The PCAOB One Year Later

A little over a year ago -- on January 6, 2003 -- eight intrepid souls, including four newly-appointed Board members -- reported for the first workday at the Public Company Accounting Oversight Board.

On that first day, the Board was very much a start-up venture. With only eight people on-board, there were plenty of wide open spaces on the two floors we had just leased. The phones weren’t yet connected. The post office hadn’t found us -- as demonstrated by the fact that a test letter one of us sent to the Board was never delivered. Ironically, our new offices in Washington, D.C. were in the commercial space previously occupied by Arthur Andersen -- whose highly publicized demise was a catalyst for the Board’s creation.

A lot has happened in the past year. We now have about 140 employees and are well on our way to filling those two floors, which have been rebuilt and furnished to meet the Board’s needs. In addition to Washington, we have opened offices in New York, Atlanta and Dallas, with a San Francisco office in the works. More importantly, we have taken a series of key steps that lay the foundation for the Board’s statutory mission of restoring investor confidence in audited financial reports.

This seems like a good time to take stock of what the Board has accomplished so far and to offer a glimpse of what it will be doing during the second year of its life. I believe that, as the Board moves into full operation, it will have a significant impact, not just on accountants, but also on public companies and investors. Before I explain why, I should note that the views I express are my own, and not necessarily those of the Board’s other members or staff.

I. Rebuilding Public Confidence

Let me begin with a brief review of what the Board is and what its duties are. Since we have only been around for a year, our role may still be hazy to some of you.

The Sarbanes-Oxley Act says that the Board’s mission is to oversee the audits of public companies, to protect the interests of investors, and to further the public interest in the preparation of informative, accurate, and independent audit reports. The creation of the Board was one of the key reforms Congress enacted in the wake of Enron, WorldCom, Tyco, and a series of other financial reporting scandals that rocked the securities markets and shook public confidence during the last several years. The birth of the Board signaled the end of voluntary self-regulation of the auditing profession and the beginning of compulsory, independent oversight.

Protecting the interests of investors is, of course, also the mission of the Securities and Exchange Commission, and the Board operates under SEC oversight. However, the Board is a private, not-for-profit corporation, and not part of the government. While the SEC must approve the Board’s rules before they can take effect, our job is to make our own, independent decisions.

II. What has the Board Accomplished?

What has the Board done during the past year to accomplish that goal? In addition to hiring staff and creating a functioning organization, the Board’s time and effort were devoted chiefly to three major tasks -- registering accounting firms, launching an inspection program, and establishing auditing standards. I want to touch on what the Board has accomplished in each area.

A. Registration of Public Accounting Firms.

Since October 22, 2003, it has been illegal for any U.S.-based accounting firm to issue an audit report with respect to an SEC-reporting company unless the firm is registered with the Board. Registration is important because it is the basis for the Board’s authority over the profession -- such as requiring compliance with Board auditing standards and conducting inspections.

Nearly 750 firms have registered with the Board. Four of those firms -- the so-called Big Four -- some call them the Final Four -- audit over 78 percent of all public companies and nearly 99 percent of public company sales revenue. There are an additional four firms that have at least 100 audit clients that are SEC registrants. That leaves roughly 740 registered firms that have fewer than 100 SEC clients. The great majority of those have fewer than 10 public company clients, and 149 have none at all.

Registration is not automatic. Each registration application was carefully scrutinized, and those with such things in their background as failed AICPA peer reviews, disciplinary proceedings against firm principals, or unusually high ratios of SEC clients to CPAs employed at the firm were individually considered and discussed by the Board.

A list of registered firms is on the Board’s Web site at www.pcaobus.org. In addition to the registration process, firms will eventually be subject to annual reporting requirements. Therefore, Board filings are potentially a fascinating new source of public information concerning the auditors of America’s public companies.

B. 2003 Limited Procedure Inspections.

Once a firm is registered, it is subject to Board inspection. In the case of the eight firms that audit more than 100 public companies, these inspections must be annual. For the other 591 registered firms that have at least one SEC client, inspections will take place at least once every three years. Conducting these inspections will be the most resource-intensive Board activity. Once we are fully staffed, roughly half of the Board’s personnel will be engaged in inspections.

