A Decade after Sarbanes-Oxley: The Need for Ongoing Vigilance, Monitoring, and Research Free

Prior to the Enron scandal in 2001, there were many warning signs and credible studies pointing to serious problems in corporate governance, corporate financial reporting and auditing, and the accounting profession itself. To resist recommended reforms, the accounting profession and the business community mounted a vigorous defense of the status quo. It took a full-blown crisis—the largest bankruptcies experienced in the United States to date, as well as massive financial reporting frauds and accompanying audit failures—to produce and implement the substantial reforms of the Sarbanes-Oxley Act of 2002 (hereafter, the Act).

We need to learn from this history, and never again let such warnings go unheeded. We also need to keep the issues of independent, high quality auditing in the forefront at all times. We can never decide that we are finished addressing these issues and become complacent when it comes to ensuring high quality financial reporting and auditing. For these reasons, research related to auditing trends and risks, and the effectiveness and impact of audit oversight, will continue to be of fundamental importance to help advance auditing practice and regulation to protect investors and the public interest.

This paper provides my perspective on the major issues debated during the development and passage of the Act, specifically related to the oversight of the auditing profession and the creation of the Public Company Accounting Oversight Board (PCAOB). This perspective is based on my earlier involvement in the U.S. General Accounting Office's (GAO)¹ work analyzing the corporate governance, financial reporting, and auditing problems that plagued the global financial markets prior to the passage of the Act, and also on my current work as a Board member of the PCAOB.

Based on these experiences, I provide my views on areas related to the auditing profession that would benefit from further research and analysis, as well as areas of opportunity for research related to audit oversight that could be useful to the PCAOB, as the organization continues to mature and considers current and future regulatory needs. I offer a perspective that may provide additional insight to academic researchers, audit practitioners, and public company audit committees and managers about recognizing and responding to evolving risks. This focus is vital to fulfilling our shared responsibility to ensure the integrity, independence, and quality of auditing over time to protect investors and the public interest.

Serious questions about corporate governance, financial reporting, audit quality, and the oversight of the accounting profession that were raised 20 years earlier, intensified during the 1990s. In 1996, the GAO issued a two-volume report (AIMD-96-98, GAO 1996a, 1996b) that summarized the results of 27 significant studies about the accounting profession that were conducted from 1972 through 1995. The GAO analyzed the status of responsive actions taken on 574 major recommendations made in those studies.² The report highlighted additional actions still needed in the following areas: auditor independence, the auditor's responsibility for detecting fraud, determining the effectiveness of internal control, and ongoing challenges with accounting and auditing standard setting.

At the same time, the number and size of public company restatements began to rise. The GAO subsequently identified and analyzed 919 restatements announced by 845 public companies from January 1, 1997 through June 30, 2002 that involved “accounting irregularities” resulting in material misstatements of financial statements and results (GAO-03-138, GAO 2002e). During that period, the number of public company restatements rose each year, and notably, the number of large companies with restatements also grew. These companies lost billions of dollars in market capitalization in the days surrounding the initial restatement announcements, and those losses caused ripple effects on overall investor confidence in the markets.

A wave of disaster began in the spring of 2000, when major corporate scandals began to emerge after the bursting of the dot-com (or tech) bubble. Two infamous companies served as bookends for this period: Enron and WorldCom. After public questions surfaced about Enron's finances in the summer of 2001, the company—which had rapidly become one of the world's largest publicly traded corporations—filed for bankruptcy in December 2001. Company disclosures and other sources revealed that Enron and its senior executives had hidden debt by using and personally managing off-balance-sheet special purpose entities, overstating revenue, and engaging in undisclosed related party transactions, among other questionable and non-transparent business and accounting practices. During that time, Enron's external auditor, Arthur Andersen, continued to issue clean opinions on the company's financial statements.

