Statement on the QC 1000 Adoption – Demise to Audit Competition

Remarks as prepared for delivery

Thank you, Chair Williams.

Early in my career, I worked for a small 8A audit firm based in Washington, DC as an auditor, which was my second job after college. During my two-year tenure, I met many hardworking CPAs from the underrepresented population. The pay was lower than the bigger firms, and the hours were extremely long. Although the work was demanding, we bonded due to our shared minority status and the belief that the pursuit of the American Dream was achievable through hard work. My favorite event was the pot-luck Thanksgiving lunch, and I still remember the delicious smells and the mouthwatering tastes of the unique dishes that my colleagues shared from their respective cultures. We formed long-lasting friendships, as I am still in touch with some of them today. Because of my personal experience, I am uniquely familiar with the challenges small and medium-sized firms and their staff face. That is why it is important to me that these firms are treated fairly and equitably.

In my November 18, 2022, statement supporting the QC 1000 proposal, I described two areas of particular interest.¹ The first area of interest is related to the proposal’s “design-only” requirement and its impact on the registered firms that do not audit public companies or broker-dealers. I stated that I wanted to read the comment letters to understand the burdens the proposed requirements may have on smaller firms and whether they are proportionate to the benefits we are expecting. I stated that smaller firms’ ability to remain competitive in the public company and broker-dealer audit marketplace is a key factor in the health of our capital market ecosystem. Thank you to all the commenters who overwhelmingly opposed the need for the design-only requirement. Unfortunately, the adopting release continues to include the requirement.

Design-Only – A Myriad of Concerns

I believe that the adopting release’s design-only requirement for firms that do not issue public company audit reports: (1) appears inconsistent with the statutory text of the Sarbanes-Oxley Act of 2002 (SOX); (2) appears inconsistent with what the PCAOB told Congress in 2023; and (3) imposes undue burdens on competition that will hurt smaller public companies (including emerging growth companies), investors, and the competitiveness of audit marketplace. 

Design-Only Appears To Be Inconsistent with SOX

The adopting release states that approximately 51% of registered firms have not performed an engagement under PCAOB standards for a public company, broker, or dealer, over the past five years. This is a long-standing trend. My understanding is that the percentage of registered firms that: (1) submitted annual reports to the PCAOB; and (2) have not performed an engagement requiring PCAOB registration has hovered in the mid 40% and above for nearly ten years. This means that these “inactive” firms are not providing services subject to PCAOB oversight. Yet the adopting release will require inactive firms to comply with the “design-only” requirements of our amended Quality Control standards. The adopting release states that this “approach reflects our view that all firms that register with the PCAOB should be appropriately prepared to perform a PCAOB engagement, regardless of whether they are currently subject to requirements ….” Emphasis added. The adopting release contains a legal justification for this approach; specifically, that SOX section 103(a)(2)(B) “directs us to include in our QC standards requirements related to numerous topics for ‘every’ registered public accounting firm.” This description is accurate but incomplete in that it fails to consider important statutory text contained in not only SOX section 103(a)(2)(B) but also SOX section 103(a)(1), which I believe contains a limiting principle on the application of our Quality Control and other standards. While SOX section 103(a)(2)(B) does apply to “every” registered public accounting firm, it applies only “with respect to the issuance of audit reports,²” which the 51% of all registered firms have neither prepared nor issued over the past five years. Similarly, SOX section 103(a)(1) provides that the PCAOB Board shall establish by rule, quality control and other standards “to be used by registered public accounting firms in the preparation and issuance of audit reports . . . .” The text of section 103 plainly indicates that the Quality Control and other standards the Board adopts apply to registered firms that are preparing and issuing “audit reports” and not the 51% of registered firms that are not doing so. Emphasis added. The adopting release’s legal justification runs contrary to both SOX section 103’s text and the bedrock principle of statutory construction to not read a statute in a way that renders statutory text superfluous.³ I thus question the PCAOB’s legal authority to impose the amended Quality Control standards on firms that do not currently prepare and issue audit reports for public companies, brokers, or dealers.

