Preventing Audit Extinction

I. Introduction

Thank you, Bob, for that very kind introduction. It is a pleasure to be here to discuss with you the future of business reporting.^[1]

But first, let's begin by talking about a development that occurred a long, long time ago, in fact sixty-six million years ago, give or take an epoch.

That was the moment when a meteor struck the earth somewhere near, what is today, the Yucatan Peninsula, altering the climate and effectively wiping out the dinosaurs.^[2] The meteor presumably traveled over an observable path with predictable results. Scientists have labeled this the cretaceous-paleogene extinction event.

I'm not here today to talk about dinosaurs, but I do want to talk about extinction events. There is a metaphoric meteor heading in our direction and it is aimed squarely at the audit and the role of the auditor. It is observable and predictable.

Before I go on, I want to note that the views I share today, including any reference to dinosaurs or meteors, are my own and do not necessarily reflect the views of the PCAOB, my fellow Board members, or the staff of the PCAOB.

Some might think the metaphoric meteor is technology. After all, we have heard a great deal over the last few years about the disruptive potential of technology on the audit. You've probably read one article after another about how blockchain, robotics, artificial intelligence, or other developments will make the audit unnecessary.

Technology is not the metaphoric meteor. Advances in technology do have the capacity to upend the audit. Drones may be able to do a better job counting cattle than humans;^[3] machine learning at testing estimates.^[4] Data analytic tools can facilitate the examination of entire populations.

But technology, while disruptive, will not be an extinction event. If anything, technology will improve quality and enhance the relevance of the audit. So if not technology, what then?

The onrushing extinction event is irrelevance and, like the climate changing meteor, the development is observable and predictable.

Investors and other consumers of the financial statements are increasingly relying on information not subject to the audit. The effect is the reduction of the significance of the audit and the role played by auditors.

The threat to relevance is not new. Audits have faced these types of concerns before. The history of auditing has been one of evolution and accommodation, changing to respond to the needs of investors, albeit with occasional pressure from external sources such as legislators, courts, and regulators. Indeed, the introduction of new communications requirements about critical or key audit matters (C-CAMs and K-KAMs) is a recent example of how the audit report can evolve to become more relevant to investors.

The current threat to relevance, however, is more serious.

So I want, in my remarks today, to explore ways to head off this possible extinction event.

First, I will talk briefly about how the audit has evolved to retain relevance in response to the interests of investors and other market forces.

Second, I want to discuss some of the types of information increasingly used by investors that are currently outside the audit, including alternative performance measures, or what I will call in this speech Non-GAAP financial measures, key performance indicators (KPIs), XBRL, and sustainability disclosure. And I will explore some of the concerns raised by investors and others about the quality of these types of information.

Finally, I want to suggest a modest path forward that has the capacity to start a conversation among investors, audit firms, and other stakeholders about relevance and possible changes that will help prevent auditors from becoming the weavers of the 21^st century.^[5]

II. Some Thoughts on Audit Relevance

Challenges to the relevance of the audit are nothing new. Standards used in the audit have been undergoing constant evolution in an effort to reflect the needs of investors and the capital markets.^[6] With the growth of large corporations in the United States, investors demanded "the development of more effective accounting and auditing standards."^[7] When events in the market exposed gaps, the standards evolved.^[8]

Likewise, the role of the auditor evolved. In the 1970s, responsibilities were extended to matters outside the financial statements with the adoption of the "Other Information" standard. Later, responsibilities were extended to reviews of interim information, with reviews of interim financial information eventually becoming mandatory for public companies in the U.S.^[9] In the aftermath of Enron and WorldCom, firms were required to attest to the effectiveness for many U.S. issuers of the internal control over financial reporting.^[10]

The most recent example of evolutionary change to promote relevance occurred in connection with the introduction of K-CAMs and C-CAMs into the audit report. Audit reports traditionally used a "thumbs up" or "thumbs down" model with little or no explanation. CAMs changed that by requiring reports to include insight into the most challenging aspects of the audit. Audit reports for the largest public companies in the U.S. began disclosing CAMs in September of this year.^[11]

These evolutionary steps helped maintain relevance and maintain investor confidence in the audit and audit report. At the same time, however, the role of investors in the debate over relevance evolved. Investor input into issues of audit relevance was, during the pre-Sarbanes-Oxley period, modest. It was during this period that the auditing profession held the drafting pen with respect to changes in the standards.

