committees, the bar, and the audit profession itself, it takes place largely behind the scenes.

The Board's Division of Enforcement and Investigation conducts rigorous investigations before recommending that the Board file any complaint. But when the Board does determine that the facts merit the filing of a complaint, it will not be public. Nor will any decision by the Hearing Officer or the Board to impose a sanction, until any appeal to the SEC is exhausted.

Litigation postpones — often for several years — the day on which the public learns that the Board has charged the auditor or firm and the nature of those charges. This secrecy has a variety of unfortunate consequences. Interested parties, including investors, audit committees, issuers and other auditors, are kept in the dark about alleged misconduct.

Audit committees may be unaware for years that their auditor has been charged by the Board. Counsel representing other auditors are deprived access to the Board's precedents. And auditors don't learn important information about conduct or actions that draw the Board's reproach, denying the public any benefit from the deterrent effect that the filing of public complaints would have on other auditors.

A case that recently became public only after the completion of SEC review of the Board's decision provides a good example. In Gately & Associates, a Florida firm issued 29 additional audit reports on public company financial statements between the commencement of the Board's proceeding and the public disclosure of the Board's charges, which did not occur until the SEC affirmed the Board's decision to expel the Gately firm from public company auditing and allowed the Board's sanction to take effect. That information, had it been available, could have made a difference to client and investor decisions regarding the firm or the companies it audits.

*    *    *

It's been a pleasure to be back in Texas and to have this chance to talk with you. Thank you for your time and interest in the PCAOB.

---