A Regulatory Budget for the Public Company Accounting Oversight Board

• Jurisdiction: United States,Federal
• Publication year: 2022
• Citation: Vol. 38 No. 3

A Regulatory Budget for the Public Company Accounting Oversight Board

J.W. Verret
Delaware Court of Chancery, jayverret@gmail.com

[Page 881]

A REGULATORY BUDGET FOR THE PUBLIC COMPANY ACCOUNTING OVERSIGHT BOARD

J.W. Verret^*

Abstract

The Public Company Accounting Standards Board (PCAOB) was created by the Sarbanes-Oxley Act (SOX) in 2002 in response to the Enron and WorldCom auditing scandals. The PCAOB regulates the $20 billion annual auditing industry, which itself provides assurance for the financial integrity of $27 trillion in outstanding global publicly traded equity. The PCAOB is uniquely a quasi-private entity overseen by the Securities and Exchange Commission (SEC), which approves its budget and must approve any changes in its rules. The PCAOB has undertaken initiatives to attenuate the cost-benefit calculus of its rules, most notably in a change from Auditing Standard 2 to Auditing Standard 5, to reduce the compliance costs of auditor attestation of internal controls required by § 404(b) of the SOX. This Article provides the SEC with a regulatory budget rubric, crafted on similar models implemented in the United Kingdom and Canada, to help the SEC fulfill its oversight function over the PCAOB by tracking a regulatory budget for the PCAOB.

[Page 882]

CONTENTS

Abstract................................................................................881

Introduction.........................................................................883

I. Sarbanes-Oxley and the PCAOB..................................884

II. Regulatory Budgeting Basics & Their Relevance to SEC Oversight of the PCAOB.....................................888

A. How Regulatory Budgeting Works.............................889
B. What Other Countries Have Implemented.................890
C. Applying Lessons in Regulatory Budgeting to the PCAOB.......................................................................893
D. Insights from the Academic Literature on Regulatory Budgeting.................................................................... 898

III. Agency Design Theory and Public Choice Analysis..........................................................................902

IV. SEC Oversight of PCAOB As Ideal Test Case for Regulatory Budgeting: Initial Questions and Legal Authority.......................................................................904

V. Measuring Costs and Benefits for a PCAOB Regulatory Budget......................................................907

A. Process Questions in Cost Estimation ....................... 908
B. Process Issues in Benefits Estimation ........................ 912

VI. Prior Empirical Literature to Inform Setting the Initial Regulatory Cost Allocation or Baseline .. 917

A. Benefits.......................................................................917

1. Impact of SOX Section 404(b) Adverse Findings on Restatements ......................................................... 917
2. Macroeconomic Benefits from SOX Generally .... 925
3. Benefits from PCAOB Inspection Regime, Enforcement, and Auditor Independence Rules ... 926

B. Costs...........................................................................930

1. Direct Compliance Costs (with Particular Attention to SOX Section 404).............................................930
2. Indirect Costs ....................................................... 933
3. Impact on Small Firms ......................................... 934
4. Miscellaneous Costs ............................................. 935

VII. PCAOB Options to Respond to a New Regulatory Budget.............................................................................936

Conclusion............................................................................939

[Page 883]

Introduction

The Public Company Accounting Oversight Board (PCAOB) regulates the public-accounting auditing industry, which reviews and audits the financial statements of all publicly traded companies in the United States to determine whether there are material weaknesses.¹ The auditing industry also examines internal controls that buttress the process of generating financial statements to determine whether that process is subject to material weaknesses.² The PCAOB has an annual budget of some $310 million (paid for by public companies and their shareholders).³ The PCAOB regulates a $20-billion-a-year public-accounting auditing industry, which is responsible for assuring the integrity of the financial statements of all public companies and broker-dealers (effectively making the PCAOB responsible for the integrity of most of the $27 trillion of public equity outstanding in the United States).⁴ This Article adapts lessons from regulatory budget processes in other countries to develop suggestions for how a regulatory budget could assist the Securities and Exchange Commission's (SEC) oversight of the PCAOB.⁵ Unique issues in measuring the costs and benefits of auditing regulation are considered, and a literature survey of auditing academic research is offered.⁶ The Article closes with initial suggestions for the PCAOB to adjust its regulatory priorities and alter the design of its approach to meet a future regulatory budget initiative.⁷

[Page 884]

This Article focuses on Section 404 of the Sarbanes-Oxley Act of 2002 (SOX 404)—a particular rule implemented by the PCAOB requiring that auditors attest to the viability of internal control processes implemented by public companies—because that rule is one whose costs tend to be both significant and discretely measurable. Although the regulatory budget process suggested in this Article focuses particularly on SOX 404, the lessons of this Article apply more broadly to all of the regulatory activities undertaken by the PCAOB.

