Getting It Right: Quality Control and Modernizing PCAOB Standards Effectively

Remarks as prepared for delivery

Thank you, Senior Associate Dean Davis-Friday. I also want to thank former PCAOB Chief Auditor Douglas Carmichael for chairing this year’s conference.

It is great to be back with Baruch and to be part of this distinguished event.

So much has happened at the PCAOB since I spoke with you in May, and I am excited to update you on the important work we are doing.

But before I do that, let me provide the usual disclaimer that the views that I express today are my own and do not necessarily reflect the views of my fellow Board Members or our talented and dedicated staff.

As you know, everything we do at the PCAOB is driven by our mission to protect investors.

And by investors, we mean people – whether that’s workers saving for retirement, families saving for college, or anyone who depends on the integrity of the U.S. capital markets to realize their version of the American dream.

To guide us in achieving our mission and keep those investors protected, the Board has set four strategic goals:

• One, modernizing our standards,
• Two, enhancing our inspections,
• Three, strengthening our enforcement, and
• Four, improving our organizational effectiveness. 

And we’ve made significant progress over this past year.

For example, our inspections division has inspected audit firms in more than 30 jurisdictions across the globe. And they recently conducted groundbreaking on-site inspection work of firms headquartered in mainland China and Hong Kong.

While they have returned home from Hong Kong, their work is ongoing.

In December, the PCAOB will make determinations whether authorities in China have allowed us to inspect and investigate completely, for the first time in more than a decade, or whether they have continued to obstruct.

Congress sent a clear message when it passed the Holding Foreign Companies Accountable Act that access to U.S. markets is a privilege, not a right.

As I have said many times, the law demands complete access, and the PCAOB will accept nothing less than complete access when we make our determinations. No loopholes and no exceptions.

At the same time, this Board is approaching enforcement with renewed vigilance.

We are rethinking how we identify cases, the types of cases we pursue, and the sanctions we impose.

We’ve more than tripled the total dollar amount of penalties imposed against individuals in 2022 as compared to each of the past five years. This includes breaking the record for the largest money penalty ever imposed on an individual in a settled case – twice.

Over that same period, we’ve quadrupled the average penalty against firms in cases where firms fail to meet PCAOB reporting requirements. And we’ve increased the average penalties against firms in all other cases by about 50%.

In the past five years, the PCAOB assessed penalties against individuals less than half of the time and firms only about 86% of the time. This year it’s 100%.

Those who break the rules should know we won’t be constrained by the types of cases the PCAOB has pursued in the past. We won’t be limited to the level of penalties that have previously been assessed.

Next, we’ve taken several steps to improve our organizational effectiveness, including reimagining our approach to stakeholder engagement.

As our first major action as a Board, we established two new advisory groups: the Investor Advisory Group and the Standards and Emerging Issues Advisory Group. Both groups bring together extraordinary experts from across the world of auditing and financial reporting.

We’ve elevated the voice of investors by hiring the first-ever Investor Advocate, and we hired a Stakeholder Liaison to focus on outreach to stakeholders just like you. His name is Todd Cranford, and I encourage all of you to get to know him. You can find Todd’s contact information on our website.

Standards

Finally, as you heard earlier from my colleague Barb Vanich, we are pursuing one of the most ambitious standard-setting agendas in PCAOB history. And that is where I would like to focus today.

When the PCAOB was first getting off the ground in 2003, it adopted existing standards that had been set by the auditing profession on what was intended to be an interim basis.

Twenty years later, far too many of those interim standards remain unchanged.

But as this audience knows better than most – our capital markets don’t stand still. They evolve and grow. Practices change. Technology advances – relentlessly – with an impact on financial reporting and auditing.

To keep investors protected, our standards must keep up.

So, Barb and her team are hard at work. Less than a year into this Board’s term, we are actively working to update more than 30 standards within 10 standard-setting projects.

Just before Thanksgiving, the Board issued a new quality control standard for public comment.

I called it a watershed moment for the PCAOB. And I believe it will improve audit quality, because firms’ quality control, or QC, systems lay the very foundation for how they approach audits.

If you’ll allow me to mix metaphors for a moment, anyone who has ever hung wallpaper will tell you that getting that very first corner lined up exactly right is essential.

Get that first corner right and you’re set up for success. But lay that first corner slightly off center or allow an air bubble to get trapped, and the further down you go, the worse it gets – more and more wrinkled and crooked with every inch.

