Audit Industry Concentration and Potential Implications

I would like to welcome our regulatory guests from over 40 jurisdictions around the world to the Public Company Accounting Oversight Board's 11^th Annual International Institute on Audit Regulation.^[*]

Today, I want to talk about the potential implications of the high level of concentration in the audit market, a topic that I believe warrants serious examination by all of us. I briefly touched on this subject in May at the Canadian Public Accountability Board 2017 Audit Quality Symposium when I noted a growing concern in the United States about whether the Big Four have become either too big or too few to fail.^[1]

The recent events in South Africa's audit market^[2] highlight why this topic has to be considered now. It is no longer merely theoretical. Regulators in other jurisdictions have begun to do so and the most recent PCAOB Strategic Plan also recognizes "the potential for catastrophic risk within the audit industry."^[3]

Let me take this moment to commend Bernard Agulhas for his principled and effective leadership as the Chief Executive Officer of the Independent Regulatory Board for Auditors in South Africa.^[4]

Under our federal securities laws, any public company that raises money through our capital markets, or has securities listed on an exchange, must hire an independent public accountant to audit its financial statements. As a result, auditors have a unique franchise and also a critical responsibility to investors and the markets.

This franchise, however, is only as valuable as the public confidence investors have in the audits being performed by an independent auditor. If investors do not believe that auditors are independent, they may not trust the financial information that is reported by companies, thereby increasing the cost for such companies to raise capital.

Current State of Market Concentration

Over the past 30 years, as a result of consolidations and other events, we have seen the number of large global audit firms decrease from eight to four. The majority of large global corporations use the Big Four accounting firms for auditing their financial statements.

In the United States, these firms collectively audit approximately 97 percent of the total U.S. market capitalization.^[5] Audit market concentration figures are even more pronounced in certain industries where only one or two firms dominate. For example, in the U.S. telecommunications services sector, one firm audits approximately 92 percent of the S&P 500 market capitalization while in the energy, materials, and information technology sectors, only two firms audit approximately 75 percent of the S&P 500 market capitalization of each sector.^[6]

In Europe, the Big Four perform almost 70 percent of the statutory audits of public-interest entities, based on a recent report by the European Commission.^[7] In the United Kingdom, for year-end 2015, these firms dominated the audits of FTSE 100 and FTSE 250 companies.^[8]

The market for audit services in some countries is even more concentrated because only a few of these firms conduct audits in those markets.

Potential Implications on Audit Quality and Audit Oversight

Given this level of concentration, investors have raised concerns as to whether the status quo results in lower quality audits and reduced investor protection, and whether our financial markets could cope if one of the Big Four were to fail or exit the field. In other words, are the Big Four too big or too few to fail?^[9] And can regulators respond effectively to unscrupulous auditor behavior if they fear their actions could potentially lead to less competition in the audit industry?

Many, indeed, believe there is little to no appetite among regulators, investors, or even audit clients, to see the Big Four become the Big Three.

Under this scenario, the Big Four firms could increasingly feel secure in their position vis-à-vis audit regulators. Accordingly, auditors could be tempted to eliminate certain audit procedures to reduce costs, take on riskier clients, acquiesce to management's demands, or aggressively expand their riskier non-audit services under the banner of a trusted audit firm brand, which would only increase the already continued high rates of audit deficiencies.^[10] Investors thus wonder, have the Big Four already adopted the attitude that they are too big to fail?

Needless to say, the failure of an audit firm would further aggravate this moral hazard of the "too big to fail" problem.

Potential Implications on Financial Markets

In addition to the risks to audit quality, our financial markets would face significant disruptions if one of the remaining Big Four failed, or was put out of business, like Arthur Andersen, or if one of these firms decided to exit the audit industry in order to focus on its lucrative consulting and advisory service offerings.^[11]

The European Commission has suggested that the collapse of a firm "… that has reached 'systemic proportions' could disrupt the whole market."^[12] A collapse by one of the Big Four today could cause paralysis in the financial markets as the resulting "Big Three" would almost certainly be too few to ensure an adequate degree of competition in large-company audits.

