internal audit outsourcing: an analysis of selfregulation by the accounting profession

7/29/2019 INTERNAL AUDIT OUTSOURCING: AN ANALYSIS OF SELFREGULATION BY THE ACCOUNTING PROFESSION

1/32

INTERNAL AUDIT OUTSOURCING:

AN ANALYSIS OF SELF-

REGULATION BY THE

ACCOUNTING PROFESSION

Dennis Caplan, Diane Janvrin and James Kurtenbach

ABSTRACT

This paper examines the accounting professions self-regulation of inter-

nal audit outsourcing services. The question of whether public accountantscompromise their independence when they provide internal audit services

to their attest clients was debated within the accounting and regulatory

communities throughout the 1990s, and resulted in a confrontation

between the accounting profession and the Securities and Exchange

Commission in 2000. Internal audit outsourcing was a factor in the public

perception of Arthur Andersens role in the collapse of Enron, and in

lawmakers reaction to that event. It is specifically identified in the

Sarbanes-Oxley Act of 2002 as a prohibited service that public accountants

generally cannot provide to their public company external audit clients.Our purpose is to contribute an historical perspective to ongoing dis-

cussions about the efficacy of self-regulation by the public accounting

profession. Self-regulation of internal audit outsourcing remains impor-

tant because the Sarbanes-Oxley prohibition does not apply to auditors

private company clients, and because the rules that the SEC issued to

implement Sarbanes-Oxley seem to allow accounting firms to provide

Research in Accounting Regulation, Volume 19, 334

Copyrightr 2007 by Elsevier Ltd.All rights of reproduction in any form reserved

ISSN: 1052-0457/doi:10.1016/S1052-0457(06)19001-3

3


2/32

internal audit services to public company attest clients under a variety ofcircumstances that were not anticipated in the original legislation. Al-

though accounting firms have not yet shown strong interest in testing the

limits of the new rules, the firms may do so in the future.

History is full of examples of how improper or ineffective self-regulation leads to gov-

ernment regulation. (Leonard Spacek, managing partner of Arthur Andersen, 1969)

Self-regulation by the accounting profession is a bad joke. (Arthur Levitt, former chair-

man of the SEC, 2003, p. 135)

1. INTRODUCTION

The Sarbanes-Oxley Act of 2002 significantly altered the regulatory land-

scape of the public accounting profession. It increased third-party oversight

of a profession that had previously been largely self-regulated. This paper

examines the efficacy of self-regulation by the accounting profession in the

years leading up to the Act in the context of a single issue: the question ofwhether public accountants maintain independence when they provide in-

ternal audit services to their attest clients. The rapid growth of internal audit

outsourcing during the 1990s prompted every important professional and

regulatory body with responsibility for auditor independence to address this

issue. It was debated within the accounting profession and the regulatory

community, culminating in a confrontation in 2000 between the AICPA and

three of the Big 5 firms on the one hand, and the Securities and Exchange

Commission on the other. Internal audit outsourcing was a factor in the

negative publicity incurred by Arthur Andersen following the collapse ofEnron, and in lawmakers reaction to that event, because internal auditing

was a consulting service that Andersen provided Enron. Hence, internal

audit outsourcing was an important phenomenon in the events that led to

Sarbanes-Oxley.

The Sarbanes-Oxley Act prohibits accounting firms from providing in-

ternal audit services to their public company attest clients. Nevertheless,

self-regulation of internal audit outsourcing remains important for two

reasons. First, the Sarbanes-Oxley ban does not apply to private company

audit clients. Second, the SEC issued rules in 2003 to implement Sarbanes-Oxley that still allow accounting firms to provide internal audit services to

public company attest clients, if those services are unrelated to internal

accounting controls, financial systems, and financial statements, or if the

DENNIS CAPLAN ET AL.4


3/32

auditors will not be reviewing their own work during the audit, or if theservices are nonrecurring evaluations of discrete items. Although accounting

firms have not yet shown an interest in exploring the limits of these new

rules, they may do so in the future.

In Section 2 of the paper, we identify and describe significant events,

pronouncements, and statements of position on internal audit outsourcing,

as well as important antecedent events. In Section 3, we assess the extent of

consensus within the accounting profession and regulatory communities, we

summarize the role played by the AICPA, and we provide concluding re-

marks.

2. A CHRONOLOGY OF INTERNAL AUDIT

OUTSOURCING

Internal audit outsourcing evolved as the result of two broad trends. The

first trend was the increasing importance of consulting services as a revenue

source for accounting firms. Throughout the 1980s and 1990s, competitive

forces in the public accounting profession led many practitioners to char-acterize attest services as a low-margin commodity product. In this envi-

ronment, accounting firms increasingly turned to consulting services to

increase revenues and profits. The second trend was the increasing visibility

and importance of internal controls. Because the routine review of internal

controls is an important internal audit activity in companies large enough to

support an internal audit department, the increased focus by regulators,

accountants, and managers on internal controls led to increased visibility

for the internal audit function. An early milestone in this regard was the

Foreign Corrupt Practices Act of 1977, which required large companies tomaintain adequate systems of internal control. The Treadway Commission

Report1 of 1987 recommended that all public companies maintain an effec-

tive and objective internal audit function, and also recommended that

management report annually on its assessment of the effectiveness of the

companys internal controls.2 Another milestone occurred when the

Committee of Sponsoring Organizations of the Treadway Commission

(COSO) issued its report Internal Control Integrated Framework (1992).

The report became widely accepted as an industry standard for its definition

of internal controls and the criteria for evaluating controls.Hence, at a time when public accounting firms were looking for new

consulting opportunities, the demand for internal control reviews was

on the rise. There was a natural fit between the training, education, and

Internal Audit Outsourcing 5


4/32

professional competency of public accountants and the work involved inreviewing internal controls. Also in the 1980s, companies experimented with

outsourcing many activities that historically had been performed internally.

Even before 1990, some companies had outsourced internal audit activities

to their public accountants for reasons that seemed compelling. For exam-

ple, because accounting firms often had a physical presence in foreign lo-

cations, such as an affiliated local firm, the firms could often provide

internal audit services in these locations more efficiently than the companys

own internal auditors.

During the 1990s, internal audit outsourcing grew rapidly. By the mid-1990s, about 1012 percent of companies were outsourcing some or all of

the internal audit function (Kralovetz, 1996; Renner & Tebbe, 1998). Often,

the outsource provider was a public accounting firm, although internal audit

outsourcing is not an attest service, and other consulting and service firms

began offering these services. Two surveys provide evidence of the preva-

lence of internal audit outsourcing just prior to the passage of Sarbanes-

Oxley. Serafini, Sumners, Apostolou, and Lafleur (2003) finds that by about

2001, among companies that had an internal audit function, 11 percent

outsourced the entire function and another 54 percent outsourced someportion of it. Forty-three percent reported that they intended to outsource

more internal auditing in the future. Carcello, Hermanson, and

Raghunandan (2005) surveyed the internal audit budgets of 217 mid-sized

U.S. public companies, and finds that for 2002, 15 percent of all internal

audit work was performed by outsource providers.

The Regulatory/Self-Regulatory Environment: During this period of rapid

growth of internal audit outsourcing, the principal regulatory bodies

with oversight responsibility for auditor independence were the SEC, theFederal Deposit Insurance Corporation (FDIC), the General Accounting

Office (GAO), and the state boards of accountancy. The various state

boards did not pursue this issue to any significant extent, so the important

regulatory activities occurred at the federal level. Although the GAO and

the FDIC were actively involved in the internal audit outsourcing inde-

pendence question, the jurisdiction of the GAO is limited to government

agencies, government contractors, and their auditors, and the jurisdiction

of the FDIC is limited to financial service firms and their auditors. Since

the jurisdiction of the SEC includes all U.S. public companies and theirauditors, the SEC was the preeminent regulatory body concerned with the

question of whether internal audit outsourcing compromises an auditors

independence. The SECs approach to this issue, consistent with its



5/32

longstanding approach toward the public accounting profession generally,was to allow the profession to self-regulate whenever possible, to use

formal and informal communications to encourage the profession to act

on issues of concern to the Commission, and to enact and enforce reg-

ulations objectionable to the profession only as a last resort.

