The Financial Reporting Ecosystem: Past and Present, and the Anatomy of an Audit Firm

Remarks as prepared for delivery

Good morning and thank you Veronica [Callahan] for the kind introduction. It is a pleasure to be with you again this year and to see so many of you at this early hour. If my count is correct, this morning is my fifth year as a presenter at the Accountants’ Liability Conference: the first four years as a PCAOB staff member, and this morning as a Board Member. I always welcome the opportunity to discuss the important work of the PCAOB and share my thoughts on the essential role the financial statement audit and the auditing profession serve to protect investors and the capital markets.

Before I continue, please know that my remarks today reflect my individual views as a Board Member, and do not necessarily reflect the views of the full Board, my fellow Board Members, or the PCAOB’s staff.

It is an honor to be speaking to you today, and to share the stage with so many distinguished speakers. The annual Accountants’ Liability Conference is a leading event that fosters interactions across a wide spectrum, and I am grateful for the opportunity to add my own perspective. I also want to recognize my dedicated and hardworking colleagues from the Division of Registration and Inspections and the Division of Enforcement and Investigations who presented yesterday and added their voices to the discussion. The PCAOB is fortunate to have a complement of staff composed of some of the finest auditors and lawyers of their respective professions, and it is a privilege to work and interact with them every day.

There is a great deal of overlap between our skills at the PCAOB and those of this audience. That is what makes this conference so special; it provides the opportunity for two groups with a similar focus to exchange ideas directly. Your own expertise includes maintaining a deep appreciation and understanding of the work being done at various financial regulators including the U.S. Securities and Exchange Commission (SEC), the PCAOB, and our non-U.S. counterparts.

I have reflected on your skills and priorities as I contemplated today’s remarks. Everyone participating in this conference, whether here or online, is part of the financial reporting ecosystem, and has a unique role to play in it. Each of these individual contributions represents a thread that, when woven together, creates the tapestry surrounding our capitalist system by serving investors and the capital markets.

As a certified public accountant and a long tenured and proud member of the auditing profession, I have the upmost respect for the important role audit firms and individual auditors play in serving investors and the public interest.

[T]he public interest [is] a “non-negotiable” aspect of the accounting profession. It can be argued that the possession of other mindsets could be problematic, even treacherous, if there is any doubt about a professional’s commitment to the public interest. In that sense, the public interest mindset is paramount, overarching, and foundational.¹

I have said it before and it is worth repeating: the work of the financial statement auditor and the auditing profession is noble, vibrant, and resilient.

Members of this audience, in your roles as advocates or advisors, have the ability to guide, instruct, and influence your client, the audit firm, in pursuit of these traits. You are in the unique position of having inside and outside perspectives, and you can marshal both to help your firm clients perform their own roles in the ecosystem in the best way they can. Your role, too, is critical to the ecosystem.

With that view of our respective responsibilities, my remarks this morning cover three broad areas.

First, I will offer some historical context on the role of the financial statement audit to society.

Next, I will move to a discussion of the PCAOB’s recent rulemaking and standard-setting activities, with particular focus on the two standards that were approved by the Board earlier this week.

I will end by reflecting on the audit firm, as an organism, within the financial reporting ecosystem, and how understanding its anatomy may offer a path forward from the inflection point we find ourselves at.

Ivar Kreuger: Of Misstatements and Matchsticks

It has been said that “[y]ou can’t really understand what is going on now unless you understand what came before.”² Observations about the current state of the auditing profession and the PCAOB’s activities are enriched by looking at them in the context of what preceded them. The last few decades offer many cautionary tales on what happens when the financial reporting ecosystem breaks down, but I want to focus instead on a story from well before that. It predates not only the PCAOB, but also the SEC. It is a story of deceit, manipulation, and matchsticks.

In the 1920s, one man supplied 75% of the world’s matches. His name was Ivar Kreuger. A Swede by birth, he came to America in the early 20th century to build his fortune.³

And build it he did. At its height, Kreuger’s empire spanned 400 different companies all over the world. For his efforts, he received international acclaim and admiration.

Kreuger’s success encouraged investment. By 1929, his companies’ securities were the most widely held both nationally and internationally. Kreuger’s securities were attractive for two main reasons: they paid high dividends, and were sold in small denominations, allowing retail investors a slice of the pie as well.

