The Need for Increased Transparency and Accountability in the PCAOB’s Remediation Process

Date:: Dec. 7, 2020
Speaker:: J. Robert Brown Jr., Board Member
Event:: AICPA Conference on Current SEC and PCAOB Developments
Location:: Virtual

On December 7, 2020, I, along with my fellow Board members, spoke on a panel at the AICPA Conference on Current SEC and PCAOB Developments. In response to a question, I addressed the PCAOB’s process of assessing an audit firm’s efforts to remediate deficiencies in the system of quality control. The area is critical to audit quality and is currently undergoing transformation at the PCAOB.

Given the importance of the topic, I am providing some additional thoughts on the subject, particularly with respect to ensuring that transformation results in greater transparency and public accountability for the PCAOB’s remediation process. ^[1]

I. Firms’ Incentive to Remediate Quality Control Deficiencies

Audit firms are required to institute and maintain an effective system of quality control for their accounting and auditing practices.^[2]

The PCAOB’s inspection program, among other things, assesses an audit firm’s compliance with the PCAOB’s standards and rules, including those that govern quality control.^[3] During the review, inspection teams may identify criticisms or potential defects in a firm’s system of quality control.^[4]

When this occurs, firms are encouraged, but not required, to remediate these deficiencies.^[5] In the Sarbanes-Oxley Act (“SOX”), Congress provided a mechanism designed to incentivize firms to timely address quality control criticisms identified in the inspection process. SOX held out the carrot of confidentiality where deficiencies were timely and appropriately remediated but also added the stick of public exposure where they were not.

Under this approach, public versions of the PCAOB’s inspection reports could not include “criticisms or potential defects” in a firm’s system of quality control, at least initially. Instead, firms were given 12 months to remediate the criticisms to the “satisfaction” of the Board.^[6] Deficiencies not adequately remediated were made public; those found satisfactory were not.

The PCAOB implemented this carrot and stick approach by establishing broad criteria for assessing firms’ remediation efforts and putting in place a process of review.

Remediation requires a change that is relevant and responsive and appropriately designed to address the criticisms.^[7] The process takes into account the repeated and persistent nature of a criticism^[8] and reflects heightened expectations for the largest firms performing the audits of the vast majority of market capitalization.^[9]

The process provides opportunities for timely interaction with the PCAOB staff concerning remediation efforts. Firms are “strongly” encouraged to engage in a dialog with the inspections staff early in the 12-month remediation period and to develop draft remediation plans that describe how a firm intends to address the quality control criticisms and share those plans with the inspections staff.^[10]

Firms also can submit evidence after the remediation period had closed.^[11] Firms are informed of the staff’s assessment (including preliminary unsatisfactory determinations) before the Board votes on the staff’s determination and, in those circumstances, have additional opportunities to interact with the staff.

II. The Need for Transparency in Remediation Determinations

The Board has identified the remediation process as an appropriate area for transformation, including the need for greater transparency. Increased transparency can result in access of highly useful information to all PCAOB stakeholders and accountability to the public with respect to the remediation process.^[12]

Transparency should start with increased disclosure about a firm’s system of quality control in the public inspection reports.^[13] While the PCAOB cannot reveal criticisms or potential defects in a specific audit firm’s system of quality control unless remediation is unsatisfactory, public inspection reports can include a host of other types of information and observations about a firm’s system of quality control.^[14] Investors have sought additional disclosure in this area.^[15]

In addition, the Board should issue annual reports that summarize the remediation process for each inspection cycle. These reports could identify any criticisms or defects in a quality control system and the number of firms where each deficiency occurred. ^[16] Data could also reveal the number of firms that had been subject to the same or similar criticism in prior inspection reports.

The annual reports should, once a remediation cycle for a particular year has been completed, disclose the number of firms that successfully remediated any deficiencies and the steps they took. The summary reports should explain why particular efforts were successful. The information could be broken down by categories of firms.^[17]

The summary reports should also provide increased insight into instances where firms failed to adequately remediate. The data should include, among other things, the number of firms that failed to remediate in the relevant inspection cycle, including those that failed to take or otherwise identify any remedial efforts, the particular criticisms that were not remediated, and the reasons why the efforts were deemed unsatisfactory.

Including additional descriptive information about a firm’s system of quality control in the firm’s individual inspection reports and providing an annual summary report of the inspection and remediation findings concerning firms’ systems of quality control would generate significant benefits.

Audit firms would better understand areas of PCAOB concern and have an opportunity to proactively address them before they were identified through the inspection process.^[18] Firms would also have greater insight into the types of remediation measures that resulted in satisfactory determinations.

Investors would obtain a better understanding of the practical operation of the remediation process. The frequency of failed remediations and the repeated nature of some criticisms could provide additional insight into audit quality and be useful in communications with audit committees and audit firms. Increased transparency on the PCAOB’s remediation process would also help investors hold the PCAOB accountable in assessing remediation efforts and advancing audit quality.