The two most important self-regulatory bodies with responsibility for

auditor independence during this period were the Executive Committee of

the Professional Ethics Division of the AICPA, and the Public Oversight

Board (POB). The Executive Committee of the Professional Ethics

Division promulgates ethics standards for members of the AICPA. ThePOB was established by the AICPA in 1977 as an independent, self-

regulatory body to oversee the quality of public company audits. An

important milestone in the self-regulation of consulting services occurred

in 1979, when the POB issued its report Scope of Services by CPA Firms.

One of the key conclusions in this report is that there is virtually no

evidence that consulting services impair auditor independence. However,

the report acknowledges that specific evidence of such impairment would

probably not be available, even if it occurred.

The remainder of this section describes important regulatory and self-regulatory events and pronouncements related to internal audit outs-

ourcing, organized by year. Exhibit 1 provides a time line of key events. 1984: The SEC responds to an inquiry by a small public accounting firm

regarding whether the firm can provide internal audit services to a small

bank that is also an attest client. The SEC states that the auditors per-

formance of internal audit type duties would impair independence in ap-

pearance. The SEC reply also states that the nature of the internal auditor

relationship appears to be close to that of an employee, and that the

internal audit function generally would be part of the system of internalcontrols administered by employees of the client. However, the SEC letter

also confirms that auditors can assist clients in the establishment of systems

of internal control that would then be administered by client personnel.3

1991: Congress passes the Federal Deposit Insurance Corporation

Improvement Act (FDICIA). The Act requires large insured depository

institutions to report annually on internal controls over financial report-

ing, and for the auditors to attest to this report. FDICIA appears to be an

important impetus for internal audit outsourcing in the financial services

industry. A worldwide survey of large financial institutions, conducted byDeloitte Touche Tohmatsu International (DTTI), found that about 25

percent of survey respondents were outsourcing some internal audit work

by 1995 (DTTI, 1995).



6/32

Exhibit 1.Time Line of Key Events Related to Internal Audit

Outsourcing.

Year Event Description

1979 The Public Oversight Board (POB) issues its

report Scope of Services by CPA Firms

The POB notes the lack of evidence that

consulting services compromises auditor

independence, but also observes that such

evidence would probably not be available,

even if independence were compromised.

1984 The SEC responds to an inquiry by an

accounting firm

The SEC staff states that internal audit

outsourcing would probably compromise

auditor independence.

1993 The AICPA Professional Ethics Division

issues ruling No. 97 under Rule of

Conduct 101

The ruling applies existing standards to

internal audit outsourcing, allowing firms

to provide these services provided they do

not perform management functions.

1994 The Auditing Standards Division of the

AICPA issues an Audit Risk Alert that

includes the topic of internal audit

outsourcing

The Audit Risk Alert references a speech by

the SEC chief accountant, and urges

practitioners to carefully consider the

implications of internal audit outsourcing

on independence.

1996 The AICPA Professional Ethics Division

issues rulings 103, 104, 105, andinterpretation 101-13, all under Rule of

Conduct 101

The rules generally allow auditors to provide

internal audit services to their externalaudit clients, as long as the auditor does

not act or appear to act in the capacity of

management or as an employee.

2000 The SEC issues new rules on auditor

independence

The new rules prohibit large companies from

sourcing more than 40% of their internal

audit function from their external

auditors.

2000 The Panel on Audit Effectiveness issues its

report

The Panel reports disagreement among its

members on the question of a general ban

on nonaudit services. It is the only

question on which the Panel does not

achieve a consensus.

2001 Enron declares bankruptcy Arthur Andersen incurs significant negative

publicity, in part because the firm

provided Enron extensive consulting

services including internal auditing

services.

2002 Congress passes the SarbanesOxley Act The Act specifically prohibits accounting

firms from providing internal audit

services to their public company attest

clients.

2003 The SEC adopts rules to implement Title II

of SarbanesOxley

With respect to internal audit outsourcing,

the SEC rules appear more permissivethan the SarbanesOxley ban would seem

to permit.



7/32

1993: In November, the Executive Committee of the Professional EthicsDivision of the AICPA issues Ruling No. 97 under Rule of Conduct 101,

responding to an inquiry by the auditor of a financial services firm.

The inquiry concerned the auditors ability to assist with the clients in-

ternal audit activities, or extend the accounting firms audit services when

the client did not maintain an internal audit function. The accounting

firm asked about three types of services: (1) testing the system of internal

controls, confirming accounts receivable, and analyzing fluctuations of

income and expense accounts; (2) reviewing loan originations or similar

activities as part of the clients approval process; and (3) reviewing theclients loan origination or other business processes for their function-

ing, efficiency or effectiveness, and providing recommendations to man-

agement.

Ruling No. 97 states that the activities described in (1) would not impair

independence, noting that these activities are similar to extensions of audit

procedures performed in connection with the annual audit; the activities

described in (2) would impair independence because the auditor would be

performing a management function; and the activities described in (3)

would not impair independence as long as the auditor did not performmanagement functions or make management decisions, even though these

activities are not normally necessary for conducting the annual audit. The

response to this last item applies existing standards for consulting services

generally to internal audit outsourcing in particular. Ruling No. 97 re-

mains in effect until 1996. 1994: In September, the Institute of Internal Auditors (IIA) publishes

Professional Issues Pamphlet 94-1: The IIAs Perspective on Outsourcing

Internal Auditing: A Professional Briefing for Chief Audit Executives.

The pamphlet notes that outsource providers are aggressively marketinginternal audit services to companies around the world. The pamphlet

summarizes the IIAs position:

The IIAs perspective is that internal auditing is best performed by an independent

entity that is an integral part of the management structure of an organization. The IIA

states unequivocally that a competent internal auditing department that is properly

organized with trained staff can perform the internal auditing function more effi-

ciently and effectively than a contracted audit service. (IIA, 1994, p. 2, emphasis in the

original)

The pamphlet characterizes the rapid growth of outsourcing as beingdriven, in part, by outsource providers promises of lower cost and higher

quality services, reduced fixed staff salaries, and improved access to spe-

cialization.



8/32

Also in September, the POB releases the report of the Advisory Panelon Auditor Independence, Strengthening the Professionalism of the

Independent Auditor. The POB commissioned the report in response to

a speech by SEC Chief Accountant Walter Schuetze criticizing the ac-

counting profession for not standing up to clients on financial reporting

issues. According to the report:

The Panel finds worrisome the trend of accounting firms, in wanting to grow, to add

or expand nonaudit services and thereby reduce their reliance on and the relative

importance of auditing.y Growing reliance on nonaudit services has the potential to

compromise the objectivity or independence of the auditor by diverting firm lead-

ership away from the public responsibility associated with the independent audit

functiony. (Advisory Panel on Auditor Independence, 1994, p. 9)

The report goes on to recommend that independent auditing firms need

to focus on how the audit function can be enhanced and not submerged in

large multi-line public accounting/management consulting firms (p. 9).

In a speech to an AICPA banking conference in November, SEC Chief

Accountant Schuetze expresses concern about the practice of total outs-

ourcing of the internal audit function to the companys public accounting

firm. Schuetze notes that AICPA Ethics Ruling No. 97 is very restric-tive, and that because external auditors must be independent both in fact

and in appearance, auditors attempting to fulfill the responsibilities of the

external auditor and the responsibilities traditionally performed by inter-

nal auditors must exercise great care. Schuetze also observes that to the

extent banking laws require internal auditors to be under the control of

management, outsourcing the internal audit function to the banks exter-

nal auditors is fundamentally inconsistent with the auditors independ-

ence (Schuetze, 1994).

