Testimony Concerning Sarbanes-Oxley at Four: Protecting Investors and Strengthening the Markets

Date:
Sep. 19, 2006
Speaker:
Mark W. Olson, Chairman
Event:
U.S. House of Representatives Committee on Financial Services
Location:
Washington, DC

Chairman Oxley, Ranking Member Frank, and Members of the Committee:

I am pleased to appear today on behalf of the Public Company Accounting Oversight Board ("PCAOB" or the "Board"). I am also pleased to join Chairman Cox of the Securities and Exchange Commission (“Commission” or “SEC”) on this panel. Not only does the SEC oversee the work of the PCAOB, but the PCAOB and the SEC share an important responsibility for investor protection, and therefore naturally work closely together on achieving their mutual mandates.

I want to begin by taking a moment to thank the Committee for its interest in how the PCAOB is fulfilling its statutory mandate.

I. Events Leading Up to Passage of the Sarbanes-Oxley Act

With more than half of all American households invested in U.S. public companies[1], the discoveries of financial reporting and auditing improprieties at Enron and numerous other public companies beginning five years ago swelled in 2002 to a national crisis in confidence in the integrity and reliability of public companies’ financial statements and of external audits. Before the Act was adopted, the markets were responding to a heightened risk environment that was the product of several contributing factors – including a few beyond the corporate scandals that were seizing headlines. Prior to the scandals, in addition to the unforeseen growth in household participation in the financial markets, there was a growing interest in equity markets globally. Market participants were also reeling from the collapse of the dot-com bubble, which was triggering a flight of capital out of certain market segments and causing significant losses for many investors. In addition, there was an emerging sense that while GAAP ac
counting was well-suited for “brick and mortar” business models, it was not necessarily equipped to capture the underlying financial aspects or purpose of transactions of non-traditional businesses. Then, of course, the Enron and other scandals revealed accounting failures by public companies and tainted the auditing profession – which investors understandably had thought was acting as their watchdog in attesting to the accuracy of the financial reports.

These factors led to a period of heightened risk aversion across the markets that was increasingly adversely affecting innovation and the economy more broadly. Heightened risk aversion led to a predictably strong response on the part of investors, boards of directors at public companies, the accounting profession, regulators, and the Congress. There was an increased recognition of the need to bolster internal controls over financial reporting and bring an enhanced focus to corporate governance. Spurred by this Committee, Congress reacted by passing the Sarbanes-Oxley Act of 2002 (the “Act”).

Today, with that brief history as context, I would like to focus on two aspects of the law that involve the PCAOB. The first is the establishment of the PCAOB itself, which replaced the audit profession’s self-regulatory model with an independent oversight system. This change was grounded in the concern that the audit profession’s self-regulatory model had not kept up with the growing democratization of the U.S. financial system, which naturally increased reliance on audits as a critical component of the system’s integrity. The second is the Act’s commitment to managing the risk of future reporting failures through disclosure about the effectiveness of internal controls at public companies.

The PCAOB oversees the auditors of public companies, in order to protect the interests of the investing public in the preparation of informative, accurate and independent audit reports on public company financial statements. The PCAOB does not set accounting standards or regulate disclosures by public companies; rather, its role is to enhance the quality of the audits. Simply put, the PCAOB’s job is to improve the quality and reliability of public company audits, so that investors can have more confidence in audited financial statements. High quality financial disclosure by public companies is a cornerstone of capital markets in the United States and is necessary for the continued growth and competitiveness of the U.S. economy.

To explain how the PCAOB aims to achieve its important task, let me describe the PCAOB’s oversight philosophy and the current state of its supervisory program. I will then describe in some detail the PCAOB’s initiatives to maximize the benefits and minimize the costs of the new internal control audits that are required under the Act. Finally, I will discuss how the PCAOB’s work fits into the broader context of Congress’s reforms, to make U.S. capital markets stronger and more reliable.

II. The PCAOB Has Established an Independent Auditor Oversight Program to Protect the Interests of the Investing Public.

Subject to the oversight authority of the Securities and Exchange Commission, the Board is responsible for --

  • Registering public accounting firms that prepare audit reports for issuers;
  • Establishing, by rule, auditing and related professional practice standards relating to the preparation of audit reports for public companies;
  • Conducting inspections of registered public accounting firms;
  • Conducting investigations of, and imposing appropriate sanctions where justified upon, registered public accounting firms and associated persons of such firms.