Design-Only Appears to Be Inconsistent with What PCAOB Has Told Congress

The adopting release’s requirement that inactive firms comply with the amended Quality Control standards’ “design-only” requirement also appears inconsistent with the PCAOB’s 2023 correspondence to Congress. In its February 8, 2023, letter to Senators Warren (D-MA) and Wyden (D-OR), the PCAOB described the limits of its statutory authority with regard to registered firm audits that do not involve public companies, brokers, or dealers.⁴ The PCAOB wrote that “Congress has placed strict limits on the scope of our authority. [SOX] established that the PCAOB’s statutory jurisdiction extends to audits (and related engagements) of public companies . . . .  As a general matter, audit firms registered with the PCAOB must follow PCAOB standards and rules specifically in connection with their audits of SEC-registered issuers, brokers or dealers only.” ⁵The inconsistency here is that on the one hand, we told Congress in 2023 that as a matter of law, our standards can only apply to registered firms’ audits of issuers, brokers, or dealers; on the other hand, we are now amending our Quality Control standards to impose certain quality control requirements on a majority of registered firms that have not and are not auditing issuers, brokers, or dealers.

The Economic Analysis Erroneously Dismisses the Impact of Design-Only on Competition

The adopting release and its economic analysis lack evidence-based quantitative support for design-only, and blithely dismiss commenter concerns on its impact on competition and the harm it may cause smaller public companies, including emerging growth companies. The adopting release acknowledges overwhelming opposition to the design-only requirement noting that many “commenters, including firms and related-groups, investor-related groups, academics and others, did not support requiring firms that are not required to comply with applicable professional and legal requirements to design a QC system under QC 1000. Several of these commenters expressed concerns that this would be unnecessarily costly to those firms, . . . may cause firms to deregister with the PCAOB, . . . or create a potential barrier to entry for new firms in the marketplace.” The economic analysis acknowledges that the requirements “could . . . cause firms to exit the public company audit market or deter other firms from future entry. Entry deterrence could be exacerbated by the fact that being registered with the PCAOB will subject firms to certain QC requirements even if they do not perform engagements.”  But the economic analysis then seems to tout the benefits of reduced competition by stating that “any exit would likely be limited primarily to firms with smaller market shares and to the smaller issuer or broker-dealer audit markets,” and that “some research suggests that reduced competition may have a positive impact on audit quality,” while acknowledging research that suggests “that reduced competition is indeed associated with higher audit fees.” As an investor, I want to encourage competition in the audit marketplace and induce inactive firms not to deregister but rather to become active, because competition will result in lower audit fees which will allow smaller issuers and emerging growth companies to dedicate more of their scarce capital to research and development and job creation. Our capital markets depend on a robust and resilient public company auditing profession, and this proposal seeks to dismantle the profession by creating unnecessary, inappropriate, and I believe unlawful barriers to entry, which I predict will adversely affect competition in the audit marketplace.

Now, the economic analysis does consider an alternative to design-only; specifically, it considered requiring inactive firms to design their QC system only upon it being required to comply with applicable professional and legal requirements with respect to a firm engagement. Let me translate that into plain English. An inactive firm would not have to design its QC system until such a point that it began the process of deciding whether to accept an engagement with a public company, broker, or dealer. The economic analysis states that this alternative approach would reduce the costs to inactive firms by allowing them to defer such costs, but then rejects this approach by stating: (1) inactive firms could reduce such costs by withdrawing from PCAOB registration, and (2) the alternative would not address the risk that firms could be unprepared to accept and perform engagements. I am dumbfounded that the economic analysis seeks to undermine competition in the audit marketplace by telling inactive firms: “if you don’t like it, leave.” How does creating barriers to entry and undermining competition protect investors? The economic analysis states that “investors and [audit committees] considering engaging the firm could reasonably expect that any firm that could pursue an engagement would already have a PCAOB-compliant QC system designed and ready for implementation and operation.” I want to know who these investors and audit committees are. The adopting release does not say. To me, it makes no sense to require an inactive firm to incur costs to design its QC system “today” when it might not seek a public company audit engagement until 1, 2, or 3 years from now. If I were an audit committee member, I would prefer that an inactive audit firm design its QC system closer in real time to when the firm pursues an engagement subject to PCAOB standards, because there is a big difference between designing a QC system under a hypothetical scenario and designing a QC system under an actual scenario.

Unnecessarily Complex and Burdensome Requirements Harmful to Audit Quality and Capital Market Resilience

In addition, I am gravely concerned about the injustice of this standard to the small but important firms. The Small Business Administration (SBA) reported in 2022 that small businesses have accounted for 2 out of every 3 jobs added in the past 25 years.⁶ SBA also noted in a 2019 report that small businesses deliver 43.5% of the United States' gross domestic product (GDP).⁷  Small and medium size firms represent 99% of the total PCAOB registered firms, but the remaining 1% audit over 99% of the S&P 500 companies, indicating that capital markets and investors need a more robust and competitive audit marketplace. Yet the PCAOB appears to be indifferent to this problem and keen to further exacerbate the large audit firm oligopoly by proposing and adopting standards and rules that add a disproportionate burden on smaller firms without articulating clear and supportable benefits.