Similarly, when a firm’s QC system operates effectively, quality audits follow. And when QC systems operate ineffectively, investors are put at risk.

I want to be clear at the outset that we have seen solid evidence of progress over time. The trendline for the total number of QC deficiencies found by our inspectors at the largest U.S. firms is down. We’ve seen a significant drop in QC deficiencies from 2011 to 2020. 

But I am often reminded of the words of Senator Paul Sarbanes. A few years out from the accounting scandals that rocked our economy and prompted the passage of the Sarbanes-Oxley Act in the early 2000s, Senator Sarbanes warned, “When things get better, companies tend to forget what happened or how serious it was at the time. Trying to maintain high standards is a difficult job.”

Maintaining high standards is exactly what the PCAOB intends to do.

While there is clear progress when it comes to QC, it is also clear that progress has been uneven.

Our inspectors continue to find deficiencies related to engagement performance, independence, personnel management, and other areas.

In fact, violations of QC standards were part of the PCAOB’s largest-ever civil penalty: our $8 million settlement with Deloitte Brazil in 2016.

More recently, in cases related to inadequate quality control, the Board has imposed close to $2 million in penalties and other sanctions over the past 11 months.

Let me be clear: if firms can’t reasonably expect to complete audits with professional competence, they should not undertake those engagements in the first place.

A review of academic research suggests some of the greatest threats to quality control are fueled by profit.

For example, studies have found that some firms’ partner-reward systems may prioritize revenue generation over professional competency.

Researchers have also studied the impact of cost-cutting on the execution of audits.

In one study, some audit staff reported working as many as 20 hours per week past the threshold where they felt audit quality began to deteriorate. That’s not a threshold we want folks who are entrusted with safeguarding our capital markets spending any time past, let alone 20 hours a week.

Separately, some research suggests that certain partners or offices may depend, commercially, on significant clients. And so, to retain those clients, they may be willing to take risks that the firm – as a whole – would not.

Quality control is complex. To ensure investors are protected, we have to get the standard right. 

As with any standard-setting project, we ask two questions:

• What is needed to ensure that investors are best protected?
• And – what changes are needed to achieve that goal? 

For quality control, that starts with a risk-based approach.

We know that risks vary from firm to firm, and effective QC systems should too. A one-size-fits-all approach is not the best way to keep investors protected.

So, the proposed standard requires all registered firms to identify their specific risks and design a QC system that includes policies and procedures to guard against those risks.

Firms that perform engagements, such as audits for public companies or SEC-registered brokers and dealers, would be required to also implement and operate their QC systems to comply with the proposed standard, including executing the developed policies and procedures, monitoring the operation of the policies and procedures, and taking remedial actions where policies and procedures are not operating effectively.

The proposal would ensure accountability by requiring annual reporting on QC system effectiveness to audit committees of every issuer and broker-dealer client and on a new form – Form QC – to the PCAOB by firms that perform or have responsibilities with respect to engagements under PCAOB standards.

And Form QC must be personally certified by both the individual assigned ultimate responsibility and accountability for the firm’s QC system as a whole and the individual assigned operational responsibility and accountability for the QC system.

Simply designing elaborate processes on paper won’t be enough. Firm leadership will have a personal stake in delivering results and additional incentives to fix problems quickly.

Stakeholder input has been critical in developing this proposal. The PCAOB began collecting input for how to improve our QC standards years ago through previous iterations of our advisory groups.

Then, in December 2019 the previous Board issued a concept release on QC. That release in turn generated dozens of comment letters from investors, investor advocates, audit firms, academics, trade groups, and others.

Like all of our standard-setting projects, our economic analysis team studied potential changes in the context of costs, benefits, and possible unintended consequences.

We also considered the QC standards recently adopted by the International Auditing and Assurance Standards Board and the American Institute of CPAs. While most risk-based systems share a similar structure, we are proposing several important requirements that go beyond their provisions to address the U.S. regulatory environment, the needs and priorities of investors and other PCAOB stakeholders, and the PCAOB’s statutory mandate to protect investors and the public interest.

For example:

• The proposal requires firms with more than 100 issuers to appoint an independent person to their governance boards.
• It includes more specific requirements for monitoring and remediation; and
• It has guidelines for a firm’s voluntary publication of QC information, such as firm statistics or engagement performance measures. If a firm says it is meeting certain metrics, they better be able to back it up. 

