United States: PCAOB—Beyond The First Year

The Sarbanes-Oxley Act of 2002 implemented far reaching changes in corporate governance and public disclosure for public companies. Equally significant was the infrastructure and direction approved by Congress for the complete overhaul of the regulatory system for accountants and accounting firms who furnish audit and other services to public companies. While a substantial portion of the changes in corporate governance and financial disclosure required by Sarbanes-Oxley have been implemented by the SEC, the NYSE and NASDAQ, the restructuring of the regulation of the accounting industry has only just begun.

Section 101 of Sarbanes-Oxley creates a private nonprofit corporate body for the purposes of overseeing the audits of public companies. The legislative mission of this body is to protect the interests of investors and further the public interest through the preparation of informative, accurate and independent audit reports. On January 6, 2003, the Public Company Accounting Oversight Board (PCAOB) opened its doors, and ushered in a new era of regulation. Prior to Sarbanes-Oxley, accountants had been largely self-regulated, with professional standards and substantive regulations and approaches being determined by various organizations created and controlled by the accounting industry itself.

The PCAOB is a hybrid organization—it is privately funded, it is non-profit, and it is expressly not part of the Federal government, but its members are appointed by the SEC and all PCAOB rulemaking must be approved by the SEC. Once approved, the PCAOB’s rules will have the force of law, and violations of such rules can result in sanctions, fines and deregistration.

PCAOB functions can be categorized as follows:

• Registration and Inspection

• Standards Setting

• Investigations and Enforcement

At a public seminar on May 5, 2004 (PCAOB Seminar), the Board Members and representatives of the PCAOB spoke about the PCAOB’s operations and goals. In this Bulletin, Vedder Price’s Accountants Professional Services Group summarizes the legal roots of the PCAOB, and what the PCAOB has publicly stated about its mission and goals.

When the PCAOB opened its doors on January 6, 2003, it faced the herculean task of building an oversight organization from the ground up, and it had a very short time in which to establish much of its basic regulatory frameworks. By October 22, 2003, the PCAOB had to be able to accept and approve applications for registration by accounting firms performing audits of public companies. Beginning on October 22, 2003, it became illegal for a domestic accounting firm to issue an audit report on a public company’s financial statements unless that firm was registered with the PCAOB. The registration deadline for foreign accounting firms to have filed the application and completed PCAOB review is July 19, 2004.

Through May 20, 2004, 859 accounting firms had registered with the PCAOB. There are eight firms with more than 100 auditing clients; the remaining 851 firms audit fewer than 100 clients, with the vast majority auditing fewer than 10 companies. There are currently almost 200 pending applications for registration, of which 12 are from domestic accounting firms, and the balance are from accounting firms with headquarters outside the United States.

Accounting firms, and all "associated entities", who engage in the practice of public accounting or in the practice of issuing or preparing audit reports or comparable reports for clients that are not issuers, must register with the PCAOB by completing and filing a Form 1. Form 1 is fairly straightforward in the type of information it requests. All filings with the PCAOB are done electronically. The PCAOB must act with respect to a registration application within 45 days after the registration fee is paid. There are three possible actions: approval, issuing a notice of a hearing, or requesting additional information. If the PCAOB requests additional information, the PCAOB must respond to the applicant within an additional 45 days after it receives the supplemental information. Under Sarbanes-Oxley, a written notice of disapproval of a completed application will be treated as a disciplinary sanction, subject to appeal. The PCAOB will report such disapproval to the SEC and to all interested state regulatory authorities, and will publish the notice of disapproval on its website. Any order issued by the PCAOB is subject to review by the SEC.

The purpose of registration is to achieve quality control for accounting firms and associated entities. The PCAOB intends that any individual or entity who participates in the audit process, regardless of location or domicile, be registered. To the extent that an audit firm is authorized to, and does, rely on an associated entity in completing an audit report, the PCAOB seeks assurance that such firm is justified in its reliance and has some influence, if not control, over the quality of the work of such associated entity. Whether such associated entity performs local audits of foreign subsidiaries of the public company or provides the backup testing work underlying the audit, the associated entity falls within the jurisdiction of the PCAOB’s registration system. The associated entity requirement has implications for those accounting firms already registered: the registered firm will not be allowed to rely on the work of such entities unless and until their associated entities are registered with the PCAOB.

