Careers
SubscribeAuditing Under SOX: An Interim Report
Auditing Under SOX: An Interim Report
It’s great to be here in East Lansing, and I appreciate the opportunity to participate in this conference. I admit that, at first, I had some reservations. I spent my college and law school years at a Big Ten school on the other side of Lake Michigan. Before accepting Hugh Maken’s invitation to speak here today, I checked the football schedule and found that the Badgers and the Spartans don’t play each other this year. So, I don’t think I am at risk of being charged with treason back home in Wisconsin.
Next Wednesday will mark the fourth anniversary of the appointment of the founding members of the Public Company Accounting Oversight Board. The Board, which is a creature of the Sarbanes-Oxley Act, was part of Congress’s response to a meltdown in investor confidence in financial reporting. It is a measure of the depth of feeling in July 2002 that the Act passed the Senate unanimously and attracted only three dissenting votes in the House. When President Bush signed the new law, he described it as "the most far-reaching reform of American business practices since the time of Franklin D. Roosevelt." It is hard to think of another recent example of such broad bipartisan support for such far-reaching legislation.
Times have changed. Today, there is a tendency to forget the things that led to the Sarbanes-Oxley Act and to focus instead on the costs. In some quarters, the words "Sarbanes-Oxley" are becoming short-hand for a wide range of concerns about the competitiveness of the U.S. capital markets. The new Secretary of the Treasury, Hank Paulson, has supported the formation of a committee that is studying whether U.S. securities regulation, including SOX, is discouraging companies from raising capital in our markets. During the last few months, at least four bills have been introduced in Congress to amend Sarbanes-Oxley.
I would like to highlight some of the positive trends in auditing since the enactment of SOX. I believe that there have been clear improvements in public company auditing. While those improvements have not been cost-free, we should be slow to give them up. Transparency and investor protection are the basis for the fundamental strength of our markets, not a weakness. Just as some critics argue that Sarbanes-Oxley was enacted in haste, it would be a mistake to perform hasty surgery on the law without fully understanding what it has and has not accomplished.
Before I go further, I must note that the views I express are solely my own, and not necessarily those of the Public Company Accounting Oversight Board, its other members, or its staff.
I. The Pre-SOX Breakdown in Confidence in Auditing
It is useful to begin with a little history. During the late 1990s and early 2000s, a series of high profile cases, corporate failures, and SEC investigations called into question the reliability of public company financial reporting. Enron and WorldCom were the most prominent examples. But, a laundry list of other household name companies was involved. And, whenever public company financial reporting was an issue, the question inevitably arose, "Where were the auditors?"
A combination of factors contributed to the erosion of trust in auditing. For one thing, revenues from consulting activities became increasingly important to auditors. In many cases, clients were paying more for consulting than for the financial statement audit. As a corollary, firms began to see the lower-margin audit as a foot-in-the-door to more lucrative consulting engagements.
At the same time, audit firms faced considerable pressure to keep client management happy and the audit fee low. Public companies themselves began to view the audit opinion as merely another standardized commodity to be purchased as cheaply as possible.
The tactic of using the audit to gain entrée to other work, coupled with the difficulty in raising audit fees, meant that the costs of auditing had to be controlled. That, in turn, led to less emphasis on traditional audit procedures and more emphasis on reducing the amount of work. Too often this occurred based on superficial judgments about which aspects of the client’s business were the most likely sources of financial statement error. That approach had disastrous consequences when the judgments about risk turned out to be incorrect, such as in WorldCom.
II. The Return of the Auditor
Fast-forward to the present. Four years have passed since Congress sought to restore investor confidence. How has the auditing environment in the U.S. changed? To me, five things stand out.
First, auditors are auditing again.
The auditing profession has returned to its roots. Many non-audit services have been prohibited. Even as to those that remain legal, audit committee approval is required, and audit committees are more reluctant to let their auditors perform significant non-audit services. In short, the model has gone back to one in which auditing is a profession, rather than a business in which the audit is a door-opener to the sale of other services.