And of course, unlike other organizations, the PCAOB’s standard was highly informed by our inspection data and observations. This information helped us to understand what’s going right – and what’s going wrong – with quality control at audit firms.

It just so happens we were urged to take this view by two professors hailing from this distinguished institution, chair of today’s event Douglas Carmichael and his fellow PCAOB alum and Baruch professor Thomas Ray. In a 2020 comment letter on our QC concept release Doug and Tom suggested that we quote, “work closely with the inspectors and draw on their knowledge and experience.”

Doug and Tom – thank you for that comment, and please know we value your feedback and all feedback we receive.

Putting all these ingredients together – strong use of inspection data, awareness of the economic and standard-setting environment, stakeholder outreach, and economic analysis – I believe we got it right.

Our proposal sets out an integrated, risk-based standard that could be applied by firms of varying sizes and complexity. 

It provides a framework for a firm’s QC system that is grounded in proactively identifying and managing risks to quality. Then it sets up a feedback loop – one powered by ongoing monitoring and remediation – that is designed to drive continuous improvement.

And the reporting requirements foster accountability.

In short, this standard protects investors.

That’s my view. Now, it’s your turn to tell us what you think.

Detailed questions are included throughout our proposal, and we encourage you to respond to any or all of them. You can also provide feedback in areas not covered by specific questions, and we invite you to submit any evidence that informs your views.

As I mentioned, certain proposed requirements would apply to all firms registered with us, including those that currently do not audit public companies or SEC-registered brokers and dealers. So, I encourage all registered firms to read the proposal and provide their perspectives.

The deadline for comments is February 1, 2023. After that, the Board will evaluate the comments and determine the best way to move forward with a final standard.

QC is foundational, but it is just one project on our agenda.

We are also on track to issue a proposal on the confirmation process before the end of this year.

Like quality control, the auditor’s use of confirmation is another area crying out for modernization. Our confirmation standard – which addresses a process that touches nearly every audit – hasn’t been substantially changed since 2003.

That’s unacceptable, because confirmation is a powerful means for auditors to obtain external evidence and can also be an important tool for auditors to address fraud risks.

Like QC, to keep investors protected, we need to ensure our confirmation standard is fit for purpose in today’s capital markets.

After confirmation, we are on track to issue several more proposals in 2023, updating our requirements in key areas that include:

• Illegal acts by clients,
• Going concern,
• The PCAOB’s attestation standards, and
• Topics addressed by our AS 1000 series standards, such as due professional care.

We also plan to issue a proposal on how our standards should be changed to address the design and performance of audit procedures using technology-assisted data analysis.

In addition to everything I’ve just mentioned, we also have four projects on our mid-term standard-setting agenda. That means the staff is hard at work to advance standard setting for these projects, even if a Board action isn’t expected in the next 12 months.

Yes, it’s a lot of hard work. As Senator Sarbanes said, “Trying to maintain high standards is a difficult job.”

But Barb and her team are up to the task, and we are grateful for their dedication. 

Before I close, I understand we have some students participating today.

Thank you for choosing a career in accounting. You will be critical as we work to continue improving audit quality, upholding the integrity of our markets, and protecting investors for the next 20 years.

As you think about where your studies will take you, I encourage you to consider public service.

I am here today as the Chair of the PCAOB just two generations away from Alabama crop farmers.

My grandmother literally kept her money under her mattress because she didn’t trust the banks, let alone the stock market.

So, when I became the first person in my family to go to law school, I chose to go into securities enforcement. I wanted to go after cheaters – because I understood that in order to help people like my grandmother and my community build wealth, we first have to build trust in the capital markets. And by holding wrongdoers accountable, I could help bolster the integrity of, and breed confidence in, the financial system.

Quality audits do the same.

Every day in your classes, I’m sure you are hit with a lot of numbers, jargon, and acronyms. That’s important. But when we cut through it, the heart of what we do is about people.

When we talk about protecting investors, we are talking about people: workers saving for retirement – maybe parents like yours saving to help with tuition – your families, your communities, and anyone who depends on the soundness of our capital markets to invest and pursue their version of the American dream.

All of those people depend on quality, accurate audits to make decisions that impact their futures. 

So don’t let anyone tell you accounting is boring. It’s all about people.

Thank you again for having me here today.

I’m looking forward to continuing the conversation with Professor Davis-Friday.