July 30th, about six weeks ago now, marked the first anniversary of the enactment of the Sarbanes-Oxley Act of 2002. When President Bush signed the Act, he described it as "the most far-reaching reform of American business practices since the time of Franklin D. Roosevelt."
October 25th, about six weeks from today, will mark another first anniversary -- of the SEC's appointment of the initial members of the Public Company Accounting Oversight Board. The creation of the Board, which many regard as the most important of the Sarbanes-Oxley reforms, essentially signaled the end of voluntary self-regulation of the auditing profession and the beginning of formal, compulsory oversight.
I would like to talk with you today about the Board's responsibility to restore confidence in audited financial statements. Fundamentally, the Board's mission is not merely to register firms, to conduct inspections, to set standards, or to discipline those who fail to live up to their professional obligations -- although we will certainly be doing all of those things. At the most basic level, our job is to help the profession regain its capacity to furnish the service that most justifies its existence -- the ability to instill public confidence in financial reporting.
This conference, which brings together investment companies and their accounting and tax advisors, is the ideal forum in which to discuss the steps the Board is taking to accomplish that goal. Registered investment companies own a significant percentage of the SEC-registered securities that trade in our public markets. These Funds' investment managers are major consumers of public company financial information and therefore major beneficiaries of auditing reform. Moreover, nearly 95 million individual Americans invest in those funds. Restoring their confidence in financial reporting, and dispelling their anger and cynicism over the financial reporting scandals of the 1990s, is vital.
Before I describe what the Board is doing, I should note that the views I express are my own, and not necessarily those of the Board's other members or staff.
II. How Was Public Confidence Lost?
It has become common-place for observers of the accounting profession to open speeches by asserting that the profession is in the midst of the greatest crisis in public confidence in its history. That may well be true. However, it is useful to keep in mind that the profession's evolution over the last century has been marked by a series of crises, followed by tougher standards and renewed commitment to the public interest. In fact, an argument can be made that the accounting scandal with the most far-reaching impact on the way auditors do their work occurred, not in the 1990s at Enron's offices in Houston or at WordCom's headquarters in Mississippi, but during the 1930s in Bridgeport, Connecticut.
Sixty-five years ago, McKesson & Robbins, a pharmaceutical company listed on the New York Stock Exchange and the predecessor of today's McKesson Corporation, was the focus of the most infamous audit failure in U.S. history. In 1924, Philip Musica, a high-school dropout with fraud convictions and a prison record, reinvented himself as F. Donald Coster and awarded himself a medical degree. The newly-minted "Dr. Coster" took control of McKesson & Robbins and embarked on a massive fraud to inflate its share prices. Coster duped McKesson's auditors -- and the investing public -- into believing that the company had a huge drug inventory, worth multi-millions of dollars, that didn't really exist, stored in equally fictitious Canadian warehouses. Coster created phony purchase orders, sales invoices, and other documents, all of which McKesson's auditors dutifully reviewed, as evidence of the imaginary inventory. The fraud succeeded because the auditing standards of the day permitted auditors to confine themselves to reviewing documents and talking to management -- they were not required to physically observe and verify inventories.
As with its 1990s descendants, the McKesson & Robbins fraud raised questions about the diligence, not just of the auditors, but also of the outside directors. The belated aggressiveness of one director is illustrative. During an emergency board meeting, hastily called after the fraud came to light, word was received that Coster had committed suicide. A Goldman Sachs partner who served as a McKesson outside director, and who was apparently by now very focused on his fiduciary obligations, reacted to this news by exclaiming, "Let's fire him anyway!"
The more recent collapse of public confidence in the auditing profession didn't involve anything so easily remedied as the lack of a standard requiring inventory verification. Rather, the profession's reputation, re-built in the decades after McKesson & Robbins, was shattered largely as a result of fundamental changes in accounting firms and the environment in which they operate. Describing those changes and their impact on auditing could be the subject of several speeches. Let me simply list three factors that seem to have contributed to the erosion of trust in auditing:
- First, the rise of non-audit, consulting, services.
Revenues from activities, such as systems design, tax planning, assistance with data processing procedures, and a host of other advisory services, became increasingly important. In many cases, clients were paying their auditors more for consulting than for the financial statement audit. As a corollary, firms began to see the audit as a foot-in-the-door to more lucrative consulting engagements.
- Second, downward pressure on auditing fees.
Auditing is a competitive business, and one in which it is not always easy to raise prices. Firms faced considerable pressure to keep the audit fee low, or risk losing both their audit and (more profitable) non-audit relationships with clients.
- Third, increased reliance on more cost efficient means of auditing.
The tactic of using the audit to gain entrée to other work, coupled with the difficulty in raising audit fees, meant that the costs of auditing had to be controlled. One of the things that, in turn, lead to was more emphasis on risk-based auditing -- the theory under which the auditor plans his or her work based on judgments about which aspects of the client's business are the most likely sources of error or fraud. In the areas of perceived low risk, the auditor relies more heavily on internal controls and management representations. While sound in theory, this process, if not judiciously applied, can have the same consequences as the McKesson & Robbins auditor's approach to inventory -- particularly if the underlying judgment about risk turns out to be incorrect.
