Under the Sarbanes-Oxley Act, all public accounting firms that prepare audit reports for issuers covered by the Act are required to register with the PCAOB. Creating the registration program became job one, and the lynchpin, the Board decided, was to build its own web-based system to receive and record all registration applications. The Board considered outsourcing the registration IT infrastructure to one of the self-regulatory organizations such as the National Association of Securities Dealers (now the Financial Industry Regulatory Authority). But the Board’s IT Director Ray Schmidt, whom colleagues described as “uniquely confident,” convinced Board Members it was crucial to control its own technology.
The PCAOB held an Open Meeting March 4, 2003, to discuss its proposed registration system and rules that would require both domestic and foreign audit firms to register as a prerequisite to auditing issuers listed on U.S. stock exchanges. Foreign regulators and firms immediately complained, and the PCAOB announced a March 31, 2003, roundtable to gather feedback. Inundated with a barrage of concerns from non-U.S. firms and regulators, the PCAOB granted foreign firms a nearly yearlong registration delay until April 19, 2004. (For more information, see Office of International Affairs.)
By mid-March George Diacont, a 24-year SEC veteran who had served as Chief Accountant for both the SEC’s Division of Enforcement and NASDAQ’s investigative arm, was hired to lead the Division of Registration and Inspections. He tapped two former SEC attorneys, Patty Thompson (who also worked with him at NASDAQ) and Sarah Williams, to spearhead the registration team. They immersed themselves into helping develop the technical requirements for the registration system and a timely process to review, analyze and present hundreds of applications. Timelines were extremely tight. Sarbanes-Oxley locked in the date Oct. 22, 2003, (180 days following SEC determination) after which it would be unlawful for any person or firm that was not registered with the PCAOB to prepare, issue, or participate in an audit of a public company covered by the Act.
Domestic firms concerned that the PCAOB was asking for too much information on its registration form reached out through comment letters to narrow the scope. While the Board approved the registration form, the registration staff worked closely with the IT team to create the various system components that would allow firms to log in, download forms, upload their applications, and make payments.
“We would have these ‘go, no go’ calls that always made me feel like we were at NASA,” said Patty Thompson about launching different phases of the system. By July, domestic firms could download registration forms and by mid-August they could submit them. Because there was a 45-day review period, the practical deadline for registering was early September. Each of the Big Four was given its own submission window for a dedicated data transfer. One of these firms had technical difficulties that brought it nail-bitingly close to missing that early date. With fewer applications than expected in September, the registration team began reaching out to firms. Suddenly, the trickle became a flood. In the final weeks before the registration deadline, the whole staff worked late into each night, evaluating and developing recommendations on new applications. The Board met twice per week to pass on the staff’s recommendations for several months. By Oct. 22, the Board had registered 598 firms. The PCAOB’s first endeavor, to create an online registration system in six months, was a success.
The funding mechanism built into the Sarbanes-Oxley Act allows the Board to be truly independent from the profession. It provides for the PCAOB to establish its budget for each year, subject to the approval of the SEC, which then serves as the basis for the annual accounting support fees. These fees are paid by publicly traded companies, investment companies, and other equity issuers, based on their average monthly U.S. equity market capitalization. In 2003, the first year the fees were accessed, about 62 percent of issuers paid $1,000 or less in accounting support fees, while the largest 1,000 issuers paid about 87 percent of the total fees due. (1)
As with the registration system, the PCAOB also chose to build its own billing system. Anxious to repay the Treasury its $20 million startup loan within the same fiscal year, the Board asked the IT team to shave a month off its agreed project schedule for delivery of the billing system.
“Developing the technology at the same time as the rulemaking was somewhat unique,” said IT Chief Ray Schmidt. However, notices of the first accounting support fees were sent Aug. 4, 2003, to about 5,200 public companies and 3,300 investment companies (2) permitting the PCAOB to repay its advance and start funding its own operations within its first year.
Conceived as one of the PCAOB’s most powerful tools, the inspections program was designed to command the largest portion of the PCAOB’s staffing and funding. But first, it needed to be created.
