Maintaining Investor Trust: Independent Oversight in the System of Quality Control

“You can’t really know where you are going until you know where you have been.”

Thank you, John [Parsons], for the kind introduction.

It is a pleasure to have an opportunity to speak to a group of professionals dedicated to protecting the well-being of our teachers, firefighters, policemen, and other local and state workers. It’s also a pleasure to be in Massachusetts, albeit virtually. The Commonwealth of Massachusetts is one of significant achievement, including the first subway in the U.S., the first college in North America, and, perhaps most important for me, the fig newton cookie. I look forward to a time when I can be back in Massachusetts in person.

Before I go on, I want to note that the views I share today are my own and do not necessarily reflect the views of the Public Company Accounting Oversight Board (“PCAOB”), my fellow Board members, or the staff of the PCAOB.

I want to talk today about the vital importance of quality control.

We rely on quality control in all aspects of our daily lives. We get on a plane with little or no apprehension because of the quality control system operating behind the scenes that helps ensure safety. Dynamic and robust systems protect the quality of our cars, our food, our clothing. When the COVID-19 vaccine arrives, and I hope it’s soon, quality control will hopefully make certain that each dose is safe and effective.

Properly done, quality control allows us to simply trust that the expected results will occur. Our markets, economy, and society rely on trust to function efficiently and effectively.

The same principles apply to financial reporting. Trust in the accuracy of financial statements is essential to investors of public companies. Some of that trust is due to the annual audit by independent accounting firms.

Trust in audits, like medicine, food or transportation, depends upon a robust system of quality control. The requirements for the audit firms’ system of quality control are set out in PCAOB’s standards. These standards, however, are out-of-date. They were written decades ago, with little, if any, input from investors. They do not reflect changes in the business and audit environment or the financial failures and crises that have occurred since the PCAOB opened its doors in 2003.

Our current standards were, in other words, written in, and for, another time.

Efforts to revise these quality control (“QC”) standards are underway. The International Auditing and Assurance Standards Board (“IAASB”) is meeting this week to consider adopting changes to its QC standards; while the PCAOB has sought comments in a Concept Release about possible revisions to its QC standards, including whether any future U.S. effort should be based on the IAASB’s standards.

We have learned from comments by investors and others that aspects of the QC approach proposed by the IAASB raise concerns. In particular, investors indicated that such an approach may not adequately address the importance of independent oversight for audit quality and I want to talk about this issue.

Independent oversight takes into account the possible conflict between the commercial interests of an audit firm and audit quality. This is only one aspect of any system of quality control, nonetheless an important one.

Investors through the comment process provided strong views on this issue and, as a result, they deserve careful consideration. The failure to do so would risk repeating history. During the period of self-regulation by the audit profession, investor input was largely absent from the standard-writing process. This failure resulted in a lack of investor trust, causing harm to the capital markets, to investors and to companies. Congress altered that dynamic with the creation of the PCAOB. The PCAOB was given an explicit mission of acting in the interests of investors and the public.

As we consider what to do with respect to QC standards, we are in mid-flight in the process. The debate is ongoing. Whether we issue any proposal to revise our QC standards remains to be seen. To the extent that we do, the need for, and the role of, independent oversight over a firm’s QC system is something that will be determined only after a fulsome debate that is only just beginning. As we continue to consider the matter, I am interested in hearing comments and views from all stakeholders on the issue and encourage everyone here to participate in the discussion.

So today, I’d like to talk about quality control and what we have learned so far from investors and others, particularly about their views on the importance of independent oversight in a QC standard.

First, I’d like to discuss the importance of revising the standards governing an audit firm’s system of quality control.

Second, I’d like to discuss the comment letters we received on our Concept Release, particularly the views on independent oversight.

Finally, I’d like to talk about possible future steps by the PCAOB and the role everyone listening to this talk can play.

