The PCAOB and Public Companies

I. Introduction

Commentators occasionally suggest that the Public Company Accounting Oversight Board is mis-named. Some urge that the word “accounting” should be dropped from the Board’s name -- since the Board has jurisdiction over auditing, not over accounting principles. Others argue that the words “public company” don’t really belong, since the Board doesn’t oversee public companies. I have even heard it suggested that our largest impact will be on auditing standards, and that the word “standards” should be added in place of “public company accounting”.

“SOB” would certainly be a catchier acronym than PCAOB. However, I think that criticisms of the Board’s name are fundamentally misplaced. The Board’s basic mission is to instill confidence in audited public company financial reports and in the accounting judgments on which those reports are based. Registering and inspecting accounting firms and setting auditing standards are the tools the Board will use to accomplish that end. The Board’s work will be critical, not just to auditors, but also to the public companies they serve.

With that thought in mind, I would like to talk with you today about the impact of the PCAOB on public companies. Of course, the views I express are my own, and not necessarily those of the Board’s other members or staff. But, there is likely to be little disagreement that the Board’s work will be of great interest and importance to public companies.

II. What are the Board’s Responsibilities?

Before I explain why that is the case, I want to briefly review what the Board is and what its duties are. Since we have only been around for about a year, the Board’s role may still be hazy to some of you.

Congress created the PCAOB in the wake of Enron, WorldCom, Tyco, and a series of other financial reporting scandals that rocked the securities markets and shook investor confidence. The birth of the Board signaled the end of voluntary self-regulation of the auditing profession and the beginning of compulsory, independent oversight.

The Sarbanes-Oxley Act charges the Board with overseeing the audits of public companies, protecting the interests of investors, and furthering the public interest in the preparation of informative, accurate, and independent audit reports. These things are, of course, also the mission of the Securities and Exchange Commission, and the Board operates under SEC oversight. However, the Board is not part of the government, and the members and staff are not government employees. The Board is a private, not-for-profit corporation.

Under the Sarbanes-Oxley Act, the Board has four primary responsibilities -- registering accounting firms, inspecting registered firms, establishing auditing standards, and conducting investigations and disciplinary proceedings. I want to briefly describe how we are going about each of these tasks.

A. Registering Accounting Firms

Since October 22, 2003, it has been illegal for any U.S.-based accounting firm to issue an audit report with respect to an SEC-reporting company unless the firm is registered with the Board. Registration is the basis for the Board’s authority over the profession -- such as requiring compliance with Board auditing standards and conducting inspections.

About 760 firms have registered. Four of those firms -- the so-called Big Four -- some call them the Final Four -- audit over 78 percent of all public companies and nearly 99 percent of public company sales revenue. There are an additional four firms that have at least 100 SEC issuer audit clients. That leaves roughly 750 registered firms that have fewer than 100 SEC clients. The great majority of those have fewer than 10 public company clients, and 149 have none at all. A list of registered firms is on the Board’s Web site at www.pcaobus.org.

Registration is not automatic. Each application is carefully scrutinized, and those with such things in their background as failed AICPA peer reviews, disciplinary proceedings against firm principals, or unusually high ratios of SEC clients to CPAs employed at the firm are individually considered and discussed by the Board.

In their registration applications, firms were required to list their associated accountants; identify public company clients; describe criminal, civil, and administrative proceedings against the firm; outline their quality control procedures; summarize disagreements with clients; and provide other basic information. Non-confidential parts of the applications will be made public. In addition, registered firms will be subject to periodic reporting to update the data. Board filings are potentially a fascinating new source of public information concerning the auditors of America’s public companies.

B. Inspecting Accounting Firms

Once a firm is registered, the Board will periodically inspect it. In the case of the eight firms that audit more than 100 public companies, inspections must be annual. For the other 600 or so registered firms that have at least one SEC client, inspections will take place at least once every three years. Conducting these inspections will be the most resource-intensive Board activity. When we are fully staffed, roughly 150 people -- that is, about half of the Board’s personnel -- will be engaged in inspections.