The string of corporate failures and financial accounting and auditing scandals continued in 2002. In January, Global Crossing filed for bankruptcy after its stock price crashed due to concerns about its financial reporting and overall business condition. That spring many other companies were in the headlines. There were lawsuits, Securities and Exchange Commission (SEC) investigations, and disclosures of false or misleading financial reporting involving related party transactions and other practices at Tyco, Adelphia, Waste Management, and other public companies. The Department of Justice indicted Arthur Andersen in March 2002 for obstructing justice by inappropriately destroying its Enron audit documentation. In May 2005, the Supreme Court reversed the criminal conviction of Arthur Andersen.³

The state of corporate financial reporting and auditing had reached a crisis point, threatening public confidence in the integrity of the U.S. financial markets and causing substantial losses for investors and thousands of lost jobs. The GAO began providing direct assistance to the Senate Banking Committee and the House Financial Services Committee as they grappled with the problems in public company financial reporting, auditing, and oversight of the accounting profession.

It was in this atmosphere that I became deeply involved with the GAO's work in this area. The GAO coordinated extensively with stakeholders and other interested parties across the interrelated system of corporate governance, accounting and financial reporting, financial statement auditing, and oversight of the accounting profession, and provided input to the U.S. Congress through testimony in committee hearings, written reports and letters, and oral briefings and meetings.

On March 5, 2002, David Walker, U.S. Comptroller General and head of the GAO, testified before the Senate Banking Committee and identified four broad areas where reforms were needed: corporate governance, accounting and financial reporting, the auditing of financial statements, and oversight of the accounting profession (GAO-02-483T, GAO 2002a).

In calling for greater oversight of the accounting profession, the GAO pointed out that the existing oversight system was fragmented and not well coordinated, yet contained duplication, and the discipline function was ineffective and not timely. The GAO elaborated on various factors and alternative approaches for Congress to consider in designing effective oversight for audits of public companies.

In a packed hearing room that reflected the seriousness of the situation and the gravity of the issues, the GAO used a color-coded chart (GAO-02-483T, GAO 2002a) on large poster boards to illustrate the complex system of federal, state, private, and self-regulation that represented the oversight of public company reporting and auditing at the time. In the GAO's color-coded scheme, “green” represented government regulation, comprising the SEC and the state boards of accountancy. The numerous private sector and self-regulatory organizations—including a number of groups made up of volunteers from the profession—were “yellow” on the GAO chart.⁴ Toward the end of a lengthy question-and-answer session with Comptroller General David Walker, Sen. Christopher Dodd summed things up: “In other words, we need more green on that chart than yellow” (Dodd 2003).

In that hearing, the GAO also took on auditor independence issues, stating that “in some circumstances, it is not appropriate for auditors to perform both audit and certain nonaudit services for the same client” (GAO-02-483T, GAO 2002a). In fact, after many years' work and an intense debate with the profession, the GAO had just issued revisions to its auditor independence requirements for government audits (GAO/A-GAGAS-3, GAO 2002f), which put in place tough restrictions on auditors providing nonaudit services for government audit clients and other audit clients receiving government funding.

The legislative activity around reform was intensifying. Just weeks later, on April 9, 2002, in testimony before the House Financial Services Committee (GAO-02-601T, GAO 2002c), the GAO fully endorsed the need for additional regulatory oversight of the accounting profession—that more “green” was needed in its graphical depiction of oversight of the accounting profession. The GAO stated that “direct intervention to statutorily create a new independent federal government body to regulate the accounting profession is needed” (GAO-02-601T, GAO 2002c).

The GAO emphasized the need for stronger independence standards for auditors with a prohibition on certain types of nonaudit services. The GAO also outlined steps that could be taken to enhance the independence of audit committees and their working relationships with auditors to further enhance the effectiveness of the audit in protecting the public interest.

The House passed House Financial Service Committee Chairman Michael Oxley's Corporate and Auditing Accountability, Responsibility, and Transparency Act (H.R. 3763) on April 24, 2002, and transmitted it to the Senate, where it was referred to the Senate Banking Committee. Meanwhile, Senate Banking Committee Chairman Paul Sarbanes was preparing his own bill, the Public Company Accounting Reform and Investor Protection Act of 2002 (S. 2673), as the culmination of ten hearings on accounting and investor protection issues.

