Additional Comments of the American Accounting Association Auditing Section Auditing Standards Committee on the PCAOB’s Amendments to PCAOB Auditing Standards Related to a Company’s Noncompliance with Laws and Regulations and Other Related Amendments

We are pleased to provide additional feedback on the PCAOB’s Amendments to PCAOB Auditing Standards Related to a Company’s Noncompliance with Laws and Regulations and Other Related Amendments (“NOCLAR”; PCAOB 2023a). Since we submitted our original comments on the proposal (Boland et al. 2024), we have continued to monitor the proposal, and we have reviewed the PCAOB (2024) Briefing Paper related to the March 2024 public roundtable on the proposal. We commend the PCAOB for holding the roundtable.

In this commentary, we provide feedback that is incremental to our original comments. Due to ongoing fundamental concerns, as well as new evidence of extraordinarily different interpretations of the proposed standard, our lack of support for the proposal remains unchanged. We strongly encourage the PCAOB to issue a revised proposal for public comment before any final standard is issued or to consider other alternatives.

We focus our new comments on three areas. First, we address the continuing lack of economic analysis from the PCAOB to support the proposal, especially analysis of costs and benefits. Second, we reflect on the auditing profession’s response to the proposal and the questions raised by audit firms’ and others’ views. There appear to be extraordinarily different interpretations of the proposed standard, ranging from the proposal adding minimal auditor responsibilities to the proposal fundamentally changing auditing and costing tens of billions of dollars per year. Finally, we discuss the proposal’s likely impact on the nature of auditing, and we fear that the proposed auditor NOCLAR responsibilities could become a virtually unlimited game of “Where’s Waldo?” That is, “Where’s NOCLAR?”

In our previous response to the NOCLAR proposal (Boland et al. 2024), we quoted from PCAOB (2023b) guidance, “The PCAOB requires that economic analysis of regulations address four main elements: (1) the need for the rule, (2) the baseline for measuring the rule impacts, (3) the alternatives considered, and (4) the economic impacts of the rule (and alternatives), including the benefits and costs.” We expressed serious concern about the PCAOB’s apparent failure to perform such an analysis, especially related to costs, which makes it impossible to fully evaluate the proposal. More broadly, it continues to appear to us that the analysis of costs, benefits, and alternatives is lacking.

The February 26, 2024, Briefing Paper (PCAOB 2024) suggests that the PCAOB still has not done any numerical economic analysis related to the proposed NOCLAR standard, especially its costs and benefits. In fact, certain questions in the Briefing Paper suggest that the PCAOB is looking to other parties to provide some data on costs and benefits. Specifically, the Briefing Paper includes the following questions (PCAOB 2024, 9):

1. What do panelists or commenters perceive as the economic benefits and costs of the proposal and how do they differ from the status quo, both quantitatively and qualitatively? Whenever possible, provide your responses separately by firm size (e.g., large, medium, and small) and stakeholder (e.g., preparers).

2. Please share any additional data or studies to clarify the economic impacts. Are panelists or commenters aware of additional data or studies on the current cost of unidentified noncompliance with laws and regulations on investors?

3. What do panelists or commenters perceive as the impact of the proposal on small- and medium-sized audit firms and how have you quantified such impact?

We believe that gathering and analyzing such data is the role of the PCAOB, not the role of its stakeholders. In addition, such analysis should come before the issuance of a proposal. Asking stakeholders for feedback on the PCAOB’s economic analysis is a sound step, but such inquiries, in our view, cannot be the core of the PCAOB’s economic analysis.

In short, we believe that the PCAOB has the burden of proof on economic analysis. The analysis must support the standard setting that is being proposed. Instead, some may perceive that the PCAOB is trying to shift the burden of proof to others, who would have to disprove the need for standard setting. We do not believe that this is appropriate. Rather, we believe that the PCAOB has the burden of “making the case,” including by providing a meaningful analysis of costs and benefits.

The PCAOB’s apparent continuing failure to provide any sense of the proposal’s costs is, in our view, a “deal breaker.” We would not buy a house without knowing the price, and we cannot support a regulatory proposal without any information about its cost beyond a statement that the cost will be “significant.” We reiterate that this burden is on the PCAOB. The PCAOB has provided no cost numbers or ranges of cost numbers to establish even a starting point for evaluating the costs versus the benefits of the proposal. This was true in 2023 when the standard was proposed, and it is still true today.