With the advent of the Sarbanes-Oxley Act of 2002 (SOX), that changed. Congress gave the pen to the PCAOB. Moreover, the PCAOB was instructed to act in the interest of investors and the public.^[12] That effectively provided investors and the public with a seat at the PCAOB's standard-setting table. The seat provided a more direct mechanism for addressing issues of audit relevance, including, potentially, those related to Non-GAAP, KPIs, XBRL, and sustainability metrics.

III. The Oncoming Meteor

A. The Importance of Data Quality

Growing up in the U.S., we are raised on the myth that if you are observant enough and lucky enough you can pick out that one company that, with a small investment, will make you fabulously rich. A $1,000 investment in Amazon in 1997, the year the company went public, would be worth more than $1 million today.^[13] Or there was Forrest Gump who let Lt. Dan invest his Bubba-Gump money in a "fruit company" later identified as Apple and, as a result, he didn't "have to worry about money no more."^[14]

Everyone in this room knows, however, that while Forrest Gump may have been successful, investment decisions for most of us are not roulette wheels or lotteries or random guesses. Institutional investors responsible for the economic wellbeing of the public are not prone to strategies that resemble gambling. Investors instead seek to make reasoned decisions that focus on future performance. In doing so, investors are not, and should not be, limited to the information in the audited financial statements. Other types of information can be highly useful in predicting future cash flows.

Let's briefly discuss four categories of information outside of the audited financial statements increasingly used by investors in making investment decisions. They include Non-GAAP, KPIs, XBRL, and sustainability disclosure.

B. Non-GAAP Financial Measures

Non-GAAP financial measures are generally those that seek to supplement rather than supplant the existing accounting framework. At one time, these measures were relatively uncommon and of modest importance to investors. Those days are over. Particularly among large companies, the metrics have become almost universal. The percentage of companies in the S&P 500 using Non-GAAP metrics has risen to 96%, up from 59% in 1996.^[15] Moreover, the number of non-GAAP metrics used by each individual issuer has increased.

What explains this dramatic growth? The simple answer is that investors find them useful. They may help reduce the complexity sometimes associated with GAAP disclosure.^[16] They can provide insight into management's view on how to best assess the performance of an issuer and, at least sometimes, be more predictive of future earnings.^[17] Indeed, academic research suggests that in the right circumstances, non-GAAP measures can be "more value relevant" to investors than the information in the financial statements.^[18]

At the same time, however, Non-GAAP measures can raise concerns.^[19] Adjustments can mislead investors.^[20] They may create an inaccurate presentation of the financial condition of the company, painting a more optimistic picture than is warranted. They may raise issues of accuracy and consistency, with metrics calculated incorrectly or calculated differently from period to period without adequate explanation.

C. Key Performance Indicators

KPIs are metrics that facilitate the assessment of an issuer's business performance but often have little direct relationship to the audited financial statements. Some KPIs are widely used and can include such metrics as comparable store sales, average number of daily users of a social media platform, and on-time performance for airlines.^[21]

The area is dynamic. Big data and technology have expanded the universe of possible KPIs. Already satellites are busy counting cars in parking lots and software tools are collecting the number of social media references.

Disclosure of KPIs can be beneficial. They offer an alternative source for predicting future cash flows.^[22] In some cases, they provide insight into the strategic planning process used by management. In an era of issuers going public devoid of positive earnings, KPIs may provide a meaningful glimpse into management's proposed path to profitability. Properly done, therefore, they can benefit investors and help reduce the costs of capital.

Issues of accuracy, however, can arise in connection with these metrics. "[S]usceptible to manipulation",^[23] KPIs may also provide an inaccurate perspective on an issuer's business. They can be calculated incorrectly or computed differently from period to period without adequate disclosure of changes in the relevant definitions, variables and assumptions, or fail to include all relevant inputs.

D. XBRL

XBRL involves the use of machine readable tags embedded in financial disclosure. The promise of XBRL is to allow for software and other tools to assess a broad population of issuers in a cost-effective manner.

Significant benefits from structured data can inure to issuers, investors, and other stakeholders. By reducing costs, XBRL can expand the population of public companies considered and increase the number of investors who can engage in the analysis.^[24] Issuers may benefit from the use of XBRL through improvements in the quality of financial reporting and the quality of internal decision making.^[25]

Concern can arise, however, over the reliability of XBRL. Recently, the U.S. Securities and Exchange Commission (SEC) took steps to reduce some of these concerns by mandating the use of inline XBRL.^[26] Inline requires the embedding of XBRL tags into a single document submitted to the SEC, eliminating the Interactive Data File otherwise required. In doing so, the SEC reduced the concerns that inherently arise when issuers submit two versions of the same information.

