The PCAOB’s Primary Mission: Improving Confidence in Financial Reporting
An Exclusive CPA Journal Interview with PCAOB Member Bill Gradison

By Mary-Jo Kranacher

E-mail Story Print Story

Before joining the PCAOB, Gradison was a senior public policy counselor for a Washington, D.C., law firm. From 1993 to 1998, he served as president of the Health Insurance Association of America.

Gradison held elective office for more than 30 years. Before being elected to Congress from his hometown of Cincinnati, Ohio, he was a member of the City Council for 13 years, serving as vice mayor and mayor. During 18 years in Congress, from 1975 to 1993, Gradison was the ranking member of the House Budget Committee and the Health Subcommittee of the Committee on Ways and Means. He began his career in public service in 1953 as assistant to the under-secretary of the U.S. Treasury. He subsequently was assistant to the Secretary of Health, Education and Welfare before returning to Cincinnati as a general partner in a New York Stock Exchange firm. He also served as chairman of the board of the Federal Home Loan Bank of Cincinnati.

When the PCAOB held a two-day forum, Auditing in the Small Business Environment, in New York City on October 22 and 23, 2007, he met with CPA Journal Editor-in-Chief Mary-Jo Kranacher to discuss a variety of issues facing the PCAOB and the accounting profession. His comments and statements below are Gradison’s alone, and not those of the PCAOB, its staff, or other board members.

The CPA Journal: Your background is more political and legislative than accounting-related. How has that helped you at the PCAOB?
Bill Gradison: My background that’s been most helpful to me at PCAOB isn’t what I did in the public sector so much as what I did in the business world. Because of my years as a general partner of a small New York Stock Exchange firm, I’m accustomed to thinking about issues in terms of investors, smaller retail investors in particular. This is because, despite the growth of our institutional business, that wasn’t how we got started, or how we built our reputation in the community. Of course, there have been dramatic changes since then, and now institutional investors dominate the market.

But operating under a statute that focuses on protecting investors—such as Sarbanes-Oxley—doesn’t require much of a shift of emphasis in my thinking because that’s basically what I did for a living. My work over the years has involved both the public and private sectors. I have found that people in the public sector generally don’t have an in-depth understanding about how the private sector operates; and, similarly, people in the private sector lack an understanding of how decisions are made in the public sector.

I believe that a bridge is needed to help those two parts of our society work together in the public interest. The decision to locate the national platform of all this within 10 square miles centering on Constitution Avenue rather than in a center of commerce, business, finance, and industry creates a bit of a gap that has to be overcome.

Quantifying the Costs of Compliance

CPAJ: The U.S. Chamber of Commerce, which represents businesses and other organizations, has been lobbying to roll back some of Sarbanes-Oxley’s provisions, including the deferral of the implementation of section 404 internal control requirements for small companies. Investors don’t have quite as large a voice, it seems. How do you find that balance between market competition and investor protection?
Gradison: The PCAOB has an excellent relationship with the U.S. Chamber of Commerce. I’ve met from time to time with their senior officials and have also very consciously reached out to a number of business, labor, investor, auditor, and issuer organizations to make sure we understand their concerns, and to tell them what we’re working on. It’s perfectly understandable that, from an issuers’ perspective, the costs imposed on them by Sarbanes-Oxley would be a concern. Although section 404 has been the focus of the expressions of concern, in many ways it goes deeper. From the PCAOB’s perspective, its mission is not to make life easier for the management, or auditors of companies listed on the New York Stock Exchange.

The PCAOB was explicitly created to protect investors by improving the accuracy and reliability of financial reports. And although it would be good to be able to report that it was possible to do this and bring down costs at the same time, that simply is not the case. I assure you there has been no conscious effort to increase costs, but I think there is some evidence that before Sarbanes-Oxley—speaking specifically about internal controls over financial reporting—not a whole lot was going on in the audits of public companies. While the requirement to focus on internal controls goes back to 1977 in the Foreign Corrupt Practices Act, I think the challenge to both auditors and issuers—the larger issuers so far—of getting up to speed on internal control reporting and internal control auditing reflects the accumulated lack of effort put into internal controls pre–Sarbanes-Oxley.

