Would Auditing Improve If the PCAOB Brought More Enforcement Actions?

By Dan Goelzer and Tom Riesenberg

In a report entitled How an Agency You Never Heard of is Leaving the Economy at Risk, the Project on Government Oversight, Inc. (POGO), a nonprofit with the stated mission of investigating and exposing waste, corruption, and abuse of power, contends that the Public Company Accounting Oversight Board is “doing a feeble job.” Essentially, POGO’s charge is that the Board hasn’t brought enough enforcement actions against Big Four accounting firms based on the audit deficiencies described in the public portion of its inspection reports. According to POGO, since inspections began in 2003, the PCAOB has identified 808 deficient Big Four audits, but only brought 18 enforcement actions against the four firms and their audit personnel and collected just $6.5 million in penalties. POGO characterizes the PCAOB’s enforcement record as “feckless” and points out that, at least in theory, the Big Four auditing lapses cited in PCAOB inspection reports, if charged as violations of the auditing standards and settled or successfully litigated, could have resulted in monetary penalties in excess of $1 billion.

POGO’s report provides some interesting information, but its conclusion — that the PCAOB “is leaving the economy at risk” — is off-base. The statistics in the report sound dramatic, but in reality they say little about whether the PCAOB is fulfilling its congressional mandate.

The PCAOB’s mission is to strengthen and maintain investor confidence in audited financial statements by improving audit quality. Under the Sarbanes-Oxley Act, the PCAOB’s core function is to conduct inspections of accounting firms that audit public companies. The inspection program is risk-based. That is, it selects for review audit engagements that the PCAOB staff views as the most challenging and, within that subset, looks at certain elements of each audit. If its inspectors conclude, based on a review of the audit work papers and interviews with the engagement team, that a material aspect of an audit opinion isn’t supported by appropriate evidence, they inform the firm and describe the deficiency in general terms in the public portion — Part I — of the report issued at the end of each inspection.

Part I of an inspection report is not the end of the story. In Part II, the PCAOB describes weaknesses in the firm’s quality controls — the underlying systemic problems that presumably result in audit engagement deficiencies. By statute, these quality control criticisms are not public unless the firm fails to remedy them to the PCAOB’s satisfaction within one year of the issuance of the inspection report. While the PCAOB has generally found that firms have satisfactorily remediated, each of the Big Four firms has “failed” remediation at least once and suffered the embarrassment of the public release of aspects of its Part II criticisms. Congress’s objective in designing this inspection/remediation framework was to create an incentive for firms to improve the quality of their public company auditing.

Theoretically, a Part I deficiency reflects a violation of the auditing standards and could serve as the basis for a PCAOB enforcement case in which a monetary penalty could be sought. Practically, it would not be feasible to pursue most inspection deficiencies as enforcement matters. And, even if it were feasible, doing so would likely be counterproductive.

There are several reasons this is so and why POGO’s criticisms are not persuasive:

• The auditing standards are not a cookbook of precise directions on how to audit. Businesses vary widely in their structure, accounting issues, and control systems, and applying the standards in an audit necessarily requires considerable judgment. The PCAOB inspection staff’s after-the-fact independent review of how the engagement team made the tough calls adds discipline to the process of auditing that did not exist before the PCAOB was created. But it does not follow that, every time the inspectors conclude that there was a deficiency, a judge could be persuaded to hold that the auditing standards had been violated. If the PCAOB only included a deficiency in Part I when it was in a position to follow-up with an enforcement action, there would be fewer Part I deficiencies. The result would be less incentive for the profession to improve.
• Inspections aren’t conducted as investigations. The inspection staff — which consists of experienced auditors, not lawyers — doesn’t seek to compile the kind of record to support the deficiencies it identifies that would be necessary at a trial. If inspections typically led to enforcement proceedings, the agency would bog down in difficult and expensive litigation. Even when the firm is inclined to settle a regulatory matter, individual auditors usually are not. Their reputations and careers are at stake. As a result, they are likely to tie up the PCAOB staff in litigation that typically can go on for several years — an expensive and time-consuming use of the Board’s resources.
• Today, even if a firm privately believes that an inspection finding merely reflects a difference in professional judgment between its team and the inspectors, the best course for the firm to follow typically is to accept the finding and take steps to change its procedures and train its staff to avoid a similar finding in subsequent inspections. In effect, Part I findings are a tool the PCAOB uses to improve auditing practice without having to amend the auditing standards. But, if monetary penalties were the consequence of most Part I findings, firms would likely conclude in many cases that the best course was to challenge the inspection report on all but the most egregious deficiencies. Turning the inspection program into a high-stakes adversary process would dilute its impact on improvements in audit quality.

POGO also implies that, because the PCAOB has not collected substantial fines from the Big Four, the firms have not sought to improve their auditing. We believe the evidence is to the contrary.

• After some initial post-SOX hesitation, the major firms now all have significant staff and resources devoted to addressing PCAOB inspection deficiencies and to identifying and addressing the root causes. It would be hard to argue that these firms do not take the PCAOB’s inspections seriously. One need look no further than the criminal prosecution of senior KPMG personnel as a result of their illicit efforts to obtain confidential information about upcoming PCAOB inspections in order to improve their firm’s inspection results.
• The PCAOB’s inspection program has also incentivized individual auditors to perform their work in accordance with PCAOB standards and expectations. A critical PCAOB inspection is likely to affect compensation and can have other negative career ramifications, even including in some instances termination of employment. Indeed, a recent academic study of the inspection process found that auditors “collectively perceive that PCAOB inspectors are remarkably powerful, representing the ‘prosecution,’ ‘judge,’ and ‘jury’ of the auditing profession.” The study’s authors stated that “our data imply that the contemporary work practices of auditors are centrally motivated by passing an inspection.: See Westermann, Cohen, and Trompeter, “PCAOB Inspections: Public Accounting Firms on ‘Trial’”, Contemporary Accounting Research, Vol. 36 №2 (Summer 2019) (discussed in The Audit Blog (July 24, 2019)).
• Most importantly, there is evidence that audit quality has improved under the PCAOB’s inspection regime. The United States has seen fewer of the kinds of dramatic public company financial reporting failures, such as Enron and WorldCom, that were almost daily headlines in the years leading up to the PCAOB’s creation. In fact, in a report issued last month, research firm Audit Analytics found that public company restatements are at an 18 year low. A restatement occurs when a company withdraws or corrects previously issued audited financial statements because they contain an error. Not all restatements reflect audit failures and not all audit failures lead to restatements. Still, the historic decline in restatements since the PCAOB started work is evidence that investors can have more confidence in audited financial reporting than they could before the PCAOB opened its doors.

Despite progress, we do not mean to suggest there is no room for improvement in auditing. Major audit failures still occur. The PCAOB’s inspectors continue to find deficiencies in Big Four auditing, and the deficiency rate (i.e., the percentage of inspected audits that result in Part I deficiencies) seems to have plateaued rather than to continue declining, as PCAOB board members have noted. The Board has suggested that it intends to place more emphasis in inspections on firm systems of quality control in the future. Depending on how that is done, it may well drive further improvements. Quite possibly, the Board should also rethink the circumstances in which it brings enforcement actions and the relationship between its inspection and enforcement programs. But comparing the number of inspection findings to the dollars of penalties collected from the Big Four firms provides little insight into how well the PCAOB is doing its job.