Smaller Accounting Firms’ Vital Role of Protecting Investors and Serving the Public Interest

Remarks as prepared for delivery

Good morning and thank you Kent [Bonham] for the kind introduction. I also want to add my welcome to everyone attending here in person and online. I am extremely pleased to be here today and am looking forward to meeting and hearing from you. Your active participation is not only welcome but encouraged in each session and please feel free to engage with us during the breaks. I am also eager to hear from our expert presenters from across the PCAOB, the SEC’s Office of the Chief Accountant, and FINRA.

Before I continue, please know that my remarks this morning are provided in my official capacity as an individual Board member and do not necessarily reflect the views of the full Board, my fellow Board members, or the PCAOB’s dedicated and hardworking staff.

House Committee on Financial Services Proposal

I want to say a few words about the proposal Congress is currently considering that attempts to fold the PCAOB into the SEC. This is not the first time this topic has been raised by Congress or others. I am not in a position to speculate what may or may not happen in Congress.

But as I was reading the proposal, I reflected on the enactment of the Sarbanes-Oxley Act in the wake of the Enron and WorldCom audit failures and the establishment of the PCAOB as an independent audit oversight body to protect investors. The majority of my 21 years at the PCAOB has been spent in and around inspections; from the creation of our inspection program and participating in the initial inspections of the Big Four firms in 2003 to observing the transformation of the program into a global oversight regime with over 1,500 registered firms in 81 jurisdictions. Having the privilege and honor of serving as the Director of our Division of Registration and Inspections and now as a Board member, I can say without hesitation that the work of the PCAOB’s talented staff has made a significant impact on audit quality and has strengthened investor protection. This expertise cannot be easily replicated.

A distinct aspect of the PCAOB’s design is the ability to inspect the audits of public companies listed on a U.S. exchange, regardless of the location of the registered accounting firm. Last year, we inspected 78 non-U.S. firms.¹ We regularly conduct inspections in more than 50 jurisdictions. Following the passage by Congress in 2020 of the Holding Foreign Companies Accountable Act, we began inspecting registered accounting firms in China and Hong Kong in 2022. This global reach is unique among regulators.

Another aspect worth mentioning is housing the audit standard-setting function and inspections inside the same organization. The ability of our inspectors to freely share insights and perspectives with the staff of the Office of the Chief Auditor, I believe, has been invaluable. This coordination facilitates real-time insight on firms’ execution of our audit standards and allows us to quickly issue practical guidance, when warranted. 

I recognize the need to be good stewards of our financial resources and look for ways to carry out the PCAOB’s mission in the most efficient and effective manner. Since commencing operations in January 2003, I believe the PCAOB has served all of our stakeholders well and continues to ensure the highest levels of trust in our capital markets. 

While I do not know what Congress will ultimately decide, I do believe the PCAOB’s oversight has added stability to the capital markets and strengthened the quality of audits, which ultimately protects investors. 

Listening to Smaller Accounting Firms

Returning my focus to today’s Forum, former Senator Elizabeth Dole once said “[t]he best public policy is made when you are listening to the people who are going to be impacted.” During my time at the PCAOB, my belief in the need for the PCAOB to engage regularly with all of our outside stakeholders, whether they be investors, audit committee members, preparers, the academic community, and in particular representatives of smaller accounting firms, has only grown.

I was thrilled last year when we brought back in-person Small Business and Broker-Dealer Forums across the country hosted by Board members. Throughout my involvement, over many years, with these forums, I have always benefited from the engagement and left better informed with a greater appreciation of how the work of the PCAOB impacts smaller firms. In fact, I often reflect on what I have learned as I consider matters before the Board.

We recognize the demands on your time from practice management, client service activities, and even commuting here to Jersey City. Our goal is to make each session today as informative and useful as possible. To that end, we also welcome your overarching feedback as to how future forums can be even more helpful.     

