Future Role of Audit A More Insightful Audit for a More Complex World

EXECUTIVE SUMMARY

The Audit Needs to Evolve Forbes Insights, at the request of the Global Public Policy Committee (GPPC) of the six largest global audit networks, conducted a research study to explore the future role of audit from the perspectives of the audit profession’s stakeholders. One role suggested by stakeholders was for the audit to evolve to provide greater insights on company performance, strengths and risks. The following Forbes Insights paper focuses on a detailed exploration of stakeholders’ views of this role. The study purposefully did not directly address implementation challenges (e.g., cost, liability risk, standard setting or client acceptance) so as not to constrain dialogue about what the future role of audit should be. Through feedback from hundreds of global stakeholders, including management, board members, academics and investors, four key messages emerged from the study:

• The current audit continues to play a very valuable assurance role, but needs to evolve to meet the demands of a more complex world. • The majority of all types of stakeholders believe that receiving greater insight from the auditor on the audited company’s performance and risks would be valuable. • Stakeholders are pleased that the audit profession is being more proactive. • The audit profession should move quickly on this call for change.

Where Should the Future Audit Focus? Acknowledging that the term “insight” is a broad one, an “Enhanced Audit Framework” was developed to test what kinds of insights would be most valuable to stakeholders. Using the framework as a starting point, stakeholders concluded that there were three broad ways in which the audit could move forward: 1. Provide more transparency into what has been learned during the course of the audit. Stakeholders supported auditors sharing more of what they discovered during the audit process. They were interested in getting deeper insight on important audit matters, such as significant management judgments, as well as additional insights on internal controls, going concern and risk factors. 2. Provide perspectives on key information generated by management. Stakeholders supported receiving greater insights on management-provided information. They were very interested in deeper insights into management’s use of non-GAAP measures. More commentary on the company’s disclosed risk factors was one of the other areas of strong support. 3. Provide deeper insights on company performance, operations and risks. Stakeholders supported the auditor doing more kinds of analyses and providing insights into the results. Many see the core audit of the future evolving beyond the financial numbers to give a more holistic perspective on the audited company. As such, enterprise risk analysis was one of the attractive elements in this category. The incorporation of fraud analytics into the audit was also widely supported, but to complement (not replace) person-to-person auditor engagement.

1

To Whom Should Additional Audit Insights Be Communicated? Audit committee members see themselves as the proper channel for communicating audit findings, as well as the right filter for choosing which information goes to investors. Stakeholders were generally very supportive of the audit committee’s important corporate governance role. On the other hand, a large proportion of investors want to receive additional insights directly. Could a More Insightful Audit Help to Address Other Key Challenges the Profession Faces? As a byproduct of a more insightful audit, other professional challenges could be partially addressed:

• Talent. Stakeholders say that today’s auditors are good

skills. Incorporating different kinds of analyses into the future audit could make a more attractive career path, thus attracting higher-caliber talent to the profession. • Stakeholder Communications. Through this endeavor, the audit profession is finding its “voice.” Being proactive in soliciting views on how the capital markets can be improved sets the stage for the profession’s longer-term, sustainable interaction with key constituencies. • Accountability. The audit profession has a clear opportunity to address the issue of auditor accountability by further exploring the provision of new information and insights with investors and shaping conclusions with their needs in mind.

at “checking boxes” but should develop other critical

RESEARCH METHODOLOGY: Stakeholder Engagement Process In the wake of large corporate failures and the recent financial crisis, the audit profession came under criticism. In response, Forbes Insights conducted a research study on the future role of audit. The study was requested by and involved the Global Public Policy Committee (GPPC), which is the global forum of representatives from the six largest international accounting networks—BDO, Deloitte, EY, Grant Thornton, KPMG, and PricewaterhouseCoopers. To complete the study, Forbes Insights engaged with hundreds of stakeholders worldwide. The stakeholders who participated were from large organizations. The study was global in scope, with participants from North America, Latin America, EMEA and Asia. The process revealed three fundamental audit roles the profession could play as it moves forward: • Role 1: Continue to opine on the fair presentation of financial statements within the existing framework, but continuously work to improve audit quality and promote other helpful initiatives. • Role 2: Expand beyond the pass/fail nature of the current

audit report to provide more useful insight on company performance, strengths and risks. • Role 3: Provide insight and a point of view on the health of the capital markets system, with focus on systemically important sectors and/or issues. The focus of this paper is Role 2. To assess Role 2, an Enhanced Audit Framework was designed. The model, a tiered set of enhanced commentaries and/or assurances, was purposefully aligned with the move toward enhanced corporate reporting, with these additional commentaries positioned as voluntary unless mandated. Elements of this model were tested via three channels: (1) three Forbes Insights–led sessions in New York, London and Hong Kong; (2) a Forbes Insights survey of C-level executives, board members and investors; and (3) one-on-one interviews with institutional investors. Specifically, participants were asked whether they would find significant value in Role 2 and what types of additional insight would be most useful. The following report focuses on how stakeholders said the profession could specifically provide more insight on company performance, strength and risks.

