Assessing costs and benefits of the PCAOB (and AS No. 2)

William Kinney, ProfessorMcCombs School of Business University of Texas at Austin

NYU Summer Camp New York City May 22, 2007

Outline

• Overview of cost/benefit measurements for federal agencies

• Application to PCAOB/SOX• Application to SOX 404/AS No. 2

– Review of research– Alternatives to AS No. 2– Alternatives to SOX 404

• Conclusions

1. Government Performance and Results Act, Public Law 103-62 (1993)

(GPRA, or "The Results Act")

“The purpose of S. 20, the Government Performance and Results Act of 1993, is to improve the efficiency and effectiveness of Federal programs by establishing a system to set goals for program performance and to measure results.”

Senate Committee on Government Affairs GPRA Report

David M. WalkerU.S. Comptroller General March 22, 2000

“GPRA was passed in part out of congressional frustration that congressional policymaking, spending decisions, and oversight had been severely handicapped by a lack of sufficiently precise program goals and adequate program performance and cost information. GPRA sought to remedy that situation by requiring agencies to set multiyear strategic goals and corresponding annual goals, measure performance toward the achievement of those goals, and publicly report on their progress.”

Using GPRA to help Congressional decision making and strengthen oversight

Performance metrics . . .

• GPRA requirements – Input measures – Output measures– Goals

• What about program results? – Costs imposed individuals and groups?– Benefits to investors, issuers, and society

as a whole?

2. Application to PCAOB

• Not a federal agency• Works within constraints of SOX• Has no SOX mandate for cost/benefit

analysis (but SEC wants strategic plan)• Yet, measurements of inputs, outputs, and

results may assist operation of the PCAOB and outside evaluation of whether it is achieving the objectives intended.

PCAOB Mission*

The PCAOB is a private-sector, non-profit corporation, created by [SOX], to oversee auditors of public companies in order toprotect the interests of investors and further the pubic interest in the preparation of informative, fair, and independent audit reports.

* PCAOB website

PCAOB inputs/outputs*

Standards ($4.8m): Auditing 14 4 (1) AS Independence 7 rules Ethics ? Quality control ?

Registration and 1800 reg.

inspection ($55.7m): 230 300/yr;4010

Enforcement ($9.2m): 24 3 inquiries

Input (staff) Output

Research/analysis ($6.8m): 23 ?

*PCAOB Budget 2007; prior reports

Costs imposed on others

• Audit firm fees, issuer compliance costs• Opportunity cost for management• Business entities going private, staying

private, going offshore, staying offshore, deals not done

• Static, compliance-oriented careers subject to multiple regulatory jurisdictions, substantial financial risk, and reduced opportunities for alternative employment

Benefits: other things equal . . .

Increased investor confidence (presumed SOX intent)?Lower cost of capital among domestic public issuers?Higher quality audits:

fewer financial scandals? fewer audit failures, AAERs, less private litigation? fewer restatements, material weakness exceptions? more partner and manager time vs. staff auditor time? better inspection “report cards”? higher GPA/SAT scores of new entrants (long term)?

Reasonable cost increases: declining audit fees in total or rising audit hours? relatively more partner and manager time? compare to alternatives for better external reporting?

3. SOX 404 and AS No. 2 example

• Review SOX 404 research on costs and benefits for accelerated filers

• Consider integrated auditing as the key

• Discuss some alternatives– Scalable and responsive guidance– Comply or explain why not option– More financial auditing

• More reliable annual and/or quarterly external reporting?

• Less fraud due to – Misappropriation by employees/third parties?– Misrepresentation by top management?

• More reliable information for internal decisions?

Is the investor protection objective of SOX 404 audits

. . . If yes, then there are several alternatives

Research on direct costs of SOX 404 for issuers

• Median audit fee increase from 2002 to 2004 (in SOX 404 years):

162% for large cap issuers ( > $ 700m) 36% for small cap issuers ( < $ 75m)

• Large cap issuers’ direct costs of ICFR consulting, review, and documentation is, typically, 4 to 6 times the audit fee increase or perhaps $15b to $20b per year

Sources: Audit Analytics data file and various surveys and estimates

Research on audit fees post of SOX 404*

Median net income (loss): small $ -1,179,000 $ -388,000 n.a. medium 1,498,000 7,101,000 474% large 60,228,000 110,000,000 83%

*Audit Analytics: 2,761 firms with big four auditor all 3 years (see next slide).