In May 2004, the PCAOB for the first time disapproved an auditor’s registration application. Such disapproval resulted from the PCAOB’s investigation into the information contained in the firm’s application, and its conclusion that such application was incomplete and inaccurate. The PCAOB denied such application on four grounds: (a) the firm did not respond "adequately and appropriately" to deficiencies identified by the AICPA in the firm’s work; (b) the firm failed to comply with reasonable requirements and take corrective steps to correct such deficiencies; (c) the firm failed to disclose in its application to register with the PCAOB information concerning disciplinary proceedings commenced by the AICPA based on failures related to the audit deficiencies; and (d) the firm demonstrated a "lack of candor" with the PCAOB. The firm did not seek SEC review of the PCAOB determination within the required time period, and therefore, there was no stay on the PCAOB’s public notice of disapproval.

Section 102(d) of Sarbanes-Oxley requires that registered accounting firms file annual reports, and PCAOB also has adopted as a priority for this year the implementation of such annual report requirement. The annual report will at least require an update of all information included in the registration application: licenses, the individual accountants involved in the audit process; the firm’s auditing clients an fees paid by such auditing clients; disciplinary proceedings; and litigations. It is also fair to expect that the annual report is likely to expand the types and extent of disclosure that the PCAOB will require in the future.

As part of its statutory mandate, the PCAOB will inspect all accounting firms registered with it. Through inspections, the PCAOB will perpetuate quality control. The PCAOB estimates that at least half of its staff is, or will be, involved in inspections. During 2003, the PCAOB conducted limited inspections of the Big Four firms, trying to understand how the firms work from all dimensions of practice. Those accounting firms with more than 100 audit clients (currently eight firms) will be inspected annually; those with less than 100 audit clients will be inspected every three years on a staggered basis. In 2004, the PCAOB commenced its inspection of firms beyond the Big Four.

Registration and inspection of accounting firms are under the aegis of the PCAOB’s Office of Registration and Inspection. The PCAOB’s headquarters is in Washington, D.C., with regional offices in Atlanta, Dallas, New York and San Mateo. The principal function of each Regional Office is to conduct inspections of the firms in its area.

Sarbanes-Oxley does not prescribe the structure for the inspection program, but instead, gives the PCAOB broad discretion to achieve quality control through inspections. The PCAOB has stated that its inspectors will look for compliance by the firm in both horizontal and vertical directions. More specifically, the inspections will seek to determine whether the actions and practices of the accounting firms comply with the full range of substantive standards applicable to all aspects (horizontal) of the firm’s practice:

• accounting profession standards

• auditing standards

• securities laws, including Sarbanes-Oxley

• the firm’s own quality control procedures

Compliance will also be measured at all levels (vertical) of the firm. The PCAOB will be reviewing actions, potential omissions, policies and behavior patterns from the senior partners to the line accountants, and including all associated persons wherever located.

At the PCAOB Seminar, the PCAOB described details of its planned inspection program. The PCAOB will review audit engagements. In 2004, the PCAOB anticipates that it will review about 5% of all audit engagements of the Big Four firms, or approximately 500-600 audit engagements per firm. For the next four firms, the PCAOB will review about 10-15% of each firm’s audit engagements, or approximately 150-200 audit engagements per firm. For the smaller firms, the extent of the PCAOB’s review of audit engagements will be decided on a case-by-case basis, the underlying principles of which are discussed below.

The PCAOB’s inspection program will be risk-based, i.e., the PCAOB will select the audit engagements to be reviewed based on the audit risks posed by such engagement. Risk has two dimensions: which clients are high risk because of previous or potential accounting failures of such clients or of companies in the same industry, and which types of audits present the accounting firm with high risk of failure because of the nature of the business being audited or the scope of work being requested of the accounting firm?

The accounting firm’s quality control system will in turn, be assessed on the basis of the results of the review of the particular audit engagements. This will require the PCAOB to conduct a substantive review of the actual audited financial statements. If the PCAOB finds the financial statements to be deficient under applicable auditing standards, then the PCAOB will scrutinize more intensely the accounting firm’s quality control standards to determine how such "deficient" financial statements could have been issued. By examining a large number of audit engagements for each firm, the PCAOB expects to be able to derive a sense of the audit processes at such firm.

