Facilitating Investor Participation at the Standard-Setting Table

I. Overview

I want to thank Lawrence [Mundy] for the thoughtful introduction and the opportunity to talk with you today. You are a particularly important audience.^[1] You help ensure that, among others, our firefighters, the police, teachers, and public employees have sound resources for retirement. They may not always know what you do, but they benefit from your hard work. Your accounting, auditing, and financial background provides unique insight and expertise into the importance of audit quality and the work done by the Public Company Accounting Oversight Board ("PCAOB").

Before I go further, I should note that the views I share are my own and do not necessarily reflect the views of the PCAOB, my fellow Board members, or PCAOB staff.

Today, I thought I would do two things.

First, I want to discuss your much needed involvement in our standard-setting efforts, and what more the PCAOB can do to enhance this role.

Second, I want to talk a bit about the purported "expectations" or "performance" gap with respect to fraud procedures and propose possible ways to bridge the gap.

II. The PCAOB and Standard Setting

The PCAOB and its oversight of the audit profession emerged out of scandal and crisis. The PCAOB received authority over auditors of issuers in Sarbanes-Oxley Act of 2002 ("SOX") following the collapse of Enron and WorldCom; and over auditors of broker-dealers in Dodd-Frank following the frauds perpetrated by Bernie Madoff and Allen Stanford.^[2] The legislation ended self-regulation and authorized the PCAOB to conduct inspections, develop standards, and bring enforcement actions.

But merely listing the assigned functions does not begin to capture the magnitude of the transformation undertaken by Congress. The statutory framework instructed the PCAOB to act "to protect the interests of investors and further the public interest in the preparation of informative, accurate, and independent audit reports…"^[3] That bears repeating, the PCAOB must protect the interests of investors and the public. This straight-forward articulation of the PCAOB's mission set in motion a profound shift in the approach to auditor oversight, particularly with respect to standards and standard setting.

Prior to the adoption of SOX, standards were for the most part determined by the profession,^[4] with occasional intervention by the SEC,^[5] Congress,^[6] and the courts.^[7] Irrespective of the catalyst, the profession held the drafting pen.^[8]

With the creation of the PCAOB, the drafting pen changed hands. Moreover, as a consequence of the PCAOB's statutory mission, investors and the public earned a seat at the PCAOB's standard-setting table. To ensure that investors remained adequately involved, the PCAOB developed several mechanisms for collecting their views.

First, the PCAOB voluntarily agreed to submit proposed auditing and related professional practice standards, and its rules to the public for notice and comment. The notice and comment process is mandatory for federal agencies under the Administrative Procedure Act (or APA),^[9] but the PCAOB is not subject to that law.^[10] So, in providing an opportunity for public notice and comment, the PCAOB went beyond what the statute requires. The notice and comment process allows anyone to provide their views on the proposed standard or rule. The proposal and the comment letters received during the process are posted as part of a public record.

Second, the PCAOB created, and actively sought advice from, investors and the public through publicly-held meetings of advisory groups. The Standing Advisory Group contains representatives of multiple stakeholders, including investors.^[11] Later, in 2009, the PCAOB added a specific advisory group targeting investors: the Investor Advisory Group. This body, consisting entirely of investors and investor representatives,^[12] has routinely weighed in on proposed standards.

Third, active outreach became a part of the standard-setting process. The PCAOB's Office of the Chief Auditor communicates with investors and other stakeholders in connection with the standard-setting process.^[13] PCAOB staff might do so through informal meetings, roundtables, or focus groups. More recently, the PCAOB created a direct point of contact for stakeholders, such as audit committees, preparers, and investors.^[14]

The consequences of this change can be seen in the results. Investor participation has become apparent and highly influential. Changes to the auditor reporting model^[15] generated a concept release, two rounds of proposals, and about 400 comment letters,^[16] while changes to disclosures, which resulted in the identification of the engagement partner and the other auditors, generated another 200 letters.^[17] They each received noticeable input from investors and both advisory groups. Significant differences in stakeholder viewpoints had to be addressed and the process took around six years in one case and seven in another to resolve. Ultimately, however, a new standard and new disclosures emerged that were approved by the SEC.^[18]

Spurred by changes in the law and hard work by the staff, investors have earned a key role in the standard-setting process at the PCAOB. Some may argue that the strong presence of investor views has added complexity to the process and lengthened the time for completion, but in my opinion, the result is higher quality standards that better address the interests of investors and the public.