The Auditing Standards Division of the AICPA issues Audit Risk Alert 1994 (Auditing Standards Board, 1994). The Risk Alert states that

companies are outsourcing internal audit activities to their public ac-

countants with increasing frequency, and then notes the concerns that

Schuetze expressed in his November speech. The Risk Alert advises au-

ditors to carefully consider the implications of internal audit outs-

ourcing arrangements on independence. 1995: In January, SEC Professional Accounting Fellow Tracey Barber

gives a speech at an AICPA conference on SEC developments. Barber

summarizes current regulatory and self-regulatory guidance on internalaudit outsourcing (including AICPA Ethics Ruling No. 97) as providing

very strict limitations (Barber, 1995, p. 3). The position of the SEC, as

described by Barber, seems to be that any arrangement for outsourcing



9/32

would either place the auditor under day-to-day control of management,or require the auditor to exercise management functions, neither of which

is consistent with auditor independence. Barber conveys the staffs view

that it is very difficult to devise internal audit outsourcing arrangements

that both would overcome the prohibitions set forth by all of the guidance

currently available, and simultaneously satisfy all of the needs of a client

(pp. 34). Barber also indicates that the SEC staffs interpretation of the

COSO internal control framework is that some internal audit activities

constitute part of the internal control system. As such, the auditor who

undertakes these activities would compromise independence.In February, the Wall Street Journal runs an article on Morrison

Knudsen. The company reported a loss of $141 million for the fourth-

quarter of 1994, its worst quarterly loss in its 83-year history, and more

than twice analysts expectations. Morrison Knudsen also announced that

it was firing Deloitte & Touche as the companys internal auditor and

hiring Arthur Andersen for these services. The Wall Street Journal staff

reporter concludes that since last November, Deloitte & Touche has

performed both Morrisons external and internal audits, effectively re-

moving a layer of review that most companies consider crucial (Rigdon,1995).

1996: In February, the Professional Ethics Division of the AICPA issues

exposure drafts of new ethics rulings that would explicitly permit auditors

to provide internal audit services to their attest clients as long as the

auditor does not act or appear to act in a capacity equivalent to a member

of client management or as an employee. Comment letters from practi-

tioners align almost uniformly with their apparent economic interests:

practicing CPAs support the proposed rules; internal auditors, including

internal audit executives from Merrill Lynch and Texas Instruments, op-pose the proposed rules. Most of the comment letters in opposition to the

exposure draft question whether it is practically feasible for auditors to

provide internal audit services without crossing the line that separates

consultants from employees, or without engaging in activities that look

like management functions. The Institute of Management Accountants

(IMA) opposes the proposed rules, primarily due to concerns about in-

dependence in appearance when the same auditor provides both internal

audit and attest services to the same client (IMA, 1996).

Comment letters from the Board of Governors of the Federal ReserveSystem and the Director of the FDIC generally support the proposal, but

object that the terms management and employee are used in a vague

manner, and also object to the proposed interpretation that allows the



10/32

auditor to attest to managements report on internal controls when thatsame auditor provides internal audit services that serve as a basis for

managements report (Board of Governors of the Federal Reserve System,

1996; FDIC, 1996). Because FDICIA requires large financial institutions

to provide a management report on internal controls and for their au-

ditors to attest to this report, these regulators focus on this issue is not

surprising. The Professional Ethics Division appears to have responded to

this concern, because the final ruling states that management cannot rely

on the auditors work as the primary basis for its assertion in its internal

controls reportJ The Institute of Internal Auditors. The lead story in the March/April

issue of IIA Today announces a significant shift from the IIAs 1994

position on internal audit outsourcing.4 The article notes that the major

accounting firms are pursuing internal audit outsourcing services and

predicts that outsourcing is likely to grow. The article acknowledges

that, as a matter of practice, internal auditing practitioners have long

used third-party providers to satisfy the need for special knowledge or

to compensate for language or distance difficulties (IIA, 1996, p. 1).

The IIA also acknowledges that outsource providers might providecost/effective internal audit services for companies too small to main-

tain their own internal audit staff, and that outsource providers might

constitute an improvement over internal audit departments that are less

than world class.

The article goes on to reference the Standards for the Professional

Practice of Internal Auditing promulgated by the Institute, and to urge

all providers of internal auditing to conform to those standards. Hence,

the Institutes new position is to try to bring outsource providers under

the umbrella of the IIA, to expand its membership to include outsourceproviders, and to urge outsource providers to support and participate in

the activities of the Institute. The IIA continues to express concern

about public accountants providing internal audit services to their attest

clients:

The IIA has also gone on record with the SECs Chief Accountant by expressing

the view that total outsourcing of internal auditing to the organizations external

auditor would impair the independence of the external auditor. The IIA most

recently affirmed that view in a letter to the AICPA Professional Ethics Executive

Committee. (IIA, 1996, p. 1)

J New Ethics Rulings. In August, the Executive Committee of the

Professional Ethics Division of the AICPA adopts new ethics

pronouncements for internal audit outsourcing, superseding ruling



11/32

No. 97, which had been in effect since 1993. The new pronouncementsconsist of ruling Nos. 103, 104 and 105, and Interpretation No. 101-13,

all under Rule of Conduct 101 (American Institute of Certified Public

Accountants, Professional Ethics Executive Committee, 1996a, b, c, d).

The pronouncements distinguish between activities that constitute on-

going monitoring of the internal control system, and separate reviews of

the control system. Under the new rules, auditors are allowed to pro-

vide attest clients internal audit services as long as those services con-

stitute separate reviews of the control system, and as long as the auditor

does not act, or appear to act, in the capacity of an employee or man-agement of the client.

The new pronouncements list examples of activities that would com-

promise the auditors independence. The client must designate one or

more individuals, preferably from senior management, responsible for

the internal audit function. The client must determine the scope, risk,

and frequency of internal audit activities, and evaluate the findings and

results arising from those activities. The accounting firm cannot deter-

mine which control recommendations should be implemented, report to

the board of directors or audit committee on behalf of management, orbe responsible for the overall internal audit work plan.

The new pronouncements address the question of whether the au-

ditor can render an opinion on managements report of the effectiveness

of internal controls over financial reporting, if the auditor also provides

internal audit services. The auditor is independent with respect to this

attest service as long as management retains responsibility for estab-

lishing and maintaining internal controls, management does not rely on

the auditors work as the primary basis for its assertion in its internal

controls report, and the auditor does not act or appear to act in acapacity equivalent to that of client management or as an employee.

The new pronouncements allow auditors to conduct operational au-

dits, such as reviewing the effectiveness or efficiency of business proc-

esses. Independence is not impaired provided that the auditor does not

act or appear to act in a capacity equivalent to that of client manage-

ment or as an employee. Also, the auditors independence does not

depend on the frequency of internal audit services provided to the cli-

ent, provided that the auditors activities constitute separate evaluations

of the effectiveness of the ongoing control and monitoring activities andprocedures built into the clients normal recurring activities.J Other Developments in 1996. In August, SEC Chief Accountant Michael

Sutton discusses internal audit outsourcing in a speech to the American



12/32

Accounting Association (Sutton, 1996). Sutton notes that internal au-diting traditionally has been a management responsibility that, in critical

ways, has been integral to the system of internal control, and then

questions whether independent auditors can perform the internal audit

function and also provide an independent look at the system of internal

control. The skillful balance sought by the drafters of the [AICPA

ethics rulings] may, in the final analysis, run up against the wall of

perception and credibility. Sutton states that both the investing public

and the accounting profession would be better served if accounting firms

only provided internal audit services to nonaudit clients, noting thatsuch an arrangement would not affect the total market for these services.

In September, the General Accounting Office issues its report The

Accounting Profession Major Issues: Progress and Concerns. This re-

port reviews developments and trends related to auditor independence,

audit quality, auditors responsibilities for detecting fraud and reviewing

internal controls, and financial reporting and auditing standard setting.

The report states that concern over auditor independence is a long-

standing and continuing problem for the accounting profession (U.S.