2

The Audit Needs to Evolve

Four key messages emerged from the Forbes Insights research study: 1. The current audit is valuable, but needs to change. Stakeholders confirmed that the audit continues to be valuable, perhaps now more than ever. The process is critical to ensuring that investors receive an independent and accurate perspective on the company’s financial reports—it’s an important “stamp of approval.” Yet, despite all of the work conducted during an audit, almost no one reads the audit report. It serves a purpose, but it is not informative in the way that the stakeholders might prefer. Many study participants see the audit as primarily a compliance exercise. The impression is that auditors are simply testing whether the financial statements comply with standards. One investor said, “As long as it is seen as just compliance, people will question the value of audit.” The Right Direction to Go Many point to shift“Where you are heading is the right ing external conditions way to be going. Clearly the inforand perceived lack of mation provided in the audit is less motivation to change useful than it was in the past—so it as contributing to the is right to be thinking about how to problem. The audit make the audit more useful.” hasn’t changed while —European investor the world has grown more complex. Companies increasingly operate across borders; rules and regulations continue to proliferate; and capital markets products and transactions evolve at a much faster pace than accounting and audit standards. One study participant said that “the [audit] is a product of a legacy that doesn’t fit with today’s capital market needs. Another stated that “auditors still do things pretty much the way they did 40 years ago. That can’t be the model or you will be irrelevant.” Audit methodologies have, in fact, changed over the past 40 years; what has not changed is the simple pass/fail audit opinion. The current audit report is no longer viewed as sufficient to meet today’s requirements. It needs to change. 2. Stakeholders want greater insight on an audited company’s performance and risks. But how should the audit change? The vast majority (at least

two-thirds or more) support the audit changing in the direction of being more transparent and providing more valuable information and insight on audited companies. This high level of support had different drivers by stakeholder group. For example, investors wanted more information to make investment decisions. Regulators wanted more auditor accountability to help protect the capital markets. Board members wanted more help in performing their governance role. Yet across all of these groups, the call for change was clear: Auditors should step beyond the “too narrow, black-and-white” nature of the pass/ fail audit and provide more insight on company performance, strengths and risks. As one UK investor said, “Audit reports should be far more informative documents. They should provide more nuanced and informative disclosures … I know there’s nervousness about this in more litigious parts of the world, but we need this type of information to elevate the debate between management and investors and others. The audit should play an important role by providing ‘hooks’ on how well management is managing assets. These ‘hooks’ could let investors go in and discuss these issues with management, to really understand how management is managing the business. ” 3. Stakeholders are pleased that the audit profession is being more proactive. Throughout the Forbes Insights research study, positive feedback was received regarding the fact that the audit profession is being more proactive. One CFO viewed the study as an important step forward because the auditor needs to “be an important voice in the debate. They can [say] what’s important, where the focus should be and how they can potentially shift their focus and emphasis based on a new paradigm.” Study participants agreed that auditors are well positioned to “step up to the plate,” given their unique view into companies. Generally, the auditors’ work continues to be respected within the context of their current role. “[Auditors] are really the clean-up batters” of the capital markets system, remarked one stakeholder. Another stakeholder said, “The auditors know more about what opportunities there are to improve the system than anyone.” Another study participant stated, “I think the more the profession is proactive, the better.”

3

4. The audit profession should move quickly on this call for change. Stakeholders encouraged auditors to move quickly on this agenda, understanding that the profession needs to engage with regulators, but also urging auditors not to wait for regulatory changes to move forward. Participants urge the audit profession to play a larger role in deciding its own future. Don’t stay silent “behind a veil of modesty,” one stakeholder said. It was also pointed out that the formulaic audit regimen comes at a price: the profession seems to be falling behind other industries in terms of recruiting and retaining top talent, as well as fostering diversity among its ranks. Moving more quickly could help address some of these challenges. At the same time, stakeholders told auditors that the future looks bright if they want to “grab the ball” and innovate the audit, without waiting for a mandate from regulators. One study participant said, in urging faster action, “My worry is that auditors will miss this [opportunity]. I hear you saying you’re going to take another year to have discussions. I think you need to push a little harder.” Simply put, if it doesn’t take the initiative to move forward on its own, the audit profession will lose the opportunity to control the conversation and, by extension, the direction in which the audit evolves.

Specific Ways in Which the Audit Could Bring More Insight While still providing valuable assurance, the current audit was also perceived as too formulaic, in effect a mechanical checklist. It falls short of providing what stakeholders said they are really looking for: better understanding of company performance, strengths, risks and prospects. The “numbers” can sometimes have little to do with the audited company’s “true” position and prospects. “It starts to look a little bit like a joke when the understanding of how companies are performing has very little relevance to the accounting statements auditors sign off on,” one stakeholder put forth. Yet the term “insight” is a broad one. What kinds of insight would be most valuable? This was the key question Forbes Insight tested using the Enhanced Audit Framework as a starting point to explore the idea of an audit that provides more insight. Based on stakeholder feedback, the Forbes Insights research study concluded that there are three broad ways in which the audit could be enhanced to provide more company insight, with specific emphasis on key elements in each.

