The Courage to Think Differently: The Audit as a Complex System and the Power of Firm Culture

Remarks as prepared for delivery

Good morning and thank you Amir [Ghandar] for the warm introduction and for the opportunity to participate in the 2025 Chartered Accountants of Australia and New Zealand’s Annual Audit Conference. For over 10 years, this has been the flagship conference and a highlight of the sponsored educational events for the approximately 138,000 Chartered Accountants in Australia and New Zealand. It is an honor to have my voice included among the numerous experienced and well credentialed presenters steeped in the many accounting, auditing, and financial reporting matters that merit further study and discussion. And I am especially pleased to participate in the opening session of this year’s conference, together with the ensuing panel discussion with Megan [Wilson] and David [O’Connor].

Before I continue, please know that my comments this morning are provided in my official capacity as an individual Board member and do not necessarily reflect the views of the full Board, my fellow Board Members, or the PCAOB’s dedicated and hardworking staff.

I must say that I am truly inspired by the theme of this year’s conference: “Strategic Courage. Bold Thinking.” I have been reflecting on these two simple, yet powerful, phrases as I prepared my remarks. It occurs to me that these words could be used to define a life well lived. But, for us today, this theme perfectly embodies the unassailable service the financial statement auditor provides to investors and the capital markets. In fact, both of these phrases – Strategic Courage and Bold Thinking – rightly describe the necessary behaviors a financial statement auditor must demonstrate to perform high quality audits and protect investors.

In previous remarks, I proposed that there are four unique qualities that collectively represent the DNA of a successful financial statement auditor.¹ These four qualities are a responsibility to investors and the public interest; a drive to obtain an understanding of a company’s business, operations, and strategy; a dedication to lifelong learning; and finally, an obligation to professional skepticism. Much like the chemical bonds that serve as the backbone of each strand of DNA, I submit that strategic courage and bold thinking provide the structural framework to the DNA of an auditor.

Expanding on this analogy, financial statement auditors must be courageous and bold to stay true to their core responsibility of protecting investors, even when that responsibility may not be in their immediate interest. Throughout the course of an audit, auditors must make difficult decisions and reach conclusions, some of which may come at a high cost. While it is human nature to take the path of least resistance and simply “satisfy the client,” auditors must be comfortable raising uncomfortable questions and skeptically evaluate responses from management. In doing the right thing, individual auditors may put their careers or their firm’s business relationships at risk in the short term. Yet, this risk is necessary for auditors to fulfill their time-honored responsibilities to investors and the capital markets and is necessary to maintain the auditor’s, and the auditing profession’s, vital independence, integrity, and public trust.

Keeping with this view of the responsibilities and traits of the independent financial statement auditor, my remarks this morning will first provide a history and overview of the PCAOB and the advent of global independent audit oversight; then propose that the execution of a financial statement audit is a complex system; and, last, examine how firm culture influences audit quality.  

The History of the PCAOB

The PCAOB was created in the wake of several well-known financial reporting and audit failures that resulted in a loss of trust in the audit profession and the U.S. capital markets more broadly. The downfall of Enron and WorldCom triggered significant economic fallout, including the elimination of thousands of jobs, lost employee retirement savings, and a steep drop in shareholder value.

In response, the U.S. Congress held a series of 13 hearings to assess the scope of the crisis and consider how to restore confidence in the capital markets. During the hearings, several U.S. Senators noted that in the three years leading up to the events of Enron and WorldCom, U.S. public companies had restated their reported financial earnings over 600 times, more than the total restatements in the previous decade.²

Senator Paul Sarbanes cited an opinion poll conducted following the bankruptcies of Enron and WorldCom that found that a majority of Americans, 57 percent, “did not have confidence in the basic information that undergirds our equities markets.”³ It was not only American investors that were losing faith in these markets; it became a global phenomenon. The Federal Reserve Board, for example, found that “foreign direct investment in [U.S.] corporate equities had fallen by 45 percent from 2001 to 2002.”⁴

Congress also discussed the downstream effects these failures had on companies. As Senator Richard Shelby argued, “[w]hen auditing failures result in good investments on paper being bad investments in reality, capital does not flow to its best use, the market does not properly reward innovation, and [public companies] that lose out themselves see the value of cooking the books.”⁵

