Posting anonymously. Some quick factors not discussed.
1) Massive compliance overhead. Going public and maintaining public status can be a real nightmare.
For example staff generally "get" what a financial statement audit is about - are the numbers correct. And when they aren't everyone gets that a system should be improved. And the auditor makes some notes about areas to improve based on their work, and the difficulty and errors noted in checking the actual numbers. This is the audit most private companies go through - and it actually works pretty well.
A public company under SOX - now you have an audit of the numbers (great) and you have a kind of meta audit of the system (internal control) that got to those numbers (ugh). The cost / benefit of this second part is not clear to most staff. It's huge checklists, everyone get's checklist fatigue, and no one dares change a system after the auditors have been through etc. You literally can ask, why in the world do we do crazy procedures X/Y/Z? Because the auditors accepted it and we are too scared to change it. All critical thinking goes out the window. And folks start driving workarounds to the systems to get stuff done (double ugh and big actual risks).
Read some PCAOB reports for "audit failures". These aren't actual "audit failures" - no numbers were wrong. But it'll be things like - the auditor read over the calculations, checked underlying documents, recalculated numbers sat in on some meetings, but STILL didn't do enough to assess internal control over some calculation.
OK - I'll save the rest for later, but the idea that the private markets are the new public markets rings true to me. These are folks who can weigh actual cost / benefit of compliance cost vs losing money on an investment. Most are going to stick to something like a regular audit. Multiply by 100x in every dimension?
Most such rules are in place because slimebags abused the system, and in some cases taking the world economy with it. I'm all for making more efficient auditing rules, but one has to be careful not the throw the baby out with the bathwater.
Perhaps have compliance tiers such that smaller co's can optionally be in a riskier and less audited stock system or level. However, we probably don't want too much of the economy in that pool.
As it is, private investors may be willing to take on riskier and even dodgier companies who don't want auditors snooping around. That's fine: if the rich want to gamble with dodgy companies via private investment, go for it.
SOX was 2003 - and after it was implemented a bunch of folks nearly took down the world economy all while saying they complied with both SOX and the "highest ethical standards".
The folks who wanted to take down the country faced almost NO consequence and SOX did little to prevent it. Seriously - thousands of companies jump through regulatory hoops - and the aggressive players get off with nothing.
There are lots of people (most people) working to do the RIGHT thing. It's SUPER annoying to have people put in huge efforts to get a bunch of small things right, and then to have goverment totally fail to enforce truly 101 big things.
I would trade out some of the stuff that 4,000 companies and 100,000's of individual have to jump through for even 100 companies getting some actual enforcement action. Everything from IRS audit to anything else you can think of, just at least make there be some consequence for the 101 style abuse of the systems.
Even auditing another 10,000 individuals, 200 additional executives - the number of folks putting money offshore - with full disclosure now available through leaked documents and information sharing, there should be 1000's of cases to chase this stuff down, not just voluntary disclosure programs.
> but one has to be careful not the throw the baby out with the bathwater.
I think it's arguable, though, that setting up onerous regulations is itself an example of throwing the baby out with the bathwater. A ton of otherwise honest companies are required to spend money on compliance because of the actions of a (relative) few bad apples.
The thing that always gets me is that the industries that have grown up around simply guiding and auditing other companies around process and financial compliance suck billions of dollars out of the economy that could be spent in better ways.
Not saying we should throw away the entirety of this regulatory apparatus, because it does serve a useful function, but I think it would be wise to examine the cost of regulation and eliminate parts that cost more than they're worth.
The US as a whole really struggles with self-regulation... we tend towards the extremes of seems deregulation or a byzantine web regulations spawning off a new industry that lobbies for answering every problem with more regulations.
Why not create stronger incentives for individuals? Simplify regulations with massive painful corporate fines and jail/asset forfeiture for culpable leadership. Red tape is implementation details, let them figure it out. A laser pointer is the best way to herd cats.
I really wish we placed more emphasis on significant and wide reaching criminal charges for Executives and other employees who are involved in the bad behavior.
It makes more sense to punish those who cheat than to create onerous regulations to prevent cheating. (Of course no reason you can't have appropriate levels of regulation alongside severe penalties for the white collar crimes the regulations are supposed to prevent.)
While I agree this is a good idea in principle, the problem in practice is that the government is complicit in the cheating. Many of the private actors in the 2008 debacle didn't get punished because the government officials who would have had to punish them had given them nudge nudge wink wink approval behind the scenes. Also, when things started to go south, government officials were calling the shots. (Not to mention the obvious revolving door effect--government officials regulating a given industry are usually former executives in that industry, and often go back and forth several times in their careers.)
But how long ago did these slimebags abuse the system, and are we sure it's still a problem in the modern era?
It seems a lot like the Uber/taxi fight - I imagine at some point somebody painted a car like a taxi and kidnapped some riders, and we needed a way for riders to be able to trust that the driver is safe to ride with so licenses/medallions came about. Now with the internet and verified identity of drivers, turns out we don't need it anymore and Uber has built a safe way to get into a stranger's car.