As the legislative activity gained momentum, the GAO continued to respond to requests for briefings and analysis on issues surrounding the proposed reforms. In addition, Chairman Sarbanes requested further elaboration in writing from the GAO regarding steps Congress should consider taking to strengthen oversight of the accounting profession and auditor independence. The GAO response (GAO-02-742R, GAO 2002d) on May 3, 2002, reflected the pressures and sense of urgency of the time. The GAO wrote:

The GAO's letter provided details for the Banking Committee to consider regarding the functions, funding, and structure of a new oversight body for the profession, including alternatives and suggestions for board membership and the appointment process.

Meanwhile, turmoil continued in the markets. On June 5, 2002, Henry M. Paulson, then Chairman and CEO of Goldman Sachs and later Secretary of the Treasury, delivered a speech at the National Press Club in Washington, D.C., calling for changes in governance and auditing for public companies. He said, “In my lifetime, American business has never been under such scrutiny. To be blunt, much of it is deserved” (Paulson 2002).

On July 15, 2002, the Senate passed the Sarbanes bill. Then, on July 21, 2002, WorldCom filed for bankruptcy protection, replacing Enron as the largest U.S. bankruptcy at that time.

On July 25, 2002, both chambers of Congress passed the Sarbanes-Oxley Act, which President Bush signed into law five days later.⁵ Among other things, the Act created the Public Company Accounting Oversight Board to oversee the audits of public companies in order to protect the interests of investors and further the public interest in the preparation of informative, accurate, and independent audit reports.

The PCAOB has four main responsibilities under the Act, as amended:⁶

• • 

  register public accounting firms that audit public companies, brokers, or dealers;

• • 

  establish auditing and other professional standards;

• • 

  conduct and report on regular inspections of registered public accounting firms that audit public companies, brokers, or dealers;

• • 

  conduct investigations and disciplinary proceedings in cases where auditors may have violated certain provisions of the Act, the rules of the PCAOB and the SEC, and other laws, rules, and professional standards governing the audits of public companies, brokers, and dealers.

The PCAOB was created as an integral part of the Sarbanes-Oxley reforms. It is not the objective of this paper to analyze the other elements of the Act, which included requirements for corporate financial accountability and responsibility, as well as stronger corporate governance, such as mandating specific responsibilities for audit committees in their audit oversight role.

The Act also reflected the fact that certain important issues were not ready for action. Thus, Section 207 of the Act required the GAO to conduct a study and review the potential effects of requiring the mandatory rotation of registered public accounting firms (GAO-04-216, GAO 2003c). In addition, Section 701 of the Act required the GAO to study and report on the consolidation of public accounting firms and a number of other related issues including competition and auditor choice, audit quality, auditor independence, and the impact upon capital formation and securities markets (GAO-03-864, GAO 2003b; GAO-08-163, GAO 2008).

Recognizing that much work remained, on December 9, 2002, the GAO convened a forum to discuss challenges facing regulators, the accounting profession, and the boards of directors and management of public companies in effectively implementing the Act and related regulatory steps designed to improve public confidence (GAO-02-494SP, GAO 2002b). Forum participants consisted of invited individuals from the SEC, Congress, investor groups, the newly formed PCAOB, the business community, the accounting profession, audit standard-setting groups, academia, and a variety of other interested parties. Forum participants generally agreed that the root causes of the breakdowns that led to the Sarbanes-Oxley Act were systemic in nature. The GAO published the results of the forum in a January 2003 report (GAO-03-419SP, GAO 2003a), the same month that the PCAOB officially opened its doors. That report describes a number of fundamental issues, with which the PCAOB and the profession continue to grapple more than a decade later. These include the expectations gap between what investors and other users of financial statements expect to learn from auditors and what the standard audit report actually delivers, as well as questions about how to make financial reporting and auditing more relevant and useful in the modern business environment.

