Saturday, March 19, 2011

Regulating Audit Firms: News and a Short Wishlist

In the last week, some news agencies have reported that the PCAOB is investigating the role of auditors in the financial crisis. It appears that auditors have been able to avoid much scrutiny from the latest economic meltdown whereas when the dot-com/telecom meltdown took place around the turn of the millennium, auditors took much of the blame. Below is a rundown of the two recommended regulatory changes that are being talked about in the news followed by a short discussion of changes that I would make if I was in charge.

Two Recommended Changes to Auditing

From the articles I read, there are two main changes being batted around: 1) changing the standard audit report and 2) requiring more auditor rotation. First, The Washington Post has an article about changing the audit report. Joe Carcello from The University of Tennessee is quoted in the article as saying: “When 90 to 95 percent of companies get the same exact report, the information content is minimal.”

That is the basic problem: most audit opinions look the same and basically say that the auditor provides something less than absolute assurance that everything is a-o-k. However, anyone who has worked in auditing knows there is a wide range of clients that get these opinions. Some clients are more risky than others, in many respects. The proposal is for the auditor to tell more about what he or she knows about the risks at the client and also to discuss some key judgments that were made during the audit, including what is or is not material.

This recommendation seems both reasonable and feasible since auditors already make these judgments so I think it would simply amount to more disclosure of what the auditor already knows and sees at the client. I personally like the idea but as with most things though, the devil is likely in the details.

Auditors would likely oppose this change because their main focus in life is to be protected in court in case they are wrong about something. They like to be able to say: "We followed X, Y and Z so you can't sue us." In a world where they were disclosing their view of the risks, if they miss a risk then they would fear being sued. I'll comment more on this attitude in auditing later but for now, suffice it to say that this change would likely be slow to be embraced by the profession. That's not to say they couldn't be forced to make the change but, as with most changes to auditing, it will probably take another meltdown like we saw with Enron-WorldCom-Andersen before the auditors would be willing to embrace something this drastic (in their minds).

I personally think it would raise the value of the audit so auditors are shooting themselves in the foot if they do oppose it but we've seen that before too....

As for the second recommendation, requiring more auditor rotation, this coin has two sides to it. Auditors believe they have expertise that allows them to do a good audit and the expertise is, at least partially, client specific. Thus, experience with a client can help the auditor learn where all the dead bodies lie, so to speak. It can also help them know how to look for the dead bodies.

Reuters quoted former SEC Chief Accountant, Lynn Turner, on this topic and said that he believes more auditor rotation "could help keep auditors independent and focused on doing their jobs properly rather than keeping a client and its fees coming in." The focus of this recommendation is on helping auditors be more independent. While this may help that process, I believe there are different approaches that would have as much potential to change auditor independence as this and wouldn't have the downside of regularly interfering with developing client specific auditor expertise. Both my recommendations have the potential benefit of keeping auditors "independent and focused on doing their jobs properly" with respect to finding fraud.

What Would I do?

If I could make two changes to the audit profession to help improve auditors, I would recommend two things to help change their mindset. Let me first describe the mindset that I believe exists and then what I would do to change it.

My focus would be to get auditors to be more vigilant and smart about looking for fraud. Contrary to what the public believes, the current environment in auditing has many things that make it so auditors do not focus much quality effort looking for fraud. This is known as the expectation gap and has been identified for decades and has, at times, been described by Lynn Turner as being as wide as the Grand Canyon! So what is it that keeps them from vigilantly looking for fraud?

Changing Auditor Litigation

I believe the number one reason is the litigation environment. When auditors think about fraud, they think about protecting themselves from a runaway jury. I've been told many times that every one of the Big Four firms have potentially billion dollar lawsuits at any given point in time that could put them out of business. Lehman and Ernst & Young is a case in point. As I've discussed before, if a jury were to decide that EY was responsible for one-half of 1% of the Lehman bankruptcy, EY would likely be gone. That's serious business!