The report of the WorldCom board's special investigative committee sheds light on what can happen when risk-based auditing is taken to unjustified extremes. WorldCom relied on two of the simplest possible devices to inflate its earnings. It reduced expenses by capitalizing costs that should have been treated as ordinary operating expenses; and it increased revenues by making large, unsupported journal entries to revenue accounts.
One might assume that these are the kinds of elementary falsifications that auditing is designed to catch. However, according to the special committee report, WorldCom's auditor, Arthur Andersen, failed to uncover them because it misjudged the risk that management would engage in fraud of that nature. Andersen did not perform meaningful, substantive tests in the critical areas of capital expenditures, accruals, and revenue. Andersen's audit approach disproportionately relied on analytical procedures -- that is, on the search for unexplained variations in WorldCom's financial statements or in the ratios of various financial statement items to each other. Andersen viewed the absence of unusual variances as evidence that follow-up audit work was unnecessary. In fact, management had manipulated the books to eliminate variations that would otherwise have been obvious.
III. The Board's Challenges
In the late 1930s, following the McKesson & Robbins debacle, the SEC held exhaustive hearings resulting in a report that recommended steps to strengthen the auditing profession and to foster public confidence in audit reports. In 2002, following the collapses of Enron and WorldCom, and numerous other reporting failures and restatements that preceded them, Congress responded in a similar way by enacting the Sarbanes-Oxley Act and creating the PCAOB to oversee the auditors of public companies and to restore public confidence in their work. I want to outline what we are doing to accomplish that mission.
1. Registration of Public Accounting Firms
First, we have built a registration system. By October 22, about one month from now, all accounting firms that issue or prepare audit reports on U.S. public companies must register with the Board. Foreign firms that audit U.S. companies also must register, although their deadline is next spring. As of September 9, 440 firms had filed registration applications -- roughly half the total number of firms that audited public companies last year. Anyone in the audience that represents such a firm that has not yet applied for registration, should stop listening, leave the room immediately, and begin work on their application. Under the Act we have 45 days to review applications. October 22 is now only 38 days away. You are already late.
Registration is important for several reasons. It is the predicate for all of the Board's other authority -- such as to require compliance with auditing and related professional standards, to conduct inspections, and to bring disciplinary actions.
In addition, registration serves as a filter -- albeit a crude one -- for who should and should not be engaged in public company auditing. Registration of a public accounting firm is not automatic. On the contrary, during the 45-day review period after an application is filed, the Board must decide whether to grant approval, request more information, or start disapproval proceedings. To grant approval, the Board must determine that registering the applicant is consistent with the Board's responsibilities to protect investors and to further the public interest in the preparation of informative, accurate, and independent audit reports. The Board has not delegated this important decision to its staff. While the staff will certainly review and summarize applications, group them in categories, and make recommendations, the five Board members plan to personally consider the issues raised and vote on each application. While this may be a time-consuming chore, it should afford valuable insight into the make-up of the profession.
Second, we have created an inspection program. Once a firm is registered, the Act requires the Board to inspect it. These inspections will assess the compliance of the firm with the Board's and the SEC's rules and with auditing and other professional standards. In the case of firms that audit more than 100 public companies, the Act requires the Board to conduct inspections annually. For other accounting firms, inspections must take place at least once every three years.
We have already launched our inspection program for this year. The four largest firms will be inspected. The focus of these first-year inspections will be on several things I referred to earlier as causes of the erosion in public confidence. These include:
- "Tone at the top."
Most organizations tend to adopt the culture of their leadership. We will seek to determine what kind of philosophy concerning professionalism and commitment to the public interest the highest levels of the major firms have and are seeking to instill in the rank-and-file.
- Partner evaluation, compensation, and promotion.
Another way of getting at an organization's values is by analyzing what behavior it rewards. For example, we would like to determine the role technical excellence and commitment and professionalism as an auditor play in partner compensation decisions and how that role compares to the importance of rain-making.
- Independence implications of non-audit services, business ventures, and alliances.
As discussed already, accounting firms offer their clients a range of services beyond the financial statement audit. While Congress restricted non-audit services in Sarbanes-Oxley, it did not entirely prohibit them. The Board needs to understand the impact of tax and consulting services on firm culture, on the performance of audits, and on the fact and appearance of independence.
- Client acceptance and retention.
We will explore how firms decide to accept new audit clients, whether to retain existing clients, and how they balance audit risk against potential revenue.
- Internal firm practices for communication and training regarding audit policies, procedures, and methodologies.
As firms have grown from small partnerships into worldwide organizations that hire hundreds of new professionals each year, training has become a significant issue. Our inspectors will ask how the major firms communicate to their staffs the procedures and policies to be followed in conducting an audit.