In reality, it was a house of cards, and Kreuger’s empire was secretly already in the process of collapsing when he committed suicide in 1932. After his death, Swedish authorities called in Price Waterhouse to make sense of Kreuger’s tangled affairs. Over five years, Price Waterhouse issued 57 reports chronicling a web of deceit that included inflating or double counting assets, fabricating the existence of entire companies, and much more.

And where were the accountants? Kreuger prepared by hand every financial statement his companies ever issued, reportedly without looking at any journals or ledgers. The few accountants he employed were tasked with recording the entries necessary to make the books correspond to the already prepared financial statements.

Kreuger deliberately hired accountants with little to no familiarity with professional accounting practices and so they did not know to object. Kreuger took requests for audited financial statements as an insult to his integrity. Occasionally, he could not avoid auditors. The auditors, unfortunately, were usually all too ready to take the word of the Match King as sufficient corroboration.

Kreuger’s death, and the subsequent collapse of his empire, entranced the world. The financial reporting ecosystem took particular notice. Kreuger’s fraud was the catalyst for the New York Stock Exchange’s requirement for independent audit reports. Committee reports for the Securities Act of 1933 devote hundreds of pages to Kreuger and designing new laws to prevent such deception from repeating. Despite his largely fading into the dusty pages of history, our financial regulatory framework today owes much to Ivar Kreuger, the Match King.

Even now, nearly a century later, many lessons from Krueger’s story remain relevant. In particular, it can be challenging to maintain a steady skeptic voice. It requires not only courage, but proper support. In the absence of any government mandates, Kreuger’s auditors and other business affiliates had simply no reason to push too hard when the money kept pouring in.

Today, we continue to work to get the balance right, and everyone in the financial reporting ecosystem has a role to play to ensure investors are protected through high quality auditing.

Our Standard-Setting Agenda: Recent Developments

With that historical perspective and background, I will turn to how we at the PCAOB are working to protect investors. The PCAOB is in the midst of an ambitious rulemaking and standard-setting agenda. Our 2022 to 2026 Strategic Plan lists modernizing standards as one of our four main goals.⁴ We have made a great deal of progress in this area.

On Monday of this week, the Board adopted two new standards, QC 1000 and AS 1000, and related amendments.⁵ These standards are now under review with the SEC. I am pleased to have the opportunity to highlight some specific features of these new standards.

QC 1000

QC 1000, A Firm’s System of Quality Control, might be thought of as a generational standard that will significantly change the requirements for the quality control system under which public company audits are performed. We designed the standard with the objective of balancing a proactive, risk-based approach to quality control with certain mandated quality objectives to ensure firms appropriately design, implement, and operate their quality control systems.

The standard identifies eight integrated components of a quality control system. The first two components are process components and consist of a firm’s risk assessment process and the monitoring and remediation process. The risk assessment process applies to all aspects of a firm’s operations and is tailored to its facts and circumstances. As part of this component, a firm establishes its quality objectives, identifies and assesses the risks to achieving those objectives, and designs and implements responses to those risks.

The monitoring and remediation process provides a mechanism to detect and address deficiencies both in engagements and in the operation of the quality control system. These two process components work in concert to create a feedback loop to drive continuous improvement throughout the quality control system.

The remaining six components will sound familiar to those aware of the quality management standards of the International Auditing and Assurance Standards Board (IAASB)⁶ and the American Institute of Certified Public Accountants (AICPA).⁷ Those components are governance and leadership, ethics and independence, acceptance and continuance of engagements, engagement performance, resources, and information and communication. While the structure of QC 1000 has commonalities with the structure of the quality management standards of the IAASB and the AICPA, QC 1000 includes incremental provisions the Board views as important to our investor protection mandate.

Certain roles and responsibilities established in QC 1000 warrant brief mention. The firm’s principal executive officer is ultimately responsible and accountable for the quality control system as a whole. In addition to other responsibilities, this individual is accountable for the design, implementation, and operation of the quality control system as well as its annual evaluation. This is the individual who must certify the firm’s annual evaluation of the quality control system to the PCAOB.

In addition, a firm must assign individuals to take operational responsibility and accountability for the quality control system as a whole; for the firm’s compliance with ethics and independence requirements; for the monitoring and remediation process; and, if appropriate, for other components of the quality control system.