Of the approximately 680 U.S. accounting firms registered with the PCAOB, over 120 firms, or 17%, are triennially inspected firms headquartered in New York and New Jersey. So, it is not a surprise that smaller firms in this geographical area represent an important part of the PCAOB’s work and why it is equally important we are meeting here today.

In fact, by my count, this is the 24^th occasion the PCAOB has had a small business forum in the New York metro area, the first going back to March 2005. I think it is fair to say, and also based on my own experience as a presenter, the New York area forums have historically generated a lively and robust discussion. I suspect today will be no different, and I am looking forward to having a dialog following my remarks. Areas of particular interest include your experience, and current status of, implementing QC 1000, A Firm’s System of Quality Control (QC 1000); areas of QC 1000 that you have questions about; and your assessment of the usefulness of our Spotlight and Audit Focus documents.

Importance of Smaller Accounting Firms to the Capital Markets

To begin, what do Boeing, Coca-Cola, Bank of America, and The Kroger Co. have in common? Before they were household names and leaders in aircraft, beverages, banking, and retail, they were all audited by smaller accounting firms. While they are now audited by Big Four firms and have been for some time, they did not start there. As small companies, they were audited by smaller local accounting firms, who were with them as they grew. As I have said in prior remarks, our capital markets require healthy accounting firms of all sizes to support capital formation.² The accounting firms you represent play a vital role in the financial reporting ecosystem and our capital markets. Perhaps, one of the companies audited by a firm here today will grow to be a member of tomorrow’s Fortune 100. Your role in capital formation benefits society.

Whether an accounting firm is large or small, the financial statement auditor represents the moral backbone of the capital markets and is critical to ensuring investors have trust in the financial statements. This trust is one of the reasons the U.S. capital markets are the envy of the world.³ On this point, former SEC Chairman Arthur Levitt spoke to the auditor’s providing trust when he said “[accountants] are highly sophisticated, knowledgeable professionals. And they serve one of the most valuable functions in a capitalist society. Their stock in trade is neither numbers, nor pencils, nor columns, nor spreadsheets, but truth.”⁴

Auditors Serve the Public Interest

The work of the financial statement auditor fundamentally serves investors and the public interest. Without question, all accounting firms, regardless of size, must be financially viable and profitable to perform quality audits and make the necessary investments in people and technology. But, because of its core responsibility to serving the public interest, auditing is well regarded as a profession rather than simply a commercial endeavor, business, or industry. George O. May said it well in 1932, “[t]he high-minded accountant who undertakes to practice in this field assumes high ethical obligations, and it is the assumption of such obligations that makes what might otherwise be a business, a profession. Of all the groups of professions which are closely allied with business, there is none in which the practitioner is under greater ethical obligations to persons who are not his immediate clients.”⁵ Mr. May’s words remain equally true in 2025 as they were when he initially made them some 93 years ago. The financial statement auditor, and more broadly the auditing profession, is vibrant, resilient, and noble. It is a calling that serves investors, our capital markets, and society.

The auditing profession is in a period of transition. The current landscape for accounting firms is evolving at a rapid pace; the future state is still coming into focus. These changes, in part, are being propelled by ever expanding investments by private equity. An October 2024 Wall Street Journal article suggested that by the end of 2025, more than half of the largest 30 U.S. accounting firms will have either sold an ownership stake or part of their business to private equity investors, up from zero in 2020.⁶ By my count, approximately 40% of the largest 30 firms have received a private equity investment. Nearly every week, there is an article announcing another private equity investment, both in the U.S. and abroad. Beyond private equity, consolidation of both larger and smaller accounting firms continues through mergers and acquisitions, as evidenced most recently by the announcement of Baker Tilley and Moss Adams.

Firms are also experiencing a number of other challenges, including succession planning, access to talent, and the need for continued investment in advanced technologies such as artificial intelligence, to remain competitive. Yet, in the midst of these challenges, audit fees for smaller public companies have not changed substantially in almost 20 years.⁷ And I recognize that, on top of these challenges, you are subject to PCAOB inspections and are in the midst of implementing the standards we adopted in 2024.

