SEC chair calls for stronger audit rules on SOX anniversary

Securities and Exchange Commission Chair Gary Gensler commemorated the 20th anniversary of the passage of the Sarbanes-Oxley Act while calling for strict new independence standards for auditing firms from the Public Company Accounting Oversight Board.

Speaking Wednesday during a webinar co-hosted by the Center for Audit Quality, Gensler discussed how he worked as a senior advisor to the late Senate Banking Committee Chair Paul Sarbanes, D-Maryland, when the legislation was passed nearly two decades ago on July 30, 2022. One of the main provisions of Sarbanes-Oxley was the establishment of the PCAOB to regulate auditing firms in the wake of the accounting scandals of the early 2000s involving companies like Enron and WorldCom. However, he believes the PCAOB has been too slow to update the accounting profession’s old auditing standards, which were set by the American Institute of CPAs.

“First, the Enron crisis revealed a key problem: the quality of auditing standards,” said Gensler. “Candidly, the relationships between issuers and auditors, between standard-setters and auditing firms, were too clubby. It matters who sets the standards. It matters who ‘audits the auditors.’ Auditing standards were set by the AICPA, a professional association. The profession was writing its own rules. That’s an inherent conflict. Additionally, auditing firms were tasked with ‘inspecting’ each other. Naturally, such inspections had conflicts, failing to identify serious shortcomings in auditor independence and audit quality.”

To correct those shortcomings, Sarbanes-Oxley Act established the PCAOB, an independently funded board under the regulatory oversight of the SEC, Gensler noted. “The PCAOB is tasked with setting enhanced auditing standards,” he said. “For practical purposes, Congress permitted the then-new PCAOB to carry over existing AICPA standards on an interim basis. The expectation was that the board would produce a more appropriate set of standards going forward. Historically, though, the PCAOB has been too slow to update auditing standards. Twenty years later, most of those interim standards remain.”

Gensler moved to replace four of the five PCAOB board members after he took office last year, and in May of this year, the PCAOB announced that it plans to update almost all of the remaining interim standards. “I look forward to these critical auditing standard updates,” said Gensler. “While they have their work cut out for them, I believe that Chair Erica Williams and the board can live up to Congress’s original vision with respect to standard-setting. I hope we can make some progress before Sarbanes-Oxley can legally drink.”

One standard that he would like to see change is the PCAOB’s auditor independence rules, which haven’t solved conflicts with audit firms’ consulting practices. “Another problem the Enron crisis revealed was weak auditor independence,” said Gensler. “In many cases, including Enron, audit firms had lucrative consulting engagements with the companies they were auditing. Thus, Sarbanes-Oxley directed the SEC to take steps to create a stronger barrier between auditors and other parts of their firms’ business when dealing with audit clients, with some exceptions. A number of firms spun out their consulting businesses in the days shortly before and after Sarbanes-Oxley. Over the past 20 years, however, many of these firms went on to rebuild them again. PCAOB inspections continue to identify independence — and lack of professional skepticism — as perennial problem areas.”

He noted that advisory practices at the Big Four auditing firms have not only grown but also become more complex. “Given the growth in the size and complexity of non-audit services, it is important that audit firms maintain a culture of ethics and integrity — placing the highest priority on auditor independence throughout the firm, not just in the audit practice,” said Gensler.

He has asked the PCAOB to consider adding updates for auditor independence standards to its agenda. “We may need to take a fresh look at the SEC’s auditor independence rules as well,” he added. “In the meantime, I encourage firms to review and enhance their independence protocols with respect to their auditing and consulting practices.”

Gensler was asked by moderator Rob Schmidt, a reporter with the Capitol Account newsletter on Substack, about more details on the new independence standards.

“I’ve asked staff and I’ve certainly asked the PCAOB,” Gensler replied. “There’s an auditor independence standard at the PCAOB, and then there’s a rule at the Securities and Exchange Commission, and they work together. I’ve asked both to consider what would be appropriate here and if the PCAOB in addition to what they laid out earlier this spring thinks that it would be appropriate to address and update the auditor independence standards.”

Gensler pointed to the impact from SOX on the Financial Accounting Standards Board and suggested he would like to see more standards developed there as well. “The Enron crisis revealed problems in accounting standard-setting,” he said. “In response, the Sarbanes-Oxley Act provided that the accounting standards-setter, the Financial Accounting Standards Board, would have secure, independent funding. Previously, FASB had to fundraise for itself — often from the very issuers for which it was setting standards. As a result, this created conflicts of interest that witnesses agreed had made FASB slow to adopt new standards and reluctant to tackle controversial topics. Again, Sarbanes-Oxley sought to create greater distance between standard-setters and industry.”

