Editor: In this issue of The Metropolitan Corporate Counsel, we examine the impact of the Sarbanes-Oxley Act on counsel for the corporation, particularly on in-house counsel. The work of the PCAOB is of intense interest to in-house counsel because the auditors have long been their allies in encouraging corporations to maintain an appropriate internal control environment. First, let me ask you to describe the mission of the PCAOB.
McDonough: While my comments are my own and are not those of the PCAOB, I think I can speak for my fellow Board members when I say that our objective is to help auditors find a new direction that will lead to the restoration of public confidence in auditing and in our markets.
We must have an end to bending rules - and principles - and return to a single-minded emphasis on presenting information fairly. The public needs a basis for confidence that those who invest in the financial markets will be treated fairly by the participants. Auditors are the key to that confidence.
Few of us could have imagined three years ago that we would be where we are today, in a world in which accounting, auditing, and corporate governance would be subject to a strict new regime under the Sarbanes-Oxley Act.
Editor: What conditions brought us to this point?
McDonough: They could be summed up as mass confusion.
We saw confusion about the role of the CEO. We saw the advent of the CEO superstar and an explosion in compensation that made those superstar CEOs actually believe that they were worth more than 400 times the pay of their average workers, an increase in the multiple by 10 times in 20 years - thoroughly unjustified, economically and morally.
We saw confusion about the importance of earnings reports. When the private sector pinned its success to a report and not to actual earnings, the end was in sight.
It became fashionable for public companies to encourage allegedly independent investment analysts to reach a consensus on the company's quarterly and annual earnings, a consensus that was closely guided by the financial management of the company.
Then the market decided that the genius CEO was truly a genius if the company met or beat the estimate by a penny, but was a failure or a fool if the estimate was missed by a penny. Now anybody with a memory knows that there is a business cycle, a product cycle and the law of gravity. However, if quarter after quarter you have to match or beat the last quarter's results to stay in favor, there is an immense incentive to cook the books.
And the books got cooked by company managements, all too often with the collaboration or collusion of bankers, investment bankers, lawyers, and, yes, even accountants, irrespective of the true cost to the nation, not to mention to the participants themselves. It was a sickness, a kind of moral blindness and lack of courage to do what is right, that threatened to strike at the very soul of our national confidence.
The shock wave started with Enron, then rolled through Adelphia, WorldCom, HealthSouth and others. The American people looked at the wreckage of our vaunted private sector, and they got angry.
The people got angry with the CEOs, with the boards, with the accounting profession and even with those of us in the regulatory sector. In a democracy, when people get angry, they will insist on change.
Congress and the President responded, and the result was the Sarbanes-Oxley Act of 2002. You have only to look at the size of the affirmative votes in Congress and the alacrity with which the President signed the bill into law to know that they heard the anger, too.
Editor: How important is the PCAOB in the new regime contemplated by Sarbanes-Oxley?
McDonough: As President Bush said when he signed the bill, "For the first time, the accounting profession will be regulated by an independent board. This board will set clear standards to uphold the integrity of public audits . . .."
Listen to those words. "Uphold the integrity of public audits." They are important words. Instead of thinking of Sarbanes-Oxley as a long checklist of new requirements, it should be thought of as a new source of strength.
The accounting profession is going to have to work on developing and maintaining this strength. Accountability - not just to investors, but to the public at large - is what the accounting profession must be about. Seldom have the stakes been higher for our markets.
Given the depth of the public anger, it surprises me that some participants in the financial system - including auditors and issuers - approach Sarbanes-Oxley as a list of burdensome new requirements whose primary attributes are extra costs and risks. Checking the boxes under the new requirements will in fact incur additional costs and extra risks, but merely checking boxes provides few real benefits.
Nor will "checking the boxes" fix the problems that the Congress and the President intended to address. Indeed, that approach misses the point and, in fact, diminishes the value of the audit. If auditors cannot distinguish for investors financial reporting problems from financial downturns, then the audit function can be written off.
The accounting profession has a chance of a lifetime to bring about significant change. It should accept that challenge, and it should do so knowing that it will not be alone. The PCAOB will be striving to create the new future with it.
Editor: What is the PCAOB and what is its current status?