ENHANCED AUDIT FRAMEWORK Possible change in nature/extent of work performed and auditor reporting

Enhanced corporate reporting

Level 1 Core audit and audit-ancillary

L1 Core Audit and Audit-Ancillary

Enhanced audit

L2 Other Management Information L3 Financial and Operational Performance Analyses L4 Third-Party Analysis

• Audit Opinion • Audit Process and Procedures • Significant Audit Matters • Internal Controls • Fraud Risk/Material Misstatement • Going Concern • Impairment Testing • Tax

Level 2 Other management information • Narrative Reporting • Earnings Releases • Non-GAAP Measures • Risk Factors • Director and Executive Renumeration • Corporate Responsibility and Sustainability • Regulatory Compliance • Internal Audit

Possible change in audit mandate Level 3 Financial and operational performance analyses • Financial Performance Analysis • Financial Reporting Process Analysis • Market and Industry Drivers Analysis • Enterprise Risk Analysis • IT Systems and Infrastructure Analysis • Corporate Governance Analysis • Fraud Analytics

Level 4 Third party analysis Comment on fact base of: • Credit Ratings • Equity Analysis

4

1. Provide more Be More Transparent transparency into what “The audit is not well understood has been learned during by investors and other stakeholdthe course of the audit. ers. We appreciate that there is an One of the biggest disindependent review and that the satisfactions with the independent opinion is vital, but current audit is that it’s not the whole story and it is a it is a “black box.” bit dated. We now live in the era of Considerable work transparency. This should apply to is executed but the auditors, too.” eventual output is a —European investor short pass/fail report. Auditors learn a number of potentially valuable things during the course of an audit. These findings may not be formally or consistently shared or commented on, even with audit committees, let alone published for a wider audience. Several audit committee members reported that they receive insights from the auditor on the company performance and challenges, but only when they ask. They recommend that auditors provide important insights in a more rigorous and proactive fashion, Highlight Important not just when they are Judgments asked. The need for “There’s an opportunity for the greater transparency on auditors to give a sense of how difaudit findings seemed ficult a set of financial statements to be even more acute is, so primarily how judgmental it for investors. As one is. Some organizations are relatively investor said, “We are straightforward. You take a retailer; working with a black not many difficult valuation issues. box and do not know Then you take a bank [by comparithe extent of ‘pass’ or son] … It might be possible for the the extent of ‘fail.’ That auditor to give a broad indication of information would the relative complexity of the finanhelp us a lot in making cial statements, then match that investment decisions.” with … the outcome of the audit Demystification of process and what impacts the audit the black box would made, in particular how different be very useful, say were the final financial statements stakeholders, as they from the ones that were initially currently have the presented?” binary audit opin—European board member ion, but do not know

anything about how it is arrived at. Stakeholders were very interested in gaining more insight on significant audit matters, including significant judgment calls, unusual transactions, areas of contention and the level of cooperation shown by management during the audit. If auditors want to aim at being more useful, stakeholders suggest that the profession strive to provide more explanation about the basis for decisions made during the course of the audit. One prominent investor suggested that auditors should strive to more consistently and proactively tell audit committees what the difficult areas were so that they understand where serious judgment calls were required. Another investor pointed out that “today’s audit report doesn’t tell you how the auditor feels about management judgments, whether the auditor endorses them or not,” adding that he’d like to receive this kind of information directly. “What I’m really interested in is more insight on items that require more management judgment; for example, fair value and cash balances. I’d like more justification from the auditor for these numbers—the auditor’s point of view acting as a second opinion.” Others wanted more information about the risks the auditor considered when planning the audit, items not necessarily covered in the management discussion and analysis (MD&A), financial statements or footnotes. These could cover such areas as industry economics, new competition, overseas threats, exchange rate impacts, and hyperinflation in the company’s key markets. Investors wanted more specific information on materiality, highlighting that auditors often utilize the concept of materiality without fully explaining publicly the materiality thresholds for the audited company to shareholders and other parties. The strong interest in significant audit matters is in close alignment with several proposals from other regulatory and standard-setting bodies. For example, in July 2013, the International Auditing and Assurance Standards Board (IAASB) released its exposure draft of a proposed revised and new standard that includes auditor reporting on “key audit matters.” Similarly, the U.S. Public Company Accounting Oversight Board (PCAOB) proposed a new audit standard in August 2013 that includes