Integrating investor views into the standard-setting process, however, cannot be taken for granted. Investor contributions to the development of audit performance standards has been less robust.^[19] The lack of investor participation creates a risk that the investor viewpoint will not be fully considered when the revised performance standards are ultimately adopted by the PCAOB.

The PCAOB, in my opinion, could do more to facilitate investor participation. The PCAOB can increase the overall transparency of the organization.^[20] With organizational transparency, investors would become more aware of the activities at, and the reasoning process of, the PCAOB. In those circumstances, investors would presumably be more inclined to participate.

In addition, the PCAOB could be more proactive in seeking investor views by extending invitations to specific investor organizations, like this one, to meet with the full board. The PCAOB could also take a chapter from the Administrative Procedure Act (and the SEC) by providing a mechanism that allows investors and other stakeholders to publicly petition the PCAOB for changes in standards and rules.^[21] Publicly posting petitions and any comments received would provide a forum for debate and discussion that could help identify and advance areas of concern to investors.

At the same time, investors should not rely exclusively on the PCAOB to ensure investor participation.^[22] The post-Sarbanes-Oxley system of auditor oversight depends upon the public to help make certain that regulators remain accountable to their mission. Your role is vital. Don't leave it to us to reach out to you. Communicate with us directly, whether about standards that have been, or should be, proposed.

III. The Predictability of Unpredictable Fraud Procedures

Let me now turn to a specific place where your involvement can make a difference. The investor seat at the standard-setting table provides an avenue both to influence changes in, and help inform interpretations of, the standards. In this regard, I often hear concerns from investors about the auditing standards relating to the detection of fraud.

The concerns have sometimes been described as an "expectations gap", suggesting that investors don't fully understand the role of auditors in the fraud detection space and want more than the standards require.^[23] Conversely, the concerns expressed have sometimes been described as a "performance gap", suggesting that the standards are adequate but that auditors underperform.

Let me see if I can bridge some of these "gaps." Specifically, I want to talk about the requirement in our standards for auditors to incorporate unpredictability into their procedures and your critical role in helping to ensure that audits meet this requirement.

A. Auditors and The Risk of Fraud

As everyone here knows, auditors do not give guarantees about the health and wellness of a corporate issuer. They can, however, provide investors with reasonable assurance that the financial statements are free from material misstatements, whether due to error or fraud.

Providing reasonable assurance from error mostly entails an approach that focusses on looking for mistakes. Think about how this might occur. Mistakes could result from human error, inadequate internal controls, misapplication of accounting standards, or reliance on incorrect assumptions.

In searching for mistakes, though, auditors do not look at everything. Instead, as our standards require, they focus on the areas of the financial statements that present the greatest risk of material misstatement.^[24] Moreover, while materiality can be qualitatively important, firms typically compute quantitative thresholds that are predominantly based on the size of the company.^[25]

So, in general, firms are not just looking for mistakes but, absent qualitative factors, big mistakes. And presumably, they will spend most of their time with accounts that have the greatest risk of material misstatement.

But remember, the auditor's opinion provides investors with reasonable assurance from all material misstatements — not only due to error but also to fraud. Looking for financial statement fraud can involve very different considerations than looking for mistakes.

First, fraud is intentional and, for the most part, deliberately concealed. Mistakes may not always be obvious but typically they are not deliberately hidden. Fraud is. That makes detection much harder.

Second, fraud can be hidden anywhere. Fraud can be in high or low risk accounts. While a risk based approach to an audit can focus auditors on a particular set of accounts, these may not be the same ones used to conceal a fraud.

Third, fraud is often material qualitatively, rendering the quantitative thresholds typically used by auditors far less relevant.^[26] In fact, recognizing fraud early, particularly in modest amounts, can be critically important for both investors and for the auditor. Frauds often begin small, but often do not stay that way and, if not detected, can eventually lead to substantial harm to investors and creditors, even the bankruptcy or collapse of the company.^[27]

B. Predictable Unpredictability

Those engaging in fraud can try to do so by localizing the misbehavior in places where the auditor is unlikely to go.^[28] The standards address this risk by requiring that auditors incorporate "unpredictability" into the audit planning process.^[29] Unpredictability makes concealment more difficult and has been described by the PCAOB as "important in responding to fraud risks."^[30] In other words, firms should, as part of the audit, make an effort to look where they are not expected and test what is not anticipated.^[31]

Academic research, however, suggests that the approach to unpredictability utilized by firms in an audit may sometimes become predictable. For one thing, audit plans may identify the same risks of fraud from year to year. The result may be reduced variation in the accounts examined, providing greater predictability about where the auditor will or will not go.