Let me go further and say that the issuers with market caps of more than $75 million—the “accelerated filers”—have now been through SOX-compliant internal-control audits three times, and we get little objection from them anymore. Many of them have built SOX compliance into their systems and say that it has value. Some audit committee members have told me they have attempted to quantify the savings that they’ve achieved as a result of the tighter internal controls. Although no one has told me that the savings have exceeded the costs, I have definitely run into some who say they have measured the savings and that they are now getting back 50% or 75% of the costs, and that, in addition, they feel much more confident about their financial reporting.

CPAJ: The savings are hard to quantify, because when you consider fraud, companies don’t know what they might be losing.
Gradison: It’s extremely difficult, and quantifying the costs is much easier than quantifying the benefits. I think that from the perspective of at least some issuers, particularly those that have operations around the world, the benefits come from putting their accounting on a common basis, although this is easier said than done. Companies that have made a lot of acquisitions often have very different accounting systems when they get into a consolidation phase, which definitely increases the challenge of controls. Be that as it may, the Chamber of Commerce and other groups understandably would like to see Sarbanes-Oxley revisited. And I have no doubt that at some point Congress should take another look at it, but I don’t anticipate it anytime soon.

One reality from the point of view of businesses is that reopening a statute like SOX in a surgical manner, to remove section 404 or its application for smaller companies, and not affect other areas, is almost impossible. Under the rules of the U.S. Senate, other issues, which might have less charm for the business community than repealing section 404, can easily come to the surface—issues such as executive compensation and proxy access. I’m not about to predict what Congress might do, but my advice to smaller issuers, based upon the experience of larger issuers, is not to put off doing your internal control work. We heard loud and clear from larger issuers that those who started early had better results—that is, less uncorrected material weaknesses in internal control over financial reporting—as well as lower costs.

CPAJ: Do you think the time has come for applying section 404 to smaller companies?
Gradison: The PCAOB doesn’t control this, and I don’t sense a disposition on the part of the SEC to extend the deferral period, so, as I said, Congress could act here. But 2007 is almost over.

The PCAOB tried to anticipate implementation of section 404 for smaller companies in a way that would be helpful. First, when I was acting chairman we held a joint roundtable with the SEC focusing on these issues. We were committed to revising PCAOB Auditing Standard 2 (AS2), and we did that. Later, we said we would replace AS2, and we did that. The new standard (AS5) is one-third the length and is written in plain English. It is crafted to focus on high-risk areas, and stresses the importance of integrating the internal control audit with the audit of financial statements in a way that makes maximum use of the work of others, such as internal auditors. Also, AS5 specifically requires external auditors to take into account the size and complexity of their audit clients. In addition, more than a year ago the PCAOB began developing some useful practical guidance for auditors that have never done an internal control audit.

I asked for a show of hands about this at the beginning of my presentation today [at the PCAOB’s Forum on Auditing in the Small Business Environment in New York]. I first asked how many firms had been inspected by the PCAOB so far, and virtually every hand went up; only a few did not. I then asked how many had received their final report based upon that inspection. Not quite everyone raised their hands, because issuing a final inspection report takes a while. Then I asked how many had ever completed an audit of internal control over financial reporting, and only half a dozen or so out of the group indicated that they had.

My point is that most smaller audit firms have never completed an audit of internal control over financial reporting before. Since the adoption of AS5 this year, PCAOB staff have continued to work on implementation guidance for auditors of smaller public companies. The PCAOB obtained the assistance, on a voluntary basis, of 12 firms that had actually completed audits of internal control over financial reporting for smaller public companies, those with market capitalizations just over $75 million. These audit firms, together with PCAOB staff and board member involvement, developed practical advice based upon their experience that would be useful to firms doing these audits of internal control for the first time. This guidance was made public on October 22, 2007.