Schmidt asked whether FASB should move faster on setting standards related to environmental, social and governance reporting and cryptocurrency.

“Whether it’s for the Securities and Exchange Commission, the Public Company Accounting Oversight Board or FASB, as markets are changing at a quicker pace than when I started in finance four decades ago, technology is changing more rapidly, and we’ve got international competitors in the capital markets that aren’t going to just leave us at the top,” said Gensler. “So it’s important for the agenda, whether it’s at the Securities and Exchange Commission or the Financial Accounting Standards Board, that they act on issues, taking into consideration public comment in a thoughtful but expeditious manner with some sense of urgency when new matters arise, whether it’s around new technologies or new business models.”

PCAOB inspections

Gensler also wants the PCAOB to take a tougher stance on inspections, especially in light of a recent scandal at Ernst & Young involving cheating on the ethics portion of the CPA exam.

“Inspections, investigations and enforcement are critical components of instilling trust in our capital markets,” he said. “Under the current leadership, the PCAOB has a chance to reinvigorate its enforcement program. The work to improve auditing standards, coupled with rigorous enforcement of auditor’s professional and ethical requirements, is essential for investor protection. … Accounting and auditing cases also are an important focus of the SEC’s enforcement program. We recently charged Ernst & Young LLP with cheating by its auditors (on Certified Public Accountant ethics exams, no less!) and with withholding evidence of this misconduct in our investigation. This action underscores the importance for accounting firms of fulfilling their gatekeeper functions in the spirit and letter of Sarbanes-Oxley.”

Gensler discussed the PCAOB’s ongoing efforts to get access to inspect auditing firms in China and Hong Kong, and how the SEC could be forced to delist Chinese companies whose shares trade on U.S. markets in accordance with the Holding Foreign Companies Accountable Act of 2020. 

“This bill, which unanimously passed the Senate, went to the president’s desk in December 2020, a couple of days after we lost Sen. Sarbanes,” said Gensler. “Going forward, will our markets include Chinese issuers? That still is up to our counterparts in China. It depends on whether they are willing to comply with the requirements of U.S. law to be able to remain in the U.S. markets.”

The SEC and the PCAOB have been negotiating with Chinese authorities on an agreement for years, but the delisting threat has accelerated those talks.

“We are not willing to have PCAOB inspectors sent to China and Hong Kong unless there is an agreement on a framework allowing the PCAOB to inspect and investigate audit firms completely,” said Gensler. “Any framework would need to bring specificity and accountability to fulfilling the goals of the HFCAA. Make no mistake, though: The proof will be in the pudding. While important, any framework is merely a step in the process. In light of the time required to conduct these inspections — as well as to fulfill quarantine requirements — a statement of protocol would need to be signed very soon if the inspections have any chance to be completed by the end of this year. This could be particularly important as Congress is considering accelerating the HFCAA’s timeline from three years to two years.”

Deloitte and CAQ

Later in the webinar, Deloitte U.S. CEO Joe Ucuzoglu discussed how firms like his have responded to Sarbanes-Oxley and its independence requirements, but he seemed to resist new rulemaking.

“You had strict scope-of-services prohibitions and I think Sarbanes-Oxley got this right,” he said. “It banned firms from performing a whole host of consultative services that could compromise the objectivity and impartiality of the auditor. There are circumstances that come up from time to time where a firm doesn’t meet that standard, where a firm violates it. There should be consequences, and those consequences should be severe. But let’s not confuse that with the rule being problematic. Then you have an independent regulator, the PCAOB. And as someone who has personally been inspected by the PCAOB, I can tell you the veracity of that process and the conduct they expect to see when they come in and inspect our work. Lots of professionals in different industries have potential conflicts. You want to make sure you have the systems and incentives in place to combat those conflicts. That’s really the enduring legacy of Sarbanes-Oxley.”

CAQ CEO Julie Bell Lindsay recalled an event the center hosted a decade ago to commemorate the 10-year anniversary of SOX in which former Senators Sarbanes and Michael Oxley, R-Ohio, spoke. “They talked about how no framework is going to eliminate all bad actors,” she said. “There’s always going to be bad actors out there. But from their perspective, had another Enron or WorldCom happened, the answer 10 years ago was no, and the answer 10 years later is still no. But that does not mean we can take our foot off the pedal and not be vigilant. I think if you look at the fact that there’s been no other Enron or WorldCom —  and you can look at other indices like restatement levels and PCAOB deficiency levels are all trending down — but I want to stress that there always needs to be a focus on audit quality.”