General Accounting Office, 1996, p. 37). With respect to nonaudit serv-ices, the report references an earlier report, Failed Banks: Accounting

and Auditing Reforms Urgently Needed (1991), in which the GAO con-

sidered but rejected a recommendation to limit the scope of nonaudit

services that accounting firms can provide their clients. The current

GAO report reiterates that position: GAO believes measures that

would limit auditor servicesy are outweighed by the value ofy tradi-

tional consulting services (p. 8). The report notes that the GAO favors

addressing concerns about independence through improved corporate

governance, but cautions the accounting profession that these concernsmight increase as accounting firms become more heavily involved in

nonaudit services. 1997: In June, the SEC, AICPA, and large public accounting firms agree

to the formation of a new private regulatory body: the Independence

Standards Board (ISB). The mission of the ISB is to establish independ-

ence standards for public company audits. The organizational structure of

the ISB is similar to the POB. The eight-member ISB includes four mem-

bers from outside the public accounting profession. The Board retains an

executive director and a small staff, and is funded by contributions fromthe accounting profession. The ISB begins operations in October. 1999: In November, Earnscliffe Research and Communications issues the

results of a study commissioned by the ISB. The report, Research into



13/32

Perceptions of Auditor Independence and Objectivity, is based on 131 in-terviews of CEOs, CFOs, audit committee chairs, investment analysts,

audit partners, and regulators. The study asked interviewees about inter-

nal audit outsourcing as well as other types of nonaudit services. The

report concludes that internal audit outsourcing is one of the three areas

where people felt pulled both ways, and considered the matters to be

important (Earnscliffe Research and Communications, 1999, p. 24, em-

phasis in the original). The report summarizes that while most people felt

internal audit outsourcing was in no way problematic, a notable minor-

ity took the position that this might lead to a lower standard of protectionfor the investor (p. 25).

The study notes that as a group auditors were more homogeneous than

any other except perhaps regulators (p. 39). Auditors were also insistent

that there were no greater issues of independence today than there

had been in the past (p. 39), and they bridled at the notion that they

might have to consider altering their business model, simply to avoid a

perception problem, when the reality was that there was no impairment

(pp. 3940). By contrast, regulators (most or all from the SEC) worried

that the [accounting] profession had been moving too slowly to deal withthe issues around nonaudit assignments (p. 43). Summarizing the views of

each group, regulators exhibited moderate concern about whether in-

dependence in both fact and appearance is a real problem today, and

serious concern about whether independence in both fact and appear-

ance will be a real problem tomorrow. By contrast, the consensus response

of auditors was none to the concern about independence in fact both

today and tomorrow, and slight to the concern about independence in

appearance both today and tomorrow. In summary, the Earnscliffe study

documents a gulf between regulators and the public accounting profession. 2000: In June, the SEC proposes new auditor independence rules that

include a provision prohibiting auditors from providing internal audit

services to their attest clients (SEC, 2000a). The large accounting firms

launch a no-holds-barred public relations and lobbying campaign

against the proposal (Levitt, 2003, p. 137). The AICPA argues that the

SEC had not proven a single instance in which an auditor had compro-

mised independence in order to obtain or retain a consulting contract, or

in which a lack of auditor independence had led to an audit failure. Ac-

cording to Levitt, the no-smoking-gun argument was very effective withCongress. Some commentators and regulators believe this argument is

exaggerated and that a few instances have been identified (over many

years) in which nonaudit services may have contributed to audit failures.5



14/32

Within a month of issuing the proposed rules, Levitt receives negativeletters from 46 members of Congress, including two-thirds of the SECs

oversight committee. Levitt believes that the public accounting profes-

sions success in lobbying Congress was related to the professions po-

litical campaign contributions. Levitt notes that the Big 5, their partners,

and the AICPA contributed $14.5 million to the 2000 elections, and that

each of the Big 5 was one of President Bushs top 20 contributors.

The AICPA Board of Directors concludes that the proposed restric-

tions on nonaudit services were not in the public interest, as they would

strip the profession of skills needed to meet its auditing responsibilities inthe New Economy (AICPA, 2000). The AICPA reports:

Putting the very future of the CPA profession on the line, the SEC in late June [2000]

proposed sweeping rules that, if enacted in their current form, would force a restruc-

turing of the accounting profession. The most threatening rule would prohibit ac-

counting firms performing audits for SEC registrants from providing most non-audit

services for those clientsyThe SECs new proposals are draconian and unwar-

rantedy. (AICPA, 2000)

The characterization of a ban on nonaudit services as draconian may

have been taken from the POBs 1979 Scope of Services report, which usedthe same term in almost the same contextJ Testimony Provided to the SEC. The SEC holds hearings on the pro-

posed rules in July and September. Thornton (2003) finds that among

39 representatives of the accounting profession, 27 oppose the proposed

rules, 9 are in favor, and 3 are neutral; among 19 financial statement

users, 18 favor the SEC proposal; and among 21 regulators, 11 favor

the proposal, 3 are opposed, and 7 are neutral.

The AICPA and leaders of three Big 5 firms oppose the proposed

rules. Leaders from two Big 5 firms support the proposed rules con-tingent on modifications that include allowing limited internal audit

outsourcing. The division among the Big 5 firms corresponds to whether

the firm has sold or is in the process of selling its consulting practice.

KPMG, Arthur Andersen and Deloitte & Touche oppose the proposal,

while PricewaterhouseCoopers and Ernst & Young support the pro-

posal. Four members of the Independence Standards Board testify:

three support the proposed rules, one is neutral. The Institute of Internal

Auditors opposes a blanket ban on outsourcing, but opposes permitting

total outsourcing due to concerns about independence arising from au-ditors reviewing their own work and assuming managerial responsibil-

ities. Former Senator Howard Metzenbaum and former Federal Reserve

Board Chairman Paul Volcker support the proposed rules.



15/32

KPMG partner Robert Elliott, then serving as chairman of theAICPA, testifies:

We in the AICPA are disappointed in the rush to judgment manifest in the SECs

premature issuance of a hastily and poorly drafted rule proposal followed by an inad-

equate comment period.yThere is no evidence that lack of auditor independence is

even an infrequent problem, let alone a current crisis. (Elliott, September 13, 2000) 6

Elliott says this is not about how much accountants are paid. This is

about our ability to provide they same level of high-quality information

for investors that has enabled the American economy to zoom ahead of

the rest of the world (Elliott, September 13, 2000). Elliotts statementcontrasts with the candor exhibited 20 years earlier by the POB:

The Board has also considered and rejected the more extreme view, expressed in

the [Metcalf Report], that auditors be prohibited from furnishing to audit clients

any nonaudit servicesySuch a draconian measure would not only deprive audit

clients of services that they obviously deem valuable but also would cause a sub-

stantial reduction in revenues for many CPA firms. (POB, 1979, p. 2)

In reply to an SEC Commissioner who asked whether there is dissent in

the AICPA about the proposal, AICPA president and CEO Barry

Melancon states that clearly, the overwhelming response of our pro-fession is of grave concern for the proposed rule (September 13, 2000).

In contrast to the remarks by Elliott and Melancon, Jim Schiro, CEO of

PricewaterhouseCoopers, testifies:

We would support restrictions of the types of consulting services accounting firms

provide, including internal audit outsourcing, because we believe that changing

market forces are making it increasingly difficult for firms to provide these services

alongside their assurance practices. (Schiro, September 20, 2000)

Shiro explains that historically, consulting services had not presented an

independence problem, but given the way consulting services were evolv-

ing, consulting and audit services cannot exist under one roof in the

future. Phil Laskawy, chairman and CEO of Ernst & Young, testifies:

Ive grown increasingly concerned during the past several years that the heightened

scrutiny of auditor independence has had a negative impact in the marketplace.

y I have, in other words, been concerned that the appearance that auditors

lack independence could undermine our relationship with the investing public.

(Laskawy, September 20, 2000)

With regard to the AICPA position, Laskawy and Schiro testify:I do not agree with the approach taken by others in the profession, including the

AICPA, in making harsh attacks against the Commission [the SEC] and in trying

to stonewall the Commissions efforts. In fact, I am quite troubled that the AICPA,



16/32

which has an obligation to represent all of its members, would take sides in a

fashion that can only weaken public confidence in the accounting profession.

