Keynote Address: A Fresh Look at Auditing

Thank you for inviting me to speak today. It is an honor to be here at the 104th annual meeting of the National Association of State Boards of Accountancy. Before I begin, let me first make clear that the ideas I express today are my own and should not be attributed to the PCAOB as a whole or any other members or staff.

For more than a century, NASBA has helped state boards of accountancy enhance their effectiveness at protecting the public with high quality professional standards in the practice of accounting.

NASBA also plays a key role in facilitating relationships between state boards and federal regulators. The Public Company Accounting Oversight Board has benefited greatly from the coordinating role NASBA plays.

When I arrived at the PCAOB earlier this year, I was pleased to see that there is a strong cooperative relationship between the PCAOB and the state boards. One of NASBA's directors, Gaylen Hansen, has been an invaluable member of the PCAOB's Standing Advisory Group for the last six years.

Moreover, I am grateful for NASBA's support in the constitutional challenge waged against the PCAOB, and NASBA's filing of an amicus brief to the U.S. Supreme Court in 2009. With NASBA's help, the PCAOB overcame the challenge and has been able to redouble its focus on its investor protection mandate under the Sarbanes-Oxley Act.

Sarbanes-Oxley's federal regulatory scheme in no way supplants the importance of long-standing state protections. As envisioned by the Act, the PCAOB and state boards together maintain an important and rigorous discipline for the profession.

To this end, I have discussed ways we can help each other with your chairman, Mike Daggett, as well as your former chairman (and former chairman of Texas State Board of Accountancy), Congressman Mike Conaway. Based on these discussions, I have asked the PCAOB staff to find ways to reinforce how important it is that accountants continue to comply with appropriate state licensing requirements.

One of the ways we will do so is through our communications with registered firms. Going forward, our letters to newly registered firms will explicitly remind them that registration with the PCAOB does not supersede licensing requirements that apply in the jurisdictions in which they engage in practice. And staff will encourage firms to consult with the appropriate state regulator to insure that the firm is in compliance with applicable law. Our website will also provide this reminder to already registered firms.

As we emerge from the shock of the initial phase of what looks to be an extended economic crisis, the threats to the investing public and the challenges confronting the auditing profession require that we combine our strengths to protect the public. NASBA and the state boards have been critical to weathering past crises and strengthening investor protection.

What, then, are the challenges facing auditors and investors that will require our combined efforts?

The accounting profession again finds itself at a point where its relevance is being debated. Some point to the profession's failure to have warned the public of the impending collapse, or of the need for government bailout, of substantial financial institutions, when these headline-grabbing events came only months, weeks or even days after the auditors' having published an unqualified audit report. Others continue to complain about audit fees, rising or not, and without regard to the complex nature of transactions to be audited and opined on.

At the same time, globalization has stretched the frontiers of auditing. Companies are multi-national; audits must be too. But national borders still exist; and inconsistent or even conflicting national economic goals and strategies make multi-national audits all the more challenging, and weaken investor protection.

More fundamentally, inherent clashes of cultural values and norms throw the goal of putting American capital to the highest and best use into uncertainty. U.S. markets and investors have been unfairly taken advantage of, by those who want the benefits of American markets but not American rules.

Little explanation is needed in this group, I know, of why and how accounting and auditing are more important to serving American society than ever. But a lot of explanation is needed in the living rooms, board rooms, and congressional hearing rooms across the country and back in Washington.

It is my hope that auditors will look back on this time as the moment when they turned to seize the future. As state and federal regulators, we are duty bound to look forward, evaluate risks to the public interest, and plan.

Let me discuss what I believe are the critical questions policy makers will need to confront. The range of policy choices will no doubt take some people out of their comfort zone. With a century of experience responding to threats to the public interest, NASBA will be an important voice in the debate.

I.  Extraordinary Challenges Require Creative Solutions

Reliable financial and economic data is one of the fundamental assumptions of American society that sets us apart. We value a culture of honest representation and must continue to do so to promote our economic success.

Our system of capital formation relies upon the confidence of millions of savers to invest in companies they trust. The auditor's opinion is critical to that trust. But there are, of course, formidable forces that work against that trust.

First, critics reliably raise the payment model: the auditor is hired and fired by the company itself.

The Sarbanes-Oxley Act's reform to shift hiring and oversight of the auditor from management to the audit committee was undoubtedly important. Few thoughtful students of corporate governance would want to return to the days of a management-controlled audit committee and management-hired auditors. And, of course, there is no consensus on how to price the benefit of such independence. There is no way to know how many more corporate failures there would have been if auditors had continued to be engaged by management itself.