While overseeing the development of the registration system, George Diacont simultaneously assembled a team to start designing the inspections process. As the architect of the inspections framework, he drew on his past experiences and tested out new ideas through experimentation. He relied again on Patty Thompson and two key hires, both former Big Five (3) audit partners Chris Mandaleris and Paul E. Bijou. “We knew where the good, the bad, and the ugly existed within the profession, and we knew we could affect change,” said Bijou.
A major priority was to hire inspectors. “We needed people who had walked in the shoes of an auditor to sit across the table from audit teams to determine whether they had gotten the standards right,” said Mandaleris. “We sought auditors with at least 9 to 12 years of experience, who had a presence, could communicate, and demonstrated good judgment.”
Chairman McDonough put it this way in early speeches: “We don't want zealots, but we don’t want pussycats either.” (4)
To combat the challenge of attracting enough qualified auditors to agree to work for a Washington, D.C., nonprofit, Charley Niemeier conceived of opening regional offices throughout the country. Chief Administrative Officer Paul Schneider helped open the first regional offices in New York City, Atlanta, Chicago, Dallas and San Mateo, Calif., near San Francisco.
During its organizational meetings in late fall of 2002, the Board decided it had to conduct limited inspections of the Big Four firms by the end of the first year in order to show how seriously it embraced its mission. Charged with hiring staff, setting up the division, and creating operational registration and inspection programs within a few short months, Division Director George Diacont, a former Marine Pilot in Vietnam, replied “They are asking me to build a plane while I am flying it.”
To create a blueprint for those first limited inspections, Diacont hired three consultants, all of who were former Big Five partners, to develop the scope of the inspections. David B. Pearson, who had been the Staff Director to the 2000 Panel on Audit Effectiveness, an eight-member board appointed by the SEC to examine and evaluate the current audit model, was on the team along with Phil D. Wedemeyer, and Thomas Wertheimer. They huddled in a conference room for 8 to 10 hours a day writing and editing the program. They used many of the innovative ideas put forth in the Panel on Audit Effectiveness recommendations, including looking at partner compensation as a driver of audit quality.
To work out the nuts and bolts of actually going into the firms, Chris Mandaleris and Paul Bijou also retreated to a conference room, which they wallpapered with flip chart tear sheets. “We had George come in at the end and walked him through each section, describing every aspect of what inspections might be, down to the resources and training that would be needed,” Bijou described.
By September 2003, Mandaleris and Bijou had hired a team of 20 inspectors to look at four engagements at each of the Big Four firms, a set of audits that was nicknamed “the Sweet Sixteen” by some in the profession.
A few weeks before the limited inspections, the PCAOB sent out document requests. Diacont and his deputies were pleasantly surprised when all the firms, despite raising confidentiality concerns, supplied with rare exception all the information requested. “That was a very positive sign for us, it signaled how the firms were going to relate to the PCAOB,” said Bijou.
According to Robert J. Kueppers, then a senior audit partner at Deloitte and the final Chair of the AICPA’s SEC Practice Section, “the learning curve was very high on inspections.” Each firm had to set up a secure room with special computers that were loaded with its proprietary software, but did not allow access to a firm’s entire system.
“It cost real money to be inspected,” said Sam Ranzilla, former National Managing partner for KPMG Audit Quality and Professional Practice. “We took really good partners offline to support our teams and to deal with inspectors, to get them the information they requested and deal with any questions or concerns they might have.”
After the inspectors returned from the field, the PCAOB was faced with the difficult and novel task of assessing and reporting its findings. Under the Act, the Board had to provide a report that would offer “appropriate detail” but could not make public criticisms in the firm’s quality control systems unless the firm failed to remediate within 12 months.
“A lot of thought went into weighing and balancing two countervailing tensions, appropriate detail to the public and confidentiality for the firms,” said Patty Thompson who played an integral role in creating the report format.