In my opinion, this standard is setting up smaller firms to fail by creating complex and prescriptive requirements that unnecessarily misalign with other standards, and possibly promotes more enforcement opportunities, all without an adequate economic analysis.

The Staff Guidance on Economic Analysis in PCAOB Standard Setting (February 14, 2014) states, “The Board is charged with adopting, by rule, professional practice standards for auditors that serve the public interest and protect investors. High-quality economic analysis helps the Board meet this statutory obligation. Economic analysis helps ensure that regulatory decisions, including whether to adopt new requirements and impose corresponding burdens, are informed by a rigorous review and analysis of the best information available. When changes to the Board's standards are being considered, economic analysis helps tailor the solution to the identified problems, and allows the Board, the Securities and Exchange Commission (SEC), and the public to compare the relative merits of different approaches.”⁸ Emphasis added.

I believe that our economic analysis lacks the required rigor and neither justifies nor quantifies the benefits in relation to the costs to support the burdensome nature of this QC 1000. For example, the adopting release acknowledges that there is a lack of data to quantify the costs of QC 1000. As such, the release draws a comparison to SOX section 404 in that “Section 404 was a policy shock…” and equates this to the internal controls framework in that QC 1000 “…reflects similar principals as COSO”. The release cites a study indicating the mean total compliance costs for SOX section 404 between January 2003 to September 2005 to be $2.2 million or $3.7 million adjusted for inflation based on a sample of companies that voluntarily disclosed section 404 cost information in their SEC filings during the period January 2003 to September 2005. However, the study also acknowledged that “firms that voluntarily disclosed the cost information were smaller (i.e., firms with sales less than $2 billion).”⁹ In fact, the PCAOB, in its adoption of the Auditing Standard 5 (AS5) to mitigate the cost of section 404 compliance, acknowledged that issuers had incurred unexpectedly high costs: “Costs have been greater than expected and, at times, the related effort has appeared greater than necessary to conduct an effective audit of internal control over financial reporting.”¹⁰ Further, the adopting release clearly states that QC 1000 has a higher documentation standard than SOX section 404 and therefore naturally would be more costly.¹¹ I am deeply concerned with the prevalence of the selective use of evidence or studies such as this throughout our economic analysis.

Our November 2020 “Spotlight” related to conducting an economic analysis state, “The costs of a standard can be either direct or indirect. Direct costs are those incurred by auditors to comply with the standard. Indirect costs can be incurred by auditors or other affected entities.”¹² The adopting release acknowledges that firms will incur direct costs to design a QC system that complies with QC 1000 and that issuers may incur indirect costs; however, it appears that the economic analysis makes no clear attempt to quantify any indirect costs.

I am similarly troubled by the differences with annual evaluation conclusions between the International Standard on Quality Management (ISQM 1) and QC 1000. One example is that QC 1000 includes three new definitions: QC Observation, QC Deficiency, and Major QC Deficiency. In contrast, ISQM 1only includes Findings and Deficiencies. The adopting release acknowledges that some commenters “...expressed concern that the definition could cause a firm to come to a different conclusion about its QC system during the annual evaluation process under QC 1000 than the conclusion a firm may reach under ISQM 1…”  To avoid confusion or different evaluation results, some commenters suggested conforming the terminology to ISQM 1. The adopting release states that market participants would be unaware of different conclusions, as both sets of evaluations are not required to be made public. Therefore, the adopting release suggests that there will likely not be any confusion among external stakeholders arising from differences in evaluation criteria.

Another commented stated that “it was unclear why a new term, “major QC deficiency,” would be necessary and questioned the need for a reference to a threshold other than “achieving reasonable assurance.” More importantly, the adopting release states, “We agree it is possible that firms could reach different conclusions as to the effectiveness of their QC system under QC 1000 and ISQM 1 or SQMS 1.”, for which the economic analysis did not satisfactorily analyze nor articulate the potential direct or indirect costs to firms associated with different evaluation conclusions.

Within the economic analysis, it includes qualitative comparisons of the U.S. Global Network Firms (GNF), based on survey information, but it does not appear to include a cost estimate on adhering to different sets of definitions between QC 1000 and ISQM 1. The quantitative portion relating to ISQM 1 included the number of firm personnel, percentage of their time committed, and the expected percentage change in QC resources when ISQM 1 became effective on December 15, 2022. In particular, the economic analysis includes discussion on “Reporting the annual QC system evaluation;” however, it does not appear to elucidate on the potential resource, process, and financial challenges that firms may face related to differing conclusions between QC 1000 and ISQM 1. By my staff’s count of prescriptive words such as “must”, “should”, and “shall,” the prescriptive nature of QC 1000 nearly doubles that of ISQM 1. However, our economic analysis reflects little to no effort to quantify costs beyond the limited information collected on the ISQM 1 implementation which is substantially less prescriptive than QC 1000.

