Re:Balance -- Jim Peterson

NOCLAR: The Auditors' Impossible Task Under a PCAOB Proposal

 

"Why, sometimes I've believed as many as six impossible things before breakfast."

-- The Red Queen, Lewis Carroll's "Through the Looking Glass," 1872

As I was pleased to address today for Bloomberg, the American audit regulator is at it again:

The Public Company Accounting Oversight Board is promoting a flawed plan to escalate the responsibility of auditors for their clients’ noncompliance with laws and regulations, called NOCLAR. As proposed, the auditors’ duties would be new, expanded, and impossible to fulfill.

For context, current standards recognize that “whether an act is, in fact, illegal is a determination that is normally beyond the auditor’s professional competence.” Reflecting reality, the standards have provided since 1988 that an audit normally “does not include audit procedures specifically designed to detect illegal acts.”

The PCAOB’s draft rules would both raise the bar and obscure its height. On top of the standard for fraud detection (AS 23401), auditors would:

• “Identify the laws and regulations with which noncompliance could reasonably have a material effect”
• “Assess and respond to risks of material misstatement” caused by “noncompliance with those laws and regulations”
• “Identify whether there is information indicating noncompliance with those laws and regulations has or may have occurred”

Supporters of the proposal include PCAOB chair Erica Williams, who said, “We’ve seen far too many examples of investors getting hurt due to noncompliance with laws and regulations. And we’ve heard calls from investors for auditors to live up to their responsibilities. It’s time we answer those calls.”

The new standard “is a great step forward for auditor responsibility and empowerment, and for the protection of investors and the markets,” board member Kara Stein said.

However, opposition from orporate America and the large and small accounting firms on whom the burden will fall comprised the bulk of the now 137 comment letters posted to date. The comment period ended in August.

PCAOB member Duane DesParte, one of the two dissenters on the five-member board, said the “expanded scope raises concerns when coupled with the additional proposed requirement for auditors to ‘plan and perform procedures to identify whether there is information indicating noncompliance.’”

The lines of disagreement are drawn with a sharp and simple reason to be wary: The Big Audit model isn’t designed to meet the proposal’s expectations or to bear its consequences.

The only meaningful assessment of auditor performance is in the small number of cases that “go wrong,” with the inevitable question—"Where were the auditors?”—tested in the litigation or regulatory actions that arise with serious corporate malfeasance.

NOCLAR reporting has challenged audit practices for decades. In the courtroom, the plaintiffs’ script follows a crisp and successful template: The “audit plan” was incomplete or inadequate - the auditor’s “search” was insufficient to catch the illegality at issue - even assuming thorough planning and search, the auditors failed to identify and mitigate this particular wrongdoing.

The auditors’ defense is that as non-lawyers who aren’t trained in substance or procedure of criminal law, they were fooled by the concealed criminality of their malfeasant clients—no less than general participants in the capital markets.

DesParte flagged what would be a changed and more threatening environment: “While the proposal focuses the auditor on those ‘laws and regulations with which noncompliance could reasonably have a material effect on the financial statements,’ the filtering threshold of ‘reasonably could’ is not adequately explained in the proposal and is not addressed elsewhere in PCAOB standards.”

Under the proposed standard, the plaintiffs’ updated playbook would argue that a particular illegality or noncompliance should have been identified as material and that indicators of noncompliance that may have occurred were overlooked.

Translating DesParte’s diplomacy into the ruder language of litigation exposure - if anything, the proposed standard’s ambiguities and imprecision would mean that defense of the auditor’s work would become even more difficult, not less.

Compounding their difficulty, the auditors could expect little help from their clients’ in-house or outside counsel. The lawyers’ long-running protection of their privileged client communications (see the US Chamber of Commerce’s comment letter) enables a black hole in corporate reporting, by which the lawyers pretend to be unable to quantify their litigation and contingency assessments, while the auditors and information users pretend to believe them.

Going forward, the deserved scrutiny of the PCAOB’s proposal would compare the proposed standards with expectations under the old. A useful exercise would back-test recent examples. If the proposed standards had been in place, would there have been any difference in PwC’s audits of Colonial Bank? Or in Deloitte’s audits of Taylor Bean & Whitaker?

