A Return to Roots: The Auditor’s Role in Uncovering and Reporting Illegal Acts

Remarks as prepared for delivery

Introduction

Today, the Board considers a staff recommendation to replace the current interim standard on the auditor’s role in detecting and reporting potential illegal acts. That recommendation is contained in a Proposing Release: Amendments to PCAOB Auditing Standards related to a Company’s Noncompliance with Laws and Regulations and Other Related Amendments. 

The currently effective standard, AS 2405, Illegal Acts, became part of the Board’s standards in 2003 when the Board absorbed on an interim basis the generally accepted auditing standards of the American Institute of Certified Public Accountants (AICPA).¹ 

The current interim standard was originally drafted in 1977 and last revised in 1988. It does not take fully into account a series of unfortunate events, including the failure of more than 745 financial institutions during the savings and loan crisis; the “Numbers Game”² and “earnings management” problems of the 1990s;  the seeming prevalence of accounting fraud that included the misdeeds of Enron and WorldCom, and Adelphia and Tyco at the beginning of this century, matched with over 900 corrections or restatements of financial reports; or the collapse and/or rescue of nine major financial institutions in 2007 and 2008, including Lehman Brothers, that sparked a global financial crisis. 

Further, the current standard does not reflect the passage of the Sarbanes-Oxley Act,³ which created a new framework for corporate responsibility, and fundamentally changed the auditor - issuer relationship.⁴

In Sarbanes-Oxley, Congress also established a new era of investor protection through the creation of the PCAOB. It gave the PCAOB the drafting pen for audit standards, with instructions “to protect investors and further the public interest in the preparation of informative, accurate, and independent audit reports.”

 The proposed standard we are considering today is at the heart of the Board’s mission. It covers ground that Congress intended us to cover when it enacted Sarbanes-Oxley.           

The Auditor’s Important Role and Special Responsibility – a Public Trust

For hundreds of years, the practice of auditing has embodied a public trust. The auditor’s report on the cost of the Greek Parthenon was actually chiseled on a marble column of the Acropolis. The Roman Senate would conduct a hearing of account when one auditor succeeded another. In fact, the word “audit” is derived from the Roman’s practice of the hearing of account (in Latin, “audire”).⁵

The essential qualities of an auditor have endured the centuries. One of the first auditing manuals in the US described the functions of the auditor plainly: 

“The Lawyer’s duty is first of all to [the client] …; but the Public Accountant has only one duty to [the] client and to the Public… [to tell] the truth, the whole truth, and nothing but the truth.”⁶

This was true when it was written over 100 years ago (1905), and it is true today.

The Congressional response to the Great Depression had to take into account a growing population of investors.⁷ The response included novel ideas: a framework for regulation by disclosure and a reliance on independent third-party auditors.

The proposal for the government to employ a corps of government auditors to check the veracity of company reports was unseated by a late bidder:  Colonel Carter, one of the most influential and recognized leaders of the accounting profession, in testimony before a Senate committee, successfully presented a vision⁸ of independent auditors, rather than government auditors, as vital to assuring the accuracy and fairness of public company financial statements. This concept was incorporated into the new securities laws “so as to afford event greater protection to investors.”⁹

As U. S. Senator Jack Reed stated in a Senate hearing after the 2008 Financial Crisis: this function of the auditor gives rise to a “special responsibility--not a unique or sole responsibility but a special responsibility--a public trust....”¹⁰

 Auditing, like any profession, has evolved over the centuries to meet the changing environments, but with a particularly important constant: “A Public Trust.”

 Our action today reflects continued recognition of the public trust inherent in the auditor’s role.

The Proposal

Today, the Board considers a staff recommendation for a new standard, that, if adopted, would clarify the auditor’s responsibilities for identifying, evaluating, and reporting potential illegal acts, known as “non-compliance with laws and regulations,” or NOCLAR.

The staff’s proposal modernizes the standard in an elegant way, focusing on the critical thinking of the auditor. The approach that the staff has taken is straightforward – the auditor’s duty to detect material misstatements should also include detection of noncompliance with laws and regulations, including fraud. Such an approach clarifies the auditor’s responsibility to identify material misstatements in a company’s financial statements-- whether due to error… or due to fraud…, or due to NOCLAR.¹¹

The staff has developed a standard that incorporates the PCAOB’s current risk assessment framework to maximize and empower auditors’ professional skepticism and judgment in approaching NOCLAR.

Auditors already consider the applicable legal and regulatory environment when conducting an audit, but the current standard does not require the auditor to plan or perform audit procedures for NOCLAR.  It states:

“[N]ormally, an [audit] in accordance with generally accepted audit standards does not include audit procedures designed to detect illegal acts.” 