The Board also grappled with that fact that several different stakeholders, beside the audit firms, would be trying to glean information from the reports. “There was never a Kumbaya moment where the whole organization got together and said, ‘this is our definitive audience,’” Thompson said. “The Board understood there are multiple audiences, reading for different purposes, seeking different information, and speaking different languages.”
Several report prototypes were developed, including one patterned after an audit report with a very brief narrative and grades like pass, pass minus, and fail. Ultimately, the team settled on a two-part report, in which Part I would be public and contain a factual, generalized and non-aggregated discussion of individual engagements. Part II would be confidential and discuss any criticisms or defects in the firm’s quality control systems. Part II would only be released if the firm did not remediate within a year.
The PCAOB also chose not to name issuers, but instead refer to them as letters of the alphabet, i.e. Issuer A, Issuer B, Issuer C. “The effect of concerns for confidentiality and for unintended potential consequences of identifying issuers are part of the DNA of inspection reports to this day, and since the issuance of the first reports, have caused them to be criticized by academics and some classes of investors for a lack of transparency,” said Phil Wedemeyer who also helped craft the early inspection reports.
According to Patty Thompson, the PCAOB had both statutory and practical reasons that precluded it from naming issuers: “Confidential business information could not be disclosed, and we didn’t want to reveal anything that would affect a company’s stock price,” she said.
Each written inspection report also went through a significant editing process, requiring signoffs from the Office of General Counsel, the Office of the Chief Auditor, and two rounds of Board approvals, before and after the firm had a chance to comment. At its highest performing clip, inspection reports were released within six months of the inspections, but more often than not, it took close to a year.
On Oct. 17, 2011, Deloitte became the first Big Four firm to have a portion of its Part II inspection report released and for senior partner Bob Kueppers, it was a personally painful event. “It was the first look inside this process that anyone had,” he said. According to Kueppers, Deloitte engaged its crisis management regime, conducting a pre-call with clients to give them a heads up and recommitted the firm to investing in audit technology and training. “We learned early, and it served us well,” he said. But Kueppers also believed the PCAOB would eventually find fault with all the big firms. “It's like shooting fish in a barrel, everybody gets in there, it’s just a question of when,” he remarked.
By 2014, all of the Big Four firms had at least one Part II released when KPMG had portions of its 2010 and 2011 Part II reports made public. “It’s hard as a professional, you never want to see your regulator call you out especially when we thought we were doing everything that we could possibly do to improve performance,” said Sam Ranzilla, KPMG’s then National Managing Partner for Audit Quality and Professional Practice.
For the PCAOB, that first Part II release was a watershed. “It was a turning of a new leaf in which the firms decided not to quibble with the Board to resist the determination of remediation, but to work constructively toward getting remediation done,” said James R. Doty, the PCAOB Chairman at that time.
Inspection reports evolved with inspections themselves. Once the limited inspections were complete, work started on designing the 2004 full inspections for the nine largest firms as well as 91 smaller ones. Initially, the PCAOB used the same resources and approach on all types of firms, but was quickly criticized for overwhelming small firms.
“Midstream, we created a task force to figure out how to right-size the inspection for smaller firms,” said Mandaleris. The Board also began offering a “PCAOB-based” inspection, in which a small firm could send in documents and work papers without receiving a field visit from an inspector.
In 2005, international inspections began with one Canadian firm that audited more than 100 public companies, and 15 other non-U.S. firms with fewer public company audits. (5)
(1) PCAOB Press Release, “PCAOB Issues Notices of Accounting Support Fee,” Aug. 4, 2003.
(2) Ibid.
(3) The Big Five includes Arthur Andersen, the 89-year old auditing firm that went out of business in August 2002 after being found guilty of obstruction of justice in the Enron case. The Supreme Court later unanimously overturned the conviction, but the firm was defunct by then.
(4) "The Fourth Annual A. A. Sommer, Jr. Lecture on Corporate, Securities, and Financial Law", by William J. McDonough, November 11, 2003.
(5) PCAOB 2005 Annual Report, page 8.