To be clear, this Article focuses on establishing an institutional mechanism to measure and formally track the costs of PCAOB regulations to assist the SEC in its oversight of the PCAOB. These costs are primarily the costs to public company issuers and not the compliance costs imposed on auditing firms themselves. Paradoxically, auditing firms are likely to benefit from increases in audit requirements because they have strong pricing power given the level of consolidation in the market for large firm audits. It may prove necessary to entirely omit the direct cost of audit firm compliance from the process offered here.

I. Sarbanes-Oxley and the PCAOB

In response to nationally prominent accounting fraud scandals at Enron, WorldCom, and a number of other companies, Congress passed, and the President signed, the Sarbanes-Oxley Act (SOX) into law in 2002.⁸ This law enhanced regulation of the auditing profession, required company executives to certify the effectiveness of their internal control systems to maintain the integrity of their accounting processes, and required annual external audits of company internal controls for most publicly traded companies.⁹

SOX also created the PCAOB, a regulatory body charged with overseeing public company audits.¹⁰ The PCAOB replaced a self-regulatory body that had previously overseen the auditing

[Page 885]

profession through a peer review system and the promulgation of auditing industry best practices.¹¹ The PCAOB is overseen by the SEC because its rules and annual budget must be approved by the SEC.¹² The PCAOB's central functions involve registration of public company auditors, auditing standard setting, inspections, and enforcement actions.¹³

Chief among the SOX requirements are §§ 302 and 404(a) (SOX 302 and SOX 404(a)), which requires publicly-traded company management to assess the effectiveness of their internal control systems and report any significant deficiencies or material weaknesses in their internal controls to their board of directors' audit committee and to their external auditor and § 404(b) of the SOX (SOX 404(b)), which requires outside auditors to attest to management's representations regarding the validity of those internal controls and to disclose whether material weaknesses exist in those internal controls.¹⁴

The SEC provided an exemption for smaller publicly traded companies (less than $75 million market capitalization) from the SOX 404(b) attestation requirement, which was subsequently codified in the Dodd-Frank Wall Street Reform and Consumer Protection Act of 2010 (Dodd-Frank Act).¹⁵ Smaller companies that are exempt from SOX 404(b) are still required to comply with SOX 302 and 404(a).¹⁶ The SEC expanded that exemption to include companies that make less than $100 million in annual revenue.¹⁷

[Page 886]

one survey in the wake of soX implementation found that soX was associated with an average fee increase of $2.3 million at the average Fortune 1000 company.¹⁸ SOX 404 was the most expensive component of that initial cost increase.¹⁹ The initial auditing standard that the PCAOB used to implement SOX 404(b)'s internal control attestation requirement was Auditing Standard 2 (AS 2).²⁰ That standard was criticized by the issuer community and by some at the PCAOB itself as resulting in excessively high increases in audit fees (relative to the pre-sarbanes oxley environment), being excessively duplicative and cumbersome, and being unlikely to help uncover material weaknesses in internal controls.²¹

The initial approach to soX 404 implementation adopted by the PCAOB under AS 2 was criticized as overly focused on process controls, rather than an analytical approach grounded in risk assessment of where internal control deficiencies were deemed likely to arise.²² The SEC issued guidance in 2007 suggesting a move toward a risk-based approach to internal control auditing.²³ The PCAOB ultimately responded to pressure from the sEC with the adoption of Auditing Standard 5 (AS 5), which embraced a risk-based approach that resulted in decreased auditing fees.²⁴ Although the ultimate reduction in auditing fees was expected, it was in no way metered or grounded in a holistic economic analysis of the optimal...