(Laskawy, September 20, 2000)

y I am extremely disappointed that a group that is to represent the members

does not solicit the views of all the members before promulgating a position.y I

find that some of the actions of the leadership of that organization have not been

representativeyof our two firms and did not engage us as they were adopting this

position. (Schiro, September 20, 2000)

The former chairman of Deloitte & Touche, J. Michael Cook, supports

the proposed rules, whereas the current chairman, James Copeland, Jr.,

opposes the proposed rules. Cook testifies:y this issue of independence and non-audit services has been highly visible, a matter

of some concern to the profession, to the Commission and to many others for many

years.yThe profession has, I think, diligently and appropriately sought to address

these concerns over these years. Unfortunately, the profession has not been able to

resolve them, and today the profession is, apparently, quite deeply divided over this

issue.yRegrettably, I conclude thaty some action on the part of the Commission

is probably the only practical and feasible way to deal with the issue.y

Some believe and continue to suggest that SEC action is not warranted absent

proof that independence, in fact, has been impaired by non-audit services. Toaccept this position, one, in my judgment, would have to ignore the importance of

the appearance of independence, which has been a fundamental precept of our

independence standards, our professional standards, for almost 70 years. (Cook,

July 26, 2000)

In contrast, Copeland testifies I firmly believe that the unintended

consequences of this bright line limitation on services will be significant

and far reaching, resulting in a lessening of audit quality and perhaps,

ironically, independence (Copeland, September 20, 2000). On the ques-

tion of independence, Copeland statesWhile there is no empirical evidence to support the assertion that an auditors

independence is impaired when it provides non-audit services to its audit clients,

clearly some do perceive this as an issue and I believe the position that the perception

issue exists. yThe appropriate response to the perception issue is to determine

whether the perception represents reality. I thought the panel on audit effectiveness

did a credible job looking into this issue. (Copeland, September 20, 2000)

The testimonies of these two men indicate a significant difference of

opinion, despite their similar backgrounds with the same firm. In 2005,

Copeland characterized the Sarbanes-Oxley ban on nonaudit services ashasty and ultimately counterproductive (Copeland, 2005, p. 39).

From the academic community, 10 professors testify before the SEC,

offering diverse opinions. Yale professor Rick Antle addresses the



17/32

potential synergy that occurs when the external auditors provide con-sulting services:

The real question is not how much value can you add by consulting, but how much

of that value is driven by a tie with auditing.yWhat are these economies of scope

Im talking about? Well, theyre the values of the synergies that are generated by

bundling services. Ill tell you now that as far as I know theres no systematic

evidence as to the magnitude of these economies, just none that I know of. (Antle,

July 26, 2000)

Antle goes on to say that his intuition is that these economies of scope

are substantial, as evidenced by Arthur Andersens ability to rebuild itsconsulting practice in just a few years, after Andersen Consulting had

spun off, from almost nothing (excluding tax services) to revenues ap-

proximately equal to its audit practice.

In October, the Financial Accounting Standards Committee of the

American Accounting Association submits a comment letter to the SEC

regarding the proposed rules (AAA, 2001). The committee summarizes

approximately 30 empirical studies, about 20 of which examine nonaudit

services and/or auditor independence. The Committees summary in-

cludes the following: (1) auditors judgments can be influenced by in-centives to retain audit clients, but the extent to which nonaudit services

influence auditors beyond the desire to retain the audit itself is not clear;

(2) auditors do not appear to use audits as a loss leader to obtain con-

sulting services; (3) studies of users perceptions of whether consulting

services impair auditor independence provide mixed results; and (4) the

only study cited by the Committee that specifically focused on internal

audit outsourcing (Lowe, Geiger, & Pany, 1999) found that loan officers

perceive internal audit outsourcing to compromise auditor independence

only when the same personnel are used for both internal audit and attestservices. Although not cited by the Committee, Swanger and Chewning

(2001) surveyed financial analysts and found results similar to Lowe et al.

The Committee presents its views to the SEC as follows: (1) client-

retention incentives that could impair independence exist in the absence

of nonaudit services, so the incremental benefit of the proposed rules

might be minimal; (2) the proposed rules do not give sufficient weight to

institutional features that provide auditors incentives to maintain in-

dependence, including the risks of litigation and loss of reputation, self-

regulatory features such as the POB and peer review, and oversight byclient audit committees; (3) the proposed rules are likely to negatively

affect auditor competency and audit quality due to the loss of expertise

gained from consulting services and due to the inability to recruit



18/32

talented employees; (4) financial statement users are not generally con-cerned about the effect of nonaudit services on auditor independence

when the accounting firm does not use the same professional staff for

nonaudit services as for the attest engagement; and (5) the client audit

committee, not financial statement users, might be the appropriate

benchmark for assessing independence in appearance.J The SECs New Independence Rules. The SEC negotiates a compromise

with the leadership of the AICPA and the Big 5 firms. In November, the

SEC adopts new independence rules that reflect this compromise. The

rules allow auditors to provide up to 40 percent of an external auditclients internal audit function, and completely exempt audit clients that

have less than $200 million in assets. These restrictions apply only to

internal audit services that have potential financial reporting implica-

tions, which probably include most reviews of internal controls. Op-

erational audits, for example, are not subject to these restrictions if the

audits are unrelated to internal accounting controls, financial systems,

or financial statements. Levitt (2003) asserts that internal audit outs-

ourcing was one of the two biggest issues that the SEC attempted to

address with the independence rules of 2000 (p. 146). The AICPAleadership reports to its members on the compromise: Our key issues

included avoiding a blanket ban ony internal audit outsourcing serv-

ices. yConsiderable progress was made. y Shielding smaller firms

from the potential crippling effect of the new rule was and is a high

priority (Miller, 2000).

The new rules also include disclosure requirements for companies to

report the amount of nonaudit services purchased from their external

auditors. These new disclosures facilitated empirical research on non-

audit services that had not been possible using publicly available datafor U.S. companies. The results of this research are mixed. Frankel,

Johnson, and Nelson (2002) find that nonaudit fees are positively as-

sociated with a proxy of earnings management. Kinney, Palmrose, and

Scholz (2004) find that certain unspecified NAS (a subset of nonaudit

services that excludes internal audit outsourcing and some other

major categories of nonaudit services) are positively correlated with

financial statement restatements. Three other papers (Ruddock, Taylor,

& Taylor, 2006; Ashbaugh, LaFond, & Mayhew, 2003; Chung &

Kallapur, 2003) do not find a significant correlation between nonauditservices and audit quality.J The Panel on Audit Effectiveness. The Panel on Audit Effectiveness

issues its Report and Recommendations in August. The Panel had been



19/32

appointed by the POB at the request of SEC Chairman Arthur Levitt,to examine the current audit model. The eight-member Panel was

chaired by Shaun OMalley, former Price Waterhouse chairman. The

Panel held public hearings and received input from regulators, industry,

the legal profession, accounting faculty, and accounting firms. The

Panels report covers many issues including auditor independence. A

ban on nonaudit services is the only question on which the Panel re-

ports disagreement among Panel members. The report makes no rec-

ommendation regarding a ban, but includes separate statements by

Panel proponents and opponents of a ban.The Panel members supporting a ban state that nonaudit services

have the potential to compromise the auditors independence in fact as

well as in appearance. When auditors provide nonaudit services, they

are serving two different sets of clients: management and shareholders.

Neither the auditor, the audit firm, client management, nor the audit

committee are likely to be able to adequately assess and address inde-

pendence issues as they arise.

The Panel members opposing a ban are persuaded by the lack of any

specific link between audit failures and the rendering of nonaudit serv-ices (POB, 2000, p. 127). Although the growth of consulting services

has highlighted the appearance problem (p. 127), the Panel identified

no new issues related to consulting services (p. 127) since the POBs

1979 Scope of Services by CPA Firms report. The Panel members op-

posing a ban also reference the Panels review of 37 audit engagements

for clients that also purchased nonaudit services, and 67 peer reviews

conducted in 1999, none of which reported that independence, objec-

tivity, or audit effectiveness appears to have been impaired.