Audit committees would also benefit from additional information in this area. They would have a better idea of the PCAOB’s concerns with respect to firms’ systems of quality control. The information would presumably inform communications between audit firms and audit committees and enhance oversight of an issuer’s audit process.

Finally, the PCAOB would benefit from this increased transparency. The summary reports could facilitate input from investors, academics, and other stakeholders and promote accountability. The input would have the potential to create a “feedback loop” for “continual improvement” in the remediation process.^[19]

III. Conclusion

The importance of a firm’s system of quality control in preventing audit deficiencies cannot be overstated.

Increased transparency in the remediation process would promote accountability and allow all stakeholders in the audit ecosystem to play a more active role in ensuring dynamic and robust systems of quality control. The lack of transparency and accountability during the era of self-regulation ultimately contributed to a decline in trust in the audit process.^[20] The Board should use the transformation process to advance transparency and accountability to ensure public confidence in, and integrity of, the capital markets.

^[1] The views I am expressing here are my own and do not necessarily reflect the views of the Board, my fellow Board members, or the staff of the PCAOB.

^[2] PCAOB, AS 1110: Relationship of Auditing Standards to Quality Control Standards (available at https://pcaobus.org/oversight/standards/auditing-standards/details/AS1110) (“A firm of independent auditors has a responsibility to adopt a system of quality control in conducting an audit practice.”). See generally J. Robert Brown, Jr., Board Member, PCAOB, Maintaining Investor Trust: Independent Oversight in the System of Quality Control, Massachusetts Public Employee Retirement Administration Commission Virtual Conference (Sept. 17, 2020) (available at https://pcaobus.org/news-events/speeches/speech-detail/maintaining-investor-trust-independent-oversight-in-the-system-of-quality-control).

^[3] Registered firms are required to comply with the PCAOB auditing and related professional practice standards, which include the Interim Quality Control Standards. Interim Quality Control Standards consist of the AICPA’s Auditing Standards Board’s Statements on Quality Control Standards and certain AICPA SEC Practice Section’s membership requirements, as in existence on April 16, 2003. The Sarbanes-Oxley Act requires that the PCAOB inspections include, among other things, an evaluation of “the sufficiency of the quality control system of the firm.” 15 U.S.C. § 7214(d)(2).

^[4] The inspection team’s assessment is derived from results of procedures specifically related to a firm’s quality control system as well as from analysis of the deficiencies identified in individual audits. See PCAOB Inspection Procedures: What Does the PCAOB Inspect and How Are Inspections Conducted? (available at https://pcaobus.org/oversight/inspections/inspection-procedures).

^[5] As explained in the Board’s 2006 release, “the Act does not require a firm to address the quality control criticisms to the Board’s satisfaction; it merely provides a specific incentive to do so.” See The Process for Board Determinations Regarding Firms’ Efforts to Address Quality Control Criticisms in Inspection Reports, PCAOB Release No. 104-2006-07 (Mar. 21, 2006) (available at https://pcaobus.org/Inspections/Documents/2006_03-21_Release_104-2006-077.pdf) (“Remediation Release”).

^[6] 15 U.S. C. § 7214(g)(2).

^[7] The changes also must be “appropriately implemented” and achieve “or be expected to achieve” execution and effectiveness “taking into account subsequent firm monitoring and inspections results, if available.” See Staff Guidance Concerning the Remediation Process, PCAOB (Nov. 18, 2013) (available at https://pcaobus.org/Inspections/Pages/Remediation_Process.aspx) (“Remediation Guidance”).

^[8] For repeated or persistent criticisms over multiple years, the expectation is that current efforts will “differ meaningfully from the types of efforts the firm has described in previous remediation submissions…..” Id. Moreover, “the same type of step, without some meaningful enhancement, will not necessarily be viewed as satisfactory again if the particular problem has persisted after there has been sufficient time for the previous efforts to effect improvement.” Id.

^[9] Remediation Release, supra note 5 (“Processes relating to such things as the firm’s internal inspections, evaluation and compensation of partners, compliance with independence requirements, establishment and internal communication of policies and procedures, and client acceptance and retention, all tend to call for much more formal and detailed approaches in larger firms than in smaller firms.”). See also Staff Inspection Brief, Information about 2017 Inspections (Aug. 2017) (available at https://pcaobus.org/Inspections/Documents/inspection-brief-2017-3-issuer-scope.pdf#search=%22root%20cause%22) (“The specific procedures performed by Inspections staff to evaluate the root causes of audit deficiencies and positive quality events vary according to the size of the firm.”).

^[10] See Remediation Guidance, supra note 7.