Although the regular inspection cycle will begin this year, we launched our inspection program in 2003 with “limited procedure” inspections of the Big Four firms. The focus of these first-year inspections was on both how the largest firms conducted selected audit engagements and on what I call their “professionalism” -- including the “tone at the top” that management seeks to infuse into the organization, how partners are compensated and promoted, how the firm internally inspects its own practice, and similar matters.

Two points regarding PCAOB inspections may be of particular interest to public companies and their advisors.

First, as part of reviewing selected audit engagements during inspections, the Board will look at how the auditors made tough calls on the application of accounting principles in client financial statements. The results so far have been somewhat startling. In several instances, our inspectors discovered possible violations of GAAP in client financials. In a few of these cases, restatements may be necessary. Companies should recognize that the Board, as part of its inspections of auditors, will necessarily also be looking at financial reporting. And, because of their access to audit work papers, our reviewers are likely to be able to focus on GAAP issues in greater depth than can SEC routine reviews of registration statements and Form 10-K filings.

Second, in light of the enhanced role that Sarbanes-Oxley carves out for audit committees, Board inspections will examine the relationship between the auditor and the audit committee. In fact, as part of the review of specific engagements that was a component of the 2003 limited inspection program, the inspection teams interviewed audit committee chairs. The objective of these interviews, usually conducted by telephone, was to assess the quality of the accounting firm’s relationship and communications with the audit committee. The Board can’t compel an audit committee member to speak with the inspection staff, but none of the 50 or so audit committee chairs contacted refused. In fact, many expressed support for the Board and its work.

C. Auditing Standards.

In addition to registering and inspecting audit firms, Congress charged the Board with establishing the auditing and other professional standards that govern public company audits. Before Sarbanes-Oxley, that task was the province of the accounting profession itself, acting primarily through the Auditing Standards Board of the American Institute of Certified Public Accountants. Now the Board has this responsibility.

During the past year, we have taken some important steps in the area of standard setting.

First, we adopted interim auditing standards. In effect, the Board adopted generally accepted auditing standards as they existed on April 18, 2003 as standards of the Board. At the same time, the Board announced that it would review all of the interim standards and would determine, standard by standard, whether they should be modified, repealed, or made permanent. This will, of course, be a long-term project.

Second, the Board adopted a new standard that will require the auditor’s opinion to refer to the Board’s authority. Instead of the familiar statement in the opinion that the audit was conducted in accordance with generally accepted auditing standards, future audit opinions will say that the review was conducted in accordance with the standards of the PCAOB. This rule, which is PCAOB Auditing Standard No. 1, is now awaiting SEC approval.

Third, the Board proposed a standard governing audit documentation. Under that proposal, work papers must contain enough information so that an experienced auditor, having no previous connection with the engagement, can understand the work performed, who performed it and when, and the basis for the conclusions reached. The proposal would also create a presumption that procedures that are not documented were not performed.

Finally, and most importantly for public companies, we have proposed a standard governing the auditor’s review of internal control over financial reporting. That proposal deserves a bit more discussion.

As most of you are probably well-aware, Section 404 of the Sarbanes-Oxley Act, and the SEC rules implementing it, require management to issue annually a report on the effectiveness of the company’s internal control over financial reporting. The company’s outside auditor must, in turn, report on management’s conclusions. If there is a material weakness in the controls, neither management nor the auditor can issue a clean report. Section 404 also directs the Board to adopt a standard telling the auditor how it should conduct this review. Our proposal -- all 134 pages of it -- was issued on October 7, and is available on the Board’s Web site.