5

providing new information related to “critical audit matters.” As one U.S. investor pointed out, “A lot of [what the audit profession is asking about here] is consistent with what the PCAOB is putting out. It’s all good and needs to be explored more. What happens now is that a lot of work is done but the only thing you get is a two- or three-paragraph opinion that the statements are in accordance with 17,000 pages of GAAP. That doesn’t say a lot compared to what the auditor did.” Others highlighted the importance of recent work done in the area of integrated reporting and want auditors to be closely linked with the movement toward greater and more nuanced corporate reporting. In essence, the audit should also strive to promote more insightful disclosures on the part of companies, to promote “better behavior” in this regard. While alignment with external developments is positive, it also Link to Integrated vividly suggests that Reporting the audit profession as a “The Vodafone audit report sets a whole should be helpbenchmark for the changes to the ing to lead and shape auditor reporting model. For the how these improvelast couple of decades, the auditor’s ments are framed and report was complying with stanimplemented, not simdards and auditors signing off on ply reacting to proposals things. We would like to see more from others. company-specific audit reports that Stakeholders showed build on standards and that enable less comparative interest companies to make more disclosures in technical informafor the benefit of investors.” tion about the audit —European investor process, such as details on sample sizes and test designs. These kinds of technical details don’t really help stakeholders understand or gain confidence in the numbers. An investor from Africa pointed out that “disclosure of methodologies and the processes would only be helpful if the audit opinion is qualified; otherwise it is not necessary.” While technical details were deemed less useful, stakeholders did appreciate the fact that the audit process is not well understood by investors and other stakeholders. Some recommended that more clarification on the respective responsibilities of the auditor versus management and the audit committee be communicated. Strong support was also voiced for more insight on going concern, although study participants also recognized that this

is an area that must Provide More on Risk be carefully conFactors sidered given the “A perennial issue is that auditors self-fulfilling prophare focused on whether the disecy aspect of the closures are fair. As an investor in going concern opinthe business, the great concern is ion. As one U.S. whether there has been any misbeinvestor said, “On havior or if there are any risks that going concern, you are inappropriate—over and above have the dilemma what one can ordinarily imagine. that if you flag conThere is an inherent disconnect cerns in advance, between these two agendas.” you can be the har—African investor binger of doom. What may be a risk becomes a reality.” Stakeholders agreed that the auditor’s main focus should be on assessing the appropriateness of management’s use of the going concern assumption in preparing the financial statements, which the auditor already does. However, the auditor could go beyond this to provide more insight into any circumstances that could threaten going concern, including a discussion of relevant financial metrics such as leverage ratios, capital adequacy and cash flows. Again, the need for more effective communication on the part of the auditor was raised in this context. As one board member remarked, “[Going concern is an area] where auditors have such a good procedure in regard to being careful about talking about going concern. They have a good system in place, but they’re not using it [consistently] with audit committees.” Stakeholders also brought up the changing nature of key factors that could play into management’s going concern assumptions. For example, one area that could now be relevant to going concern that would not have been 10 or 20 years ago is the state of a company’s IT systems, including the age of the infrastructure and the state of the backup systems. Stakeholders voiced moderate to strong support for auditors to share more insights about other matters they may have learned during the course of the core audit, including internal controls effectiveness, fraud risk, tax matters and impairment testing. As one investor stated, “I would love to see more information and analysis on fraud risk as part of

6

the auditor’s reporting, as this is something we as analysts and investors cannot easily figure out from the outside.” While there was strong support for revealing more about what was learned in the audit, the audit profession was also advised to continue improving its current role of attesting to the fairness of the financial statements. Along with that, stakeholders encouraged auditors to keep focusing on continuous improvement of audit quality. For example, one European regulator said, “While it’s great you guys are focusing on Role 2 [providing more insight on companies], your number one priority is Role 1 [opining on the fairness of financial statements and continually improving audit quality].” A European investor told Forbes Insights, “I

would walk before I could run—make sure we’ve covered the things where we are [already] stumbling.” Overall, there was also a strong message for auditors to be prudent, to focus on the most useful things first. More than one stakeholder cautioned against providing too much or unnecessary information. But the overarching message was clear. The audit could be more useful by being more transparent about critical matters learned during the course of the audit. As one European investor counseled the audit profession, “If you get to a situation where you have a highquality and more transparent audit process, this would get us to a good position. There’s plenty to do there.”

To Whom Should Additional Audit Insights Be Communicated? Stakeholders express support for auditors’ communicating insights more broadly, but Forbes Insights research also underscores that different stakeholders have different ideas as to which groups should be the direct recipients of audit insights. One investor pointed out that “the most useful information for management is what their direct reports don’t want to tell them. The most useful information for the board is what management doesn’t want to tell them. The most useful information for investors is what the board doesn’t want to tell them.” Audit committee members see themselves as the proper channel for communicating audit findings. They also feel they should choose the most relevant information for investor consumption. “You don’t want to delegate away the audit committee’s duties,” said one audit committee chair, “My concern is mission creep—making sure we are not using the auditor to do the job of the audit committee.” The majority of board members agree that boards, and audit committees specifically, should be the ones asking direct questions of the auditor and that the disclosure burden should be on the audit committee. Stakeholders also believe that initiatives to help strengthen the relationship between auditors and audit committees would be valuable. However, many investors would like to see the most important insights shared with them directly, not through the audit committee filter. A prominent representative of institutional investors sees the provision of broader insights directly to investors as an essential part of the audit profession’s role in safeguarding the capital markets. Other stakeholders, including regulators, agree that auditors should ultimately care most about