Even during periods of rapid change and evolution, there are opportunities. I will highlight two. First, the proportion of public company audits conducted by the top ten accounting firms decreased from 70% in 2023 to 65% in 2024,⁸ creating potential opportunities for smaller firms. Second, the decrease in PCAOB inspection Part I.A⁹ deficiency rates for triennially inspected U.S. firms was the largest decrease in any inspection category in 2024.¹⁰ I commend and thank you for all your efforts in this area.

PCAOB Resources for Smaller Accounting Firms

Over the past year, the PCAOB has worked to increase the usefulness and availability of information tailored to smaller firms. Actions include a new web page serving as a central hub for smaller firms and a new staff publication called Audit Focus designed for smaller firms. These documents are typically a few pages in length and, to date, have covered topics such as Critical Audit Matters, Audit Committee Communications, Journal Entries, and Form AP. In addition, we are providing a number of trainings, aids, and other information to assist smaller firms with the adoption of QC 1000. I will return to this topic. 

Throughout today’s sessions, staff from our Division of Registration and Inspections, Office of the Chief Auditor, and the Division of Enforcement and Investigations will provide information designed to equip you and your firm to enhance audit quality. Our goal is to make the information as practical and useful as possible. I will leave the specifics to the experts.

I want to use my remaining time this morning to emphasize three areas that can have an oversized, positive impact on the execution of public company audits. These are an auditor’s use of data and reports produced by the company and service organizations, root cause analysis, and QC 1000.

Auditor Use of Data and Reports Produced by the Company and Service Organizations

Given the advancement of technology used by many public companies in their financial reporting processes, auditors have correspondingly increased the use of data and reports produced by the company and service organizations (“data and reports”) as audit evidence. Considering the pervasive nature of data and reports in an audit, a failure in testing here can have outsized repercussions. Approximately 17% of the total comment forms our inspectors issued for each of the 2021 to 2022 inspection cycles contained deficiencies where the auditor did not perform sufficient procedures to test (or sufficiently test controls over) the accuracy and completeness of information produced by the company or other data and reports including information produced by service organizations.¹¹ For example, unfounded reliance on a report used in conjunction with a control can impact multiple areas of substantive audit testing.

In recognition of these risks and the frequency of inspection findings, the PCAOB staff issued a Spotlight titled Inspection Observations Related to Auditor Use of Data and Reports in April 2024.¹² This document provides information on common areas of inspection deficiencies related to data and reports and highlights reminders for auditors. I will emphasize three of these reminders. 

First, auditors should understand both the internal and external sources of data used by the company to identify the procedures to test the relevance and reliability of data and reports produced by the company.¹³ Second, for the auditor’s testing to be effective, the auditor should understand how the reports are generated. ¹⁴ And third, when a service auditor’s report does not provide audit assurance regarding the accuracy and completeness of information, the auditor must perform additional procedures.¹⁵ I hope the Spotlight and these reminders are helpful and you consider them when performing your audits.

Root Cause Analysis

Next, root cause analysis. If you attended a small business forum in 2016, you may remember a session that dissected the sinking of the Titanic as an illustrative root cause analysis. In that presentation, we discussed the common explanation that the Titanic sank because it hit an iceberg. But, through a comprehensive root cause analysis using techniques such as the fishbone diagram and asking the five whys, we suggested the sinking stemmed from the rivets used, the size of the ship’s rudder, the ship’s bulkheads not being sealed, and the lack of binoculars on the bridge. This example suggested that a robust root cause analysis should not stop at the first or easy answer and that complex problems frequently are caused by a combination of issues.

In my role as a Board member, I review each remediation recommendation that comes before the Board, and I see instances where quality control criticisms recur because remedial actions were not effective.¹⁶ I recognize there can be a number of reasons why remedial actions may not prevent future inspection findings. But, I believe one primary reason is that firms either have not performed a thorough root cause analysis at the right level, or that the actions taken to address the issue were not sufficiently correlated to the root cause.