Although the regular inspection cycle will begin this year, we launched the program in 2003 with “limited procedure” inspections of the Big Four firms. The focus of these inspections was on how the largest firms conducted selected audit engagements and on what I call their “professionalism” -- including the “tone at the top” that management seeks to infuse into the organization, how and why partners are compensated and promoted, and how the firm internally inspects its own practice.

Within the next few months, the Board will report on the 2003 Big Four inspections. This will be one of the Board’s most challenging tasks in 2004. We want to explain the results of inspections in a way that is informative to the public. At the same time, the Board must follow the Congressional prohibition against disclosure of criticisms of an inspected firm’s quality controls, unless the firm fails to correct those deficiencies within 12 months.

There is likely to be considerable interest in the results of Board inspections. For example, some have suggested that the audit committees that must make decisions regarding the hiring or retention of an inspected firm will want to discuss the Board’s findings with the firm as part of the committee’s due diligence.

C. Setting Auditing Standards

In addition to registering and inspecting audit firms, Congress charged the Board with establishing the auditing and other professional standards that govern public company audits. Before Sarbanes-Oxley, that task was the province of the accounting profession itself, acting primarily through the Auditing Standards Board of the American Institute of Certified Public Accountants. Now the Board has this responsibility.

Within the next few weeks, the Board plans to announce the appointment of an advisory group to assist it in standard setting. This group will be comprised of approximately 30 members, including practicing auditors, senior public company officials responsible for financial reporting, and institutional investors. While the advisory group will be at center stage in most future Board standard setting, the Board has already taken some important steps in that area.

First, we have adopted interim auditing standards. In effect, the Board adopted generally accepted auditing standards as they existed on April 16, 2003 as standards of the Board. At the same time, the Board announced that it would review all of the interim standards and would determine, standard by standard, whether each should be modified, repealed, or made permanent. This will, of course, be a long-term project.

Second, the Board adopted a new standard that will require the auditor’s opinion to refer to the Board’s authority. Instead of the familiar statement in the opinion that the audit was conducted in accordance with generally accepted auditing standards, future audit opinions will say that the review was conducted in accordance with the standards of the PCAOB. This rule, which is PCAOB Auditing Standard No. 1, is now awaiting SEC approval.

In addition, the Board proposed a standard governing audit documentation. Under that proposal, work papers must contain enough information so that an experienced auditor, having no previous connection with the engagement, can understand the work performed, who performed it and when, and the basis for the conclusions reached. The proposal would also create a presumption that procedures that are not documented were not performed.

Finally, we have proposed a standard governing the auditor’s review of internal control over financial reporting. Internal control review is, of course, the topic of this conference, and I will say a bit more about the proposal in a moment.

D. Conducting Investigations and Disciplinary Proceedings

The fourth major Board responsibility is enforcement. Congress armed the Board with investigatory and disciplinary powers over audit firms and their accountants.

I believe that many of the auditing problems the Board identifies will be dealt with through a combination of inspection reports and standard setting. However, inevitably, situations will arise in which those tools are inadequate. When we suspect serious violations of Board standards or the securities laws by auditors under our jurisdiction, the Board will not hesitate to use its power to conduct investigations. Where appropriate, we will impose sanctions, including monetary fines and suspensions and bars from auditing public companies.

While the Board’s disciplinary authority extends only to accountants, our investigations will also affect public companies. Obviously, in order to determine whether the auditor did his or her job properly, it will often be necessary to review the audit client’s records and possibly to talk to its personnel. In practice, therefore, investigations may often look at both an auditor’s work and at a public company’s financial reporting.

III. The Impact of the PCAOB on Public Companies

As this brief overview of the Board’s responsibilities illustrates, the past year has been a busy one and 2004 is likely to be busier still. However, for those of you who work at public companies or who counsel public companies, the activities of the Board may not seem directly relevant to your day-to-day problems. The Sarbanes-Oxley Act, and the SEC rules it spawned, created a myriad of new issues for public companies. You may have had little reason to also focus on the Board’s pronouncements.