McDonough: Congress created the PCAOB as a non-profit, non-governmental organization. Our funding is provided by public companies. In addition to our headquarters in Washington, D.C., we have opened offices in New York, Atlanta, Dallas, and San Francisco, and we are preparing to open offices in Southern California and Chicago. The regional offices will primarily support our inspections group, while our standards-setting, registration and enforcement groups will be based in D.C. I should also mention at this point that we are in the midst of a recruiting drive, to find qualified people for each of our offices.
Editor: Tell us about the registration program.
McDonough: Under the Sarbanes-Oxley Act and the Board's rules, it is now unlawful for any accounting firm to audit a publicly traded company without having registered with the PCAOB.
While registration is a prerequisite for accounting firms to continue their work as auditors of public companies, it is also the foundation, established in the Sarbanes-Oxley Act, for the PCAOB to perform its important functions of inspection and enforcement.
Editor: Describe the inspection program and its current status?
McDonough: We began our inspections program in 2003 - even before any firms were registered - by conducting, on a voluntary basis, limited procedures at the Big Four firms with an experienced team of auditors. Our reports on those limited inspections will be public.
At this time, we are conducting the regular inspections required every year for firms with more than 100 audit clients. There are eight firms in the United States that require annual inspections. Other firms will be inspected once every three years. And when the Board thinks circumstances warrant, we can order a special inspection, regardless of timing.
Our inspectors are looking for the compliance required in the Sarbanes-Oxley Act, that is, compliance with the Act, the rules of the Board and the Securities and Exchange Commission and professional standards.
Our inspectors are looking for the "tone at the top" of the firm. Does the managing partner - and the audit team leader - understand what is demanded of the accounting firm in this new era of regulation and oversight? What messages are being communicated by the leadership of the firm to its partners and professional staff? Do these messages show an understanding of the demands of the firm in this new era of regulation? Is it clear that audit quality is the firm's number one priority?
The Board and our inspectors want to know if the message of "doing the right thing" is reaching the rank and file in the firms. Our inspectors talk to the managers, but they also talk to the least experienced members of the audit teams to find out if the message is reaching them. We look at how often and how well the message is delivered.
We also look at compensation and promotion. Are the best auditors rewarded for being the best auditors, or are they rewarded for something else? We also look at how clients are selected and how they are let go.
An important part of our 2004 inspections involves reviewing a significant number of audit engagements.
In connection with those reviews we will focus on efforts to detect fraud, the adequacy of documentation, the evaluation of firm risk assessments,and compliance with professional auditing and accounting standards. We also plan to continue to focus on "tone at the top," compensation practices, and other business practices that were the subject of our limited procedures in 2003.
In those instances where we find potential violations of the Sarbanes-Oxley Act, the securities laws, or the Board's auditing and related professional standards, our enforcement group will conduct investigations by seeking documents and testimony from the firms and auditors involved. In addition, the Sarbanes-Oxley Act gives the Board the authority to seek documents and testimony from third persons, such as audit clients.
While our sanctioning authority extends only to registered firms and auditors, we will make referrals to government agencies, most commonly the SEC, when we find potential violations of law or applicable rules by others. We will also coordinate our investigations with SEC investigations as needed.
Editor: Tell us about the Board's work on auditing standards.
McDonough: The Sarbanes-Oxley Act charged the Board with establishing auditing and related attestation standards; quality control standards; ethics standards, and independence standards.
The Board's first action on standards was to adopt the existing AICPA standards as interim standards, pending review of those standards.
The Board determined not to designate a professional group of accountants to formulate auditing standards for the Board's ultimate approval. Instead, the Board chose to form a staff of expert accountants to develop auditing and related professional practice standards at the Board's direction.
For the first time, the people developing standards will have access to robust empirical and anecdotal evidence from our inspections - evidence that will cut through a cross-section of audits and firms - to set priorities and develop new standards.
Our standards-setting staff hail from a variety of backgrounds, including academia, professional practice and government. The Board is also drawing on the expertise of a standing advisory group. The group is composed of 30 individuals with experience in auditing, financial statement preparation, corporate governance and investing, as well as other relevant fields. The advisory group will help us as we examine the existing, interim standards for possible changes, and they will offer us expert advice as we consider other potential standards, such as those that would guide auditors' communications with audit committees.