The Auditor’s Report is the auditor’s only means of communication to the investor. An opinion of fair presentation, in all material respects, is a green light for reliance. But that currently comes with an embedded hidden caveat. There may be undetected material misstatements due to NOCLAR, which the auditor does not have responsibility to find.

Under today’s proposal, the hidden caveat is removed, as the auditor’s focus will be on possible material misstatements of the financial statements-- regardless of anticipated effect (direct or indirect).

I am pleased that the staff has recommended that the Board propose a new presumption: that an audit in accordance with PCAOB standards should include audit procedures designed to detect noncompliance with laws and regulations, including fraud.

The staff’s recommendation simplifies and strengthens the auditor’s responsibility in a conceptually sound manner. Under the proposal, the auditor’s duty to detect material misstatements is the same-- whether due to error, noncompliance with laws and regulations, or fraud.

I am also pleased that the staff’s recommendation has eliminated the outdated and hard-to-justify categorization of illegal acts into “direct” and “indirect” buckets.

Both auditors and investors agree that the current judgmental splitting of laws into categories of so-called “direct” and “indirect” effects on the financial statements is a source of confusion.¹² The primary purpose of this categorization was to bifurcate the auditor’s duty to identify and assess illegal acts, particularly rejecting any responsibility for the detection of so-called “indirect” effect laws.

However, staff research has indicated that laws considered to have “indirect effects” on the financial statements, such as the prohibition of bribery of foreign officials by domestic companies, evasion of anti-money laundering statutes and protocols, false and misleading disclosures, and environmental contamination, among others, can and have led to substantial fines and penalties.¹³ And that may be part of the problem. The parsing of laws and regulations may have caused a lack of emphasis, or diminution of attention, to certain laws and regulations.

So, I am pleased that the current proposal simplifies the auditor's work by removing this distinction: the auditor must do sufficient work to be reasonably assured against material errors of either commission or omission.

When companies collapse nearly overnight or when years of intentional acts of noncompliance are revealed, calls for “Where Were the Auditors?” can always be heard.

For example, many of us remember the scandal of bank employees at Wells Fargo creating millions of phony accounts to meet outlandish sales and incentive targets. The conduct went undetected and unabated for years. When the scandal became known, the company lost $7.8 billion in stock valuation. The company’s auditor told U.S. Senators who were questioning the accounting that “the potential impact” of the “unethical and illegal conduct” “would likely be insignificant.”  Moreover, the auditor noted, “improper sales practices do not implicate the effectiveness of internal controls” as “not every illegal act has a meaningful impact on a company’s financial statements or its system of internal controls over financial reporting.”¹⁴

However, the bank paid a high price, as did its investors. The company settled a number of federal enforcement actions, which included a deferred prosecution agreement related to criminal offenses, administrative cease-and-desist proceedings finding violations of the anti-fraud provisions of the federal securities laws, another administrative proceeding with findings of unfair or abusive practices, and payment of over nearly $5 billion in monetary sanctions.¹⁵ Several former executives have also settled federal charges, including fraud.

Recently, the Bank recently agreed to settle the related shareholder lawsuit for $1 billion “that will help compensate hundreds of thousands of investors — state employees, nurses, teachers, police, firefighters and others — whose critical retirement savings were impacted by Wells Fargo’s fraudulent business practices.”

Today’s proposal, if adopted, would make it clear that indications of noncompliance with laws and regulations should not be dismissed by the auditor just because management is aware of the matter, or because the effects on the financial statements are not “direct” effects.¹⁶

I am especially pleased that the first paragraph in today’s proposed standard makes clear that a PCAOB-registered auditor has a fundamental obligation to investors that includes:

• Identifying and evaluating information indicating that noncompliance with laws and regulations, including fraud, has or may have occurred; and
• Making appropriate communications to management and the audit committee about such information.

The staff designed the proposed standard to reduce the risk of an auditor failing to detect a material misstatement in a number of ways.  First, the standard requires the auditor to apply an iterative risk assessment process that includes information sources external to the company. The improved risk assessment should result in the identification of additional risks of material misstatement, if present, for which the auditor is responsible for designing and implementing an audit response.

Second, since 1988, companies have focused on strengthening the control environment and utilizing an integrated framework that includes a company’s values.¹⁷ The proposed standard replaces an auditor needing to merely understand the control environment, with the requirement that the auditor evaluate and obtain evidence of effectiveness.

