Audit Regulators and Cliff Hangers

Remarks before the Stanford Law School Federalist Society

Thank you, Theodore [Furchtgott].  It is a pleasure to be part of this Federalist Society discussion.  I look forward to hearing from Professor Grundfest and then from the rest of you as we discuss the Public Company Accounting Oversight Board (“PCAOB”).  Before I begin, I must give you the usual disclaimer that the views I express are my own and not necessarily those of the Securities and Exchange Commission or my fellow Commissioners.

Every time I come to California, I recall a visit to Yosemite National Park nearly two decades ago.  It is the most beautiful place I have ever been.  I recently rewatched Free Solo,[1] a fascinating documentary about Alex Honnold, the first climber to free solo Yosemite’s El Capitan—a straight-up, sheer, seemingly toe- and finger-holdless rock face.  I remember sitting at the base and watching some climbers, using ropes and harnesses.  Climbing free solo involves basically nothing except for the climber and the mountain—no ropes, nothing but the climber’s own physical and mental strength.  Because you are on your own with nothing and nobody to help you, as someone in the movie remarked, free soloing requires you to do everything perfectly, otherwise you die.  The film got me thinking about the economy and how different it is from the free solo experience.

The economy is all about working together with other people to enable all of us to survive and prosper.  One person’s weaknesses are offset by another’s strengths.  Each of us has something to contribute to, and each of us draws something from other participants in, the economy.  We are all better off because we are able to rely on one another’s efforts and because others rely on our efforts.  Technology, which facilitates this cooperative process, is essential too in making us more efficient and enabling us to cooperate with people all over the world. 

A video version of I, Pencil, an essay by Leonard Reed, tells this story.[2]  The short video describes—starting in the forests of Northern California—just how many people’s efforts go into the process of making a seemingly simple pencil.  It invites the viewer to dwell on the wonder of such cooperative work, coordinated only by economic forces, not by a central planner.

Whether it is a pencil or a much more technologically complex product, everything we buy and use draws on the work of many people across the world.  Each has her own expertise, talents, and knowledge.  The janitor cleaning the factory, the machine operators making the product, the suppliers supplying the parts, the farmers and miners supplying the raw materials, the utility workers keeping water and electricity flowing to the factory, the chef making lunch in the cafeteria, the truck drivers delivering the product to the retail stores, the salespeople in the retail stores, the executive managing the company, the lawyer advising the company, and the investor funding the company all work together in a common enterprise, even though they may not know one another.  Each of these people plays a role, albeit a small one, that complements the roles others play—no free soloing here.

Although less visible than the construction worker or the grocery store cashier, auditors have a part as well in this story of organic cooperation and collaboration that is our economy.  High-quality financial statements enable the investor to determine whether she should invest her money in a company and on what terms.  The responsibility for financial statements belongs in the first instance to the company.  Independent auditors, however, provide the assurance investors need to rely on those financial statements. 

To take it a step further, audit regulators and accounting and audit standard setters also have a role to play in this great economic cooperative effort.  They establish and enforce the reporting rules for companies and the standards by which auditors carry out their work, and thus make investors more willing to commit their capital to companies.  Because the audit regulator—by facilitating investor reliance on the work of auditors, who, in turn facilitate reliance on financial statements—is an important contributor to a well-functioning economy, how the audit regulator fulfills its job matters a lot.

So let us imagine a third movie, this one about auditors.  A story in which an entity named the PCAOB is central may sound awfully dry, but cast it as a tale of auditors gone wrong and the creation of a strong, independent regulator to set the world right, and we might have film material.  The question I want us to think about today is: How does the PCAOB movie end?  No need for a spoiler alert because the ending has not been written, but what happens in the next several years likely will be determinative.

At the time the movie starts, the PCAOB is just about twenty years old.  As with any bio-pic, this movie focuses on several vignettes from the PCAOB’s life to give you a flavor of the whole.  We will start with the PCAOB’s birth.  The PCAOB was born of scandal.  Most notably, Enron and WorldCom, two major companies, collapsed under the weight of accounting fraud, and took their auditor, Arthur Andersen, down with them.[3]  The precipitous demise of one of the well-respected “Big Five” auditors captured the attention of the nation and Congress.