Despite these opposing views, the Panel agreed on the followingstatement:

The Panel is not aware of any instances of non-audit services having caused or

contributed to an audit failure or the actual loss of auditor independence. How-

ever, as the POB noted in its study on scope of services, Specific evidence of loss of

independence through [management advisory services], a so-called smoking gun, is

not likely to be available even if there is such a loss. (POB, 2000, p. 110, emphasis

added)

2001: In January, Richard Miller, AICPA General Counsel and Secretary,

reports to the AICPA membership on the negotiated compromise withthe SEC:

The SEC initially proposed to completely prohibit firms from providing information

technology and internal audit outsourcing services. yWhile this approach [the



20/32

negotiated compromise] is not what we were seeking, in that it departs from current

AICPA standards, it is a vast improvement over the proposed blanket ban. Obviously,

the SEC recognized, as a result of comment letters and testimony in its public hear-

ings, that internal audit outsourcing is a very important servicey (Miller, 2001,

emphasis added)

J The Independence Standards Board. The ISB had issued a discussion

memorandum for public comment on a conceptual framework for

auditor independence in February 2000, followed by an exposure draft

in November. A final draft is issued in 2001, but soon thereafter, in

July, the ISB votes to dissolve. According to Alan Glazer and Henry

Jaenicke, who were directors of the conceptual framework project, the

ISB lost support from both the SEC and the accounting profession soon

after its formation, in part because the SEC and large accounting firms

held irreconcilable positions on independence in appearance. The ISB

initially sought middle ground, incorporating in the exposure draft the

concept of independence in appearance, but avoiding the term itself.

This compromise satisfied nobody, and the status and potential role

of the ISB were undermined when the SEC issued its independence

rules in 2000, preempting much of the ISBs agenda. Glazer and

Jaenicke claim that a majority of the conceptual framework task force

supported including independence in appearance as a central element

of the framework, and the Board itself concurred. Independence in

appearance probably would have been included in the final statement,

had the ISB survived long enough to issue one (Glazer & Jaenicke,

2002).J Enron. Enron files for bankruptcy on December 2, 2001. In the ensuing

months, Arthur Andersen comes under fire for, among other things, a

potential lack of independence with respect to the audit because Arthur

Andersen provided Enron significant consulting services, including in-

ternal audit services. Fifteen months prior to Enrons bankruptcy, Joe

Berardino, then a managing partner of the firm, testified to the SEC on

internal audit outsourcing:

When this internal auditing is performed by the same firm that is hired to audit the

financial statements, that firm significantly enhances its knowledge. Who benefits

when the audit firm has this enhanced knowledge? I would suggest the investing

public. ySome say that we are auditing our own numbers in doing what I just

described. I disagree. What we feel we are doing is simply auditing more of the

clients business. (Berardino, September 20, 2000)

As reported by the PBS program Frontline, on the same day as

Berardinos testimony, Enron chairman and CEO Kenneth Lay



21/32

submitted a letter to the SEC in opposition to the SECs proposedrestrictions on internal audit outsourcing:

The proposed rule would preclude independent financial statement auditors from

performing certain internal audit services. The description of inappropriate ac-

tivitiesy could restrict Enron from engaging its independent financial statement

auditors to report on the companys control processes on a recurring basis as the

company has now arranged. I find this troubling, not only because I believe the

independence and expertise of the independent auditors enhances this process, but

also because Enron has found its integrated audit arrangement to be more

efficient and cost-effective than the more traditional roles of separate internal and

external auditing functions. Frankly, I fail to understand how extending the scope

of what is independently audited can be anything but positive. ( Lay, September 20,

2000)

According to Levitt (2003): yAndersens independence was compro-

mised. Andersen had been acting as Enrons internal auditory. This

meant that Arthur Andersen was, at times, reviewing its own work

rather than acting as an impartial check on the accuracy of the clients

figures (p. 151). 2002: In January, the General Accounting Office issues rules significantly

changing auditor independence requirements for audits that must complywith GAO standards (U.S. GAO, 2002). The GAO identifies two over-

arching principles: (1) Audit organizations should not provide nonaudit

services that involve performing management functions or making man-

agement decisions. (2) Audit organizations should not audit their own

work or provide nonaudit services in situations where the nonaudit serv-

ices are significant or material to the subject matter of the audit. The GAO

prohibits auditors from providing internal audit services to attest clients

that do not have their own internal audit function; that is, total outs-

ourcing is prohibited. As of 2006, the rules promulgated by the AICPAconcur with the first of the GAOs overarching principles, but not with the

second. As regards internal audit outsourcing, the AICPA rules are less

restrictive than the GAO rules, because the AICPA permits total outs-

ourcing if appropriate controls are in place (AICPA, 2005).

Also in January, the POB votes to dissolve. The vote was made re-

luctantly and as a matter of principle, three days after SEC Chairman

Harvey Pitt announced a proposal for a new, private-sector regulatory

structure (POB, 2001, p. 2). The POB had been excluded from discussions

between the SEC and the accounting profession that preceded the pro-posal. In explaining its reasons for the vote, the POB also cites a lack of

cooperation from the AICPA and the Big 5, including a decision by the

AICPA in 2000 to withhold funding for certain oversight activities that



22/32

the SEC had urged the POB to undertake, but that the accounting firmsfound objectionable. On May 1, the POB disbands after 25 years as a key

self-regulatory bodyJ Congressional Hearings on Enron. In Congressional testimony in the

months leading up to passage of Sarbanes-Oxley, regulators and other

commentators provide a generally critical look at the public accounting

profession. The current SEC chairman and every living former chair-

man since 1975 testify before the U.S. Senate Committee on Banking,

Housing, and Urban Affairs.

Rod Hills, chairman from 1975 to 1977, opposes a legislative ban onconsulting services, but states: it is increasingly clear that the accounting

profession is not able consistently to resist management pressures to

permit incomplete or misleading financial statements (U.S. Senate,

2002a). Harold M. Williams, chairman from 1977 to 1981, does not favor

legislation, but observes: The case for insisting that an auditor not

provide other services to the client it audits is a strong one (U.S. Senate,

2002a). David Ruder, chairman from 1987 to 1989, urges the Big 5 firms

to refrain from offering management consulting services to audit cli-

ents, and testifies that the independence rule of 2000 seems to recognizethat outsourcing the internal audit functions to the companys external

auditors creates conflicts or appearances of conflicts because the external

auditor eventually will be auditing its own work (U.S. Senate, 2002a).

Ruder urges the SEC to monitor this portion of the rule, and to consider

prohibiting external auditors from engaging in internal auditing, with

exceptions for small businesses. Richard Breeden, an attorney who was

SEC chairman from 1989 to 1993 and a senior partner at Coopers &

Lybrand for three years afterwards, testifies: at a minimum, the auditing

firms should be prohibited from providing financial structuring, invest-ment banking, internal audit, data processing systems, and legal services

for audit clients, and perhaps for any client (U.S. Senate, 2002a). Arthur

Levitt, SEC chairman from 1993 to 2001, states:

Its well past time to recognize that the accounting professions independence has

been compromised. Two years ago, the SEC proposed significant limits on the

types of consulting work an accounting firm could perform for an audit client. An

extraordinary amount of political pressure was brought to bear on the Commis-

sion. We ended up with the best possible solution given the realities of the time. I

would now urge at a minimum that we go back and reconsider some of the

limits originally proposed. (U.S. Senate, 2002a)

Current Chairman Harvey Pitt opposes a blanket ban on nonaudit

services, stating that sufficient time has not passed since the SEC



23/32

independence rules of 2000 to determine whether additional restrictionsare needed.

