The Work of the PCAOB: Why Should Public Companies Care?

It's great to be back in Milwaukee.

My experience in public accounting was gained a few blocks up Wisconsin Avenue from where we are this afternoon. During 1969 and 1970, I worked in Milwaukee as an auditor at the CPA firm known then as Touche, Ross, Bailey & Smart and today as Deloitte & Touche. If I had known that I would eventually be involved in regulating the auditing profession, I certainly would have paid more attention to what I was doing back in those days!

I. Rebuilding Public Confidence

Last Saturday, October 25th, marked the first anniversary of the Securities and Exchange Commission's appointment of the founding members of the Public Company Accounting Oversight Board. The creation of the Board was one of the key reforms Congress enacted in the Sarbanes-Oxley Act of 2002. The Act signaled the end of voluntary self-regulation of the auditing profession and the beginning of formal, compulsory oversight.

I would like to talk to you today about the impact of the PCAOB, not on accountants, but on their clients -- public companies. At the most basic level, the Board's mission is not to register and inspect accounting firms, to set auditing standards, or to run a disciplinary program for accountants who fail to live up to their professional obligations -- although we will be doing all of those things. Rather, our basic job is to instill confidence in auditing and public company financial reporting.

That is something that should matter to all of us -- as accountants, lawyers, or company officials, and as individual investors and citizens. Obviously, the companies that raise capital from the public and that trade in the securities markets have a special stake in restoring trust and confidence in financial reporting and auditing. Without the investing public's confidence, our securities markets -- the envy of the world and the engine of our national prosperity -- would cease to operate. For that reason, the Board's work will be critical, not just to auditors, but also to the public companies they serve.

II. The PCAOB and its Work

Let me begin with a brief review of what the Board is and what our duties are. Since we have only been around for a year, the Board's role may still be hazy to many of you. Before I try to clarify matters, I should note that the views I express are my own, and not necessarily those of the Board's other members or staff.

A. What is the Board?

Congress created the PCAOB in the wake of Enron, WorldCom, Tyco, and a series of other financial reporting scandals that rocked the securities markets and shook public confidence during the last several years. The Sarbanes-Oxley Act says that the Board's mission is to oversee the audits of public companies, to protect the interests of investors, and to further the public interest in the preparation of informative, accurate, and independent audit reports.

These things are, of course, also the mission of the Securities and Exchange Commission, and the Board operates under SEC oversight. However, the Board is not part of the government, and the members of our staff are not government employees. The Board is a private, not-for-profit corporation.

A year ago, at the time of the initial Board members' appointments, we had no staff and no offices -- no resources at all. Today, we have a staff of about 120 -- 90 permanent and 30 temporary employees. We have offices in Washington and New York, with additional field locations soon to open. Ironically, our headquarters is in commercial space that formerly housed the Washington offices of Arthur Andersen -- the accounting firm whose demise was a major factor in the Board's birth.

B. What are the Board's Responsibilities?

Under the Sarbanes-Oxley Act, the Board has four primary responsibilities --

• registering accounting firms,
• inspecting registered firms,
• conducting investigations and disciplinary proceedings, and
• establishing auditing standards.

I want to briefly describe each of these tasks.

1. Registration of Public Accounting Firms.

First, all accounting firms that prepare audit reports on U.S. public companies must register with the Board. Registration is the basis for all of the Board's other authority -- such as requiring compliance with Board auditing standards and conducting inspections.

For U.S. firms, the registration deadline was last week. Foreign firms that audit U.S. public companies will also have to register, although they will have until next summer to do so. As of Wednesday, the Board had granted 617 registration applications -- out of roughly 730 domestic firms that audited at least one public company last year. About 100 applications are still pending. A list of registered firms is on the Board's Web site at www.pcaobus.org.

2. Inspections.

Second, auditors of public companies will be subject to Board inspections.

Once a firm is registered, the Act requires the Board to inspect it. In the case of firms that audit more than 100 public companies, the Act requires annual inspections. There are eight such firms. For other accounting firms, inspections must take place at least once every three years.

We have already launched our inspection program. Each of the Big Four firms will be inspected this year. The focus of these first-year inspections will be on things that might be summarized as "professionalism" -- the factors that make auditing a learned profession, rather than merely a trade.

These professionalism factors include such things as:

• "Tone at the Top." Organizations tend to adopt the culture of their leadership. We will seek to determine what kind of philosophy concerning professionalism and commitment to the public interest prevails at the highest levels of the firms.
• Partner Evaluation, Compensation, and Promotion. Another litmus test of an organization's values is what it rewards. We would like to find out what role technical excellence as an auditor plays in promotion and partner compensation decisions. How does that role compare to things like a talent for generating new business?
• Client Acceptance and Retention. We will also explore how firms decide to accept new audit clients and whether to retain existing clients. The Board will seek to learn how the major firms assess the riskiness of their clients, and how they balance audit and reputational risk against potential revenue.