> Uber has built a safe way to get into a stranger's car
The people who have been attacked by Uber drivers wouldn't agree with that statement. I think Uber/Lyft/etc. are largely safe, but their standards are pretty low, and for a long time they weren't even doing proper criminal background checks on prospective drivers. Agreed that the old taxi system was entirely broken and needed to get shaken up, but Uber was hardly a responsible darling in all this.
While I also agree Uber is no darling, the proper comparison would be between driver-on-passenger assaults for ridesharing services versus traditional taxi. How do they stack up?
It's not immediately obvious which one would be safer. In theory ridesharing yields a more extensive data/evidence trail (driver identity, passenger identity, GPS history, etc), making assault much harder to get away with; this would seem to be a better deterrent than relatively anonymous cab rides.
I did a bit of googling and can't find any hard numbers that compare the two types of transport from a driver-on-passenger assault POV. I would welcome cited figures anyone else might have.
When you say "doing proper criminal background checks", do you mean "making sure no one who has re-entered society after serving their sentence is allowed to work for them"?
Countries with good rehabilitation also do this, certain types of sexual crimes have high recidivism rates despite the best efforts. There's rehabilitation and there's realism and protecting the public, there's a balance.
On my local Nextdoor someone posted recently about a trial being finished and warning that his wife had been sexually assaulted in a nearby area. The actual newspaper story was a little heart-breaking, on the one hand the guy clearly had been trying to improve and felt remorse, on the other he's a menace to women, he literally walked up to the women and put his hand up her skirt.
There are a lot of careers in which criminals can and should be given a chance to reenter society without unacceptably compromising public safety. Driving taxis is not one of them.
I don't think you have a clear idea of what you are talking about in terms of regulation.
As mentioned earlier, Sarbanes-Oxley regulations on public company reporting (which is what is being discussed here) precedes the 2008 financial crisis. There are different regulations that came into place on banks after the 2008 crisis like the Basel III capital requirements that attempt to solve a different problem.
2008 had absolutely nothing to do with the regulations normal public corporations operate under while they are public. Stop bringing it up in the context of SOX because it's irrelevant and goes to show more than anything that the onerous regulation is ineffective because it came out before 2008.
>>But how long ago did these slimebags abuse the system, and are we sure it's still a problem in the modern era?
Of course it is. The system rewards greed, which is a strong incentive to bend the rules or even break them if one thinks they can get away with it. That is why tight controls are necessary, even if they are costly.
>>>Most such rules are in place because slimebags abused the system
While true it was those same "slimebags" that wrote the rules. They made the system complex and convoluted so they could legally do everything they were doing before only now with a full government liability shield protecting them.
My wife works in finance. This above explanation is completely untrue. Companies aren't scared of auditors. The auditors are scared of their clients. Only under extreme situations will an auditor turn around and fire a client. Usually they will find ways to work with them. So things like changing processes, especially for SOX, are non-issues.
There are thousands of public companies in the US, and they all have to endure SOX. It's a pain in the ass but it's not something to be feared. There are plenty of regulations that many companies need to go through that are less onerous than SOX.
The parent never said that companies are scared of auditors, merely that companies have developed processes that auditors have signed off on, and they become scared (I guess a better term might be "resistant") to change those processes because it's time and effort (aka money) to get those new processes approved (which might require some back and forth and iteration). This is absolutely true, and I don't find anything in the parent's post that's inconsistent with that.
From what I've heard from people at my company who deal with auditors, there's no fear or antagonistic relationship; both sides want a positive outcome (which shouldn't be surprising at all). But the cost of the audits and the cost to develop compliant process is real, and I wouldn't blame a private company for eschewing public markets to avoid having to deal with that, especially if they have enough access to private capital.
A more realistic framing would be to say that the auditors having accepted something gives a middle manager an excuse to not have to do something when you ask.
But here’s the thing; any company over a certain size is going to have internal compliance. Because that’s just good business; you want to know if money is walking out the back door.
Parent companies are still going to audit their subordinates; they don’t want the risk. Banks audit private companies before giving them loans. Investment bankers and private equity do the same. These auditors publish standards. So good internal controls processes will still be necessary, just for different reasons. If you want access to funding and resources, you had better be compliant.
>> both sides want a positive outcome (which shouldn't be surprising at all)
Well, it is suprising to me. In my country, when there is some audit by government agency, be it tax office, or stock market regulators the usual approach is that auditors won't rest until they find something against the company, some reason to fine it.
I think that auditors simply consider their time wasted if their come back to their office empty handed (i.e. without fining the audited company).
There are many cases where tax office made a company go bankrupt by first charging it with some crime, then blocking its accounts, then fining it. After few years of lawsuits company wins, court finds them innocent and orders refund of all the fines, but by the time this happens it is already too late: company is long bankrupt.