But the fact remains that, based on what PCAOB inspectors have seen, numerous audits by major firms and small firms alike exhibit flaws that go to the fundamental objective of the audit — to obtain reasonable assurance about whether the financial statements are free of material misstatement.

That's what it means when the PCAOB cites an engagement deficiency in the public portion of an inspection report. Inspectors may find other flaws that do not rise to this level. But if the deficiency is described in the public part — or Part I — of the report, that means in the inspection team's view, it did rise to this level.

Now, some firms have argued that engagement deficiencies typically reflect mere documentation deficiencies, or a difference of professional judgment, between the inspection staff and the auditor, within a range of reasonable professional judgments. Those who make decisions based on this notion — policy makers, audit committees, or others — will make the wrong decision.^[1]

Acknowledgement is the first step to addressing a problem. In some cases, especially those involving over-reliance on inquiry, or management assertions, as audit evidence, the auditor simply has not done enough work to complete the audit. In other cases, it can be a matter of the auditor rationalizing away disconfirming evidence that is already apparent.

In either case, we are left with the fundamental question: why didn't the auditor's skeptical mindset help him see that he needed to challenge management's assertion or investigate the disconfirming evidence?

I am also led back to the fee, and the effect that client service has on an auditor's ability to retain the fee from year to year. It may be that insertion of the audit committee between management and the auditor, while helpful to protect the auditor from undue influence, is simply not a strong enough step, in all engagements, to reverse the effects of the culture of client service that firms have, of necessity, inculcated to remain viable enterprises.

For the record, I do not by these voiced concerns impugn the ethics, integrity and good faith of the profession. Skepticism can fail in spite of both fundamental competence and high ethical standards, when the cited pressures, for example, result in the audit team skipping over disconfirming evidence. I am talking about casualties of judgment in the heat of the moment. As standard-setters, the PCAOB and state boards should try to find ways to counter the pressures, and fortify the judgment.

It is the age-old problem of agency, with a dispersed and unconnected set of principals. Investors are, in theory, the ultimate beneficiaries of the audit. The audit gives them assurance that they can feel confident in the stewardship of management, and the reliability of the financial information on which they base decisions to hold or sell their shares. But investors have no direct relationship with the auditor.

Management does. It is management that enjoys most of the amenities of client service. Most auditors tell me that audit committee oversight after Sarbanes-Oxley has changed the tone in the board room considerably. None have reported that disappointing management no longer matters.

In this environment, accounting firms have continued to expand the wide array of professional services they offer, including in many cases new, innovative services. At the same time, the scope of the audit has not grown. Viewed in light of the relationship between an auditor and the company it audits, that fact is not surprising.

But as the guardian of a societal value, the audit is arguably just as essential to our capitalist system as electricity and water are to our everyday life. If it is to retain that lofty status, auditors and audit policy makers must make sure the audit is useful.

This is not a new challenge. The late Sandy Burton, respected SEC Chief Accountant, and Dean of Columbia Business School, put the same challenge to the profession in his time.

Burton was an advocate for using accounting and auditing to promote the public interest. He challenged auditors to do more for the public. He said "the concept of audit" had to be expanded, and the auditor "must see his role as encompassing the evaluation of effectiveness in meeting goals and efficiency in operations as well as simply expressing an opinion on financial statements."^[2]

But, he lamented, auditors instead devote "[a] great deal of effort . . . to limiting responsibility rather than enlarging it."

This is still the case today. I know my friend and colleague from the bar, Michael Young, will follow me this afternoon to discuss the legal peril auditors can find themselves in.

It's his job to tell accountants how to limit their liability. He's superb at his job, and no doubt he will see legal risks in the road ahead. But I think he should agree that auditors who preserve and cultivate the requisite skepticism in their work, do better than those who don't.

And if auditors fail to meet public expectations, their role will decline, and the viability of the profession as a public institution will be threatened.

The challenge is maintaining a business model that relies on client service for the success of the firm, while at the same time managing the legal risk that one of those clients will succumb to the incentives inherent in its business model to provide a rosier picture of the company's financial standing than warranted.

The public interest in a broader, more robust audit function, as Burton envisioned, also faces the challenge of inertia. To protect the investing public, all public companies are required by law to obtain an audit. This statutory franchise protects the profession as a whole from the risks of obsolescence, thereby reducing auditors' need to adapt to investor needs. As a result, auditors don't have a natural incentive to evolve their reports to address what investors want.