investors. One challenge is that investors are not always satisfied with the communication provided by audit committees. They also may not know what they’re missing. As one C-level participant stated: “Audit committees are highly involved, highly effective, or they’re not. I don’t think the public has a clue about that.” A large investor counseled that “it is reasonable to pressure audit committees to represent shareholders, not management.” Some investors agree that it is acceptable to get the information they need from the audit committee, but that they’d prefer to get it from “the horse’s mouth.” One investor said, “I don’t disagree that the [more insightful audit report] should go through the board, but it should not be the board’s decision on whether the information in the report is disclosed to investors.” Yet another articulated that “the prime responsibility [of the auditor] is to report to the shareholder … It’s right to test these other stakeholders, but at the end of the day, it’s what does the investor want?” Others also support auditors thinking more about investor needs, with one corporate governance expert citing the need for auditors to “breathe life into this relationship of accountability between the investor and auditor.” Unintended consequences of broader auditor communications were also cited as a concern. Besides noting the potential for weakening the audit committee’s corporate governance role, stakeholders also worried that legalistic constraints would constrain the quality of information coming directly from the auditor, resulting in more boilerplate.

7

2. Provide perspectives on key information generated by management. Company managements generate a considerable amount of information that they communicate directly to stakeholders or externally through various channels such as annual reports, earnings releases or websites. Stakeholders generally agreed that it would be valuable for auditors to comment or perhaps even provide some level of assurance (given standards) on specific types of management-generated information. To begin with, all stakeholders believe in the imperative for management to tell its own story. The auditor should not be describing management’s story. Stakeholders also recognize potential difficulties with auditors commenting on how management chooses to describe its business, particularly if the auditor contradicts what’s in the MD&A. Some suggest that if auditors weigh in on management’s narrative, businesses might become reticent about disclosing more information and the MD&A could become even more generic than it is today. One Asian investor speculated that it could lead to nonstop arguments between management and auditor, as well as a piling on to accusations that the “auditor doesn’t understand the client’s business.” However, while conscious of the above issues, stakeholders—investors in particular—are concerned about misleading management spin and would welcome insights from auditors. To sort out the spin, at a minimum, investors would like auditors to provide a sense of the consistency of management’s narrative with the facts Take On Management “Spin” of the financial state“Today, there’s a bunch of numbers ments and the audit at the back and market spin at the work completed. front [of the annual report]. This One area that stood is not helpful. People are skeptiout for many stakecal about market spin. Companies holders was the need go through tough times, but you for auditor commenwouldn’t know it … There’s potentary on the non-GAAP tial to say that there is consistency measures used by between what management is saymanagement. “Many ing and what the auditor observes, auditors don’t want to complete the circle. This could be to be associated with useful to investors and apply good non-GAAP measures, discipline to management—make but non-GAAP measure that the stuff at the front is consures sometimes better sistent with the numbers.” reflect the true nature —European investor of the business,” said

one stakeholder. Or, as another stakeholder put it: “GAAP information can frequently be of limited value to an investor. However, while non-GAAP measures can be useful, management can spin the information in ways that can be misleading.” Investors expressed difficulty in reconciling non-GAAP management numbers back to the financial statements. As one explained, “When I look at the management discussion, management says its margins improved by 5%, but I can’t reconcile that back. It would be helpful if the auditor showed the reconciliation or cross-check. That would endorse Move Beyond Financial this management Assurance information.” “[Sustainability reporting] is the Strong support next big thing for assurance and I was expressed for thought it might have happened by auditors to pronow, but it is coming. You may not vide perspectives see the external auditor doing it, but on a company’s disyou’re going to see increasing levclosed risk factors, els of assurance on very significant particularly given reported items that are required by that these tend to stakeholders that are not necessarily be overly generon your list, because you had invesalized, crafted by tors, regulators, but what you didn’t lawyers as a catchall have was civil society. And frankly, and simply repeated all business reports to civil society.” as boilerplate annu—North American board member ally. Others pointed out that the company’s disclosed risk factors (typically broad market and competitive risks) are often not aligned with the risks that the auditor considers in planning the audit, which tend to focus more on financial statement risks such as revenue recognition. Investors suggested that a proper role for the auditor could be to highlight the company’s most significant risks and/or to prioritize the company’s disclosed risk factors. Forbes Insights also explored two areas of management-supplied information where different levels of assurance are already being provided in some jurisdictions: corporate social responsibility and remuneration reports. Some stakeholders are aware that these types of reports receive attestation in different parts of the world. Some think that they could move into the core audit of other jurisdictions over time. For example, one U.S. board