We have already witnessed the effects of a large audit firm failure on our financial markets. When Arthur Andersen collapsed in 2002, approximately 1,300 companies had to find new auditors and faced potential compliance issues with a number of provisions under the federal securities laws.^[13] The Securities and Exchange Commission had to take "necessary and immediate regulatory actions to assure a continuing and orderly flow of information to investors and U.S. capital markets" to minimize any potential disruptions from Andersen's indictment.^[14]

Today, should one of the Big Four fail or decide to exit the audit market, the implications for the financial markets could be even more severe as companies would face greater obstacles in finding a new auditor because of (i) limited competition in many geographical markets where some of these firms do not have a strong presence, (ii) a lack of sufficient auditor expertise in particular industries by the remaining firms, (iii) the other firms not being independent, due to the provision of non-audit services, and (iv) a reluctance on the part of the company to retain a competitor's auditor.

Suggested Actions

Due to the covenant between auditors and the public established under our federal securities laws, and the "public watchdog" function of auditors,^[15] regulators should be provided information that will help them assess the financial stability of the firms and anticipate possible risks to a firm's ability to conduct high quality audits.

In the interests of pursuing this goal, I would like to highlight three specific actions, all of which were recommended by the 2008 Bush Administration Treasury Department's Advisory Committee on the Auditing Profession Report, which were also recommended at past meetings by the PCAOB Investor Advisory Group ("IAG").

At this year's IAG meeting, members recommended by unanimous consent that the Big Four provide annual audited financial statements. This information would provide regulators with valuable insight about a firm's health and integrity through disclosure of their financial leverage and liquidity levels, as well as the adequacy of their insurance, whether self-provided or provided by third parties. Regulators would also gain a better understanding of the firms' leadership priorities by monitoring the growth of and investments made into the various service lines.

Regulators could use such information to evaluate the risks that different business lines pose to one another or anticipate and mitigate challenges to a firm's ability to conduct high quality audits, which brings me to the second action: requiring firms to create "living wills." Certain financial institutions are already required to provide living wills under the Dodd–Frank Wall Street Reform and Consumer Protection Act ("Dodd-Frank Act").^[16]

The 2008 financial crisis exposed weaknesses across the financial system, including a need to prepare for the potential failure of certain financial firms. In response, the Dodd-Frank Act required those banks to craft living wills. This process has produced tangible plans, with real playbooks to guide banks and regulators for an orderly process should a bank fail in the future.

Many of the reasons for requiring certain financial institutions to have living wills apply in the case of the Big Four. Individually, based on reported revenues, each of the Big Four firms would be included in the Fortune 500, and two would be included in the Fortune 250. Globally, these firms employ approximately 900,000 people. If you combine the fifth to eighth largest accounting firms in the U.S., the combined entity would not be close, in terms of revenue or size, to the smallest of the Big Four.

Given their significance to our capital markets and the potential implications if one of these firms were to fail, these firms should also be required to devise "living wills," providing for an orderly winding down should a firm get in trouble, thereby ensuring minimal disruption to the provision of audit services to the markets. This process should entail firm leaders evaluating, for example, (i) the different risks applicable to each service line that could put their firm in peril; (ii) how those risks might impact other service lines through reputational, licensing, or other means, including any cross-subsidization or dependencies between service lines; and (iii) actions that may mitigate or contain those risks.

Lastly, investors continue to call for firms to have independent board members on their governance boards. I understand that this is already a requirement in some countries. Requiring independent board members would align the profession with mandated and basic sound corporate governance practice.

Conclusion

The Big Four firms play a unique role in our capital markets. This, in turn, makes it incumbent on audit regulators to examine potential catastrophic risks within the industry, including risks posed by the current high level of concentration, to protect the interest of investors in promoting high quality audits.

Should the number of large audit firms decline, not only could this exacerbate an already unhealthy level of concentration, but also harm investor protection and, some believe, disrupt the viability of the whole financial system.

Thank you. I look forward to your questions.