Of course, one inevitable consequence of this change in the business model is that audit fees have risen. Rising audit costs are often blamed on the addition of internal control auditing to the tasks performed as part of a public company assignment. In fact, however, recent studies concluded that, for the largest companies, the cost of the internal control audit component fell roughly 48 percent last year, while the overall cost of the audit rose four percent.[1] The high demand for qualified staff, and the resulting need to pay auditing personnel more, is undoubtedly a factor. However, I think we are seeing the natural consequences of the abandonment of a business model in which the audit was a loss leader.
Second, there is a new level of discipline in the system as a result of PCAOB oversight.
The knowledge that, in the case of any particular audit, PCAOB inspectors, who are themselves experienced auditors, may review the work-papers and form their own conclusions about how the audit was conducted has had a significant effect on auditors’ work. All of us are likely to do our jobs differently if we know that someone else might be looking over our shoulder. The existence of our inspection program has also made it easier for auditors to make calls that are not popular with clients. We hear that the argument, "The PCAOB won’t let us do that," is frequently made to justify difficult decisions.
Third, auditors have a more arm’s length relationship with their public company clients.
Audit partners are under less pressure to keep management happy on auditing issues in order to retain their consulting business and more focused on traditional independence. Further, the audit committee, composed of independent directors, is now the focal point of the auditor-client relationship.
Fourth, the audit firms have strengthened their own quality controls to better manage the risks of auditing.
The Board issued a report last March on changes in the four largest firms’ quality controls.[2] While that report hasn’t attracted widespread attention, it contains some interesting findings. For example:
- Firms are more closely tying partner compensation to technical competence, rather than to business-generating skill. Auditors are being paid for auditing, not selling.
- Firms are strengthening second partner reviews. All of the major firms require a concurring partner to sign-off on a public company audit report, and there is an increasing recognition of the important protection this affords the firm, provided the review is thoroughly and competently performed.
- Firms have enhanced their internal inspection functions. Engagement partners know that their work could be subject to post-completion review by either the firm itself or by the PCAOB.
- Firms are more selective about their clients. They have enhanced the documentation and consultation requirements that must precede a decision to accept or retain a client.
In addition, the ability of audit partners to resolve difficult accounting issues on their own -- and put the whole firm at the risk of a bad call -- has been restricted. Firm internal processes requiring national office consultations are more strictly enforced.
Better risk management is a good thing. And a recent study shows that it is apparently paying dividends in the form of fewer class action suits against auditors.[3] However, risk management has had some perverse consequences. As the major firms have developed more sophisticated tools for assessing client risk, they have "fired" some clients, particularly those that they perceive as riskier, relative to the fee potential. As a result, some public companies -- particularly smaller ones -- are finding it harder to engage an audit firm. Making sure that there is healthy competition in the auditing profession so that these companies have choices is one of the key challenges we face.
Fifth, internal control reporting has had a significant impact on auditing.
Auditor reporting on the effectiveness of internal control under Section 404 of Sarbanes-Oxley has added an important new dimension to the auditor’s work. The auditor is compelled to develop a more complete understanding of the strengths and weaknesses of the client’s financial reporting systems than would be the case in a financial statement only audit. Audit committees are also being forced to learn more about those systems.
U.S. public companies have been required to maintain effective controls for almost 30 years. Pre-SOX, however, there was a lot of "deferred maintenance" regarding controls. 2005 was the first year of Section 404 reporting for accelerated filers, and most of these larger companies have now been through the process twice. In 2005, almost 15.8 percent of the 3,736 companies that reported on internal control concluded that their controls were not effective. In 2006, through June 30, that number fell to 9.5 percent.[4]
Partly due to internal control reporting, the number of restatements rose to record levels last year. According to a Glass-Lewis study, an amazing one in 12 public companies restated -- twice the rate of 2004.[5] While the restatement rate remains high this year, restatements are becoming more concentrated in smaller companies.
- From the first half of 2005 to the first half of 2006, the number of restatements filed by clients of the eight largest auditing firms declined. The largest firms’ share of total clients with restatements also declined.
- In contrast, restatements by the clients of regional and local auditing firms increased 169 percent in the first half of 2006, compared to the first half of 2005. The clients of these firms tend to be smaller issuers.