That may change. I want to suggest some ways in which the Board’s work will have an important effect on public companies.

A. Cross-Border Auditing

First, many U.S. public companies have already been affected by what might be called the internationalization of auditing.

The Board’s responsibilities are not limited to U.S.-based auditors. Congress charged the Board with oversight of all auditors, wherever they are located, that audit or participate in the audit of SEC-registered companies. One need only look at the news headlines regarding companies like Parmalat, Ahold, and Lernout & Hauspie to appreciate the importance to U.S. investors and financial institutions of reliable financial reporting and audit reports on non-U.S. companies.

This presents a number of thorny legal and practical problems. For example, Section 106 of the Sarbanes-Oxley Act expressly requires a U.S. auditor that relies on the work of an off-shore auditor to make the foreign work papers available to the SEC and the Board in the event that questions arise regarding the audit activities conducted abroad. Because of this, the major accounting U.S. firms are asking their multi-national clients to provide waivers of any foreign laws that could prevent the non-U.S. auditor from producing its work papers to the Board or Commission.

These auditor requests have required many companies to come up with procedures for obtaining appropriate consents from their foreign subsidiaries. While this is sometimes a difficult and time-consuming process, companies should understand that it is largely a consequence of the fact that auditing, like the business activities of many U.S. public companies, do not stop at the water’s edge.

B. 2004 Inspection Program

Second, the Board’s audit firm inspection program will be of interest to public companies and their advisors.

As part of reviewing selected audit engagements during inspections, the Board will look at how the auditors made tough calls on the application of accounting principles in client financial statements. Because of their access to audit work papers, our reviewers are likely to be able to focus on GAAP issues in greater depth than can SEC routine filing reviews. It would not be surprising if we occasionally uncover GAAP violations, including even some that may require restatements, in public company financials.

In addition, Board inspections will examine the relationship between the auditor and the audit committee. In 2003, the inspection teams interviewed about 50 audit committee chairs to assess the accounting firm’s relationship and communications with the committee. These interviews, usually conducted by telephone, have focused on such matters as the frequency and nature of discussion between the auditor and the audit committee; the audit committee’s expectations and evaluation of the auditor; and auditor communications regarding critical accounting judgments, including revenue recognition policies. The Board can’t compel a director to speak with the inspection staff, but none of the audit committee chairs contacted in 2003 refused, and many expressed support for the Board’s work.

C. Standard Setting

A third area in which Board decisions will directly affect public companies is auditing standards. For those of you who are not practicing auditors, the topic of auditing standards may seem to be primarily of interest as a possible cure for insomnia. However, auditing standards can have real significance for public companies.

The topic of this conference -- internal control reporting under Section 404 of the Sarbanes-Oxley Act -- is a prime example. The issuance of auditor opinions on internal control effectiveness will mark a sea-change in the scope and nature of the auditor’s responsibilities. A recent Financial Executive Institute survey suggests that the auditors’ internal control review will increase audit fees on average 38 percent. Whatever the magnitude of the increase, this new responsibility will add some cost and complexity to the audit.

At the same time, there will be real benefits to the focus on controls that Section 404 requires. Congress believed that effective internal control provides the foundation for credible public company reporting. In the long run, I think that effective controls are likely to do more to promote the reliability of financial statements and to bolster public confidence than some of the other Sarbanes-Oxley innovations, such as certification requirements, civil forfeitures, and draconian criminal penalties. For that reason, the internal control review standard is one of the most critical and far-reaching auditing standards the Board will ever adopt.

