PCAOB’s Primary Mission: Improving Confidence in Financial
An Exclusive CPA Journal
Interview with PCAOB Member Bill Gradison
- Bill Gradison was appointed by the SEC as a founding member
of the Public Company Accounting Oversight Board (PCAOB), created
by the Sarbanes-Oxley Act of 2002 (SOX). He was reappointed to
a full five-year term in August 2004, and served as acting chairman
from December 2005 until July 2006, when Mark W. Olson was appointed
the PCAOB, Gradison was a senior public policy counselor for a
Washington, D.C., law firm. From 1993 to 1998, he served as president
of the Health Insurance Association of America.
held elective office for more than 30 years. Before being elected
to Congress from his hometown of Cincinnati, Ohio, he was a member
of the City Council for 13 years, serving as vice mayor and mayor.
During 18 years in Congress, from 1975 to 1993, Gradison was the
ranking member of the House Budget Committee and the Health Subcommittee
of the Committee on Ways and Means. He began his career in public
service in 1953 as assistant to the under-secretary of the U.S.
Treasury. He subsequently was assistant to the Secretary of Health,
Education and Welfare before returning to Cincinnati as a general
partner in a New York Stock Exchange firm. He also served as chairman
of the board of the Federal Home Loan Bank of Cincinnati.
PCAOB held a two-day forum, Auditing in the Small Business Environment,
in New York City on October 22 and 23, 2007, he met with CPA
Journal Editor-in-Chief Mary-Jo Kranacher to discuss a variety
of issues facing the PCAOB and the accounting profession. His
comments and statements below are Gradison’s alone, and
not those of the PCAOB, its staff, or other board members.
CPA Journal: Your background is more political and legislative
than accounting-related. How has that helped you at the PCAOB?
Bill Gradison: My background that’s been most
helpful to me at PCAOB isn’t what I did in the public sector
so much as what I did in the business world. Because of my years
as a general partner of a small New York Stock Exchange firm,
I’m accustomed to thinking about issues in terms of investors,
smaller retail investors in particular. This is because, despite
the growth of our institutional business, that wasn’t how
we got started, or how we built our reputation in the community.
Of course, there have been dramatic changes since then, and now
institutional investors dominate the market.
under a statute that focuses on protecting investors—such
as Sarbanes-Oxley—doesn’t require much of a shift
of emphasis in my thinking because that’s basically what
I did for a living. My work over the years has involved both the
public and private sectors. I have found that people in the public
sector generally don’t have an in-depth understanding about
how the private sector operates; and, similarly, people in the
private sector lack an understanding of how decisions are made
in the public sector.
that a bridge is needed to help those two parts of our society
work together in the public interest. The decision to locate the
national platform of all this within 10 square miles centering
on Constitution Avenue rather than in a center of commerce, business,
finance, and industry creates a bit of a gap that has to be overcome.
the Costs of Compliance
The U.S. Chamber of Commerce, which represents businesses and
other organizations, has been lobbying to roll back some of Sarbanes-Oxley’s
provisions, including the deferral of the implementation of section
404 internal control requirements for small companies. Investors
don’t have quite as large a voice, it seems. How do you
find that balance between market competition and investor protection?
Gradison: The PCAOB has an excellent relationship
with the U.S. Chamber of Commerce. I’ve met from time to
time with their senior officials and have also very consciously
reached out to a number of business, labor, investor, auditor,
and issuer organizations to make sure we understand their concerns,
and to tell them what we’re working on. It’s perfectly
understandable that, from an issuers’ perspective, the costs
imposed on them by Sarbanes-Oxley would be a concern. Although
section 404 has been the focus of the expressions of concern,
in many ways it goes deeper. From the PCAOB’s perspective,
its mission is not to make life easier for the management, or
auditors of companies listed on the New York Stock Exchange.
was explicitly created to protect investors by improving the accuracy
and reliability of financial reports. And although it would be
good to be able to report that it was possible to do this and
bring down costs at the same time, that simply is not the case.