There are other external conflicts of interest for the audit to overcome. Conflicts are rife in the fundamental issues auditors face in evaluating whether a company's going concern assumption is valid. They inhere in the judgments of people who prepare and market valuations while actively trading. Conflicts also emerge in audit committees appointed by management, or compensated substantially in stock.

These forces — the payment model, the statutory franchise, and the incentives of others in the environment auditors operate in — constitute formidable discouragement. They deter the profession itself from innovating the audit to meet public expectations the way, say, a technology company would, or a properly incentivized service company would.

There is no silver bullet to address these challenges. There are as many or more problems with structural alternatives such as a third-party payor or insurance-based system; and in a dispersed ownership society, eliminating the audit requirement would be impractical and outright reckless.

II.  The PCAOB's Policy Agenda to Enhance the Relevance, Credibility and Transparency of Audits

Instead a new debate is taking shape. The PCAOB has introduced several initiatives, for broad public discussion and analysis, that go to reducing risks that flow from these conflicts and challenging incentives that weaken investor protection, by applying counter-weight.

The initiatives center around the relevance, credibility and transparency of audits. But above all, they are related to the culture of the audit. These projects are founded on the principle that audit regulation should foster conduct and a culture consistent with the franchise that the securities regulatory regime accords the audit profession.

A.  The Auditor's Reporting Model

First, the PCAOB has initiated a broad debate on the form and content of the standard auditor's report. In June, the PCAOB released a concept release on potential changes to the auditor's reporting model.

We issued this paper to examine whether the auditor's report could better serve investor needs. Given the effort involved in an audit of a large company, and the complexity of many financial statements, investors have called for deeper insight from the auditor.

The concept release describes four, broad alternatives and invited discussion. To summarize:

• Auditor's Discussion and Analysis could provide a narrative of the auditor's views on significant matters relating to the audit or the financial statements;
• Required and expanded use of emphasis paragraphs could highlight significant areas and identify where those are disclosed in the financial statements;
• Auditor assurance on information outside the financial statements could include an auditor expressing an opinion on Management's Discussion and Analysis or earnings releases; and
• Clarification of the language in the standard report could enhance users' understanding about what an audit is, and what an auditor's responsibility is, such as clarifying what "reasonable assurance" means.

We have received nearly 150 comment letters to date, including a thoughtful comment letter from NASBA's Regulatory Response Committee. In addition, in September we held a public roundtable to foster further discussion among 32 experienced individuals, including several corporate directors.

The comment letters reflect a broad range of perspectives, and a broad range of comfort with some of the proposals. There appears to be consensus that the pass-fail aspect of the opinion should be retained.

NASBA, like many other commenters, expressed concern about requiring auditor assurance on MD&A, or requiring auditors to provide their own discussion and analysis. Your committee's letter expressed concern about the risk of blurring the lines between management and the auditor, or turning the auditor into an investment analyst. Others ask, conversely, why if auditors are now required to form judgments about the quality of accounting practices and policies, the stakeholders cannot have that knowledge.

One point I have emphasized throughout is that, if we make changes, they will be focused on enhancing the relevance of the auditor's communication to investors. New communications might, or might not, require new audit procedures. But they would not change the fundamental role of the auditor to perform an audit and attest to management's assertions as embodied in management's financial statements. And in no event would they put the auditor in the position of creating and reporting financial information for management.

I appreciate the comment. It deserves careful consideration. Indeed, we will be analyzing the comments we have received for some time. This is a major project, and the PCAOB will not rush the process.

B.  Auditor Independence

The PCAOB is also focused on auditor independence. On the whole, the firms that the PCAOB inspects demonstrate that they are capable of high quality audits. And yet, as I described earlier, inspectors continue to find audit flaws, even nine years into a rigorous inspection regime.

I am left with the inescapable question whether the root of the problem is auditor skepticism, coming to ground in the bedrock of independence. The loss of independence destroys skepticism.

Inspections by other audit regulators have also given rise to concerns about auditor skepticism, as reported by the U.K.'s Audit Inspection Unit, the Dutch AFM, the Australian Securities and Investments Commission, the Canadian Public Accountability Board, the Swiss Federal Audit Oversight Authority and the German Auditor Oversight Commission.^[3] Based on such concerns, the European Commission is also reportedly considering reforms to enhance auditor independence. I understand a draft of proposals from the EC is expected in November.

In August, the PCAOB issued a concept release to seek public comment on how to enhance auditor independence, including whether audit firms should be subject to term limits.