A small audit firm may ask why the PCAOB is issuing this guidance so late in the year. Nonaccelerated filers are not required to be audited in connection with their 2007 calendar-year reports. For 2007, management has to make an assertion with regard to the effectiveness of their internal controls over financial reporting. Their auditor may work with them, to a certain extent, in preparation for the following year, but companies with $75 million or less in market capitalization are not required to obtain an auditor’s opinion on the effectiveness of internal control over financial reporting until fiscal years ending after December 15, 2008, or in other words, not until the spring of 2009, at the earliest. So they actually have more than a year to get up to speed.

The PCAOB is genuinely eager to help them because, from the public-policy point of view, we want these smaller firms to stay in the business of auditing public companies. Most registered public-company auditors have no more than five issuer clients. Generally speaking, those clients won’t pay the auditor’s rent. Their main business is probably a combination of private companies, local hospitals, and nonprofit organizations, so the PCAOB definitely doesn’t want them to throw up their hands and say, “I’ve never done one of these. I’m just going to drop out of this business.” The PCAOB wants qualified auditors to stay in the business of auditing public companies, and we’re trying to help them.

Consolidation and Competition

CPAJ: There’s been a lot of talk about the lack of competition because most of the large audit firms audit most of the public companies What are your thoughts?
Gradison: A study is underway now by the Government Accountability Office (GAO) on that very subject. The GAO was mandated to do a similar study when Sarbanes-Oxley was passed in 2002, and the report came out in 2003. So the GAO is working on an update. The preliminary data I’ve seen indicate that there is still a high degree of concentration.

I don’t want to get ahead of whatever the GAO report will say with regard to the degree of competition, but a deeply held view among larger issuers is that a Big Four is barely enough. Five would be better, and three is unthinkable. Many larger issuers will use one firm for their audit, another for their taxes, and so forth. Beyond that, in some instances there is a high degree of industry concentration within individual audit firms—for example, international petrochemical companies. Among the smaller audit firms, however, there is evidence of a very vibrant, competitive market. There has been a fair amount of client switching from firm to firm. We had more than 200 audit firms register with the PCAOB and then de-register. But at the same time, even more firms have registered for the first time. So the overall number of auditors, domestic and foreign, has been going up.

We have about 1,800 registered audit firms now, about 1,000 in the United States and about 800 in more than 80 foreign countries. However, not all of those 1,800 are actually the principal auditor of a public company. A fair number of registrants don’t audit any issuers, but I suppose they hope to do so someday. Or maybe they think it’s a good thing to have on their stationery.

CPAJ: Years ago, there was the Big Eight, then Six, then Five, and now Four. When they filed their merger requests with the SEC, they claimed that it would not affect competition. Yet now, they are the loudest voices saying, “You have to protect us because there’s a lack of competition.” So it makes one wonder if growing too big to fail was their strategy all along.
Gradison: I look to the Justice Department or the GAO or the Federal Trade Commission for expertise in that area. It certainly is an ongoing concern, and we are monitoring it. I have not run into anybody who, with the benefit of hindsight, thinks that going after Arthur Andersen with criminal charges rather than the individuals directly involved was a sound public policy decision, but that’s water under the bridge.

International Convergence

CPAJ: You’ve talked elsewhere about the convergence of U.S. GAAP and International Financial Reporting Standards (IFRS). Has the PCAOB been involved with discussions with its international counterpart, the International Accounting Standards Board (IASB)?
Gradison: Yes. Most directly, we are involved and active in the International Forum of Independent Audit Regulators, a relatively new organization made up of organizations like the PCAOB, which are independent from the profession and who in general register and inspect auditors. A number of countries are following the lead of the United States in creating organizations with objectives similar to those of the PCAOB. The European Union has passed its Eighth Company Law directive requiring each of its 27 countries to create such oversight entities. Not that they have or will have 27 varieties, but we’re working very closely with them. We had a meeting in Washington, D.C., earlier this year where we invited the PCAOB’s international counterparts that wished to share experiences. Canada, the U.K., and other countries are well along in this area.