I assure you there has been no conscious effort to increase costs,
but I think there is some evidence that before Sarbanes-Oxley—speaking
specifically about internal controls over financial reporting—not
a whole lot was going on in the audits of public companies. While
the requirement to focus on internal controls goes back to 1977
in the Foreign Corrupt Practices Act, I think the challenge to
both auditors and issuers—the larger issuers so far—of
getting up to speed on internal control reporting and internal
control auditing reflects the accumulated lack of effort put into
internal controls pre–Sarbanes-Oxley.
Let me go
further and say that the issuers with market caps of more than
$75 million—the “accelerated filers”—have
now been through SOX-compliant internal-control audits three times,
and we get little objection from them anymore. Many of them have
built SOX compliance into their systems and say that it has value.
Some audit committee members have told me they have attempted
to quantify the savings that they’ve achieved as a result
of the tighter internal controls. Although
no one has told me that the savings have exceeded the costs, I
have definitely run into some who say they have measured the savings
and that they are now getting back 50% or 75% of the costs, and
that, in addition, they feel much more confident about their financial
The savings are hard to quantify, because when you consider fraud,
companies don’t know what they might be losing.
Gradison: It’s extremely difficult, and quantifying
the costs is much easier than quantifying the benefits. I think
that from the perspective of at least some issuers, particularly
those that have operations around the world, the benefits come
from putting their accounting on a common basis, although this
is easier said than done. Companies that have made a lot of acquisitions
often have very different accounting systems when they get into
a consolidation phase, which definitely increases the challenge
of controls. Be that as it may, the Chamber of Commerce and other
groups understandably would like to see Sarbanes-Oxley revisited.
And I have no doubt that at some point Congress should take another
look at it, but I don’t anticipate it anytime soon.
from the point of view of businesses is that reopening a statute
like SOX in a surgical manner, to remove section 404 or its application
for smaller companies, and not affect other areas, is almost impossible.
Under the rules of the U.S. Senate, other issues, which might
have less charm for the business community than repealing section
404, can easily come to the surface—issues such as executive
compensation and proxy access. I’m not about to predict
what Congress might do, but my advice to smaller issuers, based
upon the experience of larger issuers, is not to put off doing
your internal control work. We heard loud and clear from larger
issuers that those who started early had better results—that
is, less uncorrected material weaknesses in internal control over
financial reporting—as well as lower costs.
Do you think the time has come for applying section 404 to smaller
Gradison: The PCAOB doesn’t control this,
and I don’t sense a disposition on the part of the SEC to
extend the deferral period, so, as I said, Congress could act
here. But 2007 is almost over.
tried to anticipate implementation of section 404 for smaller
companies in a way that would be helpful. First, when I was acting
chairman we held a joint roundtable with the SEC focusing on these
issues. We were committed to revising PCAOB Auditing Standard
2 (AS2), and we did that. Later, we said we would replace AS2,
and we did that. The new standard (AS5) is one-third the length
and is written in plain English. It is crafted to focus on high-risk
areas, and stresses the importance of integrating the internal
control audit with the audit of financial statements in a way
that makes maximum use of the work of others, such as internal
auditors. Also, AS5 specifically requires external auditors to
take into account the size and complexity of their audit clients.
In addition, more than a year ago the PCAOB began developing some
useful practical guidance for auditors that have never done an
internal control audit.
I asked for
a show of hands about this at the beginning of my presentation
today [at the PCAOB’s Forum on Auditing in the Small Business
Environment in New York]. I first asked how many firms had been
inspected by the PCAOB so far, and virtually every hand went up;
only a few did not. I then asked how many had received their final
report based upon that inspection. Not quite everyone raised their
hands, because issuing a final inspection report takes a while.
Then I asked how many had ever completed an audit of internal
control over financial reporting, and only half a dozen or so
out of the group indicated that they had.
is that most smaller audit firms have never completed an audit
of internal control over financial reporting before. Since the
adoption of AS5 this year, PCAOB staff have continued to work
on implementation guidance for auditors of smaller public companies.