When we develop new standards, we intend to engage in a thoughtful and deliberative process. We will also seek the advice and input of our standing advisory group and other ad hoc task forces we establish. We expect to propose our standards for public comment.
When we are ready to adopt a standard, like all our rules, we will submit it to the SEC for approval under the Sarbanes-Oxley Act. We will post both proposed standards and adopted standards, as well as all written comments received on our proposals, on our Web site for all auditors and other interested people to review.
While the Sarbanes-Oxley Act requires auditors to follow our auditing standards only when they are performing public company audits, we hope that - like FASB's accounting standards - they will provide appropriate guidance in other contexts. While some public companies do go private, in many, many more cases private companies go public. In addition, stakeholders other than public investors - such as lenders - have already begun to require auditors to provide audit reports according to our standards.
For these reasons, we hope to develop a set of auditing standards that may be adopted and applied uniformly in a variety of contexts. With this objective in mind, the PCAOB will monitor closely the standards-setting of the International Auditing and Assurance Standards Board and the Government Accounting Office. We recognize the opportunity to serve the public interest by maintaining a constructive dialogue with these and other bodies with standards-setting agendas, such as the ASB, and we intend to do our part to facilitate that dialogue.
Editor: What standards has the Board adopted to date?
McDonough: Following the process that I outlined in my last answer, we have adopted three auditing standards.
Auditing Standard No. 1 requires that audits of publicly traded companies be conducted in compliance with the standards of the PCAOB, replacing the previous reference to generally accepted auditing standards, or GAAS.
Auditing Standard No. 2 deals with auditors' responsibilities to audit a company's internal control over financial reporting. The Sarbanes-Oxley Act required the Board to develop this standard to complement the Act's requirement that company management assess the quality of the company's internal control.
Auditing Standard No. 3 deals with the documentation that auditors are required to retain. This standard is important not just because it is expressly required by the Sarbanes-Oxley Act, but because it is an integral piece of our effort to restore investor confidence in the audit process.Good documentation is a critical component of an effective audit.
Auditors' work papers are also key to accounting firms' quality control over their audit engagements. Investors rely on more than just the words of the audit report, which are standard. They also rely on the name and signature on the report.A firm's reputation for quality auditing is the most important asset it has, and its audit documentation defends that reputation.
Firms and regulators, including our own PCAOB inspectors, test quality control by examining audit work papers to determine whether, in fact, audits are living up to the standard of quality for which the firm's name stands. Inadequate work papers are thus an early warning sign that audits may not be worthy of the firm's name, or investors' reliance. Work papers must be sufficiently specific to enable reviewers to understand the audit work performed, who performed and reviewed the work, and the nature of the audit evidence examined.
Editor: As essential players in assuring an appropriate internal control environment, lawyers for the corporation have a special interest in Auditing Standard No. 2. Could you provide more details about the standard?
McDonough: Before we set out to write the standard, we examined the existing standard for audits of internal control, we held a roundtable discussion, and we examined the requirements set for banks in the Federal Deposit Insurance Corporation Improvement Act of 1991.
We proposed the standard in October 2003, and we received robust feedback - 194 comment letters in all. We took the time necessary to digest these comments carefully because as I said at the beginning, internal controls are simply too important to treat lightly.
That's one reason the Board determined that it was not enough to simply ask auditors to attest to and report on management's assessment of a company's internal controls. The Act clearly required more: that auditors determine for themselves that the internal controls are adequate to support reliable financial statements.
Our standard requires that an auditor perform the audit of the financial statements and the audit of internal control as part of one engagement - not so much as a cost- and time-saving measure but because each audit could have consequences for the other.
The standard requires that auditors should make note of the effectiveness of the corporation's audit committee, including whether the committee is independent of management
On another issue, auditors' ability to rely on the work of others, the Board tried to strike an appropriate balance between the work that an auditor must do himself or herself, and the work performed by management, internal auditors, and others that the auditor may use to support his or her opinion.
This approach should provide a strong incentive for companies to create strong and independent internal audit and compliance departments.