The Sarbanes-Oxley Act of 2002 was the very bipartisan legislative response to these corporate scandals.[4]  The legislation sought to rehabilitate the auditors who were blamed for not protecting the American public.  The PCAOB, a newly created audit regulator, was a centerpiece of that legislation.  In a nice cinematic twist, the new regulator moved into Arthur Andersen’s former Washington, D.C. office space.[5]  After some initial drama which included the two-week tenure of the Board’s first chairman, the Board began its work.[6]  As one of the first Board Members, Daniel Goelzer, explained a year into the PCAOB’s existence: “At the most basic level, our job is to help the profession regain its capacity to furnish the service that most justifies its existence—the ability to instill public confidence in financial reporting.”[7]

Congress endowed this new regulator with the powers necessary to build confidence in the audit profession so that investors could rely on public company financial statements.  Put succinctly, “the Board may regulate every detail of an accounting firm’s practice . . . .”[8]  Specifically, the PCAOB sets standards for the conduct of audits.[9]  Auditors of public companies (and later auditors of broker-dealers) must register with the PCAOB.[10]  The PCAOB inspects large firms annually and other firms at least once every three years and issues inspection reports.[11]  The PCAOB has investigative and disciplinary authority over registered audit firms and their associated persons.[12]

As any movie protagonist should, the PCAOB defies easy categorization.  Although “modeled on private self-regulatory organizations in the securities industry,”[13] it is not a self-regulatory organization.  Neither, although Congress brought it into existence, is it a typical governmental regulator.  It does not fit easily within an administrative law taxonomy.  Sarbanes-Oxley explicitly denies that the PCAOB is a governmental regulator: “The Board shall not be an agency or establishment of the United States Government . . . No member or person employed by, or agent for, the Board shall be deemed an officer or employee of or agent for the Federal Government by reason of such service.”[14]  Yet, the SEC, after consultation with the Federal Reserve Chairman and the Treasury Secretary, appoints its five board members;[15] approves its budget, accounting support fee, and standards;[16] and otherwise oversees its activities.[17]  To underscore its nongovernmental status, Congress set the PCAOB up as a nonprofit corporation under the laws of the District of Columbia.[18]  Its employees do not enjoy civil service protections, but their pay is much higher than that of the typical government employee.  The Board members, for example, earn approximately $550,000, and the Chairman of the Board earns approximately $670,000.  Congress’s design insulated the PCAOB both from industry and direct political accountability.  In a 2005 article, Professor Donna Nagy detailed how unusual the structure was and argued that the attempt to house governmental functions in a private regulator raises serious concerns about constitutionality, accountability, and transparency.[19]

Five years later, the Supreme Court rendered its assessment of the unusual structure.  The Supreme Court determined that the PCAOB was too far removed from political accountability to be constitutional.  Of particular concern, Sarbanes-Oxley’s charge that the SEC appoint PCAOB members was not paired with the ability to fire them at will.  Instead, the statute permitted only “for cause” removal of board members.  The Court held that this limitation put them too far outside of the President’s control:

This novel structure does not merely add to the Board’s independence, but transforms it.  Neither the President, nor anyone directly responsible to him, nor even an officer whose conduct he may review only for good cause, has full control over the Board.  The President is stripped of the power our precedents have preserved, and his ability to execute the laws—by holding his subordinates accountable for their conduct—is impaired.  That arrangement is contrary to Article II’s vesting of the executive power in the President.[20] 

The high court drama did not result in the audit regulator’s elimination, but its reformation.  The Court remedied the Constitutional flaw by nullifying the offending provision; the Court deemed the Board members removable at will by the SEC.[21]

The “at will” removal proviso made possible last year’s post-election removal of the PCAOB chairman and directive to the three remaining Board members to reapply if they wanted to plead for a chance to finish out their terms.  As my then colleague Commissioner Elad Roisman and I wrote at the time, “A future in which PCAOB members are replaced with every change in administration would run counter to the Sarbanes Oxley Act’s establishment of staggered terms for Board members, inject instability at the PCAOB, and undermine the PCAOB’s important mission by suggesting that it is subject to the vicissitudes of politics.”[22]  The Commission’s move essentially invited the next administration to follow suit.  If the PCAOB’s leadership changes along with the leadership of most other federal regulators when the administration changes, a subsequent Congress may decide simply to fold the PCAOB into the SEC, an option that was on the table when the PCAOB was created[23] and is back on the table now.[24]  