Shaun OMalley, former chairman of Price Waterhouse, and chair of

the Panel on Audit Effectiveness, testifies:

The SECs November 2000 rule prohibits the provision of many nonaudit services

to audit clients. However, two important services were not adequately addressed in

the rule. These services constitute a significant part of the nonaudit services being

performed by audit firms: (1) financial information systems design and implemen-

tation and (2) internal audit outsourcing.yAll five major firms now have agreed

to the proscription of such services to audit clients, and the AICPA also has

supported that position with respect to public companies.y [T]he professions decision to forego financial information systems design and

implementation and internal audit outsourcing services to audit clients is correct.

y [T]he evidence is strong that such services are perceived as a threat to inde-

pendence. Furthermore, both services should typically be performed by the man-

agement of an issuer, not by its auditors. (U.S. Senate, 2002b)

Bevis Longstreth, another member of the Panel on Audit Effectiveness

and a former member of the SEC, testifies:

Despite the SECs adoption of [the independence rules in 2000], the threat to an

auditors independence from performing non-audit services allowed by the Ruleremains palpable.y [A]n effective system of self-regulation does not exist and can

not be achieved without legislative reformy. (U.S. Senate, 2002b)

On the topic of the SECs independence rules of 2000, Longstreth tes-

tifies:

[I]t took both boldness and courage to issue the Proposing Release. Thats because,

by so doing, the SEC knowingly unleashed an unprecedented attack from those it

was seeking to regulateyThe ensuing battle, and it was clearly a battle, pitted a

legally created monopoly, dominated by five global accounting firms, against the

SEC. Three of the five, representing solely their private business interests, rejectedany meaningful restrictions on the free play of those interests.y

In the tumult of the moment, many leaders of the accounting profession and

here I must say I am not including leadership of the POB forgot their professions

origins as one granted exclusive rights, and reciprocal duties, to perform a vital

public service.y [T]hese leaders were demanding freedom from serious oversight

or constraint.

When the smoke had cleared,y the profession had won the battle.yThe SEC

adduced strong and abundant evidence in the rule-making processy that provid-

ing to ones audit client non-audit services of any kind or kinds, if large enough in

terms of fees paid, may impair independence. Despite this powerful predicate for

rule-making, the rule adopted fails absolutely to address this concern.y

I suggest

a simple exclusionary rule covering virtually all non-audit services, in place of the

deeply complex, existing rule that I hope, by now, to have convinced you is in-

effective. (U.S. Senate, 2002b)



24/32

Charles Bowsher, chairman of the POB at the time that it voted to

terminate its existence earlier in 2002, testifies: The POB proposes that

SEC regulations concerning independence be legislatively codified with

appropriate revisions to update restrictions on scope of services in-

volving information technology and internal audit services(U.S. Sen-

ate, 2002c). John Whitehead, former co-chairman of Goldman Sachs

and former co-chairman of the Blue Ribbon Committee on Improving

the Effectiveness of Corporate Audit Committees, states Having given

the matter a lot of thought in recent years, y I have reached the con-

clusion that the accounting firm that does the audit should not do other

advisory work for the company (U.S. Senate, 2002c).

On March 13, Barry Melancon, president and CEO of the AICPA,

testifies before the Committee on Financial Services of the U.S. House

of Representatives. After noting the lack of evidence that nonaudit

services impairs auditor independence, and listing the benefits to au-

ditors and their clients from the opportunity for auditors to provide

nonaudit services, Melancon repeats a statement that was announced

by the AICPA six weeks earlier:

Nevertheless, the profession recognizes that public concern about two particularservices financial system design and implementation, and internal audit outs-

ourcing has become intense, with a corrosive effect on public confidence. With our

public interest test in mind, the profession has concluded that it will not oppose

prohibitions on auditors of public companies from providing these two services to

audit clients. In the wake of Enron, such prohibitions will help restore public con-

fidence in the profession and the financial reporting system, without posing a sig-

nificant threat of unintended consequences. (U.S. House of Representatives, 2002)

Former SEC Chief Accountant Lynn Turner testifies: after cases such

as Waste Management and Enron, no longer are people asking, where

is the smoking gun (U.S. House of Representatives, 2002).The Sarbanes-Oxley Act. The Sarbanes-Oxley Act is signed into law

on July 30, 2002. Section 201 of the Act lists prohibited services that

are deemed outside the scope of the practice of public accountants. It is

unlawful for an accounting firm to provide these services to an attest

client. The list includes internal audit outsourcing. Sarbanes-Oxley also

establishes the Public Company Accounting Oversight Board as a reg-

ulatory body with oversight responsibility for the public accounting

profession. At the end of the year, three former SEC chief accountants

send a letter to the Board identifying areas in which the PCAOB shouldshow strong leadership. The letter states:

If investors believe that a particular service conflicts with an auditors ability to be

independent, then that service should be prohibited. Accordingly, it is important



25/32

that the provisions of the Sarbanes-Oxley legislation dealing with the independence

of auditors be implemented rigorously and not weakened in any way. (Schuetze,

Sutton, & Turner, 2002)

2003: In January, the SEC adopts rules implementing Title II of Sarbanes-

Oxley. The SEC identifies three basic principles related to nonaudit

services: (1) an auditor cannot function in the role of management; (2) an

auditor cannot serve in an advocacy role for his or her client; and (3) an

auditor cannot audit his or her own work. With respect to internal audit

outsourcing:

These rules will prohibit the accountant from providing any internal audit service thathas been outsourced by the audit client that relates to the audit clients internal

accounting controls, financial systems or financial statements unless it is reasonable to

conclude that the results of these services will not be subject to audit procedures during

an audit of the audit clients financial statements. (SEC, 2003a, emphasis added)

Similar to the independence rules that the SEC adopted in 2000, certain

types of internal audit services are generally permitted. Under the 2000

rules, internal audit services were permitted without limitation for the

size of the company or the extent of outsourcing, if those services did

not relate to internal accounting controls or financial reporting systems.

Similarly, the rules that the SEC adopts in 2003 permit auditors to provide

internal audit services to attest clients if those services are unrelated to

the clients internal accounting controls, financial systems, and finan-

cial statements. In addition, the 2003 rules permit auditors to provide

internal audit services related to internal accounting controls, financial

systems, and financial statements, if it is reasonable to conclude that

the auditors will not be reviewing their own work during the attest en-

gagement.

Also, the 2003 rules allow companies to engage the auditor to perform

nonrecurring evaluations of discrete items that are not in substance the

outsourcing of the internal audit function. For example, the company may

engage the accountant to conduct agreed-upon procedures engage-

ments related to internal controls, since management is responsible for the

scope and assertions in those engagements (SEC, 2003b). The requirement

for management to take responsibility for the scope and assertions in

those engagements is similar to the AICPA ethics rulings that were

adopted in 1996. Hence, the SECs rules seem to permit partial outs-

ourcing of the internal audit function to the companys external auditors,

if the engagement is nonrecurring.

The rules that the SEC adopts in 2003 appear consistent with the

position offered by SEC Chairman Harvey Pitt during the Congres-

sional hearings in 2002, but more permissive than the letter of the law in



26/32

Sarbanes-Oxley. The Act identifies internal audit outsourcing as a prohib-ited service, and seems only to allow exceptions on a case by case basis.

The SEC, on the other hand, in pursuing its stated objective of clarifying

the scope of the prohibited services, seems to give general permission for

auditors to provide certain types of internal audit services to their attest

clients.

3. SUMMARY AND CONCLUSION

This paper has reviewed the accounting professions self-regulation with

respect to the question of whether auditors compromise their independence

when they provide internal audit services to their attest clients. In this sec-

tion, we assess the extent of consensus within the accounting profession and

within the regulatory community on this issue, we comment on the AICPAs

role, and we provide concluding remarks.

3.1. Consensus within the Accounting Profession and the RegulatoryCommunity

There never was unanimity within the regulatory community or the ac-

counting profession on the issue of internal audit outsourcing. However,

there was a strong consensus of concern among regulators. From 1984 until

2000, the SEC never publicly condoned the provision of internal audit serv-

ices by a companys external auditors. The first official SEC sign-off occurred

in the politically motivated compromise of 2000. The consensus within the

SEC might be due to Arthur Levitts influence during his eight-year tenure aschairman. However, the SEC expressed concerns prior to Levitt, as did sev-

eral former SEC chairmen during the 2002 Senate subcommittee hearings

(although testimony in 2002 may have been influenced by hindsight). The

General Accounting Office examined the issue but did not identify a signifi-

cant threat to independence until after the Enron bankruptcy. Bank regu-

lators expressed concerns related to the internal controls reporting

requirements of FDICIA. To summarize, the regulatory community exhib-

ited a general consensus prior to 2002, with the SEC under Levitt exhibiting

more concern than other regulators, and the regulatory community exhib-iting a strong consensus by 2002 but still not unanimity.