^[11] PCAOB Rule 4009(a) (“With respect to any final inspection report that contains criticisms of, or potential defects in, the quality control systems of the firm under inspection, the firm may submit evidence or otherwise demonstrate to the Director of the Division of Registration and Inspections that it has improved such systems, and remedied such defects no later than 12 months after the issuance of the Board's final inspection report. After reviewing such evidence, the Director shall advise the firm whether he or she will recommend to the Board that the Board determine that the firm has satisfactorily addressed the criticisms or defects in the quality control system of the firm identified in the final inspection report and, if not, why not.”). See also Remediation Guidance, supra note 7 (“The information available at the time of an evaluation of the firm’s remediation efforts may include evidence of the effectiveness of the firm’s actions, including results of firm monitoring procedures or external inspections of audits performed by the firm after the firm's remediation efforts were put into place. Where such evidence is available, it is treated as relevant but is not the exclusive or conclusive data point in making an evaluation.”).

^[12] The PCAOB would benefit from increased transparency in other areas. See J. Robert Brown, Jr., Board Member, PCAOB, PCAOB 3.0: The Evolving Role of Investor Protection at the PCAOB, 50th World Continuous Auditing & Reporting Symposium, Virtual, at n. 6 (Nov. 6, 2020) (available at https://pcaobus.org/news-events/speeches/speech-detail/pcaob-3.0-the-evolving-role-of-investor-protection-at-the-pcaob).

^[13] For a discussion of this issue, see J. Robert Brown, Jr., Board Member, PCAOB, Seeing Through the Regulatory Looking Glass: PCAOB Inspection Reports, CFA Institute's Corporate Disclosure Policy Council and Capital Markets Policy Council, Virtual (July 23, 2020) ( available at https://pcaobus.org/news-events/speeches/speech-detail/seeing-through-the-regulatory-looking-glass-pcaob-inspection-reports_724).

^[14] For example, public inspection reports may include information addressing questions such as who is in charge of the system, how does it work, how does it respond to changing audit risks, and how does balance commercial incentives with maintaining audit quality. The reports could describe the mechanisms used by audit firms to address the required elements of the standards addressing quality control.

^[15] Investors have sought increased disclosure with respect to an audit firm’s system of quality control. See Maintaining Investor Trust, supra note 2.

^[16] The PCAOB, for example, issues an annual report that includes anonymized data about results, including quality control findings, in connection with inspections of firms that audit broker-dealers. See J. Robert Brown Jr., Board Member, PCAOB, A Story that Will Not Tell Itself: The PCAOB’s Role in the Protection of Customers of Broker-Dealers, North American Securities Administrators Association (NASAA), Virtual (Oct. 7, 2020) (available at https://pcaobus.org/news-events/speeches/speech-detail/a-story-that-will-not-tell-itself-the-pcaob-s-role-in-the-protection-of-customers-of-broker-dealers).

^[17] The description should disclose data for the categories of firms, including the Big Four, the Big Six, other annually inspected firms, non-U.S. firms, and firms inspected on a triennial basis.

^[18] In 2004, the SEC began publicly releasing its correspondence in connection with the staff’s review of disclosure filings. SEC, Press Release 2004-89, SEC Staff to Publicly Release Comment Letters and Responses (available at https://www.sec.gov/news/press/2004-89.htm). The resulting data provided issuers with more information about the SEC staff’s expectations in meeting disclosure obligations, as well as current trends and techniques, resulting in increased compliance. See J. Robert Brown, Jr., Board Member, PCAOB, Grading the PCAOB: Transparency, Accountability and Investor Protection, Conference of the Council of Institutional Investors, Minneapolis, MN (Sept. 17, 2019) (available at https://pcaobus.org/news-events/speeches/speech-detail/grading-the-pcaob-transparency-accountability-and-investor-protection_703). Similarly, transparency of PCAOB remediation determinations, properly done, would provide a valuable resources for firms to efficiently and effectively respond to quality control criticisms.

^[19] The PCAOB has promoted this concept in other areas. See Concept Release, Potential Approach to Revisions to PCAOB Quality Control Standards, PCAOB Release No. 2019-003 (Dec. 17, 2019) (available at https://pcaob-assets.azureedge.net/pcaob-dev/docs/default-source/rulemaking/docket046/2019-003-quality-control-concept-release.pdf?sfvrsn=5856398d_0) (“Potential requirements for firms to identify, assess, and respond to quality risks would prompt firms to take proactive measures to address such risks before they adversely affect the quality of the firm’s engagements. Risk assessment, in combination with monitoring and remediation activities. . . could also serve as a feedback loop to drive continual improvement in QC systems.”).

^[20] See The Road to Reform, A White Paper From The Public Oversight Board On Legislation to Create a New Private Sector Regulatory Structure for the Accounting Profession (Mar. 19, 2002), at 986 (“Because it is not a transparent system (details of peer reviews are not made public) and is limited in scope (audits subject to investigation or litigation are not looked at as part of a peer review), peer review has come under considerable criticism from Members of Congress, the media, and others. ‘You scratch my back, I will scratch yours’ is the prevailing cynical opinion of peer review raised by many.”).