I would like to highlight two features of the standard that I believe are particularly helpful in supporting audit quality.

The first is the establishment of the External Quality Control Function, or EQCF, for firms that issue more than 100 issuer audit reports in a calendar year. The EQCF role includes the following key aspects:

• The standard mandates that the responsibilities of the EQCF include evaluating the significant judgments made and the related conclusions reached by the firm when evaluating and reporting on the effectiveness of its quality control system. Other specific responsibilities are not mandated; firms have the flexibility to tailor the role to respond to the nature and circumstances of the firm.
• The standard requires that the individual or individuals serving as EQCF have the experience, competence, authority, and time necessary to enable it to carry out its responsibilities.
• Consistent with the concept of the feedback loop presented in the standard, a firm must consider the results of the EQCF’s evaluation in its ongoing monitoring of the quality control system.

While the evaluation performed by the EQCF will be in some respects similar to the engagement quality review evaluation performed under AS 1220, Engagement Quality Review, I would like to emphasize a few ways in which these differ:

• The EQCF role may be filled by an individual or by a group, depending how the firm designs the role to meet its objectives.
• QC 1000 does not specify the procedures the EQCF should perform to evaluate the significant judgments made and related conclusions reached, as these may vary based on the circumstances of the firm and the design, implementation, and operation of its quality control system.
• QC 1000 does not require the EQCF’s concurring approval of reporting, although firms would be free to establish such concurring approval as a matter of policy. Should the EQCF assessment differ from that reached by the firm, this information would flow into the monitoring function as part of the feedback loop.
• The EQCF role does not require a term limit, so I encourage firms to balance the need for a fresh perspective with the timeframe required to thoroughly understand the firm’s risks and operations.

The second aspect of the standard I would like to highlight are the provisions to support a strong “speak up” culture. The standard requires a program for collecting and addressing complaints and allegations for all firms that must operate a quality control system. In addition, firms must protect those who make complaints or allegations from retaliation.

QC 1000 also specifically emphasizes the importance of firm culture on the system of quality control through its inclusion as an additional risk consideration. I will return to this idea later in my remarks.

AS 1000

AS 1000, General Responsibilities of the Auditor in Conducting an Audit, replaces and improves a foundational set of four standards that had not been updated significantly since their adoption as interim standards 21 years ago, and have their roots decades before that. These foundational standards represent the general principles and responsibilities of the auditor when performing an audit and consist of reasonable assurance, due professional care, professional skepticism, independence, competence, and professional judgement. Collectively, these areas represent the necessary building blocks for high quality audits.

The standard’s introductory language reaffirms the auditor’s fundamental obligation to protect investors through the preparation and issuance of informative, accurate, and independent auditor’s reports. It is critical to underscore the interests of investors in the bedrock of our standards.

AS 1000 and the related amendments do not change or alter the auditor’s responsibilities. Rather, they serve to streamline and clarify auditor responsibilities while also enhancing the useability of the standard by making it easier to read, understand, and apply.

I would like to highlight three additional points in the new standard.

• First, the standard adds context to the concept of reasonable assurance. AS 1000 does not change the meaning of reasonable assurance or the requirement to obtain it, but rather continues to emphasize that reasonable assurance is a high level of assurance which is obtained by reducing audit risk to an appropriately low level through the application of due professional care.
• Second, the adopting release cites the determination of critical audit matters, or CAMs, as an example of the auditor’s professional judgment. As the determination of CAMs is an important part of the auditor’s reporting responsibilities and one that is of great importance to investors, I am pleased it is highlighted in this standard.
• Finally, AS 1000 confirms an auditor’s requirement to also take into account PCAOB auditing interpretations. The standard offers insight into what “PCAOB auditing interpretations” encompasses, specifically the PCAOB publications entitled “Auditing Interpretations” as currently in effect.⁸

Besides these auditing interpretations, the release notes that the PCAOB also supports the implementation of and compliance with its standards in many other ways, including providing guidance in rulemaking releases that accompany standards, amendments, or rules, or issuing Board or staff guidance. One of my priorities as a Board Member has been transparency, and that includes into the PCAOB. While these guidance documents do not have the same level of authority as Board rules and/or standards, they offer greater insight and often announce our organizational priorities and areas of focus.