Within the accounting profession, if the profession is defined to include

accountants who are not engaged in public practice, there was always a



27/32

difference of opinion. Professional organizations representing managementaccountants and internal auditors questioned the propriety of internal audit

outsourcing, particularly with respect to total outsourcing. If the profession

is defined narrowly to include only accountants providing attest services,

then there appears to have been a strong consensus until the debate over the

proposed SEC independence rules in 2000. At that point, some current and

former leaders of the profession seemed to conclude that a costbenefit

analysis of the independence-in-appearance issue made compromise de-

sirable.

3.2. The Role of the AICPA

With respect to the question of whether auditors compromise their inde-

pendence when they provide internal audit services to their attest clients, the

leadership of the AICPA and the large public accounting firms never iden-

tified an independence-in-fact issue, and for the most part, did not express a

desire to respond to concerns about independence in appearance by cur-

tailing the provision of these services. The independence-in-appearance is-sue, in particular, led to conflicts between the SEC and the profession, and

to criticism of the profession by current and former Congressional leaders.

The AICPA was somewhat confrontational, as illustrated by comparing the

moderate views expressed by the POB in its 1979 Scope of Services report

with statements made by the AICPA leadership, and also by comparing the

mixed views contained in the report by the Panel on Audit Effectiveness

with the strongly worded statements from the AICPA leadership during the

SEC hearings of 2000.

Regarding the efficacy of self-regulation of internal audit outsourcing, thetwo private-regulatory bodies with the most significant ongoing responsi-

bility for auditor independence were the POB and the Professional Ethics

Division of the AICPA. Importantly, neither body was entirely independent

of the AICPA. The Professional Ethics Division is an integral part of the

AICPA. The POB, although organizationally independent of the AICPA,

relied on discretionary funding from the profession. The importance of this

dependence was illustrated during the POBs final years, when the AICPA

withheld funding that the POB needed to fulfill its agreement with the SEC

to review compliance by the Big 5 with the professions stock ownershiprules.

Consequently, any evaluation of self-regulation of auditor independence

requires an evaluation of the AICPAs conduct, and the difficult dual role



28/32

the AICPA played: as an organization that oversaw self-regulatory activ-ities; and as a membership organization that represented and advanced the

professional and economic interests of its members. One criterion by which

to judge the AICPA is a standard proposed by Mautz and Sharaf 45 years

ago: Like the individual practitioner, the profession as a whole must avoid

any appearance of lacking independence (Mautz & Sharaf, 1961, p. 209).

With respect to internal audit outsourcing, the leadership of the AICPA

maintained a position consistent with protecting the financial interests of

public accounting firms. During this time, the AICPA seldom acknowl-

edged, let alone represented to regulators and to the public, the diverseviews of its broad-based membership; a membership that includes not

only accountants in public practice, but also CPAs who work in industry,

government and education.

3.3. Conclusion

In 1990, internal audit outsourcing was a consulting service that was un-

familiar even to most accountants. In 2002, Congress identified it by nameas a consulting service that is incompatible with the independence of the

public accountant. This paper has reviewed how, in 12 years, internal audit

outsourcing went from obscurity to become a familiar expression in the halls

of Congress. We believe that the acrimonious and visible confrontation over

internal audit outsourcing that occurred between the SEC and the public

accounting profession in 2000 helped shape the Congressional hearings two

years later that led to Sarbanes-Oxley. Enron has been referred to as a

perfect storm. We subscribe to a modified perfect-storm theory: Enron

and WorldCom led to legislation that would not have occurred except underextraordinary circumstances, but the accounting professions refusal to take

self-regulatory actions that the SEC would have considered meaningful in

2000 was an integral part of that storm.

Despite Sarbanes-Oxley, the regulation and self-regulation of internal

audit outsourcing remains an important topic. The Sarbanes-Oxley prohi-

bition applies only to public companies, so the AICPA and various state

boards of accountancy continue to promulgate independence standards for

audits of private companies. Also, as discussed above, the rules that the SEC

issued in 2003 to implement Sarbanes-Oxley seem to allow accounting firmsto provide certain types of internal audit services to public company attest

clients that would seem inconsistent with a nave reading of the legislation.

The large accounting firms have not yet shown an interest in testing the



29/32

limits of these SEC regulations, perhaps because of a sense of conservatismbrought about by the demise of Arthur Andersen, or perhaps because of

increased audit workloads related to Sarbanes-Oxley Section 404 compli-

ance. However, when the accounting firms have the available staff, the reg-

ulation and self-regulation of internal audit outsourcing may again become

an important policy debate.

NOTES

1. Formally, the Report of the National Commission on Fraudulent FinancialReporting (1987).

2. The recommendation for an internal audit function became a requirement forcompanies on the New York Stock Exchange in 2003 (NYSE, 2003). The require-ment is for an internal audit function, not an internal audit department, and anoutsourced internal audit function satisfies the NYSE listing requirement. The rec-ommendation for an annual management report on internal controls became a re-quirement for large financial institutions with the passage of the Federal DepositInsurance Corporation Improvement Act of 1991, and a requirement for all U.S.public companies with the passage of the Sarbanes-Oxley Act in 2002.

3. The accounting firm was Knapp and Company. The letter from the SEC to theaccounting firm is dated August 31, 1984. Information about this correspondence isreported in Barber (1995).

4. The IIAs change in position is analyzed in Rittenberg and Covaleski (2001).5. Two examples of audit failures in which nonaudit services may have played a

role, Colonial Reality and Westec, are referenced in Thornton (2003, p. 51).6. With respect to testimony provided to the SEC in 2000, we provide the name of

the individual and the date of his testimony immediately following the quotation. Inthe References section of the paper, we do not list each individual separately, butprovide the web address for the hearings (SEC, 2000b). With respect to the SEChearings in 2000 and the Congressional hearings in 2002, we correct spelling errors in

the transcript without using sic.

ACKNOWLEDGMENTS

We would like to thank seminar participants at Portland State University

for helpful comments. We would like to acknowledge Professor John

Thornton for sharing his insights with respect to the hearings that the SEC

held in 2000 related to the SECs proposed independence rules. We are

grateful to Joan Sterling, Technical Manager of the Professional EthicsDivision of the AICPA, for providing us comment letters and other relevant

documents related to the ethics rulings and interpretations issued by the

Professional Ethics Executive Committee.



30/32

REFERENCES

Advisory Panel on Auditor Independence. (1994). Strengthening the professionalism of the in-

dependent auditor. Stamford, CT: Public Oversight Board.

American Accounting Association (AAA). (2001). Financial Accounting Standards Committee.

SEC auditor independence requirements. Accounting Horizons, 15(4), 373386.

American Institute of Certified Public Accountants. (2000). SEC proposes sweeping rules; ripple

effect could impact firms that audit private companies. The CPA Letter, 80(7), 1, 6.

American Institute of Certified Public Accountants. (2005). AICPA GAO independence rules

comparison: Nonaudit services. Available at www.aicpa.org/download/ethics/

2004_02AICPA-GAO_rules_comparison.pdf

American Institute of Certified Public Accountants (AICPA), Professional Ethics Executive

Committee. (1993). Ethics Ruling No. 97 under Rule of Conduct 101. Performance of

certain extended audit services. New York, NY: AICPA.

American Institute of Certified Public Accountants, Professional Ethics Executive Committee.

(1996a). Ethics Ruling No. 103 under Rule of Conduct 101. Member providing attest

report on internal controls. New York, NY: AICPA.


(1996b). Ethics Ruling No. 104 under Rule of Conduct 101. Member providing oper-

ational auditing services. New York, NY: AICPA.


(1996c). Ethics Ruling No. 105 under Rule of Conduct 101. Frequency of performance of

extended audit procedures. New York, NY: AICPA.


(1996d). Interpretation No. 101-13 under Rule of Conduct 101. Extended audit services.

New York, NY: AICPA.

Ashbaugh, H., LaFond, R., & Mayhew, B. W. (2003). Do non-audit services compromise

auditor independence? Further evidence. The Accounting Review, 78(3), 611639.

Auditing Standards Board. (1994). Audit risk alert 1994. New York, NY:

internal audit outsourcing: an analysis of selfregulation by the accounting profession

Documents