Speech by SEC Staff:
Remarks Before the American Institute of Certified Public Accountants

by

Stephen M. Cutler

Director, Division of Enforcement
U.S. Securities and Exchange Commission

Washington, D.C.
December 12, 2002

The SEC, as a matter of policy, disclaims responsibility for any private publication or statement by any of its employees. The views expressed herein are those of the author and do not necessarily reflect the views of the Commission or the staff of the Commission.

Good afternoon. Thank you for inviting me here today. I rarely have the opportunity to address the accounting and auditing professions outside of a Wells meeting or a litigation release.

Today I'd like to share with you my views — and they are only my views and not those of the Commission or its staff — on why I think we should consider a new enforcement paradigm when it comes to accounting firms. But first, let me place this discussion in context.

As you well know, over the last year, we have found ourselves in a period of seemingly unprecedented corporate fraud. Despite a system and enforcement of laws universally regarded as having fostered the deepest, most liquid, and most trusted markets in the world, some of America's largest and most well-known companies have been rocked by accounting scandals.

At the SEC, we recently completed our 2002 fiscal year. When our fiscal year ends, we engage in the exercise of reducing our activities of the preceding 12 months to a series of statistics. So, while I was fully confident as I lived through it that the past year was a remarkable one in the world of securities enforcement, we now have proof. We filed a record number of enforcement actions last year, both program-wide and in the financial reporting area in particular. If you go back to 1999, the SEC brought 79 cases involving allegations of improper accounting, inadequate disclosures, or outright financial fraud. Last year, we brought more than double that number — 163 cases. But none of the numbers can convey the remarkable nature of our cases last year as vividly as a simple iteration of the names of some of the companies involved: Xerox, WorldCom, Rite Aid, Adelphia, Tyco, Enron, Waste Management, Dynegy, Edison Schools, Homestore, Microsoft, PNC Bank, Amazon.com.

While I believe the causes of this phenomenon are multiple, a significant contributing factor was the laxity of the so-called gatekeepers — the accountants, lawyers, research analysts, board members and others controlling access to our capital markets. Perhaps foremost among these is the auditor. Although the offering process today is cluttered with consultants and advisors, the only one who is absolutely necessary — as a legal matter — to a company's effort to offer securities to the public is an auditor. With this franchise, however, comes the heavy responsibility of acting as the investor's guardian. Yet, too often during the last half-dozen years, public auditors have failed to protect the investor. Rather than lending their expertise to ensuring that a company's financial statements accurately depicted its financial situation, auditors too often have been tools for achieving better — or, more accurately, the appearance of better — financial results. Instead of jealously guarding the gateway to the markets, as they were intended to do, they have thrown open the gates of our capital markets to companies whose financial statements reflected more aspiration than fact.

The willingness of some auditors to relax the traditional skepticism required by their role may be traced in part to changes that have occurred in the accounting industry. Accounting firms have grown, merged, and consolidated. The former Big 8 are now the Big 4. Accounting firms also have expanded into global multidisciplinary operations, competing with consulting firms and law firms in providing a wide variety of services.¹ In short, the profession has become less of a profession and more of a business: auditors being compensated for business acumen rather than auditing ability; competence, training and expertise taking a backseat to marketing and rainmaking.

Add to this the fact that auditing services were becoming less important to the accounting firms' bottom line: Between 1988 and 1998, the average percentage of Big 5 firm U.S. revenues attributable to audit-related services fell from 55% to 31%.² Also during that period, revenues from consulting services grew almost 3 times as quickly as revenues from audit services.

Perhaps as a result, firms became more focused on what it takes to be a good consultant rather than on what it takes to be a good auditor. And while, as auditors, accounting firms were supposed to be looking over management's shoulder, as consultants, they were working for and with management. In my view, this is one of the reasons that the economic pressure that consulting work imposes on the integrity of the audit function is far more corrosive and damaging than any pressure inherent in the fact that companies pay accounting firms for audits. Non-audit work allies the audit firm with management, potentially undermining the skepticism necessary to the performance of a rigorous audit.

Moreover, an issuer cannot fire its auditor without paying a significant price in the marketplace. A public company might be able to change auditors once in a blue moon, but do it more often than that and wary shareholders may dump the stock. In contrast, changing consultants goes virtually unnoticed in the marketplace. As a result of these market dynamics, the ability to give or withhold consulting work gave companies more leverage than the prospect of terminating an existing audit relationship. Thus, ironically, audit firms' diversification, and their resulting economic reliance on non-audit services, may have enhanced, rather than diminished, the power of a public company to pressure its auditor.