The PCAOB obtained the assistance, on a voluntary basis, of 12
firms that had actually completed audits of internal control over
financial reporting for smaller public companies, those with market
capitalizations just over $75 million. These audit firms, together
with PCAOB staff and board member involvement, developed practical
advice based upon their experience that would be useful to firms
doing these audits of internal control for the first time. This
guidance was made public on October 22, 2007.
A small audit
firm may ask why the PCAOB is issuing this guidance so late in
the year. Nonaccelerated filers are not required to be audited
in connection with their 2007 calendar-year reports. For 2007,
management has to make an assertion with regard to the effectiveness
of their internal controls over financial reporting. Their auditor
may work with them, to a certain extent, in preparation for the
following year, but companies with $75 million or less in market
capitalization are not required to obtain an auditor’s opinion
on the effectiveness of internal control over financial reporting
until fiscal years ending after December 15, 2008, or in other
words, not until the spring of 2009, at the earliest. So they
actually have more than a year to get up to speed.
is genuinely eager to help them because, from the public-policy
point of view, we want these smaller firms to stay in the business
of auditing public companies. Most registered public-company auditors
have no more than five issuer clients. Generally speaking, those
clients won’t pay the auditor’s rent. Their main business
is probably a combination of private companies, local hospitals,
and nonprofit organizations, so the PCAOB definitely doesn’t
want them to throw up their hands and say, “I’ve never
done one of these. I’m just going to drop out of this business.”
The PCAOB wants qualified auditors to stay in the business of
auditing public companies, and we’re trying to help them.
There’s been a lot of talk about the lack of competition
because most of the large audit firms audit most of the public
companies What are your thoughts?
Gradison: A study is underway now by the Government
Accountability Office (GAO) on that very subject. The GAO was
mandated to do a similar study when Sarbanes-Oxley was passed
in 2002, and the report came out in 2003. So the GAO is working
on an update. The preliminary data I’ve seen indicate that
there is still a high degree of concentration.
want to get ahead of whatever the GAO report will say with regard
to the degree of competition, but a deeply held view among larger
issuers is that a Big Four is barely enough. Five would be better,
and three is unthinkable. Many larger issuers will use one firm
for their audit, another for their taxes, and so forth. Beyond
that, in some instances there is a high degree of industry concentration
within individual audit firms—for example, international
petrochemical companies. Among the smaller audit firms, however,
there is evidence of a very vibrant, competitive market. There
has been a fair amount of client switching from firm to firm.
We had more than 200 audit firms register with the PCAOB and then
de-register. But at the same time, even more firms have registered
for the first time. So the overall number of auditors, domestic
and foreign, has been going up.
We have about
1,800 registered audit firms now, about 1,000 in the United States
and about 800 in more than 80 foreign countries. However, not
all of those 1,800 are actually the principal auditor of a public
company. A fair number of registrants don’t audit any issuers,
but I suppose they hope to do so someday. Or maybe they think
it’s a good thing to have on their stationery.
Years ago, there was the Big Eight, then Six, then Five, and now
Four. When they filed their merger requests with the SEC, they
claimed that it would not affect competition. Yet now, they are
the loudest voices saying, “You have to protect us because
there’s a lack of competition.” So it makes one wonder
if growing too big to fail was their strategy all along.
Gradison: I look to the Justice Department or the
GAO or the Federal Trade Commission for expertise in that area.
It certainly is an ongoing concern, and we are monitoring it.
I have not run into anybody who, with the benefit of hindsight,
thinks that going after Arthur Andersen with criminal charges
rather than the individuals directly involved was a sound public
policy decision, but that’s water under the bridge.
You’ve talked elsewhere about the convergence of U.S. GAAP
and International Financial Reporting Standards (IFRS). Has the
PCAOB been involved with discussions with its international counterpart,
the International Accounting Standards Board (IASB)?