8

representative said, “Sustainability reporting is nowhere near the level of accuracy that financial reporting is, and I think that’s going to be the next horizon.” A U.S. stakeholder views sustainability as a wedge, helping to push the auditor’s role beyond the financial statements. “As the level of sustainability reporting rises, either forced by the Securities and Exchange Commission (SEC) or just by general public requirements, you’re going to see auditors challenged to change their reporting way beyond financial reporting.” Mixed support for auditor commentary on director and executive remuneration was received, with some stakeholders saying that they already have consultants that do this. However, other stakeholders pointed to the usefulness of a role for auditors in this area. One Asian investor said, “The most important one [among the suggested roles for auditor perspectives on management-generated information] is the remuneration. And I wonder if it’s possible to look at it more on a systemic basis. I mean, an audit firm will have a view across whatever industry it is in terms of what typical compensation metrics are used.” Other stakeholders took a more limited view. “I would support auditors’ insights regarding remuneration with regard to compliance reporting, but I do not need the auditor to make comments on remuneration in one company versus another,” explained one stakeholder. An investor thought the idea was “intuitively appealing” given that the capital markets have struggled over the compensation report, but wondered whether a more independent entity should be looking at these issues, not the auditor.

Growing Complexity Businesses have grown more complex, as has the global environment in which they operate: 1. Companies increasingly operate across borders in a complex web of global, national and subnational rules. The S&P 500 derived 36% of revenues from foreign sources in 2000 and 43% in 2012. Fifty companies on the 2012 index had non-U.S. revenues comprising over 75% of their total revenue. 2. Despite efforts to trim, there is still a large number of accounting regulations. In the U.S., the FASB ASC Codification project (completed in 2009) reduced U.S. GAAP from 25,000 pages to 17,000 pages. IFRS,

Commenting on earnings releases was seen as potentially valuable by some, given that markets move on these disclosures. Others questioned the value of this, raising issues such as timeliness—how would auditor association with these disclosures impact the timing of these releases? A more practical solution was advanced by one U.S. investor. He pointed out that “assurance is already provided on the 10Q. Release it at the same time as earnings. That would be helpful. If you had synchronization and auditors look at the 10Q as they do now, that would accomplish what you want.” Several investors suggested that it would be helpful for the auditor to provide insightful commentary on company quarterly forecasts or guidance, providing some “justification” for that forward-looking information. One suggestion was that the auditor could comment on the process management used to develop such guidance. Overall, stakeholders were supportive of the future role of audit encompassing the provision of perspectives on management information, with strong investor support for greater insight and/or “endorsement” of management’s use of non-GAAP measures, disclosed risk factors and other types of information. 3. Provide deeper insights on company performance, operations and risks. Forbes Insights also explored expanding the purview of audit beyond its traditional scope to provide deeper

while shorter, still has 2,500 pages of accounting regulations. 3. Capital markets evolve faster than accounting and audit standards. For example, the OTC derivatives market grew at 25% CAGR from 1988 to 2008, and expanded 42% CAGR between 2005 and 2007 alone. 4. The volume of data is on the upswing. Company disclosures continue to grow as data proliferates. The average length of a FTSE 100 company 10K filing was 56 pages in 2000 and 175 pages by 2011. Footnote disclosures grew 28% between 2004 and 2010.

9

insights on company performance, operations and risk. Stakeholders recognize that when a company is acquired, a great deal of useful information about the company is provided to the buyer through the due diligence process, which the advisory arms of accounting firms perform. As shareholders are also “buyers,” why aren’t deeper analyses performed that would assist them? Stakeholders also point out that the “level of discourse” (that is, the auditor commenting more directly on risks) is different in the prospectus when a company is first listed versus the annual report, expressing the need for greater information harmonization between the two. The growing complexity of companies, as well as the external environment in which they operate, is a key driver for the perceived need for greater insight on the audited company’s operations and risk. As companies have gotten larger, expanded globally and have increasingly complex transactions on their books, the risk profiles of these organizations have grown. Along with this, the amount of “auditable” information has escalated dramatically. Given this background of greater complexity, stakeholders agree, in principle, that it would be useful for the future audit to encompass a set of diagnostics and analyses that could give a well-rounded picture of the modern Encompass Enterprise Risk company’s performance “The [future] role of audit [should] and risks. encompass risk and risk manageSeveral areas among ment systems. Give a more holistic potential new analyview, especially from the risk perses attracted positive spective and not only from the attention. One was financial reporting perspective.” enterprise risk anal—African investor ysis. Stakeholders thought of enterprise risk analysis broadly as incorporating areas such as the strength of the company’s IT systems, the effectiveness of the corporate governance structure and the soundness of the company’s financial reporting processes. “We would like to see more robust coverage of the risk area,” said one stakeholder. Another stakeholder pointed out that auditors are unique in that they have access to many parts of a company’s overall enterprise risk management framework and would be well positioned to take on this role. Others suggested that auditor insights on enterprise risk management should eventually become part of the core audit. One CEO stated, “The basic role, which is that auditors