Since the PCAOB opened its doors in January 2003, it has registered more than 1,600 accounting firms that audit, or wish to audit, U.S. public companies. Once registered, these firms become subject to the PCAOB’s regulatory programs and must use PCAOB standards when they audit public companies. Accordingly, early on, the Board established a program to set auditing, attestation, quality control, ethics and independence standards applicable to registered firms’ audits of public companies. To that end, the Board has developed a standards-setting process that provides for public input at a variety of stages. In particular, three times a year the Board holds a public meeting with its Standing Advisory Group.[2] The advisory group’s 31 members are drawn from a cross-section of the nation’s companies – from the smallest to the largest – as well as auditors from small and large accounting firms, investors and their advisors, academics, and others. These individuals share their informed opinions on how the Board, consistent with its legislated mandate, can improve the quality of audits, including by advising on best practices and emerging issues. From time to time, the Board also hosts roundtable discussions among other groups of experts and affected parties interested in the Board’s development of auditing and related professional practice standards.[3]

In addition, the Board seeks public comment on proposed new standards and rules, makes those comments publicly available on its Web site, and considers them before adopting final standards or rules. Board standards are also subject to SEC review, and they do not go into effect unless they are approved by the SEC. To date, using this deliberative approach, the Board has adopted four new standards as well as new ethics and independence rules relating to tax services and contingent fees.[4]

Registered public accounting firms also are subject to the Board’s inspection program, a key element of the PCAOB’s oversight. The PCAOB inspects the largest nine firms (the firms that audit the financial statements of more than 100 audit clients) on an annual basis. The PCAOB inspects all other firms that audit (or play a substantial role in the audit of) public company financial statements at least once every three years.[5] Inspections designed to identify auditing problems at an early stage and focus firms on correcting them. They are performed by experienced teams of inspectors, who have on average 13.5 years of relevant experience before they join the PCAOB.

These inspections take a significantly different approach from that of the peer reviews in the pre-Sarbanes-Oxley self-regulatory system, which focused on compliance with applicable standards but did not address the overall audit environment. For one thing, PCAOB inspections begin by looking at the professional environment in which audits are performed and focus on the influences – both good and bad – on a firm’s audit practice. These influences include a firm’s culture and the relationships between the firm's audit practice and its other practices, as well as between engagement personnel in field or affiliate offices and a firm's national office.

PCAOB inspections are also risk-biased, in that they focus on the aspects of audits that present the greatest risk.[6] When inspectors find an audit that is not satisfactory, they discuss with the firm precisely what the deficiency is. Often this dialogue leads to immediate corrective action.

From time to time, PCAOB inspections identify potentially inappropriate accounting or other financial reporting by companies. Inspectors bring such matters to the attention of the audit firm. Consistent with its statutory role, the PCAOB does not discuss problems with companies directly, although in many cases the audit firm takes the matter up with the company. In addition, the PCAOB has a practice of notifying the SEC when it identifies financial statements that appear to be materially misstated.

When firms approach inspections with a cooperative attitude, the PCAOB has been able to achieve significant real-time improvements, often even before an inspection is concluded. In addition, after each inspection, the Board issues an inspection report that more formally communicates key findings. Inspected firms have an opportunity to review and comment on a draft of this report before the Board issues it. Parts of inspection reports are made public on the PCAOB’s Web site, but, consistent with the confidentiality restrictions in the Act, the full report is transmitted only to the audit firm itself, the SEC and certain state regulators. Under the Act, addressing quality control criticisms within one year after the report results in those criticisms remaining non-public, which provides firms additional incentive to correct problems.[7]

As necessary, the PCAOB investigates auditor conduct and, as appropriate, imposes disciplinary sanctions. In circumstances of reckless conduct or worse, those sanctions can include significant monetary penalties, and also may include revoking a firm's registration (thus preventing it from auditing public companies) or suspending or barring individuals from working on the audits of public companies.

The Committee may be interested in learning of the international implication of the PCAOB’s role. More than 700 of the PCAOB’s registered firms are in countries outside the United States, reflecting the global nature of auditing and financial reporting today. For the most part, these firms are registered with the PCAOB because they audit or wish to audit significant non-U.S. subsidiaries of multinational U.S. companies or because they audit non-U.S. companies who have caused their securities to trade in U.S. markets and are required to file audited financial statements with the SEC.