It also was noted that the loss of investor confidence had the effect of raising the cost of capital for public companies.⁶

These Congressional deliberations touched on the special and unique role that auditors play in our society. During one hearing, Senator Sarbanes quoted an observation from the U.S. Supreme Court:

By certifying the public reports that collectively depict a corporation’s financial status, the independent auditor assumes a public responsibility…that transcends any employment relationship with the client. The independent public accountant performing this special function owes ultimate allegiance to the corporation’s creditors and stockholders, as well as to the investing public. This ‘public watchdog’ function demands that the accountant maintain total independence from the client at all times and requires complete fidelity to the public trust.⁷

Congress ultimately passed the Sarbanes-Oxley Act, which established the PCAOB as an audit oversight body independent from the profession.⁸ This independence was accomplished in two primary ways. First, the PCAOB would have five full-time board members, only two of whom could be Certified Public Accountants and, second, Congress ensured that the PCAOB would have guaranteed funding through fees paid by public companies.

Congress also sought to bring together within one oversight body functions that had been done by various professional organizations and enumerated four primary duties of the PCAOB.⁹

• First, register accounting firms that prepare audit reports for public companies;
• Second, adopt auditing, quality control, ethics, independence, and other standards for the audits of public companies to strengthen the reliability of audits for investors and other interested parties; 
• Third, conduct inspections of registered accounting firms to assess the degree of compliance with the Sarbanes-Oxley Act, the rules of the Board, the rules of the U.S. Securities and Exchange Commission, or professional standards and issue public reports on those inspections; and 
• Fourth, enforce compliance with the Sarbanes-Oxley Act, the rules of the Board, professional standards, and the securities laws as well as make settled disciplinary orders public.

The Advent of Global Independent Audit Oversight

At the time of its founding, no other country had established an audit oversight regime with this level of independence, authority, and reach. Notably, Congress made explicit that the PCAOB’s powers extend to oversight of non-U.S. accounting firms that issue audit reports for public companies subject to U.S. securities laws or play a substantial role in the preparation and furnishing of such reports.¹⁰

U.S. securities laws allow companies located anywhere in the world to raise capital in U.S. markets. As a result, companies’ auditors could also be located anywhere in the world. The authors of the Sarbanes-Oxley Act determined that non-U.S. auditors of companies listed on U.S. public exchanges should not be treated any differently than their U.S. counterparts because “[o]therwise, a significant loophole in the protection offered U.S. investors would be built into the statutory system.”¹¹ The wisdom of this approach has proven itself over time.

In the more than 20 years since its establishment, the PCAOB has, in my view, evolved into the model for effective audit oversight. Through its global oversight activities, the PCAOB’s work has helped ensure that investors in U.S. markets can have confidence in the financial statements of the public companies they invest in whether these companies are located in Boston, Brisbane, or Beijing. The benefits have not just accrued to U.S. investors, they have also improved audit quality¹² and capital formation¹³ globally. 

Our inspections program is the engine that powers our work. As of the end of 2024, there were approximately 1,500 accounting firms registered with the PCAOB, approximately 850 of which are located outside of the U.S. Having spent a number of years involved with our inspections and non-U.S. oversight activities, I can say without hesitation that the PCAOB’s work here is impactful. In 2024, our inspectors inspected 171 firms and reviewed portions of 803 audits of public companies including inspections of 221 audits performed by 78 non-U.S. firms. To date, we have inspected firms located in 54 different jurisdictions and have been regularly inspecting firms located in China and Hong Kong since 2022.

To facilitate our inspections of non-U.S. firms, the PCAOB has entered into 28 bilateral agreements¹⁴ exclusive to the PCAOB and the home country regulator. These bilateral agreements have, without question, enabled cooperation in the supervisory oversight of auditors and accounting firms subject to the two regulators’ jurisdictions.

Globally, we have seen a proliferation in the number of audit oversight authorities. In fact, “[t]he widespread adoption of public auditor oversight is one of the most significant changes in the history of the auditing profession.”¹⁵ To encourage greater engagement among audit regulators and promote audit quality, in 2006, the PCAOB joined 17 jurisdictions in establishing the International Forum of Independent Audit Regulators (IFIAR). Today, IFIAR has grown to include 56 members from around the world. Among other valuable work, IFIAR conducts an annual Inspection Findings Survey¹⁶ to measure audit quality trends by inspection results.