provide independent assurance of the financial reporting that a company does, will always remain. I think what will increase over time is more-detailed reporting, particularly around risk. [The future role of audit will include being able] to ensure that investors have a holistic perspective on the company, which would include a very detailed assessment of the risks.” Challenges to folding enterprise risk analysis into the core audit also surfaced. Some voiced concern on just how the auditor would comment on a company’s risks—this could be very tricky without clear standards. An investor wondered about the reaction of corporate clients, given that auditor disclosures about risk could presumably reveal too much on a company’s internal operations, in effect giving away important competitive information. One North American board member said, “The trouble with risk management is it conveys the notion that you can manage it, you can measure it … We have more people engaged in risk management than have ever been engaged in that function in the financial industry across the world. I mean very smart people. There’s something about risk management that’s not that simple. I think it may be a little [unreasonable] to expect that the auditors can do more than review the risk management framework, and that by itself won’t manage the risk.” Conversely, others thought that the auditor reviewing and commenting on the risk management framework, as well as knowing that such a process was in place, would be very valuable. As one investor put forth, “It would be helpful to have information on the robustness of the company’s enterprise risk management systems.” The incorporation of fraud analytics into the core audit was highly supported. Financial statement fraud continues to be of concern to stakeholders across the board. Some pointed out that the general public continues to expect that auditors detect fraud. The concept of using data analytics applications to perform a higher-quality audit (for example, auditing a company’s data sets for anomalies that could point to potential fraud risk) made sense to stakeholders. In fact, many study participants think that the audit profession is behind other industries in adopting data analytics. At the same time, stakeholders don’t want the audit to become overly reliant on technology, either. Auditors should deploy analytics but continue to

10

complement their efforts by engaging more deeply with management, employees and boards. “People are the best way to detect fraud—not data analytics,” said one board chairman. “One of the most important things for an auditor to convey is that he will investigate what people say and bring things to the attention of the audit committee.” Stakeholders showed varied appetite for deeper financial analysis, such as quality of earnings and revenue and gross margin trends. They also voiced mixed support for the auditor’s providing information on a company’s market and industry drivers. Investors at investment banks and large asset management firms stated that they already have analysts at their firms to do this kind of work, perhaps viewing it as encroachment on their turf. Others doubted the current auditor’s “fit” for undertaking deeper analyses, citing both skill sets and temperament. One board member pointed to the relatively short-term tenure of auditors as a factor in making this kind of analysis challenging, explaining that “when you limit an audit partner to five years on an engagement, they can’t get smart enough fast enough” to produce industry and market driver analyses. However, several other participants pointed out that these kinds of analyses could be of potential value to retail investors that don’t have access to their own analysts. Overall, stakeholders supported the idea of the auditor providing deeper insight on a company’s performance, operations and risks. Given the complexity of the modern company, investors require a more robust “picture” of the company’s strengths and weaknesses, something that the GAAP numbers can’t fully convey. The incorporation of data analytics into the core audit was also widely supported, but not as a replacement for the auditor taking a probing and skeptical view in its dealings with the audit committee, board, and company management and employees. Stakeholders also recognized that moving into some of these new areas could constitute “mission creep” and counseled the profession to be thoughtful in how it approaches expansion into altogether new areas—especially those thought of traditionally as “consulting.” The provision of additional analyses could be viewed simply as “management consulting,” particularly if the results of these analyses were not published externally and positioned as guidance for investors.

The underlying issue of audit independence remains high on the radar screens of capital market regulators, as well as board members and investors. 4. Provide commentary on other third-party analyses. Stakeholders voiced little, if any, support for reviewing and commenting on company reports published by thirdparty analysts, such as credit rating agencies and equity analysts. Some stakeholders said that it was an exercise “that anybody could do” and that there would be little value add from the auditors entering the arena.

Could the Provision of a More Insightful Audit Help to Address Key Challenges the Profession Faces? During the Forbes Insights research study, stakeholders raised a number of additional professional issues. These issues constitute important challenges that the audit profession faces. Some of the issues raised were directly related to the “Enhanced Audit Framework,” while others surfaced as critiques unrelated to the framework. In contemplating these issues, the question arises: Could the provision of a more insightful audit help to address or ameliorate some of the concerns these challenges hold for the profession? 1. Talent Stakeholders told Forbes Insights that today’s auditor skill set could be improved. Many viewed the boxticking nature of the current audit as detrimental to talent development. For example, one North American stakeholder stated,

Need More Industry Knowledge “When we talk about talent, is it really a talent issue or a relevance issue? So while you have good people, talented potential people, [their knowledge base] may not be relevant to the industry or the company which they are auditing, and hence the management and auditors can’t relate to one another.” —Asian manager