Public internal control reporting will mark a sea-change in the auditor’s responsibilities. The Board has received nearly 200 comments on the proposal, and I want to briefly mention some of the features that attracted the most comment:

• Some commenters objected to the fact that the proposal requires the auditor to express an opinion on the effectiveness of the company’s internal controls, not simply on the accuracy of management’s report. The reason the proposal was framed that way is that the Board believed that the audit work involved would be the same under either approach. We also believed that the potential for public confusion would be too great if the auditor seemed to be ducking responsibility for expressing a conclusion on control effectiveness.
• Another debated issue was the ability of the auditor to use the work of the company’s internal audit staff in forming conclusions about the controls. The proposal permits the auditor in some circumstances to rely on control testing performed by the company personnel, particularly internal auditors that are adequately-funded and independent of management. It does not, however, permit reliance on the work of others to substitute completely for the auditor’s own tests, since the independent auditor’s opinion would be meaningless if he or she could simply take management’s word for the testing results. The proposal tries to strike a balance in a way that will encourage strong and independent internal audit functions.
• Many comments focused on the walk-through requirement. Under the proposal, the auditor must perform “walk-throughs” of the major types of company transactions in order to obtain a sound understanding of the control system. In a walk-through, the auditor traces representative transactions from initiation and initial recording in the books to ultimate inclusion in the financials. Since walk-throughs are intended to promote the auditor’s understanding of how the controls work, they are one area in which the auditor cannot rely on internal audit.
• Finally, the topic that seemed to attract the most heated comment related to audit committees. The proposal states that an ineffective audit committee is a significant internal control deficiency and a strong indicator of a material weakness. The proposal lists specific factors that the auditor should consider in assessing audit committee effectiveness, including whether audit committee members act independently from management.

Legitimate questions can be raised about whether auditors should be expected to objectively assess the effectiveness of the committee that has the power to retain or discharge the auditor. However, it seemed to the Board that the key role that audit committees play in the integrity of controls could not be ignored. Further, this is an area where auditors should have a lot to contribute. The major auditing firms deal with hundreds of audit committees. As a result, they have an ability few others share to compare and contrast performance and to develop expertise concerning best practices.

The internal control review standard is one of the most critical and far-reaching auditing standards the Board will ever adopt. We are carefully studying the comments and, within the next few weeks, the Board will hold a public meeting to adopt a final standard -- which must then go to the SEC for approval.

III. Challenges Facing the Board in 2004

While a lot was accomplished in 2003, there is much more to do in order for the Board to fulfill the objectives Congress has laid out. A complete catalog of the Board’s agenda for the current year would run well into the afternoon session of this program. I would like to touch on just four of the areas that will be critical to the Board during 2004.

A. Cross-Border Auditing.

One problem we will have to solve in 2004 is developing workable ways of overseeing an auditing profession that is multi-national in scope.

The Board’s responsibilities are not limited to U.S.-based companies and auditors. Congress charged the Board with oversight of all auditors, wherever they are located, that audit or participate in the audit of SEC-registered companies. One need only look at the news headlines regarding companies like Parmalat, Ahold, and Lernout & Hauspie to appreciate the importance to U.S. investors and financial institutions of reliable financial reporting and audit reports on non-U.S. companies.

This presents the Board with a number of thorny legal and practical problems. To solve them, we intend to cooperate with non-U.S. accounting regulators in a way that respects their authority, but that also permits the Board to discharge its inspection and enforcement responsibilities in the case of auditors outside the U.S. Last year, the Board proposed rules under which it would rely on the work of foreign regulators based on a “sliding scale” that takes into account the similarities and differences between the foreign regulator and the Board. During 2004, the Board will have to address the issues raised in the comments on that proposal and begin the process of registering non-U.S. auditors.

Many U.S. public companies are indirectly affected by another aspect of Congress’s efforts to address internationalization. Section 106 of the Sarbanes-Oxley Act expressly requires a U.S. auditor that relies on the work of an off-shore auditor to make the foreign work papers available to the SEC and the Board in the event that questions arise regarding the audit activities conducted abroad. Because of this, the major accounting U.S. firms are asking their multi-national clients to provide waivers of any foreign laws that could prevent the non-U.S. auditor from producing its work papers to the Board or Commission. These auditor requests have required many companies to come up with procedures for obtaining appropriate consents from their foreign subsidiaries.

B. 2004 Inspection Program.

A second major challenge that will occupy the Board’s time and attention during 2004 will be scaling up the inspection program.