The Board’s oversight of these non-U.S. registered firms is facilitated by the assistance of new auditor oversight bodies that have formed in countries around the world. Under the Board’s rules, in appropriate cases the Board may rely significantly on the inspections and other work of those oversight bodies in achieving its own oversight mandate. In addition, the PCAOB monitors international developments to identify and encourage best practices in audit and related professional practice standards as well as oversight generally. To this end, the Board maintains an ongoing dialogue with its counterparts in numerous other countries.

III. The PCAOB is Working to Make Internal Control Audits Efficient.

Section 404 of the Act requires public companies annually to provide investors an assessment of their internal control over financial reporting, accompanied by an auditor’s attestation on the same subject. The term “internal control over financial reporting” refers to a company’s system of checks and processes designed to ensure that it protects corporate assets, keeps accurate records of those assets as well as its financial transactions and events, and prepares accurate periodic financial statements. Investors can have much more confidence in the reliability of a corporate financial statement if corporate management demonstrates that it maintains adequate internal control over bookkeeping, the sufficiency of books and records for the preparation of accurate financial statements, adherence to rules about the use of company assets and the safeguarding of company assets.

A. The Act’s Internal Control Reporting and Auditing Requirements and the PCAOB’s Auditing Standard No. 2.

As directed by Section 404(a) of the Act, in June 2003 the SEC established rules describing the required assessments by public companies. In March 2004, the PCAOB implemented Sections 103 and 404(b) of the Act by establishing a new auditing standard – Auditing Standard No. 2 – to provide for an integrated audit of both internal control over financial reporting and the financial statements themselves. The SEC approved Auditing Standard No. 2 in June 2004.[8] For large, established companies – which the SEC calls accelerated filers – the initial assessments and attestations were required by SEC regulations to be included in their annual Form 10-K filings for fiscal years ending after November 14, 2004.[9]

B. The PCAOB Has Monitored Auditors’ Implementation of Auditing Standard No. 2 and, as Needed, Provided Guidance.

In the two years since the SEC’s rule on management assessments of internal control and the Board’s related auditing standard went into effect, companies and auditors have faced significant unanticipated implementation challenges. These challenges led to a number of problems, including expenditure of unnecessary effort and cost in some situations. The Board has closely monitored these challenges and, as appropriate, provided additional guidance to facilitate implementation. In this regard, the Board’s staff has issued five sets of interpretive guidance that answer 55 frequently asked technical questions on the implementation of Auditing Standard No. 2.[10] In addition, on May 16, 2005, the Board issued a policy statement describing ways auditors can make their internal control audits as effective and efficient as possible.[11] In particular, the Board explained that, to properly plan and perform an effective audit under Auditing Standard No. 2, auditors should –

  • integrate their audits of internal control with their audits of the client's financial statements, so that evidence gathered and tests conducted in the context of either audit contribute to completion of both audits;
  • exercise judgment to tailor their audit plans to the risks facing individual audit clients, instead of using standardized "checklists" that may not reflect an allocation of audit work weighted toward high-risk areas (and weighted against unnecessary audit focus in low-risk areas);
  • use a top-down approach that begins with company-level controls, to identify for further testing only those accounts and processes that are, in fact, relevant to internal control over financial reporting, and use the risk assessment required by the standard to eliminate from further consideration those accounts that have only a remote likelihood of containing a material misstatement;
  • take advantage of the significant flexibility that the standard allows to use the work of others, including corporate internal audit departments; and
  • engage in direct and timely communication with audit clients when those clients seek auditors' views on accounting or internal control issues before those clients make their own decisions on such issues, implement internal control processes under consideration, or finalize financial reports.

The Board also announced that it would monitor the effectiveness and efficiency of such audits in its inspections of the largest firms. The Board’s first such inspections, as well as its other efforts to monitor the implementation of Auditing Standard No. 2, resulted in its issuance of a Report on the Initial Implementation of Auditing Standard No. 2 on November 30, 2005.[12] The Board noted in that report that, in the first year, many auditors faced tight deadlines, staffing and other resource constraints, and significant training needs. Moreover, their clients faced similar hurdles that were, in many cases, exacerbated by having to make up for deferred maintenance on internal control systems that had not kept up with the company’s growth and development. Given these challenges, as the report noted, the Board found that firms’ first-year audits of internal control were not as efficient as they should be.