Visualizing the Audit as a Complex System¹⁷

As I reflected on my experiences as a financial statement auditor, and trying to demonstrate bold thinking, I came to the realization that the execution of an audit is actually an amalgamation of hundreds, perhaps even thousands, of discrete activities and evaluations. That led me to consider the operation of complex systems. In a complex system, such as a space program, a nuclear power plant, a chemical plant, or aviation, a seemingly benign mistake or flawed practice can result in catastrophic failure. The authors of the book “Meltdown: Why Our Systems Fail and What We Can Do About It” summarize the challenge with identifying warning signs and issues before they result in catastrophes: “[a]s long as things turn out OK, we tend to assume that our system is working well even if our success is due to dumb luck.”¹⁸

I would argue that the execution of a financial statement audit also represents a complex system. It has more in common with other complex systems, such as those just mentioned, than one might think. In addition to requiring technical knowledge, professional judgement, due professional care, and skepticism, performing a financial statement audit involves a series of overlapping steps typically performed by a team of auditors, and possibly involving specialists, using varying degrees of technology. While a breakdown in an audit may not be as dramatic as the failure of a nuclear reactor or an airplane, its costs to society can be significant, and, as Enron and WorldCom have shown, can affect the wellbeing of millions of people.

Commercial Aviation and the Crew Resource Management Program

The challenges faced by commercial aviation hold potential lessons that can be instructive for auditors and accounting firms. During the 1970s, there were several plane crashes. While the causes of each accident appeared to be unique, a deeper study of these events revealed a counter-intuitive relationship between the frequency of accidents and who was flying the plane.

During a typical commercial flight, the captain and first officer alternate flying roughly half the time. Since the early days of commercial aviation, the role and actions of the captain were not to be challenged. A 1994 study by the U.S. National Transportation Safety Board found that more than three-quarters of major accidents occurred when the captain was flying the plane – meaning passengers were actually safer when the less experienced first officer was flying.¹⁹ The results of this study revealed what we all know to be true: in hierarchical structures, individuals will often defer to authority figures and choose not to challenge obvious issues.

These and other similar insights influenced the creation of a new approach to aviation training protocols, which is now known as the Crew Resource Management program, or CRM for short. CRM is broadly defined as the application of human factors, knowledge, and skills to ensure that teams make effective use of all resources, including ensuring that pilots bring in opinions and utilize unique capabilities of other teammates.²⁰

Over time, the idea of the “team” was expanded to encompass not just the flight crew, but also the ground crew, gate agents, and others.²¹ A CRM program commonly focuses on the following five components: communication, situational awareness, decision-making, teamwork, and barriers.²² This training approach has been credited with improving the overall safety of commercial aviation because it revolutionized the culture not just of communication between the captain and the first officer during flight, but of the entire team supporting the flight. 

The concepts of the CRM program have been used in other fields with complex operations like medicine and firefighting. I encourage auditors and accounting firms to consider the tenets of the CRM program in the execution of their audits. I also urge them to be weary of assuming, like I noted earlier, that everything must be working well so long as the outcomes are fine. When airborne, unpredictable things can happen: a bird can strike an engine²³ or a key component can fail. Like flying, performing a financial statement audit can be unpredictable and auditors should consider this as they approach their duties. It is not overly dramatic to say that the fate of our capital markets and the livelihoods of many individuals depend on the work of the financial statement auditor.  

The Power of Firm Culture²⁴

The CRM program only works as designed, however, when participants feel comfortable raising concerns and know their voices will be acknowledged and respected. This type of action strengthens the culture of an organization.

In a recent PCAOB Spotlight titled “Insights on Culture and Audit Quality,” firm culture was broadly defined as “a set of shared attitudes, values, goals, and practices that characterize an organization. An organization’s culture influences how it establishes its reputation, manages its teams, and sustains productivity. Healthy cultures enable organizations to thrive.”²⁵

As John Price, a former Australian Securities and Investments Commissioner, noted in 2016, “[p]oor culture can undermine … trust and confidence. By contrast, good culture, which is more conducive to good conduct, helps maintain trust and confidence.”²⁶ We all likely experienced instances when an organization’s culture supported, or even encouraged, poor judgement, resulting in the loss of trust. And once lost, this trust is challenging to restore.