The PCAOB is evaluating these foreign entities on a bilateral basis—one country at a time—for the degree of reliance that can be placed upon the inspections done by our foreign counterparts. We already have conducted joint inspections with a number of countries. Curiously, although we have not hired inspectors with language skills in mind (that was never a criterion), we’ve found sufficient members of the PCAOB staff who are fluent in other languages to meet our current needs. There are about 40 countries where we will have to figure out how to do joint inspections.

With regard to the other aspects of international auditing, the PCAOB is an official observer of the International Auditing and Assurance Standards Board, and our staff members participate in its meetings. Frankly, I’m not sure it’s sustainable in the long run to have three different auditing standards—one for international auditing, the second (PCAOB standards) for audits of public issuers in the United States, and a third set of standards by the Auditing Standards Board of the AICPA for other entities.

So, while the focus and the use of the term “convergence” has largely been on accounting, I wouldn’t be surprised if at some point more attention is given to some degree of convergence in auditing standards as well. Accounting standards are an SEC issue. The SEC will be making some decisions before long about whether foreign private issuers in U.S. markets should be permitted to use IFRS without reconciling them to GAAP. My sense is that it’s likely to happen but I don’t have a crystal ball; no one does.

As far as whether U.S. companies should have an option to file their financial statements in the U.S. under GAAP or IFRS, I’m less sure what might happen, but it wouldn’t surprise me if some U.S. companies might choose to file under IFRS if their principal competitors are non-U.S. companies that would be filing under IFRS in the U.S, simply so their financial statements are more comparable. I do have a sense from talking to issuer representatives that the cost of converting from GAAP to IFRS is fairly substantial and often much more expensive than the first year, or years, of SOX section 404. So, that may be a while in coming.

There are implications for the United States, where auditors in general are not trained in IFRS. Most, if not all, large firms have people who are trained and qualified in IFRS. Those firms could train more people, if needed. I’ve also heard from at least one accounting professor, the department head at a large school of accounting, that he is getting requests to turn out some graduates with a background in this field. Generally, students are not being trained in the field, at least in part because the CPA exam doesn’t cover international accounting standards. Several things would have to happen in the profession’s infrastructure before that change could take place. But it wouldn’t surprise me to see movement in the direction of a single set of worldwide accounting standards. Based on anecdotal input I’ve heard, I’d estimate that it will take 10 to 15 years.

CPAJ: It seems like many organizations are trying to get into the auditing oversight business. U.S. Treasury Secretary Henry Paulson appointed an advisory committee on the auditing profession that met earlier in October 2007. Is the PCAOB working with this committee to ensure that there’s no overlap in responsibilities or duplication of effort?
Gradison: Yes, two groups were set up—the one that you mentioned, and the SEC has set up an Advisory Committee on Improvements to Financial Reporting. The PCAOB has observers on both, and on all of their subcommittees. Our chairman, Mark Olson, is one of those observers, as are other members of our board, including me.

The piece that I’m involved in, because it’s a matter of special interest to me, involves auditor education. These are very impressive groups of people and the scope of their thinking is very broad. They are asking the right questions and they’ve commissioned papers that are being developed rather quickly to help inform them on these subjects. I don’t know what will come out in the end, but I am impressed by the process.

Also, to the extent that the PCAOB has information that is useful to those groups, our staff members have made presentations as well. Our research people have shared some of their preliminary observations with regard to the market impact of restatements, as one example. In addition, the whole question of materiality is another area where we’ve shared our thoughts.