At the same time, the pressure being brought to bear on auditors by management was increasing. Officers at public companies were deriving more and more of their compensation from incentive-based stock and option packages, making them increasingly keen on meeting Wall Street's earnings targets. Investors were demanding that public companies produce results in shorter and shorter timeframes, and senior managers stood to lose princely sums if they could not meet these expectations. Indeed, it was not uncommon for the market to punish companies that missed their quarterly earnings targets by only a penny or two. The combination of the growing commercialization of the audit profession and the pressure on management to obtain their auditors' sign-off on finessed or fraudulent financials was a recipe for compromise and accommodation. And in the arena of financial reporting, compromise and accommodation can lead to disaster for investors.

Let me pause here to note the obvious: these changes have not gone unnoticed by the Commission or Congress. Two years ago, the Commission adopted new auditor independence rules. And this past summer, of course, Congress passed the historic Sarbanes-Oxley Act, which addresses the integrity of the financial reporting process in a multiplicity of ways.

So, why didn't the risks to auditors of passing on inaccurate financials impel them to hold up those financials instead? Why did they apparently believe they stood a good chance of getting away with it, so to speak?

One answer may lie in the changes in the legal landscape during the last decade, which substantially limited the exposure of secondary actors to private securities fraud liability. The first step down this path came with the Supreme Court's 1994 decision in Central Bank of Denver,³ which eliminated aiding and abetting liability in private lawsuits under Section 10(b) of the Exchange Act. Since professionals like auditors frequently are viewed as having only an indirect or secondary role in the fraud, Central Bank significantly limited their legal exposure in most settings. In 1995, with the passage of the Private Securities Litigation Reform Act of 1995 (PSLRA), Congress confirmed that an aiding-and-abetting theory could be pursued only by the SEC (not by private plaintiffs). The PSLRA also limited joint and several liability and placed other restrictions on securities class actions that continue to shape most such litigation today.

But let's turn from the subject of private litigation to one that hits closer to home — the role of the enforcement process. It's that role that I want to explore in the balance of my remarks. Specifically, the Commission seldom has sought to charge accounting firms for their role in financial reporting frauds. Instead, when improper accounting or auditing has contributed to such a failure, the Commission typically has viewed the misconduct as a failure by an individual auditor rather than by the firm.

Now I don't think there is any question that the Commission has pursued such individual misconduct aggressively. (And just in case you were wondering, I think I can safely say that you should expect more of the same in the near future.) But to revisit the past, in the last few years, the Commission has charged two Deloitte partners in connection with the firm's audit of Fine Host Corporation,⁴ an Andersen partner in connection with that firm's audit of Golden Bear International,⁵ another Andersen partner in connection with the firm's audit of Sunbeam Corporation,⁶ a KPMG Peat Marwick partner in connection with that firm's audit of the Rockies Fund, ⁷three Coopers & Lybrand partners in connection with that firm's audit of Allegheny Health, Education and Research Foundation,⁸ and two other Coopers auditors (one a partner and one a manager) in connection with that firm's audit of California Micro Devices Corporation.⁹ Yet the story is entirely different when it comes to charging the large accounting firms. In none of these cases did the Commission sue the individual auditors' firms. Indeed, you can count on your fingers the number of times that the Commission has sued a Big Four or Big Five or Big Six or Big Eight accounting firm in the last quarter century for an audit failure caused by one or more of its partners.

At this point, let me state an unpopular, but indisputable fact: the Commission has the authority to bring enforcement actions, both in federal court and administratively, against accounting firms based on the conduct of their partners. This will come as no surprise to anyone who has surveyed the Commission's record of enforcement proceedings. Just last fiscal year, the Commission has filed enforcement proceedings relating to alleged independence violations against three of the Big 4 firms — KPMG,¹⁰ PricewaterhouseCoopers,¹¹ and Ernst & Young.¹²

But, what about outside the independence context? Can we charge accounting firms then? The answer — again unpopular here, but still incontrovertible — is yes. The Commission has the authority to bring enforcement actions against accounting firms outside the independence context. One example of this, rare though it is, was our case against Arthur Andersen in June 2001.¹³ In that action the Commission alleged that Andersen and several of its partners committed fraud in connection with the firm's audit of the financial statements of Waste Management. The Commission obtained permanent injunctive relief and a $7 million penalty, and also censured Andersen for improper professional conduct.
So why are such actions so rare? It's not due to any limitation on the Commission's legal authority. It is hornbook law that partners may bind a partnership, that an agent can bind its principal, and that under the principles of enterprise liability, the conduct of a partner can be imputed to his firm. All of these theories support holding firms accountable for the actions of their partners. The Commission's enforcement record — or lack of a lengthy enforcement record — when it comes to firm liability for an audit failure is a product of prosecutorial discretion, not legal inability. It is an exercise of discretion that has resulted in a presumption that the misconduct of individual audit partners normally will not be laid at the feet of the firm as a whole.