Having just completed the 2003 limited inspections, the Board’s staff must start the process over and perform full inspections of the four largest firms. In addition, we will inspect an additional 150 or so firms. Those firms vary widely in their size and sophistication -- and in the size and sophistication of their SEC clients. This will truly be a Herculean task -- even for the 90 or so highly experienced auditors that we hope to have on the inspection staff this year.

In 2004, the Board will also issue inspection reports on the 2003 Big Four inspections. Even though these inspections were limited in scope, there is likely to be considerable interest in Board inspection reports. Avid readers are likely to include other regulators with responsibilities for the inspected firm; audit committees that make decisions regarding its hiring and retention; and the investing public that relies on its audit reports. Reports will have to explain the results of inspections in a way that is informative to these audiences, but also in a way that is consistent with the Congressional prohibition against Board disclosure of criticisms of an inspected firm’s quality controls, unless the firm fails to correct those deficiencies within 12 months. Drafting the first set of reports -- and setting the precedent for future years -- will be one of the Board’s most important tasks in 2004.

C. Standard Setting.

The third 2004 challenge is to build a program for setting auditing standards that will have the confidence of issuers, investors, and the accounting profession, but will also be flexible and nimble enough to respond rapidly to emerging issues.

The key to this goal will be the Board’s Standing Advisory Group -- or the SAG. The Board announced last year that it would appoint an advisory group to assist it in standard setting. The SAG will be comprised of approximately 30 members, including practicing auditors, financial statement preparers, and investors. The Board received over 170 SAG nominations, including many prominent and highly experienced people. We hope to announce the group’s membership and convene its first meeting within the next month or so.

The SAG will have its work cut out for it. As I mentioned earlier, the Board has already announced that it will review all existing auditing standards. Further, the Board’s staff is looking at some specific topics that may deserve early consideration. One priority might be the auditing standards that apply to matters which have been fertile ground for SEC enforcement actions and restatements. The auditing of revenue recognition policies and of reserves and contingencies are possible examples. Similarly, in light of the importance Sarbanes-Oxley places on the audit committee’s role, it would make sense to take a fresh look at the standards that govern the auditor’s communications with the audit committee.

As the comments on the internal control standard underscore, the setting of auditing standards is important -- not just to auditors -- but also to the public companies that are the subject of audits and that pay the bills. Issuers will certainly be represented on the SAG. In addition, I hope that public companies will continue to be as active in participating in our standard setting process through comments as they have been with respect to Section 404.

D. Enforcement.

The final 2004 challenge that I would like to mention is the need to establish an investigation and enforcement program.

I believe that many of the auditing problems the Board identifies will be dealt with through a combination of inspection reports and standard setting. However, inevitably, situations will arise in which those tools are inadequate. There will be cases in which there are serious violations of Board standards or the securities laws by auditors under our jurisdiction. In those cases, the Board will not hesitate to act through its power to conduct investigations and to seek disciplinary sanctions, which can include fines, and suspensions and bars from auditing public companies.

While the Board’s disciplinary authority extends only to accountants, our inspections and investigations will also affect public companies. Obviously, in order to determine whether the auditor did his or her job properly, it will often be necessary to review the audit client’s records and possibly to talk to its personnel. In practice, therefore, our investigations may often look at both the public company’s financial reporting and its auditor’s work.

Congress anticipated this. The Sarbanes-Oxley Act provides that the SEC can issue subpoenas to public companies and their employees to compel them to cooperate with Board inquiries. At the end of a Board investigation, we will take any necessary action against the accountants. We will turn our findings regarding the company’s financial reporting over to the SEC.

IV. Conclusion

The year 2003 was a busy one for the PCAOB. However, to paraphrase Winston Churchill, we are only at the end of the beginning. Much remains to be done, and 2004 holds some formidable challenges.

As I noted earlier, the Board’s basic job is to re-instill confidence in public company financial reporting. The corporate collapses, audit failures, and restatements that marked the last several years have bred deep cynicism and public anger. It is critical to the long-term health of our capital markets that that phenomenon be reversed. While that is a big job, it is also an opportunity. I hope that each of you, as lawyers, as accountants, as company officials, or as investors will feel a personal stake in the Board’s success and take an interest in our work.