C. The PCAOB Intends to Continue to Improve Implementation of the Act’s Internal Control Reporting Requirements, Including Eliminating Any Procedures That Are Unnecessary to Achieve the Intended Benefits.

The Board is determined to make internal control audits as cost-effective as possible for companies that are required by the SEC’s rules to obtain an audit report on internal control, and to that end the PCAOB continues to explore ways to improve its audit requirements and accounting firms’ implementation of them, while preserving the intended benefits. In addition to considering changes to its standard, the PCAOB has also designed its 2006 inspections of registered public accounting firms to examine how efficient firms’ internal control audits have been, as measured by PCAOB’s past guidance.[13] Inspectors are probing firms’ second-year audits according to this approach. The Board expects these inspections to drive more efficiency into audits.

  1. The Board Will Soon Consider Changes to Its Standard, to Promote Efficiency and Eliminate Unnecessary Procedures.

    In May 2006 the Board announced plans to propose and seek comment on amendments to Auditing Standard No. 2 to focus auditors on areas that pose higher risk of fraud or material error.[14] These amendments should reinforce the Board's expectation that the audit be as efficient as possible. I support this initiative wholeheartedly, and indeed the Board is well on its way to proposing a new version of its standard later this fall.

    It is the Board’s intention that the proposal will achieve four goals. First, the PCAOB is critically evaluating every area of the audit to determine whether the existing standard encourages auditors to perform procedures that are not necessary to achieve the intended benefits of the audit. In particular, the Board plans to consider eliminating any suggestion that auditors need to evaluate the process that a company uses to reach its conclusion about the effectiveness of company controls. Instead, auditors’ work would clearly be limited to evaluating whether, in the auditor’s opinion, the company’s internal control is designed and operating effectively, without intruding on management’s process to reach its conclusion. Also, the Board plans to propose permitting auditors to reduce their work after the first year, if controls have not changed from year to year.

    Second, the Board plans to propose changes to make the standard simpler to read, easier to understand and more clearly scalable to companies of any size. To do so, the Board is considering reduction in detail in a number of areas, as well as re-articulation of some complex definitions and other concepts that have unintentionally caused auditors and managers unnecessary time to learn and apply. At the same time, by emphasizing core principles, the new proposal is expected to focus auditors on the importance of identifying material weaknesses prior to an actual misstatement occurring, which should greatly benefit investors and restore further confidence in the audit profession.

    Third, the Board plans to propose changes that would make explicit in the standard the Board’s past guidance on how to make internal control audits as efficient as possible. While this guidance has been in place for some time already, we have heard from auditors and others that improvements in efficiency would likely result from incorporating that guidance into actual rule text.

    Fourth, in order to focus auditors on what really matters, which is identifying material weaknesses in a company’s system of internal control before those weaknesses result in material misstatements in the company’s published financial statements, the proposal should emphasize the importance of a company’s control environment, and how it can impact the risk of financial reporting fraud or other material failure. It should also emphasize higher risk stages of financial statement preparation, such as the period-end close process that, when overridden by aggressive managers seeking to appear to meet market targets, has provided the opportunity for so many financial frauds in the past. To the extent the Board’s standard can provide more insight into how auditors should identify these risks and weaknesses, it will better serve investors.
  2. The Board Plans Guidance for Auditors of Small Companies.

    The Board is determined to make internal control audits as cost-effective as possible for companies that are required by the SEC’s rules to obtain an audit report on internal control. Among other things, based on the experience of small companies and auditors who have been – and are currently going – through the process of establishing and evaluating internal control, the Board is working with practitioners to develop of implementation guidance for auditors of smaller public companies.

    This guidance should emphasize the scalability of internal control audits at a practical level and provide audit firms with examples of how the internal control audit process can and should be scaled to fit the relative sizes of small companies, from those that are on the cusp of accelerated filer status down to those that have merely a handful of employees. In addition, the Board is exploring various means of facilitating training for auditors of smaller public companies on auditing internal control. With constructive, practical guidance, and with the SEC’s recent announcement extending the time frame for implementing the Act’s internal control requirements, the Board hopes that small companies and their investors will be able to reap the benefits of internal control reporting without unnecessary costs.
  3. The Board is Continuing Its Forums on Auditing in the Small Business Environment.