Nonetheless, concerns over quality remain. In some cases, wrong tags may be used. Some may incorrectly rely on extensions in place of required tags, interfering with the ability to make comparisons.^[27] Lower quality limits the promise of XBRL and the ability to conduct cost-effective analysis.

E. Sustainability Disclosure

Few areas have garnered more attention lately than the disclosure of information relating to sustainability, particularly environmental, socia,l and governance ("ESG") matters. Investors are increasingly taking this type of information into account when allocating capital. Investments based upon ESG principles have grown 18 fold since 1995, a leap from $639 billion in 1995 to more than $12 trillion in 2018.^[28]

Sustainability disclosure commonly addresses risks to an issuer's business model. The disclosure may be about immediate concerns, whether stranded assets, reserves affected by changing weather patterns, or escalating energy costs. They may also address concerns to the issuer's longer term business model.

In this area, issuers may disclose a multitude of metrics, whether energy consumption, water usage, or injury rates, with climate change and supporting metrics "the most important specific ESG issue considered by money managers in asset-weighted terms".^[29] Disclosure can also take the form of scenarios designed to test the sustainability of a business model under varying conditions.

Concerns have arisen over the completeness, consistency, and quality of sustainability disclosure and supporting metrics. Some of those concerns have arisen around the process used to collect the relevant data and the inputs that are included in any scenario or calculation. In addition, the disclosure may constitute an incomplete or unverifiable presentation of the issuer's risks.

IV. Preventing Mass Extinction: Steps Forward

All of these developments demonstrate that matters outside the audited financial statements are growing in importance. For now, GAAP remains the "gold standard."^[30] Subject to reasonable assurance, audited financial statements provide a high degree of accuracy, consistency and comparability. But with investors increasingly looking to other types of information, there is no guarantee that this gold standard will remain untarnished.

Some of the concerns with respect to unaudited measures, such as Non-GAAP, KPIs, XBRL, and sustainability metrics, have centered on the need for external standards. Many would benefit from uniform definitions and approaches. Others, however, would not. More customized metrics can sometimes provide a unique insight into the performance of a specific issuer. In other words, not every metric can or should be standardized.

What is a common denominator for these unaudited measures, however, is the need for improved quality. Improvement in accuracy, completeness, and consistency would benefit everyone, making the information more useful to investors, managers, directors, and the public. Moreover, improvements in data quality could spur progress on other issues such as the development, and agreement on the use, of common standards.

Ensuring quality, however, means more than making certain that the math is correct. Consistency in application matters. So does the process used to collect the data. Relevant controls should be sufficient to, among other things, ensure accuracy and completeness. For example, for a metric to be a fair representation of the issuer's business or performance, consideration needs to be given to the inputs and other variables used in the calculation.

Procedures designed to test accuracy, completeness, and consistency are routinely performed in an audit. Audits include procedures designed to test the accuracy and consistency of accounts and disclosures in the financial statements. Data may be examined for consistency from period to period, for compliance with relevant rules and regulations, and for the accuracy and completeness of the inputs used in the calculation. Auditors routinely apply judgment and professional skepticism to management assertions. In an era of ICFR opinions, audits entail consideration of the control environment.

At the same time, Non-GAAP, KPIs, and sustainability metrics do not always remain entirely outside the audit. Firms may become aware of these metrics when performing a risk assessment in the planning phase of the audit or may need to "read and consider" at least some of them to the extent appearing in the annual report.^[31] In some cases, firms provide assurance on metrics that may, in other circumstances, qualify as Non-GAAP. This can occur, for example, with respect to the footnote containing disclosure about operating segments, something examined as part of the audit.^[32] An EU directive requires audit firms to verify that certain ESG information "has been provided" by the issuer and left open the possibility that member states could require that any separate report "be verified by an independent assurance service provider."^[33]

In addition, audited and non-audited information may appear together in the same reports and filings. Information from the financial statements and KPIs may both appear, for example, in management's discussion and analysis in the annual report filed on Form 10-K.^[34] Non-GAAP and audited financial information may also be included in the same earnings release.^[35] iXBRL involves the use of machine-readable tags embedded into the financial statement information filed with the SEC.^[36]

All of this presents a risk of investor confusion.^[37] Investors may have an increasingly difficult time separating the audited from the unaudited. Indeed, academic research has found that confusion over this issue already exists.^[38]

Concern over quality, the potential for confusion, and the issue of audit relevance suggests the need for a conversation; a conversation that seeks to clarify the role of audit firms, if any, with respect to Non-GAAP, KPIs, XBRL, and sustainability measures.