I. The Outdated Standards Governing Quality Control

The largest firms audit hundreds of public companies each year. Investors, and the public, benefit from these audits. To make sure that audits deliver the expected quality, firms are required to have in place a system of controls that seek to ensure the engagements are properly conducted.

The standards governing quality control are in serious need of revision. They were written in the era of self-regulation when the audit profession held the drafting pen and investors and the public had little input into the process. The PCAOB, when it opened its doors in 2003, adopted these same standards on an “interim” basis. While some auditing standards have since been amended or updated, those governing the system of quality control largely have not.

The IAASB and the PCAOB are, fortunately, taking steps to consider whether and how to revise their respective quality control standards. The IAASB’s approach includes as a goal the continuous improvement in audits through the implementation of a feedback loop. Under this approach, firms would be required to put in place a system to identify risks that could compromise audit quality.

Once identified, the QC system would need to be adjusted to prevent the risk from recurring or, better still, from occurring in the first place. By repeating the process, a QC system would constantly evolve and the quality of audits would continually improve. The PCAOB’s Concept Release asks whether the PCAOB should use a similar approach with respect to any future PCAOB QC standard.

Whatever the promise of this approach, investors through the comment process raised a number of significant concerns. Investors indicated that the approaches under consideration would be improved by greater accountability, including increased transparency and metrics designed to measure quality, an omission of which one commenter labeled “inconceivable.” Investors also asked for mandatory outreach by audit firms to investors as part of the feedback loop, heightened accountability through a certification requirement, and a broader objective against which to measure the success or failure of the system.

II. The PCAOB Concept Release

These are all issues that should be given serious consideration. In my remarks today, though, I want to focus on another concern raised by investors, the importance of independent oversight for any system of quality control. Investors expressed strong support for the inclusion of independent oversight in any potential revision of our QC standards.

The issue of independent oversight arises, as the letters indicated, from the potential conflict between the commercial nature of firms and audit quality. Partners at firms are compensated based on the profits generated by the firms. Audit quality, in turn, is a cost that can conflict with commercial interests, at least in the short term. A potential risk exists, therefore, that commercial interests may sometimes improperly override audit quality.

How might this occur? Given the competing nature of these interests, investors identified some possibilities. Firms might under-invest in audit quality, leaving the area without adequate resources. Firms may be less willing to dismiss a lucrative client notwithstanding concerns over quality. Those responsible for audit quality may be less willing to make difficult or unpopular decisions out of concerns over the impact on their professional standing within the firm.

Independent oversight is used throughout the capital markets to address similar conflicts of interest. Listed companies address the potential conflict between the interests of management and shareholders through the use of independent directors. The major stock exchanges in the U.S. use independent oversight to safeguard regulatory responsibilities from undue influence from commercial interests. Independent oversight, as part of the investment company regulatory framework, has been characterized as “fundamental.” Accordingly, mechanisms of independent oversight are well-known by investors.

We specifically asked about the issue in the Concept Release. We sought comments on whether any future PCAOB standard should “incorporate mechanisms of independent oversight over firms’ QC system”. The question struck a nerve.

A. Comments We Received

Investors, investor associations, consumer groups, and the U.S. Government Accountability Office (GAO) all supported requirements of independent oversight as an element of a audit firm’s system of quality control. They agreed that such oversight should be required and made part of the “structure” of such a system. Independent oversight would “greatly enhance the quality of controls standards” and improve accountability. In particular, the Consumer Federation of America told us that independent oversight “has the potential to help counteract economic incentives to under-invest in audit quality or to view retaining customers, rather than protecting investors, as the firm’s top focus.”

The letters included specific suggestions for the largest firms. Investor concerns about a firm being too commercially driven could be mitigated through a system that incorporated independent oversight, such as a mechanism to report directly to independent directors on the firm’s board. A reporting line directly to these directors could result in a board better informed about audit quality issues.