The explanation seems to be that the large public companies have shaken out their control problems as a result of Section 404. But smaller companies are now uncovering those issues as they prepare for internal control reporting.[6]
Whatever its impact, however, there is little question that internal control auditing has come at a steep price. A survey conducted by CRA International finds that, for companies with market caps over $700 million, the total cost of Section 404 compliance in 2005 was $8.5 million; for smaller companies, it was $1.2 million. 2006 seems to have been somewhat better from a cost stand-point. CRA found that, in 2006, total Section 404 costs fell 43.9 percent for large companies and 30.7 percent for small.[7]
The Board is committed to making sure that Section 404 is implemented in a way that balances costs and benefits. We discussed this morning some of the things that the SEC and PCAOB intend to do to achieve that goal. From the PCAOB’s perspective, I can assure you that making internal control auditing cost-effective is our top priority.
III. Has Sarbanes-Oxley Weakened the Competitiveness of the U.S. Capital Markets?
In my view, these changes in the auditing profession and the new focus on controls are positive developments. They increase the reliability of financial reporting and provide a basis for restored investor confidence. The key question is not whether Sarbanes-Oxley has accomplished its goal of strengthening investor protection. The question is whether it has done so at a cost that it weakens the competitiveness of the U.S. capital markets.
It is absolutely critical that we be alert to unintended consequences and unnecessary costs. However, in my view, the case that Sarbanes-Oxley is undermining the competitiveness of our markets is, at best, overstated.
First, I think it is worth noting that, in much of the world today, the overriding objective of securities regulators is to encourage greater public participation in the capital markets by strengthening transparency and investor protection. The privatization of state-owned enterprises, increased reliance on private investment to fund individual retirement, and the dismantling of state-run savings plans all create tremendous pressure to take steps to increase the general public’s willingness to invest in equities.
As a result, rather than avoiding the U.S. model, many other developed countries are copying the key elements of Sarbanes-Oxley.[8] For example:
- There is a general recognition that, to improve audit quality, auditor oversight bodies should be independent of the industry they oversee. There is something like a worldwide stampede to establish organizations like the PCAOB. In the EU, for example, the recently-adopted Eighth Directive requires all member states to establish an auditor oversight body.
- Other major capital markets have also recognized the unhealthy effects of mixing auditing and consulting services. Like Section 201 of Sarbanes-Oxley, they are placing restrictions on these services to improve audit quality.
- Audit committee independence requirements are becoming increasingly common. The United Kingdom, Hong Kong, Australia, Canada, and Mexico put new rules in place requiring that members of the audit committee be independent of management.
- A number of countries have even copied our internal control assessment requirement. While the concept of auditor involvement in internal control reporting has not been as widely adopted elsewhere, some other jurisdictions, including Japan, are considering it.
Rather than racing to the regulatory bottom to attract issuers, other countries recognize that stronger investor protection and more reliable disclosure attract investors. That, in turn, lowers capital costs. A recent study by two Wharton professors confirms that countries with more extensive disclosure and corporate governance requirements have significantly lower costs of capital. In fact, listings on U.S. markets still command a substantial valuation premium, estimated by the New York Stock Exchange at 30 percent. Non-U.S. companies that cross-list in the U.S. reduce their cost of capital on average 13 percent. That translates into a valuation premium associated with listing in the U.S. of up to 37 percent.[9]
To be sure, despite their cost-of-capital advantage, our markets no longer enjoy the dominance they once did. New York is no longer the automatic destination for companies seeking to go public. The reasons for that are varied and complex, but it is hard to conclude from the empirical evidence that Sarbanes-Oxley is much of a factor.
Over the last decade, the securities markets in many other countries have become more sophisticated and more liquid. That, coupled with advances in electronic communications, has opened up choices to companies seeking to go public. With alternative markets available, some companies have decided to list outside of the U.S. For example, none of the top five IPOs last year occurred in the U.S. But that fact says little about the impact of our regulatory system. All five of those IPOs were privatizations of state-owned entities in China or France. It is hardly surprising that the Chinese and French governments decided to list in the Hong Kong and Euronext markets.