Third, the staff’s recommendation includes new required communications by the auditor to the audit committee. Over the last 35 years, audit committees have become increasingly involved in the oversight of the financial reporting process and of the external auditor, a role now required by provisions of the Sarbanes-Oxley Act requiring that the audit committee select and oversee the auditor, that it be composed of independent directors, and that the issuer disclose whether the audit committee contains at least one financial expert.t  Audit committees are often now involved in areas of significant risk, including emerging risks, cybersecurity, as well as enterprise risk management.

There have also been dramatic changes in the financial reporting and auditing environment since the standard was first written in the 1970s. The digital revolution continues to revolutionize business. Gone are the filing cabinets and document storage rooms. Gone are the fax machines. A collection of computer servers provides almost limitless data storage, data analytics, nearly instantaneous communications, such as email, virtual video meetings, and e-documents, and new tools like ChatGPT.

Technology in both corporate reporting and in the audit provides an unprecedented opportunity for automated tools, techniques, and visualizations of transactions and events. Technology will provide auditors with a new lens into the fraud triangle.¹⁸ Today, audit firms are using technological tools to perform full population testing, to search for anomalies, and to discover relationships and patterns because of their ability to ingest increasingly granular data.¹⁹

One global audit network firm noted:

“Companies have never been as data-rich as they are today, providing new opportunities to detect material frauds through data mining, analysis and interpretation.”²⁰

Another global audit network firm said it is using:

“[A] revolutionary bot that uses AI and machine learning to ‘x-ray’ a business, analysing billions of data points in milliseconds, seeing what humans can’t, and applying judgement to detect anomalies in the general ledger…²¹

It examines every uploaded transaction, every user, every amount and every account to find unusual transactions (indicating potential error or fraud) in the general ledger, without bias or variability...”

These technological tools can increase analysis and forensics, and, through machine learning, identify exceptional behavior in contracts or other processes.

The continued strengthening and testing of the effectiveness of internal controls over financial reporting also provides the auditor with additional information and more opportunities to uncover noncompliance activity, including fraud.

Appropriately, today’s staff recommendation does not require the PCAOB-registered auditor to perform a “compliance audit.”²² Some audit firms advise companies on how to establish world class ethics and compliance programs– to ensure compliance with laws and regulations. However, when performing an audit, the auditor’s role is simply to provide reasonable assurance – not absolute assurance -- that the financial statements are free of material misstatement.

Consequently, I believe that this proposed standard, if adopted, will provide a right-sized approach to increase the likelihood that auditors will identify and respond to risks of misstatement  material to the financial statements by using  the umbrella of risk assessment, by considering the information the company is publishing as well as the information about the company that is generated outside of the company, and by using a holistic approach to challenge management instead of cordoning off potential sources of misstatements.

There are 65 questions in the proposal, and I am interested in all comments regarding today’s proposal. In particular, I hope that commenters will provide answers to the following questions:

7 - 15. Are the proposed audit procedures sufficiently clear? Should the procedures include digital forensics? Are there others?

30 - 36. Are the proposed auditor communication requirements sufficiently clear? Should there be others? To whom should the communications be made? What should be included?

39 - 41. Are there auditor reporting considerations or additional requirements that should be included?  What is the consideration/requirement and why?

46 - 50. Are there additional requirements that should be made for interim (quarterly) reviews?

I want to acknowledge the hard work of the dedicated team that worked on this project. In particular, I want to thank Lisa Calandriello. She is unmatched in both her work ethic and in her constant patience with my team.

I also want to thank Jessica Watts, Kevin Lombardi, and Michael Shimansky from the Office of the Chief Auditor. From the Division of Enforcement and Investigations, Rebecca Mealey; from the Office of the General Counsel, Connor Raso and Michael Ungar; and from Office of Economic and Risk Analysis, John Cook, Tian Liang, and Federico Garcia.

In conclusion, the staff’s recommendation for a proposal for a new auditing standard is a reduction in complexity and a return to first principles. It holds true to the basic precepts of auditing that were expressed so aptly by Robert Montgomery over one hundred years ago: The auditor's responsibility is to detect noncompliance or questionable acts that the exercise of professional skill and care would normally uncover.

I am also reminded what a plainspoken federal judge once wrote:

 “Surely investors would consider the involvement of officers of a company in complex and wide-ranging schemes to inflate the company's income to be material even if the scheme had not yielded substantial results.”²³

And that’s precisely the point.

The standard we are proposing today is a great step forward for auditor responsibility and empowerment, and for the protection of investors and the markets. I am pleased to be able to support it, and I look forward to the public’s comments. Thank you.