The Council of Institutional Investors (“CII”) endorsed a U.S. Treasury Report recommendation that audit firms’ boards should have “independent members with full voting power.” CII further explained that the benefits of independent oversight exceed the “costs of imposing such a change at the largest audit firms.”

At the same time, commenters recognized that independent oversight could be made scalable. As the letter from the Consumer Federation of America stated:

Much as an independent board committee is required to oversee the public company audit, an independent board committee of the audit firm should have responsibility for overseeing the firm’s quality control system. For smaller firms that do not have independent boards or advisory committees, responsibility for maintaining a robust QC system should reside with top firm leadership.

B. Possible Concerns

The views of audit firms and their associations were more mixed. Most commenters from audit firms or their associations recognized the value and importance of independence. Indeed many firms have incorporated some form of independence and external participation into their governance structures through in a variety of ways. No firm commenter, with one possible exception, however, supported making this a requirement for a firm’s system of quality control in a future PCAOB standard.

Their hesitancy seemed to be mostly about application. Firms expressed concern over scalability, particularly the impact of any such requirement on smaller firms. They also noted the need for flexibility. A consistent theme was that a single model for independent oversight had not emerged and therefore should not be required. Instead, there should be room to allow for evolution and to consider alternative models.

To the extent that the structure would include oversight by independent directors, a number of issues would need to be addressed. Questions were raised about the ability of small firms to find qualified candidates, with suggestions that any independent oversight “should not be mandated except perhaps for the largest firms.” Some commenters favored increased disclosure about “the composition and activities of the firm’s governance structure… ” All of these concerns are important and deserve serious consideration.

In addition to concerns over scalability and flexibility, at least two other reasons have been suggested for omitting independent oversight from any future QC standard. Let me briefly discuss these reasons and what I understand so far.

First, the inclusion of an independent oversight requirement in a future PCAOB standard may result in differences in approach between the IAASB and the PCAOB, and therefore, should not be implemented.

The PCAOB’s Concept Release described the IAASB’s approach as a possible “starting point” but indicated a goal of minimizing the differences between the two approaches. The IAASB is considering adopting standards this week that may not include any requirements for independent oversight.

The goal of minimalizing differences as a justification for leaving out independent oversight has a number of flaws. The reasoning does not adequately take into account the differences between the PCAOB and the IAASB in connection with standard setting. While the IAASB’s proposed standard does provide useful input for the Board’s consideration, differences in the two organizations may make one universal standard on quality control difficult to achieve and not necessarily desirable.

For one thing, the IAASB’s standards are intended to be implemented across the globe and, therefore they must, by their nature, be general enough to suit a wide array of stakeholders, including the varied legal and cultural needs in other countries. Many jurisdictions that implement IAASB standards can, and sometimes do, add additional requirements in order to reflect specific local needs. The PCAOB, in contrast, is in a position to include those “local needs” suggested by investors in the comment process directly in any revised QC standard.

Further, the mission of the PCAOB specifically emphasizes the interests of investors, something that reflects both the particular concerns present with respect to the U.S. capital markets and the deficiencies that arose during the period when the auditing profession engaged in self-regulation. The PCAOB’s standard-setting activities therefore must give significant weight to this mission in connection with its oversight of auditors for both issuers and broker-dealers, as well as any other current and emerging issues applicable to the U.S. capital markets.

In fulfilling this mission, the PCAOB has, at least historically, considered the perspectives of an advisory group that consisted entirely of investors and their representatives. One out of every five comment letters received on the PCAOB’s Concept Release came from the investor community.

The views of these commenters on the relationship between the IAASB proposal and the PCAOB’s approach to a future QC standard are instructive. They did not see the IAASB proposal as a limit. One letter characterized the use of the IAASB’s approach as a “starting point” as premature. Others supported coordination, but did not view it as restricting potential incremental additions, such as independent oversight. All of this suggests that the goal of international alignment should not be elevated above the specific concerns and interests of investors and the public.