It also is quite notable that some roundtable participants provided numerical direct cost estimates, and they varied by tens of billions of dollars per year. There is a very clear need to better understand the scope and cost of this proposal. This situation is reminiscent of the issuance of AS2 and AS5 to implement provisions of the Sarbanes-Oxley Act of 2002. Like then, we fear that the absence of sound economic analysis will result in significantly increased (but unknown) audit fees and internal costs to issuers.¹

It also is a reality that a material component of estimating the costs of the proposal relates to projecting the PCAOB’s inspection and enforcement posture under a new NOCLAR standard, and the PCAOB has the best information about this issue. If PCAOB inspection findings and enforcement actions soar under a NOCLAR standard, then auditors would reasonably respond with greatly increased effort and documentation, causing audit fees and the overall cost of the proposal to escalate further.

In addition to the absence of a cost analysis, the benefits remain unclear. To what extent would an auditor’s detection of NOCLAR reduce investor harm? In particular, an associated contingent liability may not reach the recognition threshold of probable and estimable. An inference at the roundtable appears to be that the auditor’s scrutiny would have a deterrence effect and change the behavior of management to reduce the likelihood of NOCLAR. Moreover, some at the roundtable contended that auditors are not meeting their responsibilities under current standards. This begs the question as to whether the problem lies in the adherence to the current standard, the standard itself, standards for disclosure of contingencies, or the requirements of management—each of which might suggest different alternatives and even different regulators to effect change.

Overall, there seems to be a maintained hypothesis by the PCAOB that under this proposed standard, auditors will prevent NOCLAR or at least catch it early, nip it in the bud, prevent it from growing, and save investors millions or billions. This assumes a lot of the auditors. According to the Association of Certified Fraud Examiners (ACFE 2022), most frauds are caught through whistleblower tips. Even internal auditors are far behind tips in terms of catching fraud. Would NOCLAR be any different? How likely is it that auditors looking for NOCLAR will find things early?

For example, under a NOCLAR standard, would auditors have prevented or greatly limited the losses at Wells Fargo? Even once the problem was identified, it was not clear to management or the auditor that it would be material to the financial statements (KPMG 2016). Although significant fines were eventually levied, Wells Fargo’s financial statements have not been deemed materially misstated. The overstated revenue associated with unauthorized accounts was inconsequential, and it is unclear whether a contingent liability associated with fines would meet recognition or disclosure criteria, a subjective judgment (see Keyser and Smith 2023 for an analysis of the Wells Fargo case).

Rather than catching frauds in their infancy, perhaps it is more likely that, even with a NOCLAR standard in place, auditors will not see things until they become material problems, and much damage has already been done. Although auditors may detect NOCLAR, it is not their responsibility to prevent NOCLAR from occurring, a recurring theme in the roundtable. Whenever the negative news comes out, shareholders will suffer. Maybe the auditor’s work results in the news coming out in July instead of September, for example, but either way, when companies have meaningful violations, there will be losses and stock price volatility.

Furthermore, we question whether NOCLAR reporting would act as a strong deterrent to issuers. A recent working paper by Flasher and Lau (2024) examines 2,417 governmental auditor prosecutorial referrals of clients who appear to have engaged in activities inconsistent with written laws. The authors find that only 8.9 percent of the referrals were prosecuted, and 1.6 percent resulted in incarceration. The authors conclude (Flasher and Lau 2024, 1), “increased auditor responsibility is unlikely to deter fraud and other illegal behaviors, as the auditors’ increased identification, evaluation, and communication is not met with prosecutorial charges that practically raise the costs of engaging in fraud or other illegal behaviors for most instances.” Overall, we suggest great caution in predicting how much “pain” investors will avoid under a NOCLAR standard.

The lack of economic analysis (costs, benefits, and alternatives) related to the NOCLAR proposal continues to be a major issue for us, and the extraordinarily different interpretations of the proposed standard evidenced at the roundtable amplify our previous concerns. One important step in identifying the costs and benefits is to identify over the past 10–15 years situations where there were material misstatements related to noncompliance. This would help to clarify for stakeholders the need for this standard.

Further, as the International Auditing and Assurance Standards Board (IAASB 2016) has issued its own standard (ISA 250) on NOCLAR, the PCAOB might consider gathering economic analysis information based on the implementation of the international standard.

The U.S. public company audit market is slow growing, especially in relation to the market for advisory services, which now accounts for a large portion of major firms’ revenues. In a slow-growth market, profit-minded accounting firms should welcome new requirements that will yield significant new revenues. Thus, all else equal, there should be an apparent self-interest bias for audit firms to strongly favor new standards that create more audit work.