In light of the importance of root cause analysis, the PCAOB staff issued another Spotlight in April 2024, titled Root Cause Analysis – An Effective Practice to Drive Audit Quality.¹⁷ This Spotlight includes suggestions for performing a root cause analysis, including specific considerations for smaller firms. One observation is that many triennially inspected firms, including broker-dealer auditors, either performed limited or no root cause procedures. I believe this creates opportunities for firms to evaluate the circumstances surrounding an engagement deficiency or a quality control criticism.

An audit is similar to a complex system with multiple moving parts. My suggestion to firms performing a root cause analysis is to recognize that there may be more than one causal factor or solution. Firms should be open to identifying contributing causes that result in a negative quality event. There can be intricate interrelationships between causes and effects, so the root cause analysis procedures should be designed with flexibility as new information is discovered.

The staff in the remediation group of the Division of Registration and Inspections has extensive experience evaluating root causes and the effectiveness of remedial actions. I encourage you to provide a draft remediation response early in the 12-month period and use the remediation staff as a resource as you perform your analysis. You can consider their feedback on the results of your root cause analysis before you embark on implementing remedial actions. The Sarbanes-Oxley Act and Board Rules grant a firm 12 months to implement remedial actions. This period affords firms time to perform a comprehensive root cause analysis and obtain feedback from our staff.

QC 1000

The final area I want to cover, and the one that is probably top of mind for most firms, is QC 1000. Much as internal control over financial reporting changed the landscape for internal controls at public companies, QC 1000 is transforming the control framework at accounting firms. The standard includes enhanced risk management requirements, including systematic risk assessment procedures. These requirements can be tailored to firms of all sizes as QC 1000 does not require a “one size fits all” approach.

QC 1000 also emphasizes the responsibility of firm leadership to establish a culture that prioritizes audit quality and ethical behavior. This emphasis on culture is even more critical than it has been given ongoing consolidation of smaller accounting firms through mergers, acquisitions, and private equity investments.

I also want to highlight changes to AS 2901, Responding to Engagement Deficiencies After Issuance of the Auditor’s Report, that were made with the adoption of QC 1000. After the implementation of QC 1000, remedial action will be required for all engagement deficiencies, including when the auditor’s opinion is not impacted. Please keep this in mind if you receive an inspection comment form.

QC 1000 Resources

I acknowledge that implementation of QC 1000 may require incremental resources above those you have already allocated for the implementation of the AICPA and international quality management standards.¹⁸ We want to be helpful. In addition to the resources provided today and the implementation guidance on our website,¹⁹ we are holding two workshops designed to meet the needs of smaller accounting firms on the implementation of QC 1000. One will be held on May 13 in Washington, D.C.²⁰ and another on June 17 in Irving, Texas. These workshops, one of which will allow for virtual participation, will provide hands-on activities on QC 1000 implementation and will provide another opportunity to engage with our staff. Registration for the May 13 event is open and you can submit questions in advance. I encourage you to consider attending.

Conclusion

As I conclude, I want to reiterate my desire to listen. As mentioned earlier, the following three topics are of specific interest: your experience, and status, of implementing QC 1000; areas of QC 1000 that you have questions about; and your assessment of the usefulness of our Spotlight and Audit Focus documents.

Reflecting on the important role of the financial statement auditor, it has been said that “[t]he auditor is continually confronted with temptations. He wants to see his clients succeed. He wants their owners and managers to like him. But his real success lies in how effectively he discharges his public trust – how conscientiously he serves the public interest. That is why he has been licensed to practice.”²¹

I will end where I began, by emphasizing that smaller accounting firms play a critical role in the financial reporting ecosystem. Without healthy and profitable smaller firms, the market for audit services would be dominated by relatively few larger firms, hampering competition, potentially increasing costs, and limiting the choices of growing businesses. Your dedication and the work you perform serve the public interest and our common goal of protecting investors.

Thank you again for joining us today and I welcome your questions and thoughts.