Assessing costs and benefits of the PCAOB (and AS No. 2)

1. Assessing costs and benefits of the PCAOB (and AS No. 2) William Kinney, Professor McCombs School of Business University of Texas at Austin NYU Summer Camp New York City May 22, 2007

2. Outline • Overview of cost/benefit measurements for federal agencies • Application to PCAOB/SOX • Application to SOX 404/AS No. 2 • Review of research • Alternatives to AS No. 2 • Alternatives to SOX 404 • Conclusions

3. 1. Government Performance and Results Act, Public Law 103-62 (1993)(GPRA, or "The Results Act") “The purpose of S. 20, the Government Performance and Results Act of 1993, is to improve the efficiency and effectiveness of Federal programs by establishing a system to set goals for program performance and to measure results.” Senate Committee on Government Affairs GPRA Report

4. Using GPRA to help Congressional decision making and strengthen oversight “GPRA was passed in part out of congressional frustration that congressional policymaking, spending decisions, and oversight had been severely handicapped by a lack of sufficiently precise program goals and adequate program performance and cost information. GPRA sought to remedy that situation by requiring agencies to set multiyear strategic goals and corresponding annual goals, measure performance toward the achievement of those goals, and publicly report on their progress.” David M. WalkerU.S. Comptroller General March 22, 2000

5. Performance metrics . . . • GPRA requirements • Input measures • Output measures • Goals • What about program results? • Costs imposed individuals and groups? • Benefits to investors, issuers, and society as a whole?

6. 2. Application to PCAOB • Not a federal agency • Works within constraints of SOX • Has no SOX mandate for cost/benefit analysis (but SEC wants strategic plan) • Yet, measurements of inputs, outputs, and results may assist operation of the PCAOB and outside evaluation of whether it is achieving the objectives intended.

7. PCAOB Mission* The PCAOB is a private-sector, non-profit corporation, created by [SOX], to oversee auditors of public companies in order to protect the interests of investors and further the pubic interest in the preparation of informative, fair, and independent audit reports. * PCAOB website

8. *PCAOB Budget 2007; prior reports PCAOB inputs/outputs* Input (staff) Output Standards ($4.8m): Auditing 14 4 (1) AS Independence 7 rules Ethics ? Quality control ? Registration and 1800 reg. inspection ($55.7m):230 300/yr;4010 Enforcement ($9.2m):24 3 inquiries Research/analysis ($6.8m):23 ?

9. Costs imposed on others • Audit firm fees, issuer compliance costs • Opportunity cost for management • Business entities going private, staying private, going offshore, staying offshore, deals not done • Static, compliance-oriented careers subject to multiple regulatory jurisdictions, substantial financial risk, and reduced opportunities for alternative employment

10. Benefits: other things equal . . . • Increased investor confidence (presumed SOX intent)? • Lower cost of capital among domestic public issuers? • Higher quality audits: • fewer financial scandals? • fewer audit failures, AAERs, less private litigation? • fewer restatements, material weakness exceptions? • more partner and manager time vs. staff auditor time? • better inspection “report cards”? • higher GPA/SAT scores of new entrants (long term)? • Reasonable cost increases: • declining audit fees in total or rising audit hours? • relatively more partner and manager time? • compare to alternatives for better external reporting?

11. 3. SOX 404 and AS No. 2 example • Review SOX 404 research on costs and benefits for accelerated filers • Consider integrated auditing as the key • Discuss some alternatives • Scalable and responsive guidance • Comply or explain why not option • More financial auditing

12. Is the investor protection objective of SOX 404 audits • More reliable annual and/or quarterly external reporting? • Less fraud due to • Misappropriation by employees/third parties? • Misrepresentation by top management? • More reliable information for internal decisions? . . . If yes, then there are several alternatives

13. Research on direct costs of SOX 404 for issuers • Median audit fee increase from 2002 to 2004 (in SOX 404 years): 162% for large cap issuers ( > $ 700m) 36% for small cap issuers ( < $ 75m) • Large cap issuers’ direct costs of ICFR consulting, review, and documentation is, typically, 4 to 6 times the audit fee increase or perhaps $15b to $20b per year Sources: Audit Analytics data file and various surveys and estimates

14. 2002 2004 change Median audit fees: small (<$ 75m) $ 140,000 $ 191,000 36% medium 234,000 645,700 176% large (>$750m) 758,200 1,990,000 162% Median net income (loss): small $ -1,179,000 $ -388,000 n.a. medium 1,498,000 7,101,000 474% large 60,228,000 110,000,000 83% Research on audit fees post of SOX 404* *Audit Analytics: 2,761 firms with big four auditor all 3 years (see next slide).