Gradison: Yes. Most directly, we are involved and
active in the International Forum of Independent Audit Regulators,
a relatively new organization made up of organizations like the
PCAOB, which are independent from the profession and who in general
register and inspect auditors. A number of countries are following
the lead of the United States in creating organizations with objectives
similar to those of the PCAOB. The European Union has passed its
Eighth Company Law directive requiring each of its 27 countries
to create such oversight entities. Not that they have or will
have 27 varieties, but we’re working very closely with them.
We had a meeting in Washington, D.C., earlier this year where
we invited the PCAOB’s international counterparts that wished
to share experiences. Canada, the U.K., and other countries are
well along in this area.
is evaluating these foreign entities on a bilateral basis—one
country at a time—for the degree of reliance that can be
placed upon the inspections done by our foreign counterparts.
We already have conducted joint inspections with a number of countries.
Curiously, although we have not hired inspectors with language
skills in mind (that was never a criterion), we’ve found
sufficient members of the PCAOB staff who are fluent in other
languages to meet our current needs. There are about 40 countries
where we will have to figure out how to do joint inspections.
to the other aspects of international auditing, the PCAOB is an
official observer of the International Auditing and Assurance
Standards Board, and our staff members participate in its meetings.
Frankly, I’m not sure it’s sustainable in the long
run to have three different auditing standards—one for international
auditing, the second (PCAOB standards) for audits of public issuers
in the United States, and a third set of standards by the Auditing
Standards Board of the AICPA for other entities.
the focus and the use of the term “convergence” has
largely been on accounting, I wouldn’t be surprised if at
some point more attention is given to some degree of convergence
in auditing standards as well. Accounting standards are an SEC
issue. The SEC will be making some decisions before long about
whether foreign private issuers in U.S. markets should be permitted
to use IFRS without reconciling them to GAAP. My sense is that
it’s likely to happen but I don’t have a crystal ball;
no one does.
As far as
whether U.S. companies should have an option to file their financial
statements in the U.S. under GAAP or IFRS, I’m less sure
what might happen, but it wouldn’t surprise me if some U.S.
companies might choose to file under IFRS if their principal competitors
are non-U.S. companies that would be filing under IFRS in the
U.S, simply so their financial statements are more comparable.
I do have a sense from talking to issuer representatives that
the cost of converting from GAAP to IFRS is fairly substantial
and often much more expensive than the first year, or years, of
SOX section 404. So, that may be a while in coming.
implications for the United States, where auditors in general
are not trained in IFRS. Most, if not all, large firms have people
who are trained and qualified in IFRS. Those firms could train
more people, if needed. I’ve also heard from at least one
accounting professor, the department head at a large school of
accounting, that he is getting requests to turn out some graduates
with a background in this field. Generally, students are not being
trained in the field, at least in part because the CPA exam doesn’t
cover international accounting standards. Several things would
have to happen in the profession’s infrastructure before
that change could take place. But it wouldn’t surprise me
to see movement in the direction of a single set of worldwide
accounting standards. Based on anecdotal input I’ve heard,
I’d estimate that it will take 10 to 15 years.
It seems like many organizations are trying to get into the auditing
oversight business. U.S. Treasury Secretary Henry Paulson appointed
an advisory committee on the auditing profession that met earlier
in October 2007. Is the PCAOB working with this committee to ensure
that there’s no overlap in responsibilities or duplication
Gradison: Yes, two groups were set up—the
one that you mentioned, and the SEC has set up an Advisory Committee
on Improvements to Financial Reporting. The PCAOB has observers
on both, and on all of their subcommittees. Our chairman, Mark
Olson, is one of those observers, as are other members of our
board, including me.
that I’m involved in, because it’s a matter of special
interest to me, involves auditor education. These are very impressive
groups of people and the scope of their thinking is very broad.
They are asking the right questions and they’ve commissioned
papers that are being developed rather quickly to help inform
them on these subjects. I don’t know what will come out
in the end, but I am impressed by the process.
the extent that the PCAOB has information that is useful to those
groups, our staff members have made presentations as well. Our
research people have shared some of their preliminary observations
with regard to the market impact of restatements, as one example.
In addition, the whole question of materiality is another area
where we’ve shared our thoughts.