Let me suggest a modest way that I think the discussion of some of these issues can be brought forward and one where the investor seat at the standard-setting table can make a significant difference.

Audits already must sometimes take into account matters outside of the financial statements. The "Other Information" standard provides that firms should "read and consider" the contents of the annual report for material inconsistencies with the financial statements.^[39] Issued in the 1970s, the standard was put in place at the behest of the SEC.^[40]

Adopted at a time when SEC filings were done in hard copy,^[41] the standard has not been modernized to reflect the dramatic shifts in the mechanisms for disseminating financial information, whether earnings releases required to be furnished to the SEC,^[42] social media,^[43] or TCFD (Task Force on Climate-related Financial Disclosures)^[44] and sustainability reports. Nor have proposals taken into account the ability to rely on technology and automation as a means of reviewing relevant "other" information. ^[45]

Given the growing importance, and use of, metrics outside the financial statements, the PCAOB did, in 2013, consider changes to this standard.^[46] Despite a proposal and additional research performed by PCAOB staff, no revision to the standard has yet been made. "Other Information," including auditor responsibilities relative to Non-GAAP and KPIs, nonetheless remains on the PCAOB's research agenda, with the staff in the process of "developing recommendations" on these issues. ^[47]

In my opinion, the time has come for a renewed conversation over the "Other Information" standard. In doing so, the conversation could consider whether the role of auditors in connection with Non-GAAP, KPIs, XBRL or sustainability metrics, should go beyond what is currently required under a standard that was issued before the proliferation of many of these measures. And in reviewing the information, the conversation would presumably want to include whether the "read and consider" standard currently applicable provides a sufficient level of auditor involvement.

The conversation will have the capacity to address concerns over relevance and, given its role setting and revising standards, the PCAOB could, in my opinion, serve as the moderator of any discussion over changes to the "Other Information" standard. The PCAOB has played this moderator role before with respect to relevance. Concerns over the relevance of the audit report caused the PCAOB to convene the key constituencies, collect the relevant comments and feedback, and ultimately devise a set of revisions. The process wasn't easy and took six years from concept release to final rule to complete,^[48] but produced a revised standard approved by the SEC that resulted in disclosure of critical audit matters or CAMs and firm tenure, among other things.^[49]

A similar conversation could be initiated with respect to the scope of the "Other Information" standard and how it should apply to Non-GAAP, KPIs, XBRL, and sustainability disclosure.

Any discussion would need to resolve a number of questions.^[50] Do investors want audit firms to play an increased role with respect to this information? Which metrics or other information is appropriate for auditor review? Should the standard apply to other periodic reports besides the annual reports? What level of review or assurance should be applicable? What are the costs of including these types of information in the "Other Information" standard? Does the PCAOB have the authority to explicitly include Non-GAAP, KPIs, XBRL and sustainability metrics within the "Other Information" standard irrespective of where they are disclosed?

The discussion would have limits. The "Other Information" standard was not designed to define relevant metrics. That presumably falls to other regulators or the private sector. Still, the conversation may lead to changes in the audit that result in improvements in accuracy, completeness, and consistency of the information and may reduce some of the uncertainties with respect to these measures and metrics. And those steps may spur changes elsewhere that address remaining concerns.

IV. Conclusion

I want to end with some observations and suggestions.

The metaphoric meteor is approaching. The path is observable and predictable. What, if anything, can or should be done about this threat to the relevance of the audit?

Audit relevance here means relevance to investors and the public. In altering standards, the mission of the PCAOB is to act in their interests.^[51] For a conversation moderated by the PCAOB to take place, investors need to ask for it. They must take advantage of their seat at the standard-setting table and urge that this topic be moved forward.

Of course, a decision to hold a conversation does not presuppose an outcome. Perhaps after fully vetting the various issues, the "Other Information" standard will remain largely as it is. Even then, the discussion may prove useful in clarifying, if not fully addressing, investor concerns over relevance.

On this issue, therefore, I encourage investors and other stakeholders to communicate with the PCAOB and to share their view on whether the PCAOB should move forward on the "Other Information" standard as a catalyst for a discussion of relevance. Write to us, ask for meetings with the staff or the Board. Also feel free to contact me directly – I am interested in hearing your thoughts.

And when you write, consider asking us to post your communications so that others can learn your thoughts and possibly participate in the conversation.

And maybe, just maybe, you will help prevent another extinction event.