Historically, the Commission has sued a firm for an audit failure only when senior management of the firm was involved in some way in the audit. In the Andersen/Waste Management matter, for example, the Commission stressed that its decision to sue the firm for fraud turned at least in part on "the positions within the Firm of the partners who were consulted by the engagement team," as well as "the gravity and duration of the misconduct, and the nature and magnitude of the misstatements."¹⁴ In short, absent egregious conduct in which senior firm managers participated or acquiesced, the Commission typically has elected not to pursue a case against the firm itself.

Some may argue that it is unreasonable to expect a firm to control the actions of thousands of employees conducting audits around the world. But why should an accounting firm be allowed to routinely disassociate itself from the actions of its partners? Shouldn't the Commission use all of its enforcement tools to do everything it can to make audit quality a firm priority? Faced with the prospect of liability in Commission actions, it is my hope that accounting firms will take an even greater role in ensuring that individual auditors are properly discharging their special and critical gatekeeping role. The Commission's historic reluctance to charge accounting firms may have had the unintended consequence of holding accounting firms to a lower standard rather than to the high standard their special role demands.

Thus, I believe the Commission should recalibrate its enforcement approach when it comes to audit firms. It is time to adopt a new enforcement model — a new paradigm: one that holds an accounting firm responsible for the actions of its partners; one that reverses the current presumption against suing firms for an audit failure, no matter how improper the individual auditor's conduct.

As I have noted, I don't think there is much question that a different approach is legally sound. Equally important, however, is that this approach is fair. And I think it is fair because audit work supplied by an accounting firm is very much a product of that firm's culture, personnel, systems, training, supervision, and procedures. If that product is defective, the causes may well be found in the firm. The current practice of suing individual auditors without also charging their firms may not adequately reflect — at least in some cases — the role and responsibility of firms in these matters.

In implementing a different approach to accounting firm liability, we need look no further than the Commission's approach to issuer liability, where the relevant question is not "should the company be charged?" but is instead, "are there reasons why on this particular occasion the company should not be charged?" Where public companies are concerned, the Commission recently published a 21(a) report explaining the factors it considers in deciding whether a company should not be subject to an enforcement action.¹⁵ In my view, the principles discussed in this report should be made equally relevant to determinations whether or not to charge an accounting firm for an improper audit.

Specifically, the Report identifies four broad measures of a company's cooperation:

1. The first is self-policing. Prior to the discovery of the misconduct, did the company establish effective compliance procedures? Did it have an appropriate tone at the top? In the audit firm context, evidence of a commitment to self-policing might include: an appropriate means for managers and others to report misconduct or misgivings in connection with an audit without fear of reprisal and a strong internal compliance staff charged with conducting meaningful reviews of audit work. An appropriate tone at the top might be characterized by the presence of top management who are committed to making tough decisions that may cost the firm business in the short run or require delivering unwelcome news to clients. A firm also should have in place procedures to ensure that the hard decisions are vetted at a high level, rather than made by an individual partner in the field. A firm will not fully realize the benefits of having an appropriate tone at the top if the diciest decisions never make it to the desks of senior management. I should add here that Commission actions encouraging this type of environment would dovetail with the Public Company Accounting Oversight Board's (PCAOB) mission to, among other things, adopt and enforce ethics standards for accounting firms.¹⁶
    
2. The second factor is self-reporting. When misconduct was discovered, did the company conduct a thorough review of the nature, extent, origins and consequences of the misconduct, and promptly, completely, and effectively disclose the misconduct to regulators and the public? In the case of auditors, did they report it as well to the Audit Committee of their client? Accounting firms should become accustomed to obtaining the same kind of forensic analysis of their own missteps as they provide for their clients. Moreover, they should be prepared to make that analysis readily available to regulators — and I'm not talking about dog and pony shows — if they want to avoid firm liability.
    
3. The third factor is remediation. Did the company dismiss or appropriately discipline wrongdoers, modify and improve internal controls and procedures to prevent recurrence of the misconduct, and appropriately compensate those adversely affected? Meaningful remediation requires an accounting firm to go beyond simply removing an audit partner involved in misconduct from the audit engagement; firms should consider termination or other forms of discipline in such situations. In addition, they need to ensure that the entire audit team — down to the manager or staff level, where appropriate — has been adequately disciplined and/or has received the sort of remedial training necessary to ensure that they take appropriate steps in the future to inform the firm when they see something amiss. Firms should also consider whether it would be appropriate to make recompense to the shareholders of the audit client, or at least, to refund the client's audit fees.
    