Inspections and Enforcement

CPAJ: Some critics allege that the PCAOB’s inspection process is not truly transparent because they refer only to issuer A, B, C, in the inspection reports, rather than actually identifying the issuer. How would you respond to that?
Gradison: Sarbanes-Oxley prohibits the PCAOB from saying more than A, B, C, with respect to audits of issuers, and indeed goes further by prohibiting us from making public any information—even A, B, C’s, if they involve unremediated quality- control deficiencies that are identified through our inspections of the audit firms. So only the very tip of the iceberg is in the public portion. A few small firms have never responded to our efforts to seek remediation. And there are a few firms whose quality-control deficiencies have been made public on the PCAOB website because of a failure to remediate. But in general that’s the last thing these firms want to have happen. In the big firms, only a handful of people see the complete nonpublic portions of the inspection reports. In general, the engagement teams usually don’t see the entire report. However, as permitted by the statute, the PCAOB can and does issue reports that summarize our observations across inspections without mentioning the name of the audit firm or the name of the issuer.

For example, yesterday [October 22, 2007], the PCAOB issued its first summary of observations with regard to smaller audit firms. Specifically, that report summarizes observations on almost 500 inspections of smaller firms, and the objective was to let smaller firms know the principal concerns that we identified. These issues didn’t arise in every case, of course. That’s helpful because, except in very rare instances, a small audit firm is inspected only once every three years. And only they know what’s in the nonpublic portion of their own report, unless they choose to release it. This general report will give smaller firms a window into what’s happening in other smaller firms that have been inspected, so they can take an extra look at what is happening in areas that may not have been identified in their own inspection report.

CPAJ: The PCAOB is now going after some unregistered auditing firms. Some people have complained that this is not a good use of the PCAOB’s resources. How would you respond?
Gradison: Actually the SEC, not the PCAOB, has taken action against firms that appear to have lent their names to the audits of issuers without being registered with the PCAOB. In a few instances, the PCAOB has identified such firms and what we’ve done pretty uniformly is to deny them registration—that is, the ability to audit public companies for one year—after which they can reapply for registration.

The PCAOB’s Future

CPAJ: In September 2007, PCAOB board member Kayla Gillan announced that she will be stepping down. How will that affect the dynamics of the board?
Gradison: It will be a real loss to us in terms of what she’s contributed, and the experience that she’s brought. Kayla has brought particular insights into the concerns of investors because she was general counsel for one of the largest retirement systems in the world, the California Public Employee Retirement System (CalPERS), before she joined the PCAOB.

The board is small—only five members. Board members were initially appointed to varied and shorter time frames—one year, two years, and so on—in order to ensure staggered terms for members, and therefore continuity. Members may be reappointed for a second term. Once the staggered terms end, each new board member will have five-year terms with the option of an additional five years. My total service will be seven years; Kayla’s will be less than that.

In 2008, another board member’s term will expire. The year after that, mine does. Under the statute, these vacancies are filled by the SEC acting as a body. I say it that way because one of the issues that’s been raised in a lawsuit that questions the constitutionality of Sarbanes-Oxley and the PCAOB is whether the Constitution is violated by the fact that the SEC as a group, rather than just the SEC chairman, names the PCAOB board members. The case is now before the U.S. Court of Appeals.

I thought when the suit was first filed that it would be decided by the court in 2008, but now I think that’s totally unrealistic—probably 2009 or later because of the complexity of the case and the time it takes to move through the appellate process.

CPAJ: Is there anything that we didn’t touch on that you would like our readers to know?
Gradison: Yes: How delighted I am that we were able to get together. It’s really important for the PCAOB to have an opportunity to share our views and answer questions. Communication is very important. A lot of people are impacted by what the PCAOB does. When I was in public office, reaching the public was what you had to do when you were running for office. PCAOB board members aren’t running for office, we’re simply trying to do a good job. The more people know about what we are doing, the more likely they are to let us know what they think about us. We want two-way communication. So, my bottom-line message to you and your readers is: “Hey, folks, keep the cards and letters coming.”

©2009 The New York State Society of CPAs. Legal Notices