    In late 2004, the Board embarked on an ambitious outreach effort directed toward small accounting firms and the small public companies they audit. Specifically, the Board has conducted a series of one- and two-day discussion sessions with small firms and their audit clients, focusing on the topic “Auditing in the Small Business Environment.” To date, the Board has held 15 Forums in 14 cities.[15] These Forums have fostered a robust dialogue and given the PCAOB valuable insights to apply in its standards-setting and other programs. They have also better equipped small firms with useful information to address the challenges of the new regulatory environment.

IV. Reforms in Financial Reporting Have Strengthened the Foundation for Strong U.S. Markets.

Four years after scandals rocked investor confidence and led to the passage of the Sarbanes-Oxley Act, we are able to evaluate the extent to which investors are recognizing improvement in the reliability of financial reporting by U.S. public companies. In some ways, the Act codified best practices that had begun to emerge immediately following the scandals. The Act ensured that boards of public companies and their auditors would reassess the roles of audit committees and the integrity of financial reporting and assign responsibility for assuring that internal control over financial reports would be discharged in a meaningful way.

Today, we are in a better position to reflect on the impact of the Act and whether we are on the right track to achieve its objectives. I believe we have seen restored investor confidence in financial reporting. We are also seeing audit firms realign their business models to focus on quality audit services, ethics, and appropriate levels of independence.

The PCAOB understands that these milestones have not been reached without cost. For example, we continue to hear concern that the costs associated with Section 404 of Sarbanes-Oxley have weakened U.S. markets, pointing to recent growth in non-U.S. markets. I would encourage the Committee to evaluate the cost/benefit broadly and over an extended period of time. To be sure, many markets outside of the United States have risen to become global players, due to a number of factors, including ease of information exchange and the reduction of certain barriers to cross-border transactions. Companies today are presented with more options when they are determining where to raise capital. Regulatory regimes as well as local political and cultural influences are often factored into this decision. We should welcome competition among markets around the globe but not support a competition that is based on cost alone. Having the right balance of oversight and regulation protects the reliability, stability and depth of U.S. capital markets, so they can continue to attract investors and issuers worldwide.

Listings on U.S. markets continue to command a valuation premium.[16] Indeed, in the two years since companies have been reporting and obtaining audits on their internal control, the amount of capital raised by non-U.S. companies on U.S. exchanges has grown, not shrunk as it did in the years directly after the scandals.[17] Even with the expansion of equity markets in other countries, I expect that we will see a continued dominance of U.S. capital markets, particularly in the long term.

V. Conclusion

The PCAOB works hard to achieve the objectives Congress set for it. The oversight program it has in place is contributing to a reduction in the risk of financial reporting failures and contributing to a renewed confidence in financial reports of publicly traded companies and ultimately in the U.S. securities markets. Now in its fourth year of operation, the PCAOB has established a strong foundation for its oversight of public company auditors. The Board continues to assess its oversight program, however, and will make appropriate adjustments to assure that it achieves the objectives of the Act in the most effective and efficient manner possible. In particular, the Board is committed to ensuring that its standard on internal control lays the foundation for efficient, risk-based audits. Reconsideration of Auditing Standard No. 2 on internal control is just one example of this process, though. The PCAOB’s oversight role – as enunciated in the Act and implemented over the past four years -- has already produced positive results.

The PCAOB model clearly resonates in countries that are seeking to strengthen the integrity of their own capital markets, and we are increasingly seeing other nations implement this model to auditor oversight in varying degrees.

While, as I have described, it is important to eliminate unnecessary regulatory costs, vigilance in that regard should not detract from the fundamental reasons for the long-standing strength of U.S. markets. That strength has been due in large part to the high quality standards and investor protections that have been the trademark of those markets for decades.

Thank you Mr. Chairman and Members of the Committee. I welcome your questions.

[1] Due to the expansion of defined contribution plans and other incentives, nearly 57 million U.S. households own stocks directly or through mutual funds, according to a study by the Investment Company Institute and the Securities Industry Association. See Equity Ownership in America: 2005 (November 2005), available at http://www.ici.org/pdf/rpt_05_equity_owners.pdf .