Our inspectors will also look at the way firms performed some selected audit engagements. But, much of our focus this first year will be on firm culture, rather than on audit mechanics.

3. Professional Discipline.

Third, the Board will administer a disciplinary regime.

I hope that most of the Board's work will be remedial -- aimed at helping firms raise their standards and at strengthening their quality controls. However, we also have the authority to impose fines and expel individuals and firms from public company auditing. When serious violations of the law or professional standards are uncovered, the Board will act. Board Chairman William McDonough put it this way in a speech last month to the New York State Society of CPAs:

I expect that you, as members of a regulated profession, know what the rules are. I expect that you are following those rules, both in their letter and their spirit. * * * If you depart from those expectations * * * woe be unto you. There will be consequences, and they will be grave. ^[1]

4. Auditing Standards.

Finally, the Board must establish the auditing and other professional standards that govern public company audits. Before Sarbanes-Oxley, that task was the province of the accounting profession itself, acting primarily through the Auditing Standards Board of the American Institute of Certified Public Accountants. Now the Board has this responsibility.

The Board has announced that it will appoint an advisory group to assist it in standard-setting. The advisory group will be comprised of approximately 25 members, including practicing auditors, financial statement preparers, and investors. I believe that the combination of the Board's top notch professional staff, headed by nationally-known experts Doug Carmichael and Tom Ray, of a sophisticated advisory group, and of an open and transparent process will ensure public confidence in the Board's standards.

III. The Impact of the PCAOB on Public Companies

For those of you who work at public companies or who counsel public companies, the activities of the Board may not seem very relevant to your day-to-day problems. The Sarbanes-Oxley Act, and the SEC and stock exchange rules that it spawned, created a myriad of new issues for public companies. It has probably been a relief not to have had to also focus on the Board's pronouncements.

That may change. The PCAOB will have a significant impact, not just on auditors, but also on their public company clients. I want to suggest five ways in which the Board's work will have an important effect on public companies.

1. Accounting Support Fee.

The first, and least important impact on public companies, is that they will be footing the bill for the Board's work. Accounting firms must pay registration and annual reporting fees to cover the costs of processing their filings with the Board. However, Congress provided that our primary funding source will be fees assessed against public companies in proportion to their market capitalization.

The Board's 2003 budget is approximately $68 million. On August 4, we began sending the 2003 public company bills -- about 8,500 of them in all. The four companies with the largest market capitalization will pay fees of more than $1 million, with the largest bill being about $1.3 million. However, about half of the PCAOB bills are for less than $1,000, and about 1,000 are for the minimum amount of $100.

I mentioned earlier the direct stake that public companies have in the restoration of public confidence in financial reporting and auditing. As a result of the statutory funding scheme, public companies will also have a financial stake in how the Board goes about that mission. If we do our job effectively, you should view the fees that support us as money well spent.

2. Inspections and Enforcement.

Second, while the Board's disciplinary authority extends only to accountants, our inspections and investigations will also affect public companies. Obviously, in order to determine whether the auditor did his or her job properly, it will generally be necessary to review the audit client's records and to talk to its personnel. In practice, therefore, our investigations may often look at both the public company's financial reporting and at its auditor's work.

Congress anticipated this. The Sarbanes-Oxley Act provides that the SEC can issue subpoenas to public companies and their employees to compel them to cooperate with Board inquiries. At the end of a Board investigation, we will take any necessary action against the accountants. We will turn our findings regarding the company's financial reporting over to the SEC.

3. Non-Audit Services.

Third, the Board's work may influence the types of non-audit or consulting services that public companies can obtain from their auditors.

In the 1990s, revenues from consulting, such as systems design, tax planning, assistance with data processing, and a host of other advisory services, became increasingly important to the major firms. In many cases, clients were paying their auditors far more for non-audit services than for the financial statement audit. Burgeoning non-audit revenues raised questions about auditor independence and auditor willingness to risk losing consulting business by standing up to the client on audit issues.

The Sarbanes-Oxley Act sought to reverse this trend. Congress believed that auditors needed to get back to auditing. The Act prohibits accountants from providing nine categories of non-audit services for public company audit clients. Services that are not on the prohibited list may still be performed, but only if approved in advance by the client's audit committee and publicly disclosed.

The Board has authority to add to the list of prohibited non-audit services. While I have no reason to think we will be doing that in the short-term, all five members of the Board place great emphasis on both the fact and appearance of auditor independence. To help us understand whether we should take further action in that area, the Board's inspection staff is focusing this year on the impact of non-audit services, along with the other elements of professionalism I mentioned earlier. In the future, we may also look at how audit committees make decisions regarding non-audit services.

In my view, audit committee restraint in approving non-audit services, especially the acquisition of aggressive tax products, would be a better answer than Board rules. However, we will certainly act to further restrict non-audit services if we must.