Further foreshadowing a possible SEC-eats-the-PCAOB end to the PCAOB movie is the complexity of the hybrid structure.  The SEC’s responsibility for overseeing the PCAOB’s activities and approving its budget, together with the interrelated nature of the two regulators’ missions, translates into duplicated effort, frequent interventions in PCAOB affairs by the SEC, and jurisdictional tensions.  The PCAOB can discipline auditors and audit firms, but so can the SEC.  Often the SEC handles an enforcement action against a PCAOB-registered auditor because the facts are intertwined with a related enforcement action against the audited public company or because the SEC can obtain more meaningful remedies.  Or, as recently occurred, the SEC brought actions against former PCAOB employees who were alleged to have misused confidential PCAOB information to benefit an audit firm.[25] 

Standard-setting also suffers from duplication.  The PCAOB adopts standards after getting public input, and then the SEC puts them out again for public comment before approving or rejecting those standards.  The SEC establishes auditor independence requirements, but so does the PCAOB.  The bureaucratic duplication does not make for good movie material, but it adds to the questions around the PCAOB’s future.  Some audience members watching this PCAOB drama might be clamoring for an ending that saves some money, cuts some red tape, and makes the PCAOB a division of the SEC.

The PCAOB movie is one of international intrigue.  Sarbanes Oxley grants extraterritorial authority to the PCAOB over foreign public accounting firms that provide certain audit work on U.S. public companies.[26]  The PCAOB has worked with foreign audit regulators to fulfill its statutory mandate and has conducted inspections in more than fifty foreign jurisdictions.  China and Hong Kong are the remaining holdouts.[27]  Despite many attempts, the PCAOB has been unable to reach agreements with these jurisdictions to enable the PCAOB to do its job.  In 2020, concerned about unresolved issues around foreign inspections and investigations, Congress passed the Holding Foreign Companies Accountable Act (HFCAA) to stop US trading of the securities of issuers based in jurisdictions that do not allow the PCAOB to conduct its work.  If the PCAOB continues to be unable to inspect or fully investigate a registered public accounting firm located in a foreign jurisdiction because of a position taken by an authority in that foreign jurisdiction, public companies that have retained that accounting firm to issue an audit report finally will face serious consequences.  This possibility helps to underscore the importance of the PCAOB’s role; if the PCAOB cannot do its job with respect to the audits of certain companies, those companies cannot be allowed to draw on US public capital markets.

Another challenging event in the PCAOB’s life has been its implementation of audit standards under Section 404 of the Sarbanes-Oxley Act.  Section 404(b) requires “each registered public accounting firm that prepares or issues the audit report for the issuer [to] attest to, and report on, the assessment made by management of the issuer” on “the effectiveness of the internal control structure and procedures of the issuer for financial reporting.”[28]  This requirement resulted in now infamous Auditing Standard 2 (“AS2”), adopted by the PCAOB in 2004, which resulted in intensive and expensive internal control audits.[29]  PCAOB’s broad drafting of AS2 was aggravated by its inspection of auditors’ compliance with AS2.  Auditors, scared to employ their judgment and opting instead for long checklists, were demanding from companies reams of documentation around internal controls.  Professor Grundfest was among those at the time calling for a rewrite of AS2.  As he and Steven Bochner wrote, “a cascade downward from the material, through matters that are merely ‘more than inconsequential,’ to matters that do not even reach the threshold of inconsequentiality, all in an overzealous effort to identify controls that might, in fact, be material.”[30]  Grundfest and Bochner further pointed out that, compounding the problem were a number of factors, including auditors’ realization that AS2 work was quite profitable.[31]  They called for an overhaul of AS2, a sentiment shared by then SEC Commissioner Paul Atkins, who suggested that the PCAOB adopt a special unit to deal with overhauling its internal control provisions: “in light of the importance of the AS2 revision project, PCAOB should establish a new office to concentrate on these internal control issues.  I’d suggest calling it the Internal Control Unit, or ICU.  So I guess that would make it — the Peekaboo, I See You.”[32]  The PCAOB did replace AS2 with AS5 in 2007.[33]  Although the replacement standard was better, internal control audits continue to prove costly, particularly for smaller issuers.  Robert Pozen, writing in the Wall Street Journal in 2006, noted another interesting feature of the early internal control work by companies and their auditors—it wandered into matters not related to financial reporting.[34]