The PCAOB has defined seven focal points for its inspections, any of which could impair the integrity of an audit report prepared by a firm:

Tone at the Top: The PCAOB has repeatedly emphasized the significance of the "Tone at the Top." The PCAOB intends to ascertain the messages, both overt and subliminal, that the senior partners at the accounting firm convey to their subordinates, as to how to conduct the audit, the quality control policies which the accountants must follow, and the interactions with the audit client. The PCAOB will conduct interviews and focus groups at all levels of the firm—senior partner, junior partner, principal, manager, line accountants, non-professional staff—to determine whether the accounting firm maintains a culture of compliance. E-mails, videoconferences and public speeches by representatives of the firm will be examined.

Compensation System; Promotion System: The PCAOB will look at the relationship between performance and rewards at the accounting firm. Are "good" auditors being promoted and financially rewarded? Before the spate of recent accounting scandals, the accounting firms rewarded rainmaking, for both auditing business and consulting business. Now, with the separation of attest and non-attest practices at the accounting firms, are the auditing firms emphasizing thoroughness and quality in their audits? Needless to say, this aspect of the inspection is inextricably tied to the "Tone at the Top" element discussed above. The firm’s internal evaluation forms for its professional staff will also be reviewed to confirm whether the actual evaluation and promotion process is based on the qualities of a good auditor.

Independence and Non-audit services. The firm’s internal policies and procedures on independence will be reviewed in light of Sarbanes-Oxley, the NYSE Listing Standards and the NASDAQ Listing Standards. The PCAOB will look to see if and how the firm’s stated policies are being implemented. Is there a procedure in place for verifying that non-audit services will not jeopardize a firm’s independence? What internal approvals are required before the firm can provide non-audit services? Does the professional staff understand the definition of independence and the distinction between audit services and non-audit services? The PCAOB will review the actual nonaudit services provided by the accounting firm during the period since the last examination to evaluate whether such non-audit services impaired the independence of the firm in connection with any audits conducted during the same period.

Engagement and Retention of Clients: Under the PCAOB’s risk-based approach, the PCAOB will examine the links between the firm’s client intake process and the adequacy of the audits performed for clients. What does the client intake process entail? What information is required to accept a new audit client? Who makes the intake decision? Does the firm regularly review each client, and the risks presented by each client, to make a decision as to whether to retain such client? The PCAOB will look to see whether the firm has compromised its audit procedures in order to attract new business, lower overall audit fees or accommodate the particular needs and circumstances of any client.

Quality Control Process: The accounting firm’s quality control policies and procedures will be examined thoroughly by the PCAOB. Do the firm’s personnel know and understand the policies and know how to implement them? Is the quality control process evident in the audits? The

PCAOB’s inspection will look at remedial measures taken by the firm when it finds a deficiency in its audit process. Another concern of the PCAOB is the process by which the firm selects its own internal audit team. Is being selected to conduct an internal review considered an honor awarded to outstanding auditors, or a task relegated to those professionals without significant client commitments or audit experience? The PCAOB also wants to confirm that the accounting firm’s internal audit team is independent with respect to the offices being examined.

Audit Policies and Procedures: The PCAOB will be conducting its inspections by reviewing particular audit engagements to determine weaknesses in the firm’s policies and procedures. The firm’s process and procedures for concurring partner reviews is another significant factor for PCAOB examination. Work papers and the firm’s document retention policy will also be a focus of the PCAOB inspection. When the PCAOB’s audit document retention standards are finalized and adopted, the PCAOB will examine whether the firm is complying with those document retention standards. How are revisions to the firm’s audit policies and procedures communicated to the professional staff? Is there training available for significant changes in the procedures? One important factor to the PCAOB will be the uniformity of audit policies and procedures throughout all offices of the firm. Where the PCAOB finds a questionable result in an audit report, it will "drill down" into the audit process, interviewing the entire audit team, from partners to principals, to managers and to staff accountants. The PCAOB may decide also to interview the chairman of the client’s audit committee.

Quality of Associated Entities and Foreign Affiliates: With the global economy and the international structure of audit clients, it is inevitable that accounting firms will need to rely on foreign accounting firms and other entities in order to complete certain of their audit reports. The PCAOB will examine the processes by which a firm selects a foreign entity to assist in the audit process, and the quality of such foreign entity. Has such foreign entity registered with the PCAOB because it is substantially involved in the audit of U.S. clients? Are the firm’s quality control procedures communicated to such foreign entity? Does the domestic firm periodically evaluate the quality of the services provided by such foreign entity?