So what does this do to auditors? They focus their procedures on protecting themselves from the runaway jury. That may sound good but let me explain. The mentality becomes one of dotting i's and crossing t's as opposed to finding fraud. There is a big difference.

As an example, I've participated in some fraud brainstorming sessions with auditors. SAS No. 99 requires auditors to brainstorm about fraud. I have personal experience of a large audit firm that required that a forensic expert be involved in fraud brainstorming sessions on their higher risk clients. In doing so, there were two types of brainstorming sessions: 1) serious, effective brainstorming sessions and 2) dot-the-i and cross-the-t brainstorming sessions. I believe the dot-the-i sessions results from a common mentality in auditing of protecting themselves from litigation or other scrutiny by regulators such as the PCAOB. Essentially, the audit partner wasn't focused on having an effective fraud brainstorming session, he was focused on documenting that he held a brainstorming session with the right people and met the SAS No. 99 and firm requirements for this critical fraud procedure.

So what change would I make to fix this? I've done some research with my colleagues here at BYU, Greg Burton and Jeff Wilks, that suggests that if auditors were simply penalized for missing a fraud and no litigation process took place, they would be more vigilant. In other words, audit penalties would not be based on whether or not you could show you followed the required process, but whether or not you had the right outcome. This recommendation is actually counter to what many others would argue needs to happen but I'm convinced this is the way to go.

The study referred to above will be published in December 2011 in one of the top accounting journals, The Review of Accounting Studies.  I won't go into the details here and I will acknowledge that one study can't answer all these questions, but I will say that I am working on more research in this area and I believe the change would result in quantum improvements in this dysfunctional audit mentality of trying to dot the i and cross the t in order to be protected in court. Here is the essence of why the change would work.

First, auditors have standards for performing their work. I've already alluded to the SAS No. 99 requirement to brainstorm. In the current world, if auditors can show they followed the standard then they have some protection against the runaway jury. So, much of what auditors do is to show they followed the standard. However, I believe that if they would focus half this energy trying to protect themselves on thinking about how they could do things more effectively to detect fraud, they would either deter more fraud or detect it occasionally.

Doing away with auditor negligence litigation and simply imposing predetermined penalties on auditors for failing to detect material misstatements would accomplish this goal and it would put some attorneys out of work too! That could be a boon in many respects! Of course, the devil is in the details in this proposal too and I won't go into all those now, but if I were king for a day, this would be my first change.

Improving Auditor Independence

The other change I would make would be to change auditor independence by having auditors of publicly traded clients be hired by the stock exchanges. This idea was proposed years ago by Paul Healy and Krishna Palepu at Harvard and, unfortunately, I never hear much about it since their proposal.

Stock exchanges have a stake in keeping fraud at bay. As such, I believe that they would more effectively hire and fire auditors based on how vigilantly the auditors were at looking for fraud. The auditors would have to show them that they are doing something to detect fraud and this expertise would be the competitive edge that the exchange would look for in an auditor.

Unfortunately, there are many procedures auditors could be doing to look for fraud that would likely make it much harder for clients to get away with material financial statement fraud and that would detect more fraud. For example, they could contact every employee in the client firm and provide a whistle blower hotline to report to the auditor any material financial statement fraud. However, the only way auditors will go to their clients today and say, we are going to do some new procedures to look for fraud is if the profession requires them to do the procedures. Otherwise, the client will push back and ask why their audit fees are going up so they can do these unusual, new procedures.

I believe there are many other examples of procedures auditors could do to look for fraud that would be less costly. Unfortunately, auditors will resist doing these procedures as long as they are afraid of push back from the client management. In the end, it's silly to think auditors will be focused on finding new ways to probe for fraud as long as they are getting paid by the client. This proposal has the benefit of encouraging client specific expertise at fraud detection whereas mandatory rotation does not.

So there you have it: my two changes to the auditing profession. I believe both these changes would improve the profession's value to society and would lead to a much more vibrant and effective audit. What are the chances that these changes will happen in my lifetime? Unfortunately, I'm not holding my breath...

No comments:

Post a Comment