[2] The Board convened its Standing Advisory Group pursuant to Section 103(a)(4) of the Sarbanes-Oxley Act. The Group consists of a select group of experts in auditing and financial reporting, including representatives of investors, accountants, and public companies and gathered to advise the Board on its standards-setting responsibilities.

[3] For example, in June 2006 the Board sought the advice of its Standing Advisory Group on several topics related to the Board’s project to refine its auditing standard on internal control. In addition, in May 2006, together with the SEC, the Board hosted a roundtable discussion on the second year of implementation of the Act’s internal control requirements.

[4] Specifically, the Board’s Auditing Standard No. 1 relates to references in auditors’ reports to the standards of the PCAOB; Auditing Standard No. 2 relates to audits of internal control over financial reporting; Auditing Standard No. 3 relates to audit documentation, and Audit Standard No. 4 relates to auditors’ reporting on whether a previously reported material weakness continues to exist. They are available on the Board’s Web site at Standards, along with the Board’s new ethics and independence rules.

[5] See PCAOB Rule 4003.

[6] The PCAOB has an Office of Research and Analysis that evaluates both public and non-public information to use in assessing risks for purposes of inspections and other PCAOB programs. Recently, in conjunction with the PCAOB’s Office of the Chief Auditor, the Office of Research and Analysis published its first Audit Practice Alert , highlighting for auditors certain issues related to the timing and accounting for stock option grants. That Alert is available on the Board’s Web site at http://www.pcaobus.org.

[7] See Section 104(g)(2) of the Act. The legislative approach reflected in Section 104(g)(2) rests on the premise that firms could be genuinely motivated to improve their quality controls by the prospect of keeping the Board’s criticisms confidential. The Board’s early experiences with the process generally validate the wisdom of that premise. See PCAOB Release No. 104-2006-078 , Observations on the Initial Implementation of the Process for Addressing Quality Control Criticisms within 12 Months After an Inspection Report, March 21, 2006, available at http://www.pcaobus.org; see also PCAOB Release No. 104-2006-077 , The Process for Board Determinations Regarding Firms’ Efforts to Address Quality Control Criticisms in Inspection Reports, March 21, 2006, available at http://www.pcaoubs.org.

[8] See SEC Release No. 34-49884, Order Approving Proposed Auditing Standard No. 2, An Audit of Internal Control Over Financial Reporting Performed in Conjunction with an Audit of Financial Statements (June 17, 2004).

[9] The SEC’s rules have not yet become effective for non-accelerated filers.

[10] These questions and answers are available at Auditing Standard 2.

[11]  See PCAOB Release No. 2005-009, Policy Statement Regarding Implementation of Auditing Standard No. 2 ( May 16, 2005 ).

[12] See PCAOB Release No. 2005-023 , Report on the Initial Implementation of Auditing Standard No. 2 ( November 30, 2005 ), available at http://www.pcaobus.org.

[13] See PCAOB Release No. 104-2006-105 , Statement Regarding the Public Company Accounting Oversight Board’s Approach to
Inspections of Internal Control Audits in the 2006 Cycle (May 1, 2006), available at http://www.pcaobus.org.

[14] See PCAOB News Release, Board Announces Four-Point Plan to Improve Implementation of Internal Control Reporting Requirements (May 17, 2006), available at News Release.

[15] Beginning in November 2004, the PCAOB has held Small Business Forums in Atlanta, Boston, Chicago, Dallas, Denver, Fort Lee (New Jersey), Orange County (California), Orlando, Pittsburgh and San Francisco. In 2006, the Board has held forums in Santa Monica , Fort Lauderdale , San Antonio , Seattle and Boston and has scheduled sessions in Philadelphia , New York and Chicago .

[16] Remarks of Noreen Culhane, Executive Vice President, Global Corporate Client Group, New York Stock Exchange, printed in Ernst & Young, Accelerated Growth: Global IPO Trends 2006, at 26 (An "underlying motivation for most companies listing in the U.S. is the valuation premium (average 30 percent) that accrues as a result of adhering to high standards of governance.").

[17] See Cowan, Lynn , "Foreign Companies Cash in on U.S. Exchanges", Wall Street Journal, August 28, 2006, at C6.

Related Information