Information that the PCAOB has requested in its inspections has been far-reaching in scope. The information requested has included:

• Independence policies, code of conduct and ethics for partners and staff

• Details of firm governance – structures, committees, committees membership, of vilifications of individuals

• Audit proposals (including all versions of such proposals) during the last year

• Public companies accepted as clients, and public companies rejected as clients during the last year

• Client service model and client teams – reporting responsibilities, division of tasks

• Partner and staff evaluation forms and policies; new partner admissions

• Quality control policies

• Policies for provision of non-audit services

• Income allocation among partners and changes in such allocation from past year

It is not the intention of the PCAOB to conduct the same type of inspection every year. For each firm, the PCAOB will look at the firm’s history, the results of prior inspections and fundamental changes in the firm since the last PCAOB inspection. The PCAOB emphasizes that the inspections will be flexible and will be custom

tailored for each firm. The path of each inspection will not be pre-determined; as the PCAOB encounters new information, it may change the scope and/or direction of its inspection. In addition, either the PCAOB or the SEC can authorize a "special" inspection at any time, depending upon the exigent circumstances. Furthermore, beginning this year, the PCAOB may conduct surprise inspections at any time and as often as it determines to be warranted by the circumstances.

For smaller registered firms, the PCAOB will focus on: audit methodologies; workpaper documentation; consultation; concurrent partner review; independencies quality control; other auditors.

Under Section 104(g) of Sarbanes-Oxley, the PCAOB must prepare a report of its inspection of each registered accounting firm. Though the rules of inspection have not yet been made final by the SEC, the process following the conclusion of an inspection is likely to include the following:

• the preliminary PCAOB inspection report is delivered to the firm, and the firm has an opportunity to review and comment on such report within 30 days;

• the PCAOB report and the firm’s written response to it will be given to the SEC and, if determined by the PCAOB to be necessary, to the applicable state regulatory authorities;

• Sarbanes-Oxley (Section 105(b)(5)(a)) requires that each inspection report be made public; the PCAOB will not, however, publish criticisms of the audit firm’s quality control systems, unless the firm fails to correct any defects cited in a report within 12 months of such report;

• the firm can appeal the report to the SEC, but the SEC’s decision on the appeal of the report is not judicially reviewable.

In order to conduct inspections, the PCAOB must have standards by which it can evaluate the audits. The auditing standards comprise the starting point for insuring quality audits. Until now, auditing standards and accounting principles have been established by the accounting industry itself. Now, the Office of the Chief Auditor of the PCAOB will be responsible for the setting of the "PCAOB Standards".

In order to provide continuity, in April 2003, the PCAOB adopted as its interim auditing standards, the Generally Accepted Auditing Standards, as they existed at that time. One by one, in a priority determined by the PCAOB, these standards will be reviewed by the PCAOB’s Chief Auditor’s Office, and either adopted as final PCAOB Standards or revised in accordance with the knowledge gained by the PCAOB in its inspections. PCAOB has appointed a Standing Advisory Group (SAG) to work with the Chief Auditor’s Office. The SAG is comprised of accountants, attorneys and business professionals. The SAG will assist the Chief Auditor in determining the priorities with which the auditing standards need to be reviewed and, if required, amended. Enforcement actions currently being pursued by the SEC are one element to consider in determining where auditing standards, or at least compliance with auditing standards, are falling short.

The PCAOB does not itself have the statutory authority to adopt final rules. Under Section 107 of Sarbanes-Oxley, the SEC oversees the PCAOB and, accordingly, the SEC must approve each PCAOB Standard before it can become effective. Even though the PCAOB is classified as a private body, the Exchange Act provisions on rulemaking specifically apply to the PCAOB. The process which is complex and timeconsuming, can be summarized as follows:

• the PCAOB holds a public roundtable discussion about a new standard being considered; briefing papers describing the recommendations of the PCAOB staff are posted on the website;

• the PCAOB proposes the standard for public comment (21 days for public comment);

• the PCAOB reviews the comments and modifies its proposal based upon those comments,

• the PCAOB adopts the final rule at an open meeting;