Questions and Answers

Q&A: The Monitoring Group Consultation Paper

Question regarding matters discussed in the Monitoring Group Consultation Paper: The Monitoring Group is a group of international organizations with a shared commitment to overseeing the governance arrangements for international audit-related standard setting. The international standard-setting boards operating under these arrangements include the IAASB (addressing audit standards) and the IESBA (addressing ethics standards). In November, the Monitoring Group issued a consultation paper setting forth its concerns about the current governance model and seeking input on possible reforms.^[17]

Board Member Harris, based on your experience in helping to craft the Sarbanes-Oxley Act of 2002, do you have any reaction to the Monitoring Group's consultation paper and its call for reforms to the current model governing international audit standard setting?

Response by Board Member Steven B. Harris: Yes. I recommend everyone to read this paper, as I believe it raises legitimate questions. The paper notes at the outset that "questions have been raised about the independence of the standard setting process and its responsiveness to the public interest (emphasis added)."^[18]

The Monitoring Group further notes, in part, that "there is a legitimate concern among many stakeholders that the influence of the profession is at least perceived to be too strong and that addressing this issue could further strengthen public confidence."^[19]

I share these concerns about the independence of the international audit and ethics standard setters. Today, a majority of the governing boards of both of the audit and ethics standard setters is not independent of the profession, nor are their funding sources. As a result, the standards remain open to what I consider to be legitimate concerns that they may be susceptible to a standard setter's form of regulatory capture.

Self-policing didn't work well in the United States. Prior to 2002, the SEC looked to private organizations affiliated with the accounting profession to set auditing standards. Accounting firms or their representatives controlled or funded those organizations. As a result, standards tended to be written through the lens of the profession as opposed to the lens of investor protection.

Concerns about the independence of the standard-setting process were squarely addressed in the United States in 2002, with the passage of the Sarbanes-Oxley Act, in the aftermath of Enron, WorldCom, and a host of other accounting scandals. I believe the PCAOB's assumption of plenary authority over audit standards was essential. So, too, was its independent funding. These measures are intended to safeguard the PCAOB's ability to carry out its mission to "protect the interest of investors and further the public interest" when establishing auditing standards.

For the international audit and ethics standard setters to free themselves of perceptions of conflict of interest or regulatory capture, I believe a clear majority of their governing boards should be independent of the profession. They also need a source of funding that is not secured through the accounting firms.

Technicians should certainly be involved in the drafting of standards but the policymaking choices should be made by public officials who are committed to investor protection.

The Consultation Paper also raises "stakeholder concerns about the timeliness and relevance of the standard-setting process…"^[20]

I share these concerns and would note that, on average, it takes audit and accounting standard setters in the United States and internationally five to 10 years to adopt a major standard.

Compare that to how long it took the United States to land a man on the moon. President Kennedy challenged Americans to do just that in 1961^[21] and the mission was accomplished in 1969. Eight years.

I think we all have an obligation to demonstrate the need and define the problem to be addressed before considering any standard, but once that is done, standards should be adopted in a far more timely fashion than is currently the case.

I consider the current timeframes to be unacceptable. I also think we must strive to reduce the complexity and length of our standards whenever possible, which may also speed up their adoption.

Finally, before contemplating any new standard-setting initiative, I believe all audit and accounting standard setters should reach out first and foremost to the investor community, which is the primary constituency of standard setters and the audit profession alike.

The Consultation Paper raises a number of other issues. For example, it includes "the option for a single independent board responsible for setting auditing and assurance standards and ethical standards for auditors …" and goes on to state that "[t]here may be advantages to integrating the development of auditing and assurance standards …"^[22] I think this is an option well worth considering.

In sum, I recommend the paper and encourage each of you to bring it to the attention of the users of audited financial statements in your countries, and urge them, in turn, to add their voices to the constructive debate regarding the issues raised by the paper.

Q&A: PCAOB Standard-Setting Initiatives

Question regarding topics of importance to investors: The PCAOB Investor Advisory Group, which you chair, and the Board's Standing Advisory Group recently held separate meetings. What were the most important topics of discussion in your opinion?