In November 2003, a meeting of The American Assembly⁷ covered similar topics. The GAO Comptroller General Walker participated in the meeting. The resulting summary report, The Future of the Accounting Profession,⁸ presented the participants' views that the accounting profession was moving to improve its practices, after having acknowledged that auditors had yielded too often to management pressure to paint the most favorable picture possible of a corporation's financial health. In addition, the participants concluded that the Sarbanes-Oxley Act reforms were generally positive and the participants were encouraged by the actions of the PCAOB in its first year of operations. At the same time, the participants concluded that “much remains to be done.” For instance, a gap continued to exist between users' expectations for exactitude, certainty, and precision in financial statements and what is actually achieved through the financial reporting and auditing processes.

Recognizing that more progress was needed, in 2007 the U.S. Department of the Treasury established an Advisory Committee on the Auditing Profession (ACAP) to examine the condition and future of the auditing profession and to provide advice and recommendations. The Committee's final report, issued in October 2008, contained more than 30 recommendations to improve the performance and sustainability of the public company auditing profession (U.S. Department of the Treasury 2008).

The report and its recommendations cover three broad areas: (1) human capital, with a focus on improving accounting education; (2) firm structure and finances, with a focus on enhancing auditing firm governance, transparency, responsibility, communications, and audit quality; and (3) concentration and competition, with a focus on ways to increase audit market competition and auditor choice for public companies.

Meanwhile, the PCAOB was establishing its programs, including its approach to independent audit standard setting. The Act provided that the PCAOB establish or adopt auditing and related attestation standards, quality control, ethics, independence, and other standards for the preparation of audit reports for securities issuers as may be necessary or appropriate in the public interest. In April 2003, the Board adopted, as its interim professional standards, the existing standards of the Auditing Standards Board (ASB) of the American Institute of Certified Public Accountants (AICPA) that were then in use for public company audits. The goal of this approach was to provide continuity in the auditing of public companies. These standards were to remain in effect while the Board reviewed individual interim standards applicable to registered public accounting firms and specific audit matters. The Board would then modify, repeal, replace, or adopt permanently the interim professional auditing standards (PCAOB 2003).

To promote coordination among the organizations that had a role in setting auditing standards in the United States, the GAO in 2003 proposed the formation of the U.S. Auditing Standards Coordinating Council. The purpose of the Council was to provide a forum for the heads of the GAO, the PCAOB, and the ASB to meet regularly to coordinate priorities and standard-setting agendas (Walker 2004).

Subsequently, during some of those meetings and in comment letters on the PCAOB's proposed auditing standards, the GAO voiced concern about the Board's approach to standard setting. The interim standards adopted from the ASB in April 2003 were not being updated at the same pace as were those of the ASB and international standard setters, and differences were developing among the various sets of auditing standards. The GAO expressed its concern that inconsistencies in core auditing standards could increase audit costs and lead to potential misapplication of the standards. The GAO supported an approach in which the U.S. auditing standard setters would work together to achieve agreement and consistency on core auditing standards. Only in cases where there is a clear and compelling reason should standard setters develop additional standards necessary to meet the needs of their constituencies and then communicate them clearly, according to the GAO (2007).

Thus far, PCAOB has issued 18 auditing standards, which have collectively superseded and amended the interim auditing standards to varying degrees. Some stakeholders have questioned whether this approach is effective and sustainable. As discussed later in this paper, the PCAOB has benefitted from academic research in the areas that has impacted its auditing standards, and rich research opportunities continue to exist.

Now that we are more than a decade removed from the enactment of the Sarbanes-Oxley Act and the reforms have had time to take effect, it is appropriate to assess the current state of financial reporting and auditing, and to take the necessary steps to address existing risks and try to prevent future systemic breakdowns involving audit failures. We are also at an appropriate point in time to evaluate the impact and effectiveness of the PCAOB's oversight programs to date.

As a Board member of the PCAOB since March 2012, I have had the opportunity to consider the provisions of the Sarbanes-Oxley Act and its investor protection objectives while overseeing the PCAOB oversight programs that are in place as a direct result of the Act. I am also mindful about the potential for systemic problems that could—once again—put pressure on public company financial reporting and auditing. I hope that the reforms and ongoing efforts at improvement are creating a system of public company auditing that is strong enough to withstand such pressures, and that integrity and confidence are maintained.