It is this strong correlation between culture and trust that interests me, as I believe a strong, positive culture enhances the quality of audits. A healthy and transparent environment, like that established under a CRM program, fosters a “speak-up culture.” A speak-up culture is an environment where all employees feel safe and encouraged to openly voice their ideas, concerns, and feedback without fear of negative consequences.²⁷ It is a culture of open communication and transparency where all levels of the organization are not only encouraged but feel empowered to express their views and raise concerns.

Firm leadership must continually stress and demonstrate the importance of these behaviors. As an example, staff members should not only be recognized and rewarded when they express views consistent with the group’s thinking, but they should be recognized and rewarded when they raise questions and express perspectives contrary to those of the group. There is an emotional cost of standing up for one’s beliefs.²⁸ Because dissent is a precious commodity in modern organizations,²⁹ public recognition of the courage to express opposing views or questions will strengthen firm culture by recognizing all voices and all viewpoints, not only those that conform with the group. 

In the context of an audit, a speak-up culture could be reflected as a junior staff member feeling comfortable raising thoughts in the team fraud brainstorming session, a manager raising concerns to a partner on the completeness of a memorandum drafted by the partner, or a partner informing an office managing partner that the engagement team needs more time to complete their audit steps and therefore the company will need to delay its earnings release and/or regulatory filing. I am sure you can think of other examples from your own experiences.

It is in fostering an environment where concerns are welcomed and can be raised that any flaws in the audit can be identified and addressed, before negative consequences arise. It has been said, “[a]ll too often, when we deal with a complex system, we assume that things are working just fine and disregard evidence that conflicts with that assumption.”³⁰

A strong accounting firm culture combats this complacency and, I believe, is a critical determinant of a firm’s integrity, reliability, and the corresponding quality of their work. An accounting firm’s culture should be designed to foster the same components emphasized in the complex systems of airlines under the CRM program: communication, situational awareness, decision making, teamwork, and barriers. Such a culture provides individual auditors with the strategic courage to speak up.   

Critical Audit Matters/Key Audit Matters

Before I conclude, I want to say a few words about the importance of Critical Audit Matters (CAMs)³¹ or, as they are known outside of the U.S., Key Audit Matters (KAMs).

I continue to believe CAMs are a vital way for financial statement users to gain insight into the audit process, thus reducing information asymmetry between investors, company management, and auditors.³² CAMs provide a perspective into the thinking of the auditors, including the auditor’s view of key risk areas. I also maintain this added transparency for investors increases the relevancy of the audit itself.

Unfortunately, in the U.S. at least, the number of CAMs in audit reports has been decreasing over time. Hence, I am pleased that our Office of the Chief Auditor has a research project to understand this decrease and evaluate whether there is a need for guidance, changes to PCAOB standards, or other regulatory action to improve reporting of CAMs.

For the second year, the PCAOB’s Investor Advisory Group is seeking nominations for the best CAMs or KAMs in audit reports included in 2024 Form 10-K and Form 20-F filings. The deadline is June 30 and details are available on our website.³³ I am thrilled the Investor Advisory Group is continuing the initiative and encourage you to consider nominating your favorite CAM or KAM.

Conclusion

In conclusion, I want to leave you with three key takeaways:

• First, stay focused on the theme of the conference - Strategic Courage. Bold Thinking. It provides the framework for the DNA of an auditor and serves as a shining beacon guiding the financial statement auditor;
• Second, the execution of a financial statement audit is a complex system that requires vigilance to ensure each component of the audit is working as intended. Being exclusively focused on the outcome can be deceptive; and
• Third, consider the teachings of the Crew Resource Management program and the impact of firm culture on audit quality across all levels of the firm. The focus on firm culture is a journey that requires leaders to actively seek out all views and continuously reinforce the need for all members of the team to speak up.   

Robert Montgomery, who was one of the most ardent advocates of the duty of the auditor to be totally, brutally honest about his client’s financial condition, described auditors as “fearless seekers for the truth.”³⁴ As I reflect on these words, I am again reminded of the need to have courage and be bold which is just as pertinent for us today as it was when Mr. Montgomery expressed his view in 1937.

Thank you for your attention. I look forward to the panel discussion and your questions and hope you enjoy the rest of the Annual Conference.