15. 2002 2004 change Mean audit fees: small (<$ 75m) $ 228,804 $ 339,813 49% medium 354,363 877,021 147% large (>$750m) 1,850,976 3,891,894 110% (. . . for those preferring mean values to medians and wanting source and aggregates) Mean net income (loss): small $ -20,836,040 $ -8,671,100 n.a. medium -22,028,540 -6,704,100 n.a. large 94,755,320 440,676,690 365% Audit Analytics, 2,761 firms, big 4 auditor all years aggregate audit fees = $ 6.563 billion (2004) aggregate market value = $13.3 trillion (2004)

16. Potential cost of small firm 404 audits to investors include: • Increased management attention to compliance with and documentation of mechanical control processes • Reduced management attention to running the business better, strategy, risk analysis • Permanent increase in combined audit fees due to nature of smaller entities

17. Potential costs of small firm 404 audits to economy include • Constrained capital formation as smaller entities stay private, go private, stay offshore, go offshore, sell out to bigger entities, reduce innovation due to compliance costs • Expansion or systems improvement only if an entity can get potential ICFR problems solved (and audited) before next 404 deadline • Potential loss of competitive edge as small firm managements focus on process compliance rather than innovation and better performance

18. Research shows small firms have (other things equal): • More business risk • More CEO/CFO involvement in financial reporting (but also more direct oversight of the business) • Less specialization and expertise in accounting and day-to-day processing controls resulting in • Higher financial misstatement risk • More “substantive” financial audit work, and • Higher audit fees per unit of firm size Source: numerous scholarly studies and practice reports

19. Research on effects of SOX 302 and 404 ICD disclosures • ICDs are predictable using IC risk factors (size, profitability, complexity, growth, asset mix, acq.) • ICDs are associated with lower quality accruals • “Clean” 404 audit opinions associated with 100+ basis point cost of capital reduction for some firms • Restatements typically precede (or accompany) ICD disclosures (i.e., ICD disclosure is not a “leading indicator”) Sources: Ashbaugh-Skaife et al. / Doyle et al. / Glass Lewis / Jonas / Moody’s / Ogneva et al. (all 2006)

20. ICD reporting and cost of capital(Ashbaugh, Collins, Kinney, LaFond 2007)

21. Fraud by (former) top mgt Third party collusion Human failure SEC/FASB induced Rare event 85% No MW, no Restate 10% Rst MW 5% Pervasive IC problems Restatements Growth, acquisitions, operating problems 10% No ICFR weaknesses Auditor detects MW at quarter but remediated before FYE Design evaluation detects – no misstatement Effectiveness testing detects – no misstatement Auditor detects misstatement due to MW before FS issued and corrects misstatement, but MW not remediated by FYE Management review detects MW and not remediated by FYE Restatements X materially weak

22. < 20% > 80% ICFR deficiency adjustment/ misstatement Research on source of ICD discovery Financial audit ICFR audit Implications for benefits of SOX 404 audits?

23. Integrated audits defined . . . • “An integrated audit combines an audit of ICFR with the audit of financial statements, such that the objectives of the two audits are achieved simultaneously through a single coordinated process.” • “As a practical matter, integration of the two audits means that evidence gathered and tests conducted in the context of either audit contribute to completion of both audits.” Source: PCAOB Release 2005-009, May 16, 2005

24. Audit effort for separate audits of Financial statements per PCAOB Interim AS Internal control per AS No. 2 +

25. Internal control per AS No. 2 Audit effort for integrated audits of firms with best possible ICFR Financial statements per PCAOBInterim AS

26. Internal control per AS No. 2 Audit effort for integrated audits of firms lacking strong ICFR Financial statements per PCAOBInterim AS

27. Or, rather than integrated audits, drop ICFR audits per se and . . . Internal control audit effort Financial statement audit effort

28. Financial statement audit effort Expand financial audits (plus analyze audit differences as to cause, disclose MW) Internal control audit effort

29. Alternatives to “one size fits all” or “exempt small issuer” • A “scalable and responsive to individual contexts” approach reflecting smaller issuer strengths and weaknesses (many options) • Offer smaller issuers a “comply or explain why not” option, and let the market decide (UK way) • Mandate: • more financial auditing at year end and for quarterly reviews, and • publicly disclose all “sizable” audit differences, their apparent causes (e.g., MW in ICFR), and disposition

30. 4. Conclusions • Potential for useful cost, benefit, and results measurements for PCAOB and SOX 404 • Difficult measurement issues, including data access and developing new metrics • Many alternatives available given present statutes and potential alternative statues.