Despite this apparent bias toward favoring new revenues, we find it incredibly notable that audit firm opposition to the NOCLAR proposal is nearly universal, as reflected in comment letters submitted in 2023. In fact, the Center for Audit Quality (CAQ 2023) analysis of NOCLAR comment letters from audit firms reveals 96 percent opposition to the proposal, 0 percent support, and 4 percent unclear.²

Although audit standard-setting authority clearly rests with the PCAOB, we implore the Board to more fully examine the following question, “Why are audit firms so willing to turn down significant new revenues in a slow-growth industry?” There must be some very good reasons. Perhaps audit firm opposition is related to fundamental concerns with the proposal (see CAQ 2023), including a lack of clarity around the potentially massive scope of what is being asked, the firms’ lack of expertise in the task, and the potential regulatory and civil liability dangers that the firms may face. Moreover, audit firms need more clarity before supporting this proposal around core conceptual elements related to the proposal, such as “could reasonably” versus “reasonably possible” versus “reasonably likely” and “direct” versus “indirect.” In our view, what the firms seem to be saying is, “We’d love more fees, but we cannot do what this proposal demands that we do. It is not possible.”

When profit-minded organizations say “no thanks” to more money, we believe that the regulator needs to listen. The regulator should fully understand why and be willing to fundamentally clarify and/or revise the proposal. As academics who study the auditing profession and audit market, the firms’ reaction to the NOCLAR proposal sends a strong message that needs to be thoroughly understood. Audit firm opposition to the proposal appears to be based on fundamental concerns, not based on the need for tweaks around the edges of the proposal.

The discussion in the roundtable reveals concerns and profound disagreements about many fundamental aspects of the proposal, including the basics of its scope, cost, and benefits. Further, there appear to be extraordinarily different interpretations of the proposed standard, ranging from the proposal adding minimal auditor responsibilities to the proposal fundamentally changing auditing and costing tens of billions of dollars per year. Such lack of consensus about the basics of the proposal is troubling and suggests the need for additional work by the PCAOB.

Audits are built around management making assertions and auditors testing those assertions, with the goal of expressing an opinion on the financial statements. We continue to be very concerned that the NOCLAR proposal would fundamentally alter the focus of the audit to include reducing stock price volatility and investor losses, which goes far beyond traditional notions of an audit. Specifically, the proposal appears to take auditing from testing assertions to auditors also having to engage in what we fear may become a virtually unlimited game of “Where’s Waldo?” That is, “Where’s NOCLAR?”

Without significant clarity in the standard about the specific expectations of auditors regarding the scope of laws covered, we fear that auditors would be searching far and wide for actual or possible violations of any law, regulation, rule, etc. that could reasonably have a material effect on the financial statements. As noted in our previous response (Boland et al. 2024), we have serious concerns about the lack of clarity surrounding the scope of this task and the auditor’s expertise in the task.

Consider this from an auditor’s perspective: you want me to go out and look for Waldo (possibly material instances of NOCLAR), but I am not sure what Waldo looks like, I do not have any expertise in Waldo, I do not know how far and wide to search for Waldo, I do not know how many pages are in the Waldo book, and I fear that if I miss a Waldo, my firm and I will suffer greatly. It is no surprise that the audit firms want no part of such a “Where’s Waldo?” game.

Perhaps an alternative “first step” that the PCAOB and the Securities and Exchange Commission might consider is to expand the process of assessing internal control over financial reporting (ICFR) by having both management and the auditor assess and report on internal control over compliance with laws and regulations (ICCLR) that may materially affect the financial statements. A benefit of this approach is that management would have to define “Waldo” in terms of identifying relevant laws and regulations rather than having so much of this burden potentially falling on the auditor.

For a company that uses the COSO framework, this requirement would have a lot of overlap with assessing ICFR, so the cost would not be as dramatic as the initial implementation of AS2. For example, issues related to the control environment on compliance would have overlap with the control environment on financial reporting. Disclosure of material weaknesses in compliance controls could potentially give the investors a sense of whether there is a problem with compliance at a company. The process of having management assess compliance controls will raise the importance of compliance controls with management and the board of directors and may reduce the likelihood of future compliance violations. Because there is experience in implementing ICFR, the PCAOB may be able to infer the economic costs and benefits of requiring an assessment of ICCLR.

As we reflect on NOCLAR developments since our previous response (Boland et al. 2024), we continue to have fundamental concerns with the proposal for three main reasons: (1) there is no PCAOB economic analysis to support standard setting, especially regarding costs and benefits; (2) in addition to constituents having vastly different interpretations of the proposal, profit-seeking audit firms are staunchly opposed to a standard that would give them significant new revenues, and this opposition needs to be fully understood; and (3) we fear that under this standard, auditing could morph into a game of NOCLAR “Where’s Waldo?” in a quixotic quest to reduce stock price volatility and investor losses.

We strongly encourage the PCAOB to revisit the proposal and to issue a new version for public comment. The objections being raised, both in the comment letters and in the roundtable, are quite fundamental and widely shared. There also is evidence of profoundly different interpretations of the proposed standard, highlighting the need for more uniform understanding of the proposed requirements. Finally, we urge the PCAOB to consider alternatives such as a focus on internal control over compliance or a reconsideration of standard setting on this issue. Thank you for the opportunity to provide additional feedback on this proposal.