• the PCAOB files the proposed rules with the SEC on Form 19b-4 (the statutory form used by the stock exchanges for filing rule proposals);

• the SEC publishes the final rule in the Federal Register for comment (generally, 35 days for public comment, but the SEC can extend that time period to 90 days);

• the SEC adopts the rules, or sets a hearing to discuss its denial of the rules, but the SEC does not have authority to make changes in the rule proposed by the PCAOB; the SEC’s review is limited to whether the proposed PCAOB standard is consistent with the requirements of Sarbanes-Oxley and the federal securities laws, and is in the public interest;

• the PCAOB Standard becomes effective after it is published as final in the Federal Register.

To date, the PCAOB has issued the following three Auditing Standards:

Auditing Standard #1 requires that all audit reports refer to the PCAOB Standards as governing the audit of the financial statements; this replaces the previous reference to generally accepted auditing standards. Standard #1 was approved by the SEC on May 18, 2004, and became effective on May 24, 2004.

PCAOB Standard #2 addresses internal controls, and requires public companies and the auditors to report separately on internal controls; also addresses independence standards and the approval of non-audit services; Standard #2 is also final; SEC approval is expected in mid-June.

Auditing Standard #3 addresses audit documentation required, and proposes measures to assure that the audit documentation supports the conclusions contained in the audit report; Standard #3 was adopted by the PCAOB on June 9, 2004, and is awaiting SEC approval.

The Office of Investigations & Enforcement at the PCAOB is comprised of both accountants and attorneys. Congress has given the PCAOB a broad range of enforcement powers: fines, sanctions, suspensions and deregistrations.

The PCAOB will determine whether to commence any investigation, based upon a variety of factors including the inspection report, pending enforcement actions involving either the audit firm or the relevant public company, history of the audit firm and the relevant public company, and previous violations. The PCAOB has the power to compel the production of documents and testimony of registered accounting firms and may request documents and testimony of the firms’ audit clients.

Disciplinary proceedings brought by the PCAOB will not be public. The burden of proof at such hearings will be by the preponderance of the evidence. The PCAOB anticipates that the disciplinary proceedings it brings will focus on direct violations of auditing standards, the failure to supervise or the failure to cooperate with the PCAOB.

The PCAOB has the power to impose fines and issue sanctions. More severe results would include suspension from audit practice or even deregistration from the PCAOB. If an audit firm loses its registration, that firm will not thereafter be able to issue audit reports with respect to companies registered with the SEC. All PCAOB enforcement actions are subject to review by the SEC. The PCAOB will also supply its findings to the applicable state regulatory authorities.

At this point in time, the Office of Investigations and Enforcement is in the process of gearing up for operations. It is clear, however, that an adverse decision in an enforcement proceeding brought by the PCAOB (albeit technically a private body) would have material adverse consequences for the audit firm on the losing end of such decision.

The PCAOB is a privately-funded entity, and receives no governmental money. For 2004, the PCAOB has an operations budget of approximately $103 million. The funds for the PCAOB are principally provided by public companies, and in a small part, by the registered audit firms.

The PCAOB annually assesses issuers for fees using a sliding scale based on the market capitalizations of such issuers. Issuers with the 100 largest market capitalizations paid 46% of the PCAOB’s fees in the last year; 31% of issuers paid fees of less than $500 each. Accounting firms also pay fees upon registration with the PCAOB. The PCAOB is contemplating adopting, but has not yet done so, annual reporting by the audit firms, and when that occurs, it is likely that the accounting firms will be paying annual fees to the PCAOB.

If the fees due to the PCAOB by an issuer remain unpaid after 90 days, the PCAOB reports such issuer to the SEC. More importantly, no auditor can issue an unqualified audit report if the client’s PCAOB fee is past due. The PCAOB has clearly stated that the auditor has an obligation to determine whether the PCAOB fee has been paid by the issuer; one method of obtaining such verification will be by E-mail to the PCAOB at confirm@pcaobus.org.

There is little disagreement among accountants, lawyers, politicians and the business community that the accounting industry is in the middle of a major restructuring. The PCAOB is just beginning its work, and its ultimate direction is not yet clearly defined. What is certain, however, is that the PCAOB is now a major factor, both positive and negative, in the way accounting firms conduct their business.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.