Those exposed illegalities may be the easy cases. What if the inquiry were more nuanced? Would KPMG’s procedures have differed in its audits of Silicon Valley Bank, where the question of legality still needs unpacking?

Or this: Verizon and AT&T recently have been sued in investor class actions over their failure to recognize the remediation costs of lead-clad cables, long since abandoned underground.

While no auditor’s risk assessment would wish exposure under both the environmental and securities laws, the auditors are flirting with the former—see the International Auditing and Assurance Standards Board’s advocacy of its proposed Global Sustainability Assurance Standard—while the scope of auditor diligence under the NOCLAR proposal is hardly likely to extend to ancient cables long buried and forgotten.

Comment letters on the proposal urged further public input, whether by task force, roundtables, or field testing. These might gracefully allow for reconsideration and retreat from the backward formulation of the PCAOB’s motivation, even as Williams contends the board’s majority is “simply making sure that the protection investors think they are getting today matches what the standard requires.”

That articulation should be concerning. A standard based on what one of the affected constituencies “thinks they’re getting” has it the wrong way around, even if the auditors are too delicate to say forthrightly, “we can’t” or too timorous to step up with “we won’t.”

For the sake of its credibility as it strives to show its value, the PCAOB should demonstrate better diligence over a proposal with potential for such dramatic unintended consequences.

 

Originally published at Bloomberg Tax Insights & Commentary, September 8, 2023, and reproduced with permission. Copyright 2023 Bloomberg Industry Group, Inc. (800-372-1033) www.bloombergindustry.com.

Alert for readers here, although too late to footnote in the Bloomberg version: on September 1, Francine McKenna provided a fulsome tour of the history of company reporting for litigation and other contingencies on her substack, The Dig -- both a helpful primer for new arrivals to the NOCLAR topic and a useful reminder for veterans of the long and tortured relationship between auditors and lawyers.    

 

Thanks for joining this dialog. Please share with friends and colleagues. Comments are invited and welcome, and subscription sign-up is easy and free, both at the Main page.

 

 

EY’s Project Everest and Stockton Rush’s Titan –- A Comparison of Two Wrecks

"The Defense Department regrets to inform you that your sons are dead because they were stupid.”

            Goose to Maverick, Top Gun, 1986

 An exam essay for my graduate-level course in Risk Management and Decision-Making, out of this spring’s two catastrophic implosions:

• Stockton Rush’s submersible Titan, crushed in a nano-second on its descent to take an expensive porthole peek at the disintegrating wreckage of the Titanic, lying 2100 fathoms deep on the floor of the North Atlantic.

• EY global chief executive Carmine DiSibio’s aborted Project Everest, by which he sought but failed to split and separate the accounting and consulting practices of the Big Four network.

Here it would be:

As an exercise in “failure study,” compare and contrast the attitudes and behaviors of Rush and DiSibio, and the sources of bias, error, mis-judgments and other factors contributing to the collapse of their ambitious aspirations.

This course seeks lessons for business, professional and personal choice-making. The semester has just ended and my terrific student cohort has scattered on their summer holidays, so here’s what I would have expected from them –- a comparative exercise in how central themes in human behavior are found and recur across a broad range of examples.

While the literature on flawed decisions is rich with guidance, it converges on the deadly combination of arrogance and ignorance. Over-confident commitment to a triumphal goal –- a visual close-up of the historic wreck site, or the cascade of riches anticipated from the EY separation –- would suppress any appeal to proceed with caution, prudence and counsel with the available expertise of others in the sector: hull design, incremental trouble-shooting, and inclusion of safety and emergency capabilities, on the Titan –- and for Everest, coherent strategic planning, globally functional leadership, and resolution of organizational inadequacies in governance and infrastructure.

Innovation, evolution and boldness of vision lie at the heart of great plans, to be sure. But not even unlimited financial resources can purchase a repeal of the inexorable laws of physics and metallurgy and marine engineering –- nor can boundless hubris and grandiosity evade or bypass the basics of economics and organizational dynamics.