Further, while the cost of capital in the U.S. is low, the cost of raising capital is not. In fact, the highest costs companies going public in the U.S. face are not compliance costs, but underwriting fees. One recent study has estimated that underwriting fees consume 6.5 to 7 percent of IPO receipts in the U.S., compared to 3 to 4 percent in Europe.[10]
The U.S. share of world IPOs has been dropping for at least ten years. In 1996, approximately 60 percent of new offerings occurred here. By 2001, that percentage had fallen to around 8 percent. Since the enactment of Sarbanes-Oxley in 2002, the U.S. share of world IPOs has nearly doubled, to 15 percent, and the amount of capital raised by non-U.S. companies on U.S. exchanges has increased.[11]
While LSE’s lightly regulated AIM market is actively soliciting small companies, the number of U.S. companies that have responded is not large. As of August 31, only 36 of the 2,000-plus AIM-listed companies were based in the U.S. Seven of those also trade on a U.S. market.[12]
To me, what this evidence suggests is that the global capital markets are becoming more competitive. In that environment, we should not lose sight of the things that have historically drawn issuers to our markets -- and that others are now seeking to emulate. In my view, our markets have been attractive to companies from all over the world for many years because of, not despite, the level of transparency and investor protection we offer. In seeking to remain competitive, we need to be careful not to throw the baby out with the bathwater.
IV. Conclusion
Our securities markets are a unique national asset. Because of the confidence investors place in the fairness of those markets, we have a level of public participation in equity investment that is the envy of the world.
It does not, of course, follow that our system is perfect or that every regulation now on the books is justified. As I have outlined, I believe that we have made progress in the last four years in bolstering confidence in financial reporting and auditing. While there is plenty of work left to do, we should not lose sight of the fact that our markets are critically dependent on reliable financial information. Therefore, the auditor’s role is too important for us not to get right.
[1] See CRA International, Sarbanes-Oxley Section 404 Costs and Implementation Issues: Spring 2006 Survey Update at 3 (April 17, 2006). See Foley & Lardner LLP, The Cost of Being Public in the Era of Sarbanes-Oxley at 1 (June 15, 2006).
[2] See Observations on the Initial Implementation of the Process for Addressing Quality Control Criticisms within 12 Months after an Inspection Report, PCAOB Release No. 104-2006-078 (March 21, 2006).
[3] See Cornerstone Research, Securities Class Action Case Filings 2006 Mid-Year Assessment (July 26, 2006).
[4] Source: Audit Analytics. For a discussion of deferred maintenance, see Report on the Initial Implementation of Auditing Standard No. 2, An Audit of Internal Control over Financial Reporting Performed in Conjunction with an Audit of Financial Statement, PCAOB Release No. 2005-023 (November 30, 2005).
[5] See Glass Lewis & Company, Restatements Trend Alert: Getting It Wrong the First Time at 1 (March 2, 2006).
[6] See Audit Analytics, Financial Restatements Dashboard – Annual Results for Years 2001 to 2005/Analysis for First 6 Months of 2006 at 2.
[7] See CRA International, Sarbanes-Oxley Section 404 Costs and Implementation Issues: Spring 2006 Survey Update at 2-3 (April 17, 2006).
[8] These examples are from Testimony of Christopher Cox Chairman, U.S. Securities And Exchange Commission, Concerning The Impact Of The Sarbanes-Oxley Act, Before the Committee on Financial Services U.S. House of Representatives at 2 (September 19, 2006).
[9] See Doidge, C., Karolyi, A., and Stulz, R., Why Are Foreign Firms Listed in the U.S. Worth More?, 71(2) Journal of Financial Economics 205-238; See generally C. Niemeier, American Competitiveness in International Capital Markets, available at http://www.pcaobus.org
[10] See Oxera Consulting Ltd., The Cost of Capital: An International Comparison at 4 (June 2006), available at http://www.londonstockexchange.com.
[11] Source: Dealogic; See also Cowan, L., Foreign Companies Cash in on U.S. Exchanges, Wall Street Journal at C6 (August 28, 2006).