4. Auditing Standards.

The fourth aspect of the Board's work that will affect public companies standard-setting. For those who are not practicing auditors, the topic of auditing standards may seem to be primarily of interest as a possible cure for insomnia. However, auditing standards can have real dollars-and-cents importance for public companies. The Board's recent proposal on the auditor's review of internal control is a good example.

As most of you are probably well-aware, Section 404 of the Sarbanes-Oxley Act requires management to issue annually a report on the effectiveness of the company's internal control over financial reporting. The outside auditor must, in turn, issue its own report on management's conclusions.

While auditors have always reviewed internal control as part of their work, in the past the auditor's objective has been to determine the extent to which he or she could rely on controls in conducting the audit. In the future, the auditor's review must be broader, since it must result in a public opinion about the controls. And, if the auditor concludes that there is a material weakness in the controls, the auditor must describe the weakness and issue an adverse opinion.

Section 404 directs the Board to adopt a standard telling the auditor how it should conduct this review. Our proposed standard was issued on October 7 and is open for public comment until November 21.^[2] It addresses a wide range of issues that will affect public companies. For example:

• The proposal requires the auditor to reach an opinion on the effectiveness of the company's internal controls, not simply on management's report. The Board believes that the audit work involved would be the same under either approach. We also believe that the potential for public confusion would be too great if the auditor seemed to be ducking responsibility for determining whether the controls are effective.
• The proposal permits the auditor in some circumstances to rely on control testing performed by the company's internal audit or other staff. It does not, however, permit that work to substitute completely for the auditor's own tests. The proposal gives weight to the role that an independent and adequately-funded internal audit function can play. At the same time, the independent auditor's Section 404 opinion would be meaningless if he or she could simply take management's word for the testing results. The proposal strikes a balance between these two considerations.
• The proposal recognizes that internal control is not a one-size-fits-all proposition. We recognize that the auditor's judgment about the effectiveness of internal control can and should take into account the size of the company and the complexity of its operations. Smaller companies do not have to devote the same resources to controls as their larger counter-parts.

I would urge you to read the Board's proposal -- all 110 pages of it -- and to submit a comment letter if you think it can be improved. Some of the things in the proposed standard will undoubtedly be controversial because they will involve costs, both in the form of management time and effort and in the form of audit fees. However, in reviewing the proposal, I would also urge you to consider both costs and benefits.

The Board release accompanying the proposal lays out some of the tangible benefits of evaluating internal control. The most fundamental benefit of effective internal control is that it provides a reasonable basis for reliance on the company's financial reporting. Many of the most dramatic financial reporting scandals of the past few years can be characterized as break-downs in internal control. In my view, it would be a mistake to focus only on the costs of evaluating controls and to lose sight of the importance of effective controls in restoring public confidence in financial reporting.

5. Corporate Governance.

A fifth area in which the Board will impact public companies is corporate governance practices. Quite clearly, one of the themes of the Sarbanes-Oxley Act is the strengthened role of the audit committee. The PCAOB, in turn, has responsibility to oversee the auditor's work, including the auditor's relationship and communications with the audit committee. As a result, it is inevitable that our standards and our inspections will affect what audit committees do.

The Board's proposed standard on the audit of internal control is again a good example. The proposal states that an ineffective audit committee is a significant internal control deficiency and a strong indicator of a material weakness. Therefore, in order for the auditor to form an opinion on the company's internal control over financial reporting, the auditor must determine whether the audit committee is effectively discharging its responsibility to oversee the company's external financial reporting and internal controls. The proposal lists seven specific factors that the auditor should consider in assessing audit committee effectiveness, including whether audit committee members act independently from management.

Legitimate questions can be raised about whether auditors should be expected to evaluate objectively the committee that has the power to retain or discharge the auditor. However, the major auditing firms deal with hundreds of audit committees. They have an ability few others share to compare and contrast performance and to develop expertise concerning best practices.

I think the proposal illustrates that independent auditors will increasingly be seen, not only as experts on the application of accounting principles, but also as sources of independent advice and judgment on corporate governance practices. And the Board, because of its responsibility for the standards that govern the auditor, will play a major role in that process.

IV. Conclusion

I want to conclude with the point that I began with. The Board's basic job is to instill confidence in auditing and financial reporting. Public companies and those who advise them have a big stake in our success. The corporate collapses, audit failures, and litany of restatements that marked the last several years have bred deep cynicism and public anger. It is critical to the long-term health of our capital markets that that phenomenon be reversed.

I believe that the Board's aggressive implementation of the blueprint Congress laid out in the Sarbanes-Oxley Act will go a long way toward accomplishing that goal. Ultimately, however, restoring public confidence is something that we must all do together.

---

^[1] William J. McDonough, Speech before the Foundation for Accounting Education, New York State Society of Certified Public Accountants (New York City, September 9, 2003).

^[2] See Proposed Auditing Standard -- An Audit of Internal Control Over Financial Reporting Performed in Conjunction With an Audit of Financial Statements, PCAOB Release No. 2003-017 (October 7, 2002).