So I think you are lucky to live in a country where auditors are this friendly :)
I think the parent is talking about periodic internal audits i.e. conducted routinely but you are referring to forensic audits which are conducted occassionally when there is suspicion of wrongdoing (e.g. manipulated tax returns, inflated contracts etc).
> You literally can ask, why in the world do we do crazy procedures X/Y/Z? Because the auditors accepted it and we are too scared to change it.
I interpret it as the parent saying that they're afraid of making changes because they're afraid that the auditors won't sign off on it. "Scared" is a funny word to use when they could have called it a "pain in the ass", etc.
Fear of pain, hassle, loss, or discomfort is still fear. "Scared" is a perfectly acceptable word to use when someone decides not to do something they should do because they don't want to take a risk.
The simple act of complying with GAAP is much more onerous than SOX. Any finance person worth their salt can navigate SOX easily. Only inexperienced finance people have problems with SOX, but then again, similar things can be said about inexperience programmers as well.
I'm afraid this illustrates how poorly informed you are - you clearly are not an accountant with significant experience (just saying). This goes doubly so of your wife - if this is her level of understanding that is very worrisome - the idea that she is licensed with this attitude is scary - it's what you don't know that can bite you.
Some facts for those that may read the above and get the wrong idea. EVERY major big four firm and their clients and all other major players have had great difficulty in this area. It's super painful because the question is not - are the numbers right - which pretty much everyone in accounting would understand putting efforts towards, but a very meta (and wide) question on systems getting to the numbers (with turns out to be subjective).
What's crazy is I can step back from this type of thing and without even going into a company spot lots of issues likely illustrating poor control or even worthy of enforcement action (actual enforcement) from the outside. Seriously, go to a consumer complaint website - if you see a ton of the same complaint it's worth a look.
This is why CFPB was such a powerful idea. Yes - they overreached slightly but 90%+ great work - and very focused on bad actors which was wonderful to everyone trying to do right thing. Absolutely should have kept going with that idea.
Just a flavor... pay close attention to words like all and every which open up each item to huge scope - the auditor here picked a random month to test a system and actually went in person to a meeting where reconciliations were performed. Now repeat this 100x for each client. Every firm out there doing audits has had issues like this (many).
These are the MOST experienced people - so I laugh when I hear that "only inexperienced people" have problems.
KPMG:
A.1. Issuer A
In this audit, the Firm failed to obtain sufficient appropriate audit evidence to support its opinions on the financial statements and on the effectiveness of ICFR.
The Firm identified this manual control and certain other manual review and reconciliation controls as compensating controls, but failed to sufficiently test these controls.
Specifically —
o To test the review and approval of changes to the financially
significant applications, the Firm tested a sample of changes to
determine whether they had been appropriately approved. The
Firm's testing was not sufficient as ... its sample was limited to changes made in only
one month (the third month before year end) and the Firm failed to
consider whether this month was representative of changes made
throughout the year.
o To test the manual review and reconciliation controls, the Firm
obtained certain monthly operating review reports and
reconciliations and attended certain monthly management meetings
where the reports and reconciliations were discussed. The Firm's
testing was not sufficient, as (a) it did not test controls over the
completeness and accuracy of the data in the reports, and (b) it
failed to test whether these controls identified all of the relevant
issues for investigation and, if so, whether such issues were
appropriately investigated and resolved.
No doubt you have experience that I don't. But if I'm reading a comment about audit controls, and it can't keep track of how many numbered points it has, I'm going to be skeptical.
The issue is simply a result of earlier articles talking about how nobody wants to do Series A's anymore--VC's and companies. If one end of the pipeline shuts off, the other end eventually runs out too.
1) Massive compliance overhead. Going public and maintaining public status can be a real nightmare.
For example staff generally "get" what a financial statement audit is about - are the numbers correct. And when they aren't everyone gets that a system should be improved. And the auditor makes some notes about areas to improve based on their work, and the difficulty and errors noted in checking the actual numbers. This is the audit most private companies go through - and it actually works pretty well.
A public company under SOX - now you have an audit of the numbers (great) and you have a kind of meta audit of the system (internal control) that got to those numbers (ugh). The cost / benefit of this second part is not clear to most staff. It's huge checklists, everyone get's checklist fatigue, and no one dares change a system after the auditors have been through etc. You literally can ask, why in the world do we do crazy procedures X/Y/Z? Because the auditors accepted it and we are too scared to change it. All critical thinking goes out the window. And folks start driving workarounds to the systems to get stuff done (double ugh and big actual risks).
Read some PCAOB reports for "audit failures". These aren't actual "audit failures" - no numbers were wrong. But it'll be things like - the auditor read over the calculations, checked underlying documents, recalculated numbers sat in on some meetings, but STILL didn't do enough to assess internal control over some calculation.
OK - I'll save the rest for later, but the idea that the private markets are the new public markets rings true to me. These are folks who can weigh actual cost / benefit of compliance cost vs losing money on an investment. Most are going to stick to something like a regular audit. Multiply by 100x in every dimension?