4. The fourth factor is cooperation with law enforcement authorities. Did the company provide the Commission staff with all information relevant to the underlying violations and the company's remedial efforts on a timely basis? Such cooperation must be meaningful and complete from the outset of the Commission's investigation.¹⁷ Too many times, audit firms, including some of the Big Four, have been obstreperous and recalcitrant in Commission investigations. As Paul Berger will discuss, particularly when asked to produce the work papers of their foreign affiliates, these firms have been far from cooperative. More broadly, firms often don't respond to anything except subpoenas and threats of subpoena enforcement actions when it comes to providing information, and often take a confrontational approach when dealing with Commission staff. I'm not talking about zealous advocacy — which I respect and encourage. The fact is, there's a perception that firms circle the wagons when questioned about their conduct. That sort of approach should not be rewarded by an exercise of discretion not to sue the firm for an audit failure.

A decision by the Commission to systematically exercise its prosecutorial discretion in favor of charging accounting firms for the failures of individual audit partners would create powerful incentives. Accounting firms would be prompted to strengthen their internal controls, bulk up their systems of supervision, and reinvigorate their training programs. Such an approach also would encourage firms to embrace broad principles of remediation, including disciplining or terminating wrongdoers, and after instances of misconduct, reviewing and revising firm procedures to prevent recurrence of the problem. They also would be likely to cooperate more readily with Commission investigations. Finally, if firms expected to be held accountable for the actions of their audit partners, the deterrent effect of Commission enforcement actions involving auditors would be enhanced. Investors would benefit from the improvements within firms and from greater efficiency in the Commission's investigative process.

Conclusion

While many factors may have contributed to the apparent rise in corporate fraud, it is clear that one of the few means virtually guaranteed to help turn this tide is to bring more rigor to public company audits. Holding accounting firms responsible for the audit failures of their partners is an effective mechanism to achieve this goal.

Accordingly, accounting firms should begin thinking now — before they become embroiled in another investigation — of changes or enhancements that will enable them to demonstrate, when the time comes, the sort of extraordinary cooperation and citizenship that would make the Commission say, "Notwithstanding the audit partner's role in this financial reporting failure, the partner's firm just couldn't have done anything better." For it is my hope, at the end of the day, not to see more enforcement actions against firms, but instead to see fewer instances of misconduct.

Thank you.

Endnotes

¹ Proposed Rule: Revision of the Commission's Auditor Independence Requirements, Release No. 33-7870, June 30, 2000 (footnote omitted).

² Proposed Rule: Revision of the Commission's Auditor Independence Requirements, Release No. 33-7870, at Table 2, June 30, 2000.

³ Central Bank of Denver v. First Interstate Bank of Denver, 511 U.S. 164 (1994).

⁴ In re Jeffrey Bacsik, CPA, Accounting and Auditing Enforcement Release No. 1482, Dec. 27, 2001; In re Barbara Horvath, CPA, Accounting and Auditing Enforcement Release No. 1483, Dec. 27, 2001 (respondent was both a senior manager and then a partner during the relevant period).

⁵ In re Michael Sullivan, CPA, Accounting and Auditing Enforcement Release No. 1676, Nov. 26, 2002.

⁶ SEC v. Philip E. Harlow, et al., Litigation Release No. 17001, May 15, 2001.

⁷ In re Carroll A. Wallace, CPA, Accounting and Auditing Enforcement Release No. 112, April 1, 1999.

⁸ SEC v. William F. Buettner, Mark D. Kirstein, and Amy S. Frazier, Accounting and Auditing Enforcement Release No. 1431, Aug. 1, 2001.

⁹ In re Michael J. Marrie and Brian L. Berry, Accounting and Auditing Enforcement Release No. 1151, Aug. 10, 1999.

¹⁰ In re KPMG LLP, Accounting and Auditing Enforcement Release No. 1491, Jan. 14, 2002.

¹¹ In re PricewaterhouseCoopers LLP, and PricewaterhouseCoopers Securities LLC, Accounting and Auditing Enforcement Release No. 1596, July 17, 2002.

¹² In re Ernst & Young LLP, Accounting and Auditing Enforcement Release No. 1661, Nov. 13, 2002.

¹³ In re Arthur Andersen LLP, Accounting and Auditing Enforcement Release No. 1405, June 19, 2001; Securities and Exchange Commission v. Arthur Andersen LLP, Robert E. Allgyer, Walter Cercavschi, and Edward G. Maier, Accounting and Auditing Enforcement Release No. 1410, June 19, 2001.

¹⁴ In re Arthur Andersen LLP, Accounting and Auditing Enforcement Release No. 1405, June 19, 2001.

¹⁵ Report of Investigation Pursuant to Section 21(a) of the Securities Exchange Act of 1934 and Commission Statement on the Relationship of Cooperation to Agency Enforcement Decisions Accounting And Auditing Enforcement Release No. 1470, Oct. 23, 2001.

¹⁶ See Sarbanes-Oxley Act, section 103.

¹⁷ Securities and Exchange Commission v. Dynegy Inc., Accounting And Auditing Enforcement Release No. 1632, Sept. 25, 2002.

http://www.sec.gov/news/speech/spch121202smc.htm