The comparisons extend. The hydrostatic pressures on the hull of the Titan were calculable in terms of the water’s depth and density (P = pgh, for those interested) –- predictably catastrophic forces on a vessel of sub-optimal shape, inadequate testing, and fatigued by multiple descents.

As turns out, the formula has application, by analogy at least, to Project Everest –- the depth of its problems went unmeasured and untested, and the density of its leadership created destructive forces beyond recovery.

There’s one further comparison, grisly in its nature, in an expert engineer’s analysis:

• The Titan’s malfunction and loss of power, de-stabilizing and tipping it out of control to “fall headlong towards the seafloor,” meant that its five passengers –- helplessly piled in the nose of the cabin without lights, communications or workable emergency measures -- likely had about a minute of terrified awareness before its fatal failure.

• Likewise, the plain take-away for Carmine DiSibio in the failure of his head-to-head with EY’s American leader and deal skeptic Julie Boland was that the lights were out on Project Everest, a crash was imminent, and there was no available rescue plan or exit strategy.

Stockton Rush’s mis-adventure in “tourism porn” –- charging obscene ticket prices for a reckless project having no legitimate purpose within the protocols of real science, but induced by incentives lying elsewhere in egoism, emotion or ambition –- will be no more than a blip on the future of deep-water exploration. Further analysis is to come, but early post-mortem reporting on the recovered remains already indicates that the causes of the Titan implosion are well understood in the surfeit of flaws in its design and execution.

The same for Project Everest, and DiSibio’s frustrated conflicts as the would-be leader of a new, publicly-listed consulting enterprise. The debate will continue about the desirability of alternate models for professional services, as across the spectrum from integrated, full-service firms to “audit only” assurance practices completely separated from the expanding array of consultancies in Sustainability, cyber security, artificial intelligence and otherwise. But because history’s best example of the latter is the mixed outcome of the Arthur Andersen divorce of 2001 –- the immense success of the Accenture IPO and that company’s powerhouse growth thereafter, contrasted with the death spiral of the Andersen accounting firm in less than a year –- the next entrepreneur tempted to dive into these cold waters will be wise to study with care the uncharted hazards beneath the surface.

“What will kill you is ‘not knowing what you don’t know’” -- the maxim is captured by the academics as the Dunning-Kruger effect. Critically for lessons to be learned, any complex situation with a non-zero possibility of potentially fatal problems calls for pauses and consultation, analysis of emergent quality issues, and careful attention to dissenting views and disaffirming evidence.

Which apparently did not figure for either Rush or DiSibio –- meaning that the outcomes of both projects were fore-ordained. Titan and Everest are now reduced to rubble and mourning, for reasons traceable to the conduct and behavior of their sponsors and advocates. Further efforts in either area may benefit from their unhappy experience.   

 

Thanks for joining this dialog. Please share with friends and colleagues. Comments are invited and welcome, and subscription sign-up is easy and free -- both at the Main page.

EY's Collapsed Split Attempt -- Questions for the Audit Model

The collapse of Project Everest, the doomed attempt by accounting giant EY to split its consulting and audit practices, leaves a landscape like a medieval battle-field -– strewn with casualties and be-set by looters.

The mood is dour –- a retired partner sees “a lot of animosity within the firm,” and an academic says that “short-term turmoil and leadership changes are probably going to happen.” Job cuts were announced for the local firms in the US and the UK.

Uneasy lie the heads that wear the crowns: Carmine Di Sibio, EY's global chief executive; UK managing partner Hywel Ball; their principal antagonist Julie Boland in the US. The tenures of EY’s leadership are in the balance, along with the cohesion of the network and its $ 45 billion of 2022 revenue.

Renewed questions are now aimed at the fitness of the Big Audit model -- see Bloomberg, the Financial Times, and The Economist. As reporters Amanda Iacone and Michael Rapaport put it (all emphasis added):

“Experts say some problems are baked into the very way audits are structured, and that the system actually provides incentives for auditors not to do a tough audit. It’s hard to change that without scrapping the whole system and starting from scratch.”

That view is not shared by the participants. The compensation packages of the partners are linked by golden chains to the unexamined verity of an outmoded product from the Victorian era. That they might willingly imagine a different world would be unthinkable.

