These standards may concern the auditing procedure, the organization of the auditing firm, or both。 For example, regulation can affect the auditing procedure by mandating external confirmation of the audited company’s credits, and by calibrating the evidence required for such confirmation according to the credit’s magnitude。 While relatively small credits may be checked by a telephone call to the debtor or a fax, original documents may be required for credits whose existence and terms can affect the solvency of the audited firm。 The importance of rules on external confirmation was highlighted by the recent Parmalat scandal, where massive fraud went undetected because of

1 Auditing rules apply to the conduct of auditors: They prescribe how audits must be conducted。 In contrast, accounting standards apply to firms: They concern the reporting principles and procedures that firms can use。

insufficient evidence on a major credit of the company。2 The Parmalat scandal underscored also the importance of another procedural rule, which applies to the auditing of conglomerates by multiple auditors: when an auditor certifies the accounts of the group’s holding company and other auditors verify those of its subsidiaries, a problem of “moral hazard in teams” arises unless the responsibility for the certification of the consolidated balance sheet lies with a single auditor。3 But regulation can also affect the organization of auditing firms, for instance by providing guidelines regarding the system of quality control for audits and by setting standards of competence, independence and honesty of their employees。4

In this paper, we show that the optimal design of auditing regulation depends on three main ingredients。 First, the cost of enforcement, which includes both the necessary public funding (salaries of bureaucrats and judges, paperwork, investigations, etc。) and the compliance costs borne by audit firms and their customers。 Second, the accountants’ incentives to collude with their clients。 Third, the economies of scope that may be reaped through the joint provision of auditing and consulting services to the same firm。

We characterize optimal regulation of auditing under the assumption that the quality of the information certified by auditors is unobservable, so that in the absence of regulation the equilibrium level of audit quality would be inefficiently low。 To avoid this loss of informational efficiency and the implied misallocation of investment, the regulator can impose