Response by Board Member Steven B. Harris: There are two key topics that stand out: (i) the auditor's role with regard to non-GAAP measures; and (ii) the auditor's consideration of a company's noncompliance with laws and regulations.

Both topics are of importance to investors and are listed as research topics in our most recent standard-setting update.^[23]

Non-GAAP Measures

Both groups felt that continuing to examine the auditor's role regarding non-GAAP measures should be a high priority for the Board. Some observations included:

• The use of non-GAAP measures has increased over the years. For example, in 2016, approximately 88 percent of S&P 500 companies reported one or more non-GAAP measures in their fourth-quarter earnings releases.^[24]

• Earnings reported under non-GAAP measures often are higher than GAAP reported amounts. For example, approximately 86 percent of companies reported higher non-GAAP net income than what they reported in their GAAP financial statements.^[25]

• Investors are increasingly using non-GAAP measures in their financial analysis. However, there is little standardization in the way companies define and calculate these measures, making comparability difficult among companies.

Both our Investor Advisory Group ("IAG") and Standing Advisory Group ("SAG") encouraged the Board to move forward with making the auditor's responsibilities for non-GAAP measures more rigorous than the current requirements.^[26]

To promote consistent reporting and presentation across companies and industries, the PCAOB's IAG recommended that non-GAAP measures be defined and disclosed as part of the financial statements so that they would be subject to independent validation as part of the audit. If such measures remain outside of the company's audited financial statements, IAG members recommended that they should be clearly defined by management and auditors should examine them for compliance with the company's definition.^[27]

Additionally, I believe – and this was also mentioned at both group meetings – that it is important for the Board to consider the auditor's involvement in environmental, social and governance ("ESG") reporting. Investors increasingly consider ESG metrics when making investment decisions.^[28] This information is provided through supplemental disclosure but, here as well, comparability is difficult due to a lack of uniform standard reporting.

Investors believe they will benefit if the auditors are required to also examine this information.

Against this background, I believe it is very important for the Board to remain focused on this research topic with a view to exploring possible standard-setting approaches. Investors are clearly interested in using this type of information in their analysis and are looking for an enhanced auditor's role.

I would note that ESG reporting is currently required in a number of countries and I firmly believe that such reporting and some form of assurance is the wave of the future.

Auditor's Consideration of Noncompliance with Laws and Regulations

Over the last several years, there have been a number of high-profile cases involving company violations of consumer fraud and banking regulations, as well as laws and regulations that relate to the Foreign Corrupt Practices Act, and environmental and product safety requirements.

The PCAOB's research project on this topic is focusing on whether existing standards are sufficiently clear to investors and auditors, and whether the current scope of auditor responsibility to detect, investigate, and report on illegal acts is adequate from an investor protection point of view.

This topic was also discussed at the recent meeting of the PCAOB's Investor Advisory Group. At this meeting, investor representatives indicated that investors expect auditors to do more in uncovering noncompliance with laws and regulations. They also expressed concerns that auditing standards in this area are outdated, confusing, and inconsistent among audit regulators. They advocated strengthening the auditor's responsibilities to better protect investors by:

• Expanding the auditor's responsibility to detect illegal acts;
• Improving the auditor's assessment of risks relating to illegal acts, including the audit response;
• Developing more robust requirements around the auditor's understanding of a company's whistleblower programs; and
• Expanding management representations to the auditor about illegal acts or possible illegal acts.^[29]

Last week at a meeting of the PCAOB's Standing Advisory Group, some SAG members expressed support for enhancing the auditor's responsibilities, whereas others expressed caution regarding potential overreach of further auditor requirements that would be outside the scope of the auditor's qualifications.^[30]

The PCAOB's work in this area is ongoing but, given the feedback we have received to date, I believe there is considerable room for improvement in the existing requirements for auditors to detect, investigate and report on a company's noncompliance with laws and regulations and that the Board should adopt additional requirements here as well.