There are, of course, considerable implementation challenges associated with mandatory term limits. Some institutions have fixed term limits for their auditors. In some countries the audit firms bid on and take term-limited engagements. These changes can be dramatic, and yet they are managed.

To be sure, when auditors change, there may be a learning curve for the new auditors. But consider this: according to the research firm Glass Lewis, between 2003 and 2006, more than 6,500 public companies, or nearly 52 percent of all public companies, voluntarily changed their auditors.

How did auditors and companies manage those changes? What did auditors, and the audit committees that oversee them, do to make sure the new auditors were in a position to provide reasonable assurance in the early years of an engagement?

The concept release invites study and consideration of whether there are ways to mitigate the challenges of auditor turn over. But the reason to consider the concept is to resolve the question to which the discussion of independence, skepticism and objectivity always seems to return. That is the central question of the concept release:

will term limits, set at some appropriate length, with due regard for implementation complexities, reduce the pressures auditors face to develop and protect long-term client relationships to the detriment of investors and our capital markets?

The idea of audit firm term limits is not new. The debate ebbs and flows, but the contending solutions languish unresolved. In fact, the very size, complexity, and systemic risk found in today's issuer population supports the need for reconsideration of audit firm rotation at this time.

To be sure, partner rotation focuses the firm on a partner's decisions in the audit. But a new partner may feel the need to live with those decisions and agreements; he may have little motivation to reopen them. What is lost is the true "fresh pair of eyes."

We have a long comment period, extending to December 14. We will then hold a public roundtable to further discuss the subject in March of 2012.

Comments are already flowing in, and they are divided. It may well be that the process will generate a range of proposals, combining elements of different approaches, all designed to foster independence with different tools applied to different engagement types.

C.  Audit Transparency

The third policy initiative the PCAOB has mooted recently relates to audit transparency. Earlier this month, the Board proposed amendments to its auditing standards to improve audit transparency by enhancing disclosure about the participants in audits, including disclosure about the partner in charge of the audit as well as other firms involved in the audit.

This proposal stems from a concept release that the Board issued in July 2009 to obtain comment on whether the Board should require engagement partners to sign audit reports.

The names of key management executives, not to mention corporate board members, have long been disclosed. The names of audit engagement partners are also disclosed in many countries, but to this point not in the United States.

I fail to see why shareholders in large European banks and other companies should be able to see the name of the engagement partner in the audit report, but shareholders in U.S. banks and companies should not.

Indeed, the names of engagement partners for some European companies that are listed on the NYSE are disclosed in U.S. filings. Why are their shareholders to be favored over shareholders in U.S. companies?

At the concept release stage, the Board received certain objections to requiring engagement partner signature, most notably that the change could unintentionally imply a reduction in the firm's overall responsibility for the audit and the audit opinion. The proposal is intended to address those concerns.

Our audit standards set forth the responsibilities of the auditor. The proposal does not change the responsibilities of the audit firm or the engagement partner.

The second aspect of our proposal would provide more transparency about the firms that contribute to global audits. For many large, multi-national companies, a significant portion of the audit may be conducted abroad — even half or more of the total audit hours.

I have been surprised to encounter many savvy business people and senior policy makers who are unaware of the fact that an audit report that is signed by a large U.S. firm may be based, in large part, on the work of affiliated firms that are completely separate legal entities in other countries.

In theory, when a networked firm signs the opinion, the audit is supposed to be seamless and of consistently high quality. In practice, that may not be the case.

Enhanced transparency about how cross-border audits are conducted should help investors and audit committees gain a better understanding of how an audit was conducted and make more informed decisions about how to use the audit report. Shining a light on the composition of the multi-national audit should reward consistent high quality where delivered.

III.  Audits Across Borders

On the subject of global audits, our inspections have revealed that the U.S.-based firms that we oversee — both large and small — are increasingly engaged in audits with an international component.

Moreover, the PCAOB has registered a significant number of non-U.S. firms that audit or wish to participate in audits of issuers. Many of these non-U.S. firms are affiliated with one or another of the large U.S. firms through a global network.

These affiliates can be quite large, measured by number of professionals as well as by market capitalization of audit clients. Because of their legal structure, each foreign office of a global network is separately registered and subject to its own inspection. To date, the PCAOB has conducted 296 inspections of non-U.S. registered firms located in 36 jurisdictions.

To best protect investors, inspections of cross-border audits need to be as seamless as the audits are supposed to be. At the PCAOB, we have seen first hand the benefits of evaluating the various pieces of audits performed by different registered firms in multiple jurisdictions.