And let’s be clear. Not all “differences” in standards are the same. Given the global nature of the audit profession, inconsistencies may sometimes present unique challenges with respect to implementation. Adding additional, more detailed requirements, however, do not raise the same concerns. Independent oversight and other matters sought by investors commenting on our Concept Release do not appear to result in inconsistencies with, but for the most part are additions to, the QC approach of the IAASB.

Second, some say that independent oversight as an element of the standard may be unnecessary because of the role of the PCAOB. This is a complement when you think about it. Some may be suggesting that a regulatory body can effectively replace an internal system of independent oversight. Complement though it is, I am concerned that this view misconceives the function of the PCAOB.

PCAOB inspections of audit firms can include a review of the system of quality control for conformity with established standards. Accordingly, these inspections do sometimes identify instances where the system does not meet these standards. The PCAOB cannot do this if a requirement is not in our standards, nor will we be able to enforce what that is not there.

Without a requirement for independent oversight in an audit firm’s system of quality control, the PCAOB has limited ability to ensure that commercial interests are not unduly influencing or negatively impacting audit quality. Granted, the problem may become so severe that it can be identified through deficient engagements. But this will be rare. And the view fundamentally conflicts with the goal that the system of quality control should be designed to ensure that the problems or concerns do not occur in the first instance.

On the other hand, should a requirement of independent oversight be added to any resulting standard, the PCAOB can play an active role in ensuring adequate implementation and enforcement. PCAOB inspections can make sure the element is present and appropriately integrated into the firms’ system of quality control. The PCAOB can also facilitate public accountability through disclosure. As I have said in the past, I believe that we have the authority to include in the public portion of the inspection report a description of a firm’s QC system, something that would presumably include the implementation of independent oversight.

These issues clearly need to be considered, debated and addressed in determining whether independent oversight should or should not be included in a future QC standard. Some of these concerns were at most touched upon lightly in the comment process and would benefit from additional insight. Moreover, there may be ways to address commercial influences. We would benefit from further insight on this topic. I look forward to hearing those views.

III. Conclusion

So where does this leave us?

Quality control is essential for trust. Like consumers of food, medicine, and transportation, those relying on audits expect regulators to require, and audit firms to implement, a rigorous system of quality control. On that, there is, I think, agreement.

The importance of independent oversight is really one piece of that broader debate.

There may be multiple ways to construct a QC system that adequately promotes audit quality without independent oversight. Investors have, however, advanced the view that independent oversight can improve quality, result in greater accountability and increase the confidence placed by investors and the public in the quality of audits. These are important points that warrant serious consideration.

Nonetheless, the debate is far from resolved. I very much look forward to hearing and carefully considering any additional thoughts on this issue. I am particularly interested in views that either support or challenge the positions taken by parties submitting comments on the Concept Release. All of this will help develop a more fulsome record that will be useful in determining whether independent oversight should or should not be a requirement in any standard addressing QC systems.

I encourage everyone here to participate in the debate. Give us your thoughts on independent oversight and anything else you think may help improve our standards on quality control. Your participation is important. The letters we received on the Concept Release were extremely helpful. While sometimes the interests of investors and the public can be discerned, nothing is better than hearing from you directly.

Write to us, email us, or meet with us. I’m happy to arrange a conversation, whether with me, our staff or other Board members.

Should the PCAOB issue a proposed standard in the area, be prepared to give us your feedback. I expect the issue will generate a spirited debate during any notice and comment period over whether an independent oversight requirement should be included in the standard and, if so, how it should be implemented.

If past history is any indication, the differences in commenter views will be significant. The auditing profession has traditionally favored a principles-based approach that uses general language applicable to all firms, irrespective of their differences in size, resources and number of clients. Investors tend to favor an approach that involves a mix of principles and specific requirements.

And remember, your views are essential to the PCAOB. Our mission is to act in the interests of investors and the public. To do this, we need you to tell us what those interests are.

The complete publication, including footnotes, is available here.