Firm and Engagement Metrics and Firm Reporting Proposals

I would like to call your attention to two other topical matters on our rulemaking agenda. Last month, we issued two additional proposals: Firm and Engagement Metrics and Firm Reporting. As I noted in my statements accompanying those proposals, I see them as reflecting the continuing need for increased transparency in the audit process, and for information regarding audit firms’ ability to conduct quality audits.

Although our standard-setting agenda by necessity proceeds in pieces, different standards overlap and augment each other. This is particularly true for these two projects and QC 1000. QC 1000 includes certain provisions regarding firm and engagement metrics, and the Firm Reporting proposal includes certain public disclosures regarding the EQCF.⁹

The comment period for both of these proposals is open until June 7, and I encourage all of you to contribute your thoughts. All voices are welcome and important.

Anatomy of an Audit Firm

I turn now to the current state of audit quality, as there are a number of indicators that are troubling. While our preliminary 2023 inspection results indicate a modest improvement in Part I.A deficiency rates at some U.S. Global Network Firms, and a decline in the number of Part II deficiencies for certain of these firms’ quality control systems, deficiency rates as reflected in our inspections remain unacceptably high. As others at this conference have noted, our Division of Enforcement and Investigations has brought to light worrying conduct by certain firms and associated persons too often to label them as outliers.

Looking globally, the International Forum of Independent Audit Regulators (IFIAR) recently released results of its annual international inspection findings survey, showing that the frequency of inspections with at least one finding had risen to the highest level since 2020. The report notes in particular that the observed rate of findings related to engagement performance is the highest in five years, and that quality control rates continue to fluctuate.¹⁰

Admittedly, inspection results and enforcement cases provide a hindsight view. Nevertheless, as a profession, we find ourselves at an inflection point. Choices we make now can have an outsized effect on the future. I recognize that there are many entities that work together in the auditing ecosystem and each has a role to play in this endeavor. But, at this moment, focusing on the audit firm as its own complex organism within that system can offer some direction.

I recently spoke about the DNA of an auditor.¹¹ I proposed the following four unique characteristics collectively represent the DNA of a successful financial statement auditor:

• a commitment to the auditor’s responsibility to investors and the public interest;
• a drive to obtain an understanding of a company’s business, operations, and strategy;
• a dedication to lifelong curiosity; and
• an obligation to professional skepticism.

I would like to explore the natural extension of auditor DNA: the anatomy of an audit firm.

I recognize this analogy is not exact. But anatomy is the study of internal workings or processes. When a body has experienced a trauma – and I believe this body has – it is time to take vitals, to check which things are working as they should, which need treatment, and how quickly we must act.

In my view, the PCAOB’s response here, in part, is QC 1000. In particular, it explains how a firm’s quality control system “consists of components that are present, function, and operate together, not exclusively in a linear manner, enabling the consistent performance of engagements and the issuance of informative, accurate, and independent [audit] reports.”¹²

I suggest that there are five processes or functions that operate together and are necessary to keep any audit firm healthy and functioning as it should. These five are:

• accountability;
• independence;
• integrity;
• investor focus; and
• voice.

An effective quality control system will touch all these points, but it cannot ensure success on its own. The audit firms themselves have the starring role in this task. This may be a unique way to think about an audit firm, and I certainly welcome your thoughts and views.

Accountability

Audit firms must infuse a sense of accountability in their partners and all staff. However, unlike other professions, an audit firm’s accountability to its client – by which I mean the entity under audit – carries profound risk.

Instead, members of audit firms must be accountable to their professional obligations and to the investing public. Yesterday, SEC Chief Accountant Paul Munter quoted the 2000 O’Malley Report to make this point: “Only quality audits serve the public interest, and the public is [an auditor’s] most important client.”¹³ Members of audit firms must also be accountable to their professional peers and colleagues, most especially within their firms. No doubt this is one reason why the partnership model, generally, has served audit firms well. An unwavering internal commitment to audit quality, continuously reinforced, is the sign of a healthy firm.