At the end of each inspection, the Board will issue a report. Under the Act, firms will have 12 months to correct any quality control defects uncovered in the inspection, or face public disclosure of the Board's findings.
3. Professional Discipline
Third, we are designing an aggressive enforcement program. The Board will conduct investigations and bring disciplinary proceedings when it believes that an accounting firm or its employees may have violated the law or professional standards. In disciplinary proceedings, the Board can impose fines, require remedial action, or suspend or bar a firm or individuals from participating in public company audits.
While we have proposed detailed rules to govern this process, our enforcement program is still being developed. However, one thing is already clear. When violations are uncovered, the Board will be tough. Board Chairman William McDonough put it this way in a speech last week to the New York State Society of CPAs:
I expect that you, as members of a regulated profession, know what the rules are. I expect that you are following those rules, both in their letter and their spirit. * * * If you depart from those expectations - that is, if you break the rules, if you ignore the spirit of the law even while meeting the letter - woe be unto you. There will be consequences, and they will be grave.
4. Auditing Standards
Fourth, we have begun standard-setting. The Act directs the Board to establish auditing and related attestation standards, quality control and ethics standards, and independence rules for accounting firms. These tasks have traditionally been the province of the profession itself, acting through the American Institute of Certified Public Accountants' Auditing Standards Board and other bodies. Now, however, the Board will establish the professional standards that govern public company audits.
The Board recognizes that, in order to instill confidence, the development of auditing standards should be an open process in which the accounting profession, public companies, the investor community, and others have the opportunity to participate. The Board has announced that it will appoint an advisory group to assist it in standard-setting. The advisory group will be comprised of between 15 and 30 members selected from a variety of backgrounds and disciplines.
We hope to appoint the advisory group this fall and to convene its first meeting before year-end. However, the Board is not waiting for the formation of the advisory group to begin discharging its important standard-setting responsibilities. We have already announced work on two critical standards -- auditor review of management reporting on internal control and the scope and nature of audit documentation.
IV. Independence and Non-Audit Services
The Board's authority to set standards, particularly in the areas of ethics and independence, brings me to a final area that may be of particular interest to this audience: The non-audit services, such as tax services, that an auditor may render to its public company audit clients.
I suggested earlier that the increased importance of non-audit services as a firm revenue source was one of the contributing factors in the decline in public confidence in auditing. Congress shared this view. The Sarbanes-Oxley Act prohibits accountants from providing nine categories of services for public company audit clients. These include appraisal or valuation services; fairness opinions; management functions; internal audit; legal and expert services unrelated to the audit; and any other service that the Board determines should be prohibited.
The legislative history says that the prohibited services list is based on three "simple principles." To be independent of its audit client, an accountant:
- Should not audit its own work;
- Should not function as part of client management or as a client employee; and
- Should not act as an advocate for the audit client.
Services that are not on the prohibited list -- and that includes tax services -- may be performed, if approved in advance by the client's audit committee. The Act does not define "tax services." However, the Commission issued a release last January which said that "accountants may continue to provide tax services such as tax compliance, tax planning, and tax advice to clients, subject to the normal audit committee pre-approval," but that audit committees should "scrutinize carefully" the retention of the auditor in a tax-motivated transaction initially recommended by the auditor.
In my view, this is an area in which auditors and audit committees should be cautious. Auditors have more to lose in the form of a further decline in the public's trust than they do to gain from added fees. I have no problem with auditors assisting their clients with traditional tax compliance and routine planning. Auditors have long played a part in return preparation and have advised their clients on the complexities of the tax code and how it affects the client's tax liabilities.
But, tax services that go beyond that -- especially the marketing to audit clients of novel, tax-driven, financial products -- raise serious issues. If the IRS questions the validity of a tax shelter, the auditor almost inevitably becomes an advocate for the client's position that the tax benefits claimed are legitimate. Further, the financial statements may be materially influenced by the supposed tax benefits of the product. Therefore, the auditor may find itself in the position of auditing its own work.
The biggest obstacle to writing a rule prohibiting this kind of activity seems to be that distinguishing tax shelters from more conventional tax planning advice is not easy. However, given the well-publicized Congressional and public concern in this area, the Board may have to try its hand at solving the problem.
I want to conclude by repeating a point I made earlier. The corporate collapses, audit failures, and litany of restatements -- and the resulting losses suffered by average investors -- that marked the last several years have bred deep cynicism and public anger. A good share of that anger and cynicism is directed at the accounting profession. In my view, it is critical to the long-term health of our capital markets that that phenomenon be reversed, and that the public once again view auditors as watchdogs of corporate integrity, rather than as lap-dogs of their corporate clients.
The vast majority of Americans that invest in the securities markets do so through registered funds. Therefore, restoring the public's sense that the markets and the financial reporting that makes them work are fair and transparent should be especially important to the fund industry. I believe that the Board's aggressive implementation of the blueprint Congress laid out in the Sarbanes-Oxley Act will go a long way toward accomplishing that goal. Ultimately, however, restoring public confidence is something that the profession itself must do.