2002 2004 change

Median audit fees: small (<$ 75m) $ 140,000 $ 191,000 36% medium 234,000 645,700 176% large (>$750m) 758,200 1,990,000 162%

(. . . for those preferring mean values to medians and wanting source and aggregates)

Mean net income (loss): small $ -20,836,040 $ -8,671,100 n.a. medium -22,028,540 -6,704,100 n.a. large 94,755,320 440,676,690 365%

Audit Analytics, 2,761 firms, big 4 auditor all years aggregate audit fees = $ 6.563 billion (2004) aggregate market value = $13.3 trillion (2004)

2002 2004 change

Mean audit fees: small (<$ 75m) $ 228,804 $ 339,813 49% medium 354,363 877,021 147% large (>$750m) 1,850,976 3,891,894 110%

Potential cost of small firm 404 audits to investors include:

• Increased management attention to compliance with and documentation of mechanical control processes

• Reduced management attention to running the business better, strategy, risk analysis

• Permanent increase in combined audit fees due to nature of smaller entities

Potential costs of small firm 404 audits to economy include

• Constrained capital formation as smaller entities stay private, go private, stay offshore, go offshore, sell out to bigger entities, reduce innovation due to compliance costs

• Expansion or systems improvement only if an entity can get potential ICFR problems solved (and audited) before next 404 deadline

• Potential loss of competitive edge as small firm managements focus on process compliance rather than innovation and better performance

Source: numerous scholarly studies and practice reports

• More business risk• More CEO/CFO involvement in financial

reporting (but also more direct oversight of the business)

• Less specialization and expertise in accounting and day-to-day processing controls resulting in– Higher financial misstatement risk– More “substantive” financial audit work, and – Higher audit fees per unit of firm size

Research shows small firms have (other things equal):

• ICDs are predictable using IC risk factors (size, profitability, complexity, growth, asset mix, acq.)

• ICDs are associated with lower quality accruals• “Clean” 404 audit opinions associated with 100+

basis point cost of capital reduction for some firms• Restatements typically precede (or accompany)

ICD disclosures (i.e., ICD disclosure is not a “leading indicator”)

Sources: Ashbaugh-Skaife et al. / Doyle et al. / Glass Lewis / Jonas /Moody’s / Ogneva et al. (all 2006)

Research on effects of SOX 302 and 404 ICD disclosures

ICD reporting and cost of capital(Ashbaugh, Collins, Kinney, LaFond 2007)

Internal Control

302 certification (2003, unaudited)

Deficiency disclosed

404 Mgt. Report (2004, audited)

Change in Cost of Capital at 404 announcement

No Yes (material weakness)

0.93%**

(n=162)

No No 0.01% (ns)

(n=685)

Yes No (MW remediated)

-1.51%**

(n= 38)

Yes Yes (continues to exist)

-0.16% (ns)

(n=119)

Fraud by (former) top mgtThird party collusionHuman failure SEC/FASB inducedRare event

Pervasive IC problemsRestatementsGrowth, acquisitions, operating problems

No ICFR weaknessesAuditor detects MW at quarter but remediated before FYE

MW Rst

85%

10%

10%5%

No MW, no Restate

Restatements X materially weak

Design evaluation detects – no misstatementEffectiveness testing detects – no misstatementAuditor detects misstatement due to MW before FS issued and corrects misstatement, but MW not remediated by FYEManagement review detects MW and not remediated by FYE

ICFR audit

Financial audit

ICFR deficiency

adjustment/misstatement

< 20%

> 80%

Implications for benefits of SOX 404 audits?

Research on source of ICD discovery

Integrated audits defined . . .

• “An integrated audit combines an audit of ICFR with the audit of financial statements, such that the objectives of the two audits are achieved simultaneously through a single coordinated process.”

• “As a practical matter, integration of the two audits means that evidence gathered and tests conducted in the context of either audit contribute to completion of both audits.”

Source: PCAOB Release 2005-009, May 16, 2005

Audit effort for separate audits of

Financial statements per PCAOB Interim AS

Internal control per AS No. 2

+

Audit effort for integrated audits of firms with best possible ICFR

Internal control per AS No. 2

Financial statements per PCAOB Interim AS

Audit effort for integrated audits of firms lacking strong ICFR

Internal control per AS No. 2

Financial statements per PCAOB Interim AS

Or, rather than integrated audits, drop ICFR audits per se and . . .

Internal control audit effort

Financial statement audit effort

Expand financial audits (plus analyze audit differences as to cause, disclose MW)

Internal controlaudit effort

Financial statementaudit effort

Alternatives to “one size fits all” or “exempt small issuer”

• A “scalable and responsive to individual contexts” approach reflecting smaller issuer strengths and weaknesses (many options)

• Offer smaller issuers a “comply or explain why not” option, and let the market decide (UK way)

• Mandate: – more financial auditing at year end and for quarterly

reviews, and – publicly disclose all “sizable” audit differences, their

apparent causes (e.g., MW in ICFR), and disposition

4. Conclusions

• Potential for useful cost, benefit, and results measurements for PCAOB and SOX 404

• Difficult measurement issues, including data access and developing new metrics

• Many alternatives available given present statutes and potential alternative statues.