The Board has received nearly 200 comments -- many from issuers -- on its proposed Section 404 standard. I want to briefly mention some of the features that attracted the most comment:

• Some commenters objected to the fact that the proposal requires the auditor to express an opinion on the effectiveness of the company’s internal controls, not simply on the accuracy of management’s report. The reason the proposal was framed that way is that the Board believed that the audit work involved would be the same under either approach. We also believed that the potential for public confusion would be too great if the auditor seemed to be ducking responsibility for expressing a conclusion on control effectiveness.
• Another debated issue was the ability of the auditor to use the work of the company’s internal audit staff in forming conclusions about the controls. The proposal permits the auditor in some circumstances to rely on control testing performed by the company personnel, particularly internal auditors that are adequately-funded and independent of management. It does not, however, permit reliance on the work of others to substitute completely for the auditor’s own tests, since the independent auditor’s opinion would be meaningless if he or she could simply take management’s word for the testing results. The proposal tries to strike a balance in a way that will encourage strong and independent internal audit functions.
• Many comments focused on the walk-through requirement. In a walk-through, the auditor traces representative transactions from initiation and initial recording in the books to ultimate inclusion in the financials. Under the proposal, the auditor must perform “walk-throughs” of the major types of company transactions in order to obtain a first-hand understanding of the control system.
• The topic that seemed to attract the most heated comment relates to audit committees. The proposal states that an ineffective audit committee is a significant internal control deficiency and a strong indicator of a material weakness. Legitimate questions can be raised about whether auditors should be expected to objectively assess the effectiveness of the committee that has the power to retain or discharge the auditor. However, it seemed to the Board that the key role that audit committees play in the integrity of controls could not be ignored. Further, this is an area where auditors should have a lot to contribute. The major auditing firms deal with hundreds of audit committees, and have a unique ability to compare and contrast performance and to develop expertise concerning best practices.

We are carefully studying the comments. The Board announced yesterday that it will hold a public meeting on March 9 to adopt a final standard. That standard must then go to the SEC for approval.

D. The Role of the Audit Committee

As the internal control comments illustrate, the Board will also impact public companies by becoming a new factor in the debate concerning the role of the audit committee. The Board does not aspire to regulate corporate boards and their committees. Nonetheless, the Board is likely to influence the field in several ways.

• I have already mentioned that our inspection program looks at auditor-audit committee communications. A corollary to that work is the Board’s authority over the auditing standards that govern the auditor’s relationship with the committee. We are already considering revising and sharpening the auditing standards that relate to the information that the auditor must communicate to the audit committee, especially in light of the expanded audit committee responsibilities resulting from Sarbanes-Oxley.
• Over time, the Board’s work will significantly influence how audit committees look at auditor independence issues and the types of non-audit or consulting services that committees are prepared to authorize. The Board has authority over the independence standards, including the ability to add to the Sarbanes-Oxley Act’s list of prohibited non-audit services. All five members of the Board place great emphasis on both the fact and appearance of auditor independence. A comprehensive review of independence standards is likely to be on the Board’s agenda eventually. The Board may also be pressed to start giving interpretive guidance under existing independence standards.
• Perhaps most importantly, the Board may become a clearinghouse for information regarding audit committee best practices. Our inspection work will give us access to a wealth of specific, factual data regarding how auditors and audit committees interact. If we make that information available to the public, through published reports and conferences at which directors can share their knowledge, I believe the Board could make a real contribution to the evolution of audit committee practices.

IV. Conclusion

As I said earlier, the Board’s basic job is to instill confidence in auditing and financial reporting. I believe that public companies and those who advise them have a big stake in our success. Without the investing public’s confidence, our securities markets -- the envy of the world and the engine of our national prosperity -- would cease to operate. For that reason, the Board’s work will be critical, not just to auditors, but also to the public companies that those markets serve.

Unfortunately, the corporate collapses, audit failures, and litany of restatements that marked the last several years have bred deep cynicism and public anger. It is critical to the long-term health of our capital markets that that phenomenon be reversed. While that is a big job, it is also a rare opportunity to make a difference. I hope that each of you, as lawyers, as accountants, as company officials, or as investors will feel a personal stake in the Board’s success and take an interest in our work.