A challenge on the immediate horizon for the PCAOB will be to resist the temptation to jump into another area not necessarily linked to financial reporting—environmental, social, and governance (“ESG”) issues.  The PCAOB is facing pressure from several directions.  Drawn by the allure of increasing revenue streams from clients, audit firms are rapidly shifting their focus to ESG assurance.[35]  A 2021 survey of 1400 companies across 22 jurisdictions revealed that 51% of companies engaged in sustainability reporting received assurance on the disclosure and that 63% of such assurance engagements were conducted by audit firms.[36]  In the US, those figures are lower: the Center for Audit Quality found that 266 companies in the S&P 500 received assurance on ESG disclosures, but only 31 of those companies received assurance from audit firms.[37]  Audit firms clearly see ESG as a money-making opportunity, but the PCAOB would be unwise to follow the audit profession down this politically fraught road. 

Individual members of the PCAOB already have expressed interest in overseeing the audit profession’s foray into ESG assurance.  Former Board Member Jay Brown argued that “the role of the auditor in providing assurance for information outside of the financial statements should be modernized” because “[i]nvestors rely on non-GAAP measures, key performance indicators, and environmental, social, and governance (ESG) metrics to make investment and voting decisions” and urged the PCAOB to “lead the discussions on the role, if any, of auditors, in providing assurance on these metrics.”[38]  More recently, when approving the 2022 budget for the agency, two sitting board members highlighted the PCAOB’s efforts on ESG assurance matters.[39] 

The PCAOB’s statutory mandate is to promote informative, accurate, and independent audit reports for public companies.  Its role is important, but limited.  That auditors want to provide assurance on matters outside of the financial statements does not change the PCAOB’s more limited role.  The temptation to be a part of the ESG conversation, which dominates the corridors of power in Washington and on Wall Street these days, is understandable, but misguided.  Taking part in that politically fraught conversation will undermine the ability of the PCAOB to play its role as neutral arbiter of audit quality.

Steps taken by the international community serve as a cautionary tale.  The recent creation of the International Sustainability Standards Board under the same umbrella organization as the International Accounting Standards Board marries non-financial and financial standard setting in a way that is sure to water down the latter by tainting it with the imprecision of the former.[40]  This is a bad marriage, not the stuff of the romcoms for which Chair Gensler has expressed an affinity.[41]  Setting sustainability standards on equal footing with financial reporting standards undermines the accounting standard setter’s current important, investor-centered work.  In the United States, accounting standards are set by the Financial Accounting Standards Board, which recently raised a number of questions about ESG in its agenda consultation.[42]  Though I would have preferred FASB to concentrate on other issues, at least the request for feedback prioritized “[s]uggestions on ESG-related disclosures . . . within the context of financial accounting and reporting and [with] a direct link to specific financial statement line items.”[43]  We should keep accounting standards focused on the financial statements, audit standards focused on audits of the financial statements, and audit regulators focused on improving audit quality.  Were the PCAOB to get into ESG, the movie might be more fun, but the ending would be bad—a politicized PCAOB.

The PCAOB within the last couple months welcomed four new board members, including a new chairperson.  As was the last board, this new board is, as the statute requires, composed of “prominent individuals of integrity and reputation who have a demonstrated commitment to the interests of investors and the public.”[44]  I support this new Board and intend to work with it to ensure that the PCAOB fulfills its statutory mandate of ensuring informative, accurate, and independent audit reports.  It should build on the work of the last Board, which took a number of actions that improved audit quality.  Former SEC Chief Accountant Sagar Teotia, for example, commended the PCAOB’s efforts to “communicat[e] more effectively with investors, preparers, audit committees, auditors, and other key stakeholders in order to improve audit quality,” by, among other things, issuing “certain inspection reports in a new streamlined format to enhance readability and make the results of inspections more accessible and understandable to users.”^[45]  As another example, the PCAOB staff issued numerous “spotlight” documents to share timely observations and insights about inspections, implementation of new requirements, COVID-19, and other matters of interest to auditors, audit committees, and investors.^[46]  The new Board should build on the last board’s focus on the bread-and-butter audit quality issues core to its role as audit regulator, even though these issues may not make for the most exciting movie material. 

I leave you then with a cliff hanger—my hope is that the PCAOB will remember that it is not free-soloing.  Rather, it has a small, but very important, role to play in the broader economy.  It should continue to immerse itself in that role, rather than allowing the Washington political winds to divert its gaze and cause it to fall.  Thank you for your attention.