As has been widely reported, the PCAOB remains unable to inspect registered firms that perform or participate in U.S. audits but reside in China or some parts of Europe. I am hopeful that we will be able to resolve concerns raised by authorities in these countries.

This is not to say that we haven't made progress: we are recently back in the U.K.; we have begun inspections in Switzerland; and we will soon begin inspections in Norway. In each of these inspections, we will not only review audit work for foreign private issuers, but we will also look at audit work performed on subsidiaries of U.S. companies.

We also aspire to make progress on a joint inspection arrangement with Chinese authorities, but there the progress is slower. Unfortunately, the risks to investors are every bit as great. For example there have been numerous reports of auditors for Chinese and other emerging-market issuers resigning because of concerns about management misrepresentations.

In the past two weeks, the situation with China has hit new bumps in the road. The Chinese recently put off a meeting here that had been scheduled since this summer, when a joint SEC-PCAOB delegation visited Beijing. Press accounts now say the Chinese authorities have called in the heads of global firms to lay down the law and seem to suggest that they are prohibiting the firms from bringing out of China summaries of audit results. If true, that, of course, would go well beyond keeping PCAOB inspectors out of China. It would be a long-arm interdiction of the global firm's maintenance of its own work papers.

It is, however, important for auditors considering work in China or with emerging-market audit clients to consider the available guidance. Earlier this month, the PCAOB staff issued an Audit Practice Alert that provided auditors guidance on a number of audit questions related to risks in emerging markets.^[4]

The PCAOB's Audit Practice Alert No. 8 highlights conditions that indicate heightened fraud risk, such as fraud in bank confirmations, including through forgery or collusion. It also discusses risks involved in auditing variable interest entities. It also highlights the responsibility principal auditors have to oversee the work of local affiliates or other auditors. In this regard, the PCAOB is looking hard at how U.S. firms get comfortable that they can rely on the work of affiliates in countries that have resisted inspection.

IV.  Secrecy of Enforcement Proceedings

Before I close, I would like to touch on one more initiative that I believe will be of interest to NASBA's members.

Both PCAOB investigations and any contested disciplinary proceedings we bring are by law under Sarbanes-Oxley non-public unless the respondents consent to publication of our complaints and decisions. We have asked Congress to change this.

In the years since Sarbanes-Oxley passed, the PCAOB has built an active enforcement program, but unfortunately for investors, audit committees, the bar, and the audit profession itself, it takes place largely behind the scenes.

The Board's Division of Enforcement and Investigation conducts rigorous investigations before recommending that the Board file any complaint. But when the Board does determine that the facts merit the filing of a complaint, it will not be public. Nor will any decision by the Hearing Officer or the Board to impose a sanction, until any appeal to the SEC is exhausted.

Litigation postpones — often for several years — the day on which the public learns that the Board has charged the auditor or firm and the nature of those charges. This secrecy has a variety of unfortunate consequences. Interested parties, including investors, audit committees, issuers and other auditors, are kept in the dark about alleged misconduct.

Audit committees may be unaware for years that their auditor has been charged by the Board. Counsel representing other auditors are deprived access to the Board's precedents. And auditors don't learn important information about conduct or actions that draw the Board's reproach, denying the public any benefit from the deterrent effect that the filing of public complaints would have on other auditors.

A case that recently became public only after the completion of SEC review of the Board's decision provides a good example. In that instance, a firm issued 29 additional audit reports on public company financial statements between the commencement of the Board's proceeding and the public disclosure of the Board's charges, which did not occur until the SEC affirmed the Board's decision to expel the firm from public company auditing and allowed the Board's sanction to take effect.

In another recent matter, the Board adopted the decision of its chief hearing officer permanently barring an audit partner and permanently revoking registration of a registered firm because of the audit partner's participation in audits while subject to a previous PCAOB bar. Because of restrictions in the Act, the Board was prohibited from publishing the decision, or making public any other information about the status of the proceeding, until after the partner and the firm had an opportunity to seek SEC review.

Information relating to these proceedings, had it been available sooner, almost certainly would have made a difference to client and investor decisions regarding the firm or the companies it audits. Secrecy about the problem not only erodes public confidence in the PCAOB's ability to police registered firms, but inevitably undermines confidence in state authorities' resolve too.

*    *    *

The PCAOB's initiatives aim to maintain, or as necessary in some corners restore, the public's faith in the financial fairness of our society. At stake are the values of our society, those that unite Wall Street's capital-raising machine with the scientists, engineers, designers and dreamers of our universities (and our garages, or wherever else they make their start) and, ultimately, our millions of workers, savers, and families.

---