Some critics allege that the PCAOB’s inspection process
is not truly transparent because they refer only to issuer A,
B, C, in the inspection reports, rather than actually identifying
the issuer. How would you respond to that?
Gradison: Sarbanes-Oxley prohibits the PCAOB from
saying more than A, B, C, with respect to audits of issuers, and
indeed goes further by prohibiting us from making public any information—even
A, B, C’s, if they involve unremediated quality- control
deficiencies that are identified through our inspections of the
audit firms. So only the very tip of the iceberg is in the public
portion. A few small firms have never responded to our efforts
to seek remediation. And there are a few firms whose quality-control
deficiencies have been made public on the PCAOB website because
of a failure to remediate. But in general that’s the last
thing these firms want to have happen. In the big firms, only
a handful of people see the complete nonpublic portions of the
inspection reports. In general, the engagement teams usually don’t
see the entire report. However, as permitted by the statute, the
PCAOB can and does issue reports that summarize our observations
across inspections without mentioning the name of the audit firm
or the name of the issuer.
yesterday [October 22, 2007], the PCAOB issued its first summary
of observations with regard to smaller audit firms. Specifically,
that report summarizes observations on almost 500 inspections
of smaller firms, and the objective was to let smaller firms know
the principal concerns that we identified. These issues didn’t
arise in every case, of course. That’s helpful because,
except in very rare instances, a small audit firm is inspected
only once every three years. And only they know what’s in
the nonpublic portion of their own report, unless they choose
to release it. This general report will give smaller firms a window
into what’s happening in other smaller firms that have been
inspected, so they can take an extra look at what is happening
in areas that may not have been identified in their own inspection
The PCAOB is now going after some unregistered auditing firms.
Some people have complained that this is not a good use of the
PCAOB’s resources. How would you respond?
Gradison: Actually the SEC, not the PCAOB, has taken
action against firms that appear to have lent their names to the
audits of issuers without being registered with the PCAOB. In
a few instances, the PCAOB has identified such firms and what
we’ve done pretty uniformly is to deny them registration—that
is, the ability to audit public companies for one year—after
which they can reapply for registration.
In September 2007, PCAOB board member Kayla Gillan announced that
she will be stepping down. How will that affect the dynamics of
Gradison: It will be a real loss to us in terms
of what she’s contributed, and the experience that she’s
brought. Kayla has brought particular insights into the concerns
of investors because she was general counsel for one of the largest
retirement systems in the world, the California Public Employee
Retirement System (CalPERS), before she joined the PCAOB.
is small—only five members. Board members were initially
appointed to varied and shorter time frames—one year, two
years, and so on—in order to ensure staggered terms for
members, and therefore continuity. Members may be reappointed
for a second term. Once the staggered terms end, each new board
member will have five-year terms with the option of an additional
five years. My total service will be seven years; Kayla’s
will be less than that.
another board member’s term will expire. The year after
that, mine does. Under the statute, these vacancies are filled
by the SEC acting as a body. I say it that way because one of
the issues that’s been raised in a lawsuit that questions
the constitutionality of Sarbanes-Oxley and the PCAOB is whether
the Constitution is violated by the fact that the SEC as a group,
rather than just the SEC chairman, names the PCAOB board members.
The case is now before the U.S. Court of Appeals.
when the suit was first filed that it would be decided by the
court in 2008, but now I think that’s totally unrealistic—probably
2009 or later because of the complexity of the case and the time
it takes to move through the appellate process.
Is there anything that we didn’t touch on that you would
like our readers to know?
Gradison: Yes: How delighted I am that we were able
to get together. It’s really important for the PCAOB to
have an opportunity to share our views and answer questions. Communication
is very important. A lot of people are impacted by what the PCAOB
does. When I was in public office, reaching the public was what
you had to do when you were running for office. PCAOB board members
aren’t running for office, we’re simply trying to
do a good job. The more people know about what we are doing, the
more likely they are to let us know what they think about us.
We want two-way communication. So, my bottom-line message to you
and your readers is: “Hey, folks, keep the cards and letters