The Sarbanes-Oxley Act included various provisions intended to deal with a number of vexing issues that had troubled the auditing profession for decades. Those issues included inadequate auditor independence and professional skepticism, inadequate auditor detection of financial reporting fraud, and inadequate consideration of audit and financial reporting risks, including those resulting from poor internal controls. Through the PCAOB's oversight programs, we can see that these issues continue to pose risks to the system. The questions before us today involve whether these risks have been reduced enough and whether the profession and its oversight and monitoring mechanisms are positioned to prevent future crises. Because these questions will persist, we need continued analysis, study, and monitoring to identify changing risks.

To achieve and maintain high performance in the areas of auditor independence, audit quality, audit firm oversight, and coordination among the different regulatory and self-regulatory functions requires constant vigilance. All participants in the system need to be vigilant and nimble to make the appropriate adjustments in response to changing market and business conditions. This vigilance is especially true in light of constantly evolving technology, increased globalization, and the ever-changing pressures and risks in the financial markets. Academic research and other contributions continue to be a very important part of making this process work effectively. The following are key areas of potential research: broad systemic forces and risks, audit committee oversight, audit quality and PCAOB oversight, and auditing standards.

The Sarbanes-Oxley Act was enacted to provide better protection for investors by improving the reliability of corporate financial reporting and disclosures under the securities laws. Continued research and analysis are important to assess how breakdowns occurred in auditing and governance systems and how they can be prevented in the future. In addition, research can help to assess progress and identify current and future risks so that corrections can be made to maintain confidence in financial reporting and auditing. Table 1 presents opportunities for future research and analysis in this area.

Audit committees play a key role in overseeing public company financial reporting and audits under the structure set forth in the Sarbanes-Oxley Act. Audit committees are an important part of the system that is in place to help promote audit quality and auditor independence, while protecting investors and the public interest. The success of the system relies on the effective execution and coordination among key players to help ensure auditor independence and audit quality.

In connection with its 2012–2016 Strategic Plan, the PCAOB identified as a near-term priority a project to enhance its outreach to and interaction with audit committees to constructively engage in areas of common interest (PCAOB 2012). Advancing this initiative also has been embedded in the Board's 2013–2017 Strategic Plan (PCAOB 2013c). The oversight role of audit committees represents an important complement to the PCAOB's mission to protect the interests of investors and further the public interest through independent, high-quality audits. The academic community can play an important role in this area through research and analysis into issues such as those suggested in Table 2.

Now that more than ten years have passed since the establishment of the PCAOB, it is appropriate to ask questions about the present state of audit quality—including whether or to what extent audit quality has improved in light of the Act's reforms, and the nature and extent of the impact that PCAOB oversight has had on audit quality.

PCAOB inspections and enforcement activities have identified a disturbing number of serious audit deficiencies and violations of audit standards over the years. At the same time, many stakeholders and members of the profession have told the Board that they believe audit quality has improved, and I agree with them. But measuring and tracking trends in audit quality has remained elusive. The lack of reliable, measurable data has been cited as an impediment to assessing audit quality. But because audit quality is such a fundamental issue, a critical opportunity exists to identify information and data that can be used and shared to dynamically measure and track audit quality.

The Board has made it a priority to begin to identify audit quality indicators, with a longer-term goal of tracking such measures for domestic global network firms and reporting on those measures over time (PCAOB 2013b). The Board's latest strategic plan also includes a number of other initiatives targeted at improving major areas of audit practice linked to audit quality. At the same time, the PCAOB is developing its own performance measures and indicators to assess progress in achieving its mission.

Academic research and analysis focused on trends in auditor independence, audit quality, and the impact of specific PCAOB oversight activities would be useful not only to answer basic questions about trends in the practice of auditing and in audit quality, but also to help inform stakeholders about adjustments that may be needed across the system. In addition, research that deals with the impact of PCAOB inspections and its approach to conducting inspections and reporting inspection results would be valuable for consideration of these oversight approaches going forward. Table 3 presents some opportunities for future research in this area.