While tone at the top is essential, we must not neglect the tone at the middle and tone at the lower levels, which the PCAOB is focused on. QC 1000 specifically emphasizes the importance of firm culture on the system of quality control through its inclusion as an additional risk consideration to tone at the top.¹⁴ And as you heard yesterday, our Division of Registration and Inspections has a team in the midst of an inaugural culture review initiative.¹⁵ Understanding the impact of firm culture on a firm’s ability to conduct high quality audits is an area worth further exploration.

The term “costly skepticism” means appropriate application of skepticism that does not identify a misstatement. Members of an engagement team can pay a price for such skepticism. On the other hand, research shows that supervisors who consistently reward appropriate skeptical behavior, regardless of the outcome, develop staff that are more likely to detect and raise fraud red flags. In turn, when supervisors believe that their own audit partner will view the skepticism favorably, they are more likely to “pay it forward” and reward their own staff who engage in skepticism.¹⁶

An audit firm with a fully developed accountability system makes sure it flows in both directions. It instills a “culture of challenge” that empowers rank-and-file auditors to do their job knowing their manager and their firm has their back.¹⁷ An accountable firm, without hesitation, also will hold its clients to account.

“Critical . . . is firm management giving clear and consistent messages that it not only expects auditors to do the right thing, but also will support them, fully and unequivocally, when ‘no’ is the right answer – even when that means losing a client.”¹⁸

Accountability is the circulatory system of the audit firm. Blood carries nourishment, pumped by the heart to the tiniest capillaries of the body’s extremities. But only through a vast system of arteries does the system work. If one artery gets blocked, the vessels they feed will starve, no matter how powerful the pumping heart.

Likewise, a firm’s commitment to accountability must also not have any blockages. A firm’s culture is embodied by both written and unwritten rules, and so can be undermined by the culture in a particular region or office, or even the behavior of an individual supervisor.

Independence

An audit firm and its associated persons must be independent in fact and appearance of the companies it audits. While this should be a well-known point, data continue to suggest otherwise.

In March, we authorized a settlement where a firm failed to implement a quality control system that provided reasonable assurance that its personnel would maintain independence in all required circumstances.¹⁹ The circumstance in that instance involved an issuer client whom the firm wanted to transform into a joint business relationship instead. In their zeal to pursue this strategy, neither firm leadership nor the engagement partner paused to consider the independence concerns until well into the process, resulting in the issuer terminating the firm as its auditor when the audit was already underway.

Independence is the skin of an audit firm. It defines the boundary between interior and exterior. It allows for smooth movement of the body as one. It offers protection from the elements and from many pathogens. But, it is not difficult to breach, and the smallest nick can have dire consequences.

Last year, the Australian authorities sanctioned a firm whose tax partners began sharing confidential government information. The misconduct was profound and far reaching. According to Australia’s Tax Practitioners Board, it began with a lack of adequate arrangements to manage conflicts of interest.²⁰ This misalignment of incentives opened the door to much more. It is no wonder, then, that the independence of audit firms is one of the ecosystem’s perennial concerns.

It can be challenging to anticipate independence breaches without direct examples. One area that has me concerned is the continuing trend of private equity investments in accounting firms and the accompanying use of alternative practice structures. A complex system suggests a potential for blurred boundaries. Independence is an area that requires constant vigilance. Members of this audience have an indispensable role here in identifying points of friction well before the skin is broken.

Integrity

Integrity, coupled with independence, is what provides an audit firm with the highest currency: trust. Trust in the audit, and, by extension, trust in the financial statements under audit. Without trust, the value of the audit, and the rationale for the auditing profession, is lost.

I would compare integrity to ligaments and tendons, those bands of tissue that connect bones, joints, and organs together, and hold them in place. Integrity is a binding agent. It binds an audit firm together in pursuit of audit quality, and the firm, in turn, reinforces the bonds between the capital markets’ many participants by providing the bedrock of confidence that sustains them.²¹

If integrity is the tissue, then there must be an Achilles heel – the tender point that can lead even the strongest and most confident to stumble and fall. The last few years have pointed us toward a likely contender by way of the widespread cheating scandals that have been uncovered.

I could choose many examples, including one last month that led us to levy our highest civil money penalty to date.²² But, it was a detail from a different order that sticks with me.²³ In that matter, the then-National Professional Practice Director recognized that the firm’s audit partners had fallen behind in training compliance. The director began emailing them the answers. The director’s email explained that the answers provided would result in a passing rate on the exam, but not a score of 100%.²⁴ The deceit had to look realistic.