11

“When we keep talking about talent, one of the things that I think is numbing the talent is that there is so much checklist, regulation and standards.” Another charge was that audit teams are heavily weighted with junior people, and the communication between junior and senior audit staff is not always optimal. Frequent staff New Skill Sets Required turnover was cited as “If you’re asking the auditor to creating challenges to a be the smartest guy on the block consistent audit process around an industry and its market and a deeper undertrends and where it’s going, that’s standing of a company’s probably not the same person that’s business. A number of going to learn 200 audit accountstudy participants, paring standards and understand the ticularly representatives PCAOB requirements.” of management, also —U.S. board member highlighted the need for greater industry knowledge on the part of auditors. Still others pointed out that they could not see today’s auditor doing the deeper kinds of analyses described in the enhanced audit model. At the same time, many stakeholders recognized that the advisory arms of the audit firms have the competencies to do this type of work. An opportunity clearly exists to harness the analytical competencies residing in other areas of the firm in service of the audit. By the same token, the profession could continue to deliver such services in an advisory capacity, given that rules around the provision of non-audit services are met. All that said, weaving deeper analyses into the fabric of the audit could have the advantage of creating a more compelling audit career track, thus attracting a higher grade of talent into the profession. 2. Stakeholder Management and Communications Stakeholders have pointed out that the audit profession needs to develop a “voice.” One criticism has been the profession’s “failure to bark” in instances of corporate or systemic failures. Some have criticized the profession’s seeming passivity in the face of external reform efforts. To some, these behaviors

seem partially self-inflicted and stem from historical circumstances. As external regulation increased and the profession became less self-governing, some observed that it also seemed to pull back from more active engagement in shaping its future, leaving that to regulators and standard setters. In practical terms, developments such as these caused the auditor to shrink from communicating effectively with its various constituencies. Stakeholders view the initiation of direct communication with a wide range of stakeholders on the future role of audit as one of the key benefits of this work with Forbes Insights. Being proactive and engaging in discussion on how capital markets can be improved and made more trustworthy has set the stage for longer-term interaction with key constituencies. Moreover, the audit profession is taking on a greater role in determining its own future. Stakeholders are pleased that these initiatives are under way, and many have inquired as to how they can continue to work with the profession to further shape the future role of audit. 3. Accountability Differences in perspectives as to the principal accountability of the audit remain a major challenge. To whom is the auditor responsible? To whom is the auditor accountable? In the current environment, the audit profession sees the audit committee as the proper reporting channel through which audit findings should be communicated, and most audit committee members in the research study agreed. Yet auditors also work closely with management through the course of an engagement. To that, some C-level study participants expressed disappointment that auditors don’t serve them as business advisors like they did in the past. But a large number of stakeholders (of all types) believe that the audit profession, as a practical matter, is responsible to investors. As such, the audit profession has a clear opportunity to address the issue of investor accountability by further exploring the provision of new areas of commentary and analysis that are widely supported by stakeholders, but particularly investors.

12

Conclusions

Nobody can imagine the world without the audit. The audit is, in fact, needed more than ever, given that trust in the capital markets is still fragile. While not perfect, the current pass/fail opinion is highly valued for its assurance provision. Stakeholders want auditors to continue to look for ways to improve the quality of the traditional audit and its focus on the financial statements. However, at the same time, the audit needs to evolve. Stakeholders want more insight from auditors. The majority of stakeholders would like deeper insight on a company’s performance, strengths and risks so that they can form a more holistic opinion about that company. Auditors need to help stakeholders better connect the financial and operational “dots” of the modern enterprise. However, constituents don’t want more boilerplate. Auditors should proactively contribute to the discussion on building a more insightful audit. The audit profession has an important opportunity to take more of a leadership role in capital markets reform. Auditors have a unique role and presence within companies and are thus well positioned to take audit insights to the next level. Auditors need to move fast. A valuable opportunity exists to be proactive, better serve investors and help address pressing professional challenges, including talent attraction, accountability and stakeholder communications improvement. Stakeholders have been clear: “Grab the ball” and evolve the audit to meet the requirements of a rapidly changing and more complex capital markets.

13

About Forbes Insights Forbes Insights is the strategic research and Thought Leadership practice of Forbes Media, publisher of Forbes magazine and Forbes.com, whose combined media properties reach nearly 50 million business decision makers worldwide on a monthly basis. Taking advantage of a proprietary database of senior-level executives in the Forbes community, Forbes Insights conducts research on a host of topics of interest to C-level executives, senior marketing professionals, small business owners and those who aspire to positions of leadership, as well as providing deep insights into issues and trends surrounding wealth creation and wealth management.

Bruce Rogers Chief Insights Officer

Brenna Sniderman Senior Director

Kasia Moreno Editorial Director AND REPORT AUTHOR

Brian McLeod manager, North America

Lawrence Bowden manager, emea

Curtis Bergh DEPUTY DIRECTOR, ASIA

Charles Brucaliere designer

• 60 Fifth Avenue, New York, NY 10011 • 212-366-8890 • www.forbes.com/forbesinsights

14