Firms will be faced with making multifaceted judgements about the design, implementation, and operation of their QC systems. Since it is possible that firms will reach different conclusions on their QC systems under PCAOB and other standards, firms may potentially have to operate two sets of QC systems resulting in monitoring and remediation challenges. Again, large firms have both the resources to hire more people and implement technology that can assist in addressing QC deficiencies, and the ability to pass the costs to the big issuers that have no real choices other than paying higher audit fees due to the high concentration of the marketplace.

As I have stated previously, I am especially concerned about audit quality impacted by the declining competitive audit marketplace. I have heard many references made about the 2008 Advisory Committee on Auditing Profession’s (ACAP) report in relation to audit quality. However, notably, there is no mention of the ACAP’s recommendations regarding “Concentration and Competition,” which includes the following: “Reduce barriers to the growth of smaller auditing firms consistent with an overall policy goal of promoting audit quality. Because smaller auditing firms are likely to become significant competitors in the market for larger company audits only in the long term…”¹³ Ironically, this heightened regulatory environment aids the large firms, as they have ample resources to comply with new standards and rules; whereas smaller firms will likely be forced to make a strategic business decision on whether it is worthwhile to remain a service provider in the public company audit marketplace.

Conclusion

I agree that we need a robust and modernized quality control standard which was why I supported the proposal over 18 months ago. But we must do it right, and not rush to replace an outdated standard with one harmful to audit quality by increasing burdens without credible benefits that will likely reduce competition. Rather than potentially dismantling the audit profession and simultaneously setting copious standards that ironically make this profession exceptionally unappealing to future accountants and auditors, we as a regulator should thoughtfully balance the scale, using evidence-based quantitative and qualitative analysis to justify the need for our standards. In other words, requirements should promote a commensurate balance between benefits and the associated direct implementation costs to audit firms, that by extension are passed on to issuers and broker-dealers, and then indirectly reduce returns on investments.

Now I am mindful of the aphorism “don’t let the perfect be the enemy of the good,” but I feel compelled today to cast a dissenting vote due to the myriad of concerns I have on the design-only requirements and the insufficient economic analysis in justifying the unnecessarily complex and burdensome requirements that are, in my opinion, harmful to audit quality.

While I am disheartened, the Board’s vote today is not the end of the process. Under SOX, the SEC must approve this adopting release in order for it to become effective.¹⁴ Under SOX and section 19(b) of the Securities Exchange Act of 1934,¹⁵ the PCAOB will submit a Form 19b-4 to the SEC, which will be posted on the PCAOB’s website, and the SEC will solicit public comment. I look forward to reading comments submitted to the SEC by audit firms, audit committee members, emerging growth companies, and actual investors, with regard to design-only and its burdens on competition. I am confident that the Commission will do the right thing.

In closing, I would like to express my appreciation to the Office of the Chair, the Office of the Chief Auditor, and the Office of Economic and Risk Analysis for their hard work and engagement with me and my team.

I now have a few questions for the staff:

1. How will different QC evaluations/conclusions between QC 1000 and ISQM 1 affect audit quality and investor protection?
   
2. Do you agree then that our standards might require two QC systems?
   
3. Can the PCAOB today inspect and/or investigate a registered firm that has never performed a public company, broker, or dealer audit?
   
4. Do we inspect and/or investigate a registered firm that has never performed a public company, broker, or dealer audit?
   
5. Do registered firms under QC 20-40 have to comply with any of our QC standards if: (1) they have not performed a public company, broker, or dealer audit in the past five years; and (2) are not contemplating the acceptance of an engagement with a public company, broker, or dealer? [If yes, ask for specifics.] 
   
6. In the legal analysis relating to design-only, you emphasize Congress’ use of the word “every” in SOX section 103(a)(2)(B), but you do not discuss or mention the phrase “with respect to the issuance of audit reports” in section 103(a)(2)(B). How does that phrase bear on the scope of our standard-setting authority?
   
7. Why didn’t you include a discussion of this phrase in your legal analysis?
   
8. It appears that staff want to give out-sized effect to the word "every" and down-play or give short shrift to statutory text reflected in not only section 103 but also sections 104 and 105, that ground the scope of our standard-setting, inspection, and enforcement authority in registered firms' preparation and issuance of audit reports.
   

Thank you. Back to you, Chair Williams.