Amid the temptations that auditors are continually confronted with, “[their] real success lies in how effectively [they] discharge[ their] public trust – how conscientiously [they] serve[] the public interest. That is why [they have] been licensed to practice.”²⁵ This is how former Andersen partner Bill Hall described integrity nearly 40 years ago. The same can be said of an audit firm.

Investor focus

As I mentioned earlier, the first sentence of AS 1000 confirms that an auditor has a fundamental obligation to investors.²⁶ To continue to flourish today, an audit firm must understand shifting investor focuses and develop ways to respond.

In his autobiography, Henry Ford recounts that in conceiving of the Model T, he would make sure that “any customer can have a car painted any color that he wants so long as it is black.”²⁷

Audit firms cannot take a similar approach today and expect to have lasting success and value. The share of Americans who own stocks has never been higher.²⁸ And that rising population of investors are raising their voices, demanding more and different disclosures.

Investors are looking to auditors, and do not always like what they see. In increasing numbers, investors are voting against the ratification of auditors.²⁹ While such votes may only be advisory, and the proportion still small, I believe they suggest a sea change. If audit firms do not listen to investors and adapt, the system will not sustain itself.

It is also true that the proportion of passive investing has never been higher.³⁰ Rather than diminishing the role of an auditor, these developments, in my view, make the audit even more important. When investment holdings become longer term, increased attention falls on their stewardship. Research indicates that a rise in passive investing leads to less support for auditor ratification and a higher likelihood of auditor turnover.³¹

Investor focus corresponds to the ears. In addition to allowing the body to listen and hear, the inner ear helps us maintain our balance. An audit firm whose ears are blocked against or not attuned to the voices of investors is at risk of losing its balance and stumbling.

Voice

Last is voice. Voice, admittedly, is an outlier in this discussion. It is not a body system, or even an organ. However, it is how firms communicate internally as well as with the profession, with investors, and with the broader public. And, it has been all too quiet.

The audit firm and the auditing profession need strong voices to emerge from their ranks, ones that have the courage to acknowledge shortcomings and call on peers to rally in a commitment to take action, find solutions to improve audit quality and put investors first. Former PCAOB Board member Charley Neimeier described such voices in 2005, and the impact they can have:

[A]lmost immediately upon the passage of the Sarbanes-Oxley Act, the brunt of the impact of the Act was thrust upon [the audit profession]. And yet, the profession did not resist what the Act required of it; instead, it courageously and without hesitation accepted the challenges that the Act required it to make. The profession did not shy away from its problems, but faced them head-on and in doing so has become stronger. Of all those that were responsible for the financial reporting problems of the last few years, the accounting profession is one group that has had the guts to say that it made mistakes but also has quietly gone about making the changes that Sarbanes-Oxley required it to make.³²

The individuals and firms who can herald the path forward from the current inflection point are the ones most likely to lead. It is a challenging but vital role, and the only way to ensure the continued nobility and resiliency of the profession. 

This Audience’s Role

As I conclude, you may be thinking to yourselves, where do we feature in this system? I noted at the start of my remarks your unique perspective with both insider and outsider viewpoints. You are close enough to your clients, the audit firms, to understand their concerns, merit their trust, and share their goals, but at a degree of removal to allow for additional perspective and context.

I submit that you are in a unique position to contribute to firms’ health and, when necessary, recovery. In this analogy, you can take on many of the healthcare roles. You can help the firms keep their fitness levels up to make injuries less likely. You can inoculate. You can point out the stumbling blocks before the fall happens. You can diagnose when a firm knows something is wrong, but is not sure what. You can recommend rest to avoid further injury. You can assist in the bandaging and the physical therapy. You can provide the necessary referrals when things may extend beyond your skills.

Prevention and recovery can be difficult and sometimes even painful. A patient cannot always see what is in their best interest long term. There are so many ways that you can help.

Conclusion

In summary, the anatomy of a firm consists of accountability, integrity, independence, investor focus, and voice. Audit firms, with your counsel and support, need to refocus and ensure proper time and attention is given to each component for the health of the firm and by extension the health of the auditing profession. The stakes are simply too high to do otherwise.

Thank you for your attention, and I look forward to your questions.