Except that it’s not. The depth of EY’s wounding is yet to be felt, with the potential loss of clients, practice stagnation, and the poaching and flight of disaffected personnel. “Expedited hiring discussions” are initiated by opportunistic competitors, and at least two life-threatening litigations are looming –- NMC in the UK and Wirecard in Germany.

It is well to remember that kernels of supposedly eternal truth are ground to dust in the mills of the gods:

• Galileo’s 17^th century inquisitors were piously confident that heliocentrism was divinely condemned.

• “If God had meant man to fly, He’d have given him wings.”

• “I think there’s a world market for maybe five computers,” said IBM Chairman Thomas Watson in 1943.

Irony not being a Bloomberg characteristic, its writers’ question deserves serious and expanded treatment:

“Does the current way of doing things need to be scrapped and rebuilt from scratch, then?”

“What if” the disintegration or collapse of EY? And the unavoidable consequence: an unsustainable Big Three model that would make unavailable, at any price, audit reports for the world’s large companies.

Vexing issues gathered by Bloomberg confront the accountants, with hands wrung in angst and frustration –- here summarily re-cast as “the latest flare-ups of a rolling, seemingly intractable series of crises over audit quality, the role of consulting, and auditors’ integrity”:

• The firms pronounce that audit "is at the heart of the DNA of these firms…They all take very seriously their public interest role…”, and regulators assert that “We’re confident that audit quality has improved, at least at the biggest firms” –- despite persistent outbreaks that at minimum suggest the contrary.

• “The firms, their critics, and their regulators have tried for 25 years to solve the industry’s recurring problems -– but while some observers say audit quality has improved by some measures, failed audits and corporate collapses haven’t stopped.”

• “All of the Big Four firms have had significant audit blowups in recent years” -– see the current attention to KPMG as auditor for the “three-fer” of recently failed American banks SVB, Signature and First Republic.

• “(A)uditors maintain that they actually aren’t responsible for doing as much as investors think they are –- something the auditors call the ‘expectations gap’.”

• “Even as rulemakers contemplate setting high bars for auditors, regulatory enforcement of those rules historically has resulted in penalties that amount to a slap on the wrist…”.

• “In theory, an EY split could help alleviate conflict-of-interest concerns, but … a break-up could hamper EY auditors’ access to expertise, specialists, and technology from the firm’s consulting side.”

• Quoting a plaintiffs’ lawyer, “I don’t think anyone believes what the auditors say anymore…They don’t see any risk to being wrong or to not uncovering something, where there is a risk to uncovering something.”

Hypothesizing a failed EY and a future in which the traditional opinion is no longer obtainable -- resolution of all the above issues is available in that future:

Assurance providers would be freed from their shackled role as “statutory auditors” and enabled to provide targeted, bespoke assurance, extending to all or portions of company information, both financial and as to Sustainability.

The over-hang of death-threat litigation would lose its significance. The “expectations gap” would be closed, as opinions would be delivered under contracts defining third-party reliance and caps and limits on liability.

Firms freed to offer a full range of assurance would hire the equally broad range of required talent and expertise. Career paths would open up. Limitations of auditor independence and constraints on scope of service would have fallen obsolete.

Comprehensive global presence and scale no longer being essential, new providers could offer niche services under new structures and capitalized by new sources –- superseding current concerns for limited competition and range of choice.

Rather than answer to the narrow prescriptions of the regulators, disclosures and assurance would be testable and evaluated in the capital markets.

• Anticipating the anxiety of the bureaucrats, however, nothing in this brave new world would eliminate either issuer responsibility for appropriately defined disclosures to investors or suitable oversight of assurance providers.

No prediction, when or whether a Big Four network might collapse like Arthur Andersen in 2002. But it would be reckless to believe that it cannot or will not happen. 

That possible future, however, should not be so scary as to self-censor an exercise in scrutiny that needs be both thorough and candid. 

 

Thanks for joining this dialog. Please share with friends and colleagues. Comments are invited and welcome, and subscription sign-up is easy and free, both on the Main page.