Academic research also suggests that, in response to identified fraud risks, audit firms may employ the same substantive procedures each year with little variation. In other words, the nature of the testing may not vary.^[32] This could entail increases in the planned sample sizes without undertaking "effective modifications to a standard audit program, such as targeting procedures or samples in the fraud area."^[33] Similarly, in testing the general ledger, engagement teams may use filters to search for possible fraud risk factors but do so in a predictable fashion, such as using the same filters, using a predictable rotation of filters, or limiting their applicability to the same accounts.

Academic research suggests that even our standards can push auditors towards some level of predictability.^[34] The risk assessment process may nudge an auditor away from less material accounts or lower risk accounts.^[35] Similarly, the standards contain a presumption that improper revenue recognition is a fraud risk.^[36] But fraud can be hidden anywhere. To the extent auditors focus mostly on revenue, those committing fraud have an incentive to rely on non-revenue accounts.

C. Red Flags

The use of unpredictable procedures will potentially reveal risk factors or red flags that suggest the possibility of fraud. As a result, auditors also must apply professional skepticism and develop appropriate procedures to respond to these possibilities of fraud. ^[37]

The enforcement division at the PCAOB has brought cases for the failure to exercise appropriate professional skepticism upon the discovery of certain "warning signs" that "warranted heightened scrutiny." These have included last minute adjustments,^[38] deficiencies in internal controls that increased the risk of fraud,[39] the treatment of errors discovered after issuance of the earnings release but before the audit report,^[40] unusual payments to officers,^[41] failure to assess "uncharacteristically large amounts . . . reported in the last week or two of the reporting period from unusual transactions",^[42] and indications of the unreliability of documentation.^[43]

Red flags are, of course, not proof of fraud.^[44] Nor are all red flags the same.^[45] They will often generate false positives. But they are matters that require additional consideration and analysis. And in doing so, auditors may find themselves having uncomfortable conversations with management. But these conversations are structurally necessary and a sign of an effective audit, something that ultimately benefits the issuer and the consumers of the financial statements.

IV. Steps Forward

So what can you do in this space?

Unpredictability is a critical element of the fraud detection process. Greater emphasis on unpredictability may or may not increase the detection of fraud. But by signaling that fraud can be less easily hidden, some may forego the effort. The primary benefit may well be the frauds avoided.^[46] You therefore have an interest in helping to ensure that this element is properly executed.

You can do so through direct conversations with audit firms about their approach to these matters. Outreach by firms to the investor community seems to be increasing. The conversations can better help auditors incorporate elements of unpredictability into their selection of auditing procedures.

You can, as investors, encourage audit committees to engage in conversations with firms to better understand their approach to unpredictability and to emphasize the importance of this requirement. This does not mean a discussion of specific procedures employed in the audit but can entail a discussion about the need to incorporate elements of unpredictability in the nature, timing and extent of audit procedures.

V. Final Observations

Let me end by returning to the mission of the PCAOB and the seat for investors and the public at the standard-setting table. The PCAOB needs to hear from you.

Specifically, with respect to unpredictability, I would encourage you to bring any insights to the PCAOB. Remember, the PCAOB has the drafting pen and you have a seat at the table. The PCAOB could, if it wanted, look more often at the issue of unpredictability in the inspection process, and the PCAOB could potentially provide guidance on how to better fulfill the requirement. Your comments could very much contribute to these steps.

How might you do that? Write to us, talk to us, ask for meetings with the staff or the full Board to share your views. Push for more transparency.^[47] Give us any insight you have into how we might better reflect the interests of investors and the public in our standards.

Why should you do this? Because you benefit. If we can make better decisions in this space, we will improve the quality of, and trust in, the corporate reporting regime and help you in your role ensuring the economic well-being of the hard working Americans that are counting on you for their retirement.