As previously discussed, PCAOB standards currently consist of the interim standards adopted in April 2003, plus new standards issued by the Board that have superseded and amended many of the interim standards to varying degrees. PCAOB standards now differ from international auditing standards and other U.S. auditing standards, which has resulted in a challenging situation for practitioners and educators.

One effort to help clarify the current standards is a Board proposal that would reorganize its existing interim and PCAOB-issued auditing standards topically with a single, integrated numbering system and a logical order that generally follows the flow of the audit process (PCAOB 2013a). The reorganized standards should also help facilitate mapping to, and comparison with, international auditing standards. Many opportunities exist for research into broad standard-setting themes and approaches, as suggested in Table 4.

In 2005, the Executive Committee of the Auditing Section of the American Accounting Association (AAA) assembled nine academic research teams to develop syntheses of existing research related to key PCAOB standard-setting projects. Ten papers were published at the conclusion of the initial synthesis project. Due to the success of the first round of papers, the Auditing Section began working with PCAOB staff on a second round of synthesis papers in 2011. In 2013, 11 synthesis papers were published in a special supplement of Auditing: A Journal of Practice & Theory (2013).⁹

These synthesis papers have been an important resource for the PCAOB when considering audit practice issues and initiatives for new standards. The PCAOB staff plans to work with the Auditing Section on a third round of synthesis papers in the near future. As academic researchers contemplate future topics, they may find it useful to consider the projects listed on the PCAOB's current standard-setting agenda.¹⁰ Additional research opportunities into topical standards are presented in Table 5.

It is imperative that we learn from the history of events that led to the passage of the Sarbanes-Oxley Act to help make certain that nothing approaching the scale of that auditing crisis ever happens again. We can be sure that auditing will come under stress again in the future due to business cycles and other developments. We must be vigilant and continually examine the activities of the profession and the regulatory regime to ensure that the core values of investor protection and safeguarding the public interest remain front and center so that audit independence and audit quality are not compromised when the system does come under stress. And when there are lapses, we must ensure that the appropriate corrections and adjustments are made in real time, as needed. We can never again afford to wait until a full-blown crisis is upon us before we make the necessary changes.

At the GAO, I oversaw and audited the federal government's responses to countless business failures that included financial reporting and auditing failures under various regulatory schemes. Prior to the events that led to the passage of the Act, I spent many years of my career overseeing the activities of the Resolution Trust Corporation, which handled the liquidation of hundreds of failed savings and loan institutions, and the activities of the Federal Deposit Insurance Corporation, which handled the liquidation of hundreds of failed banks. From 2008 through 2011, just prior to my appointment to the PCAOB, my team at the GAO performed oversight of the U.S. government's efforts to help stabilize the financial markets and promote economic recovery during the most recent financial crisis.

These experiences, combined with my service as a Board member at the PCAOB, have given me a strong conviction that we will never be “done” and cannot ever declare victory and become complacent when it comes to ensuring high-quality financial reporting and auditing to protect investors and the public interest. We have seen from the various business cycles and financial bubbles over the decades that regulation needs to adapt quickly to changing circumstances, and that auditors must effectively fulfill their responsibilities at all times.

The interrelated nature of corporate governance, accounting and financial reporting, the auditing of financial statements, and oversight of the accounting profession call on all stakeholders to work vigilantly to ensure the integrity of each aspect of this system. All participants, including those involved in corporate financial reporting and internal control, corporate governance (boards of directors and audit committees), audit firms and audit teams, as well as regulators, need to be alert to warning signs and red flags and respond appropriately to maintain integrity and the public trust. Failure in any of these areas places a strain on the entire system and could threaten our capital markets and greater economic well-being.

The successful functioning of this system also relies on academic researchers. The academic community plays a key role in this system of vigilance by conducting research and analysis, monitoring the strengths and weaknesses of the system at any given time, evaluating performance across the financial system, studying the impact of specific actions, and generating recommendations for change. In addition, success of the entire system relies on educators preparing future members of the profession to successfully assume and carry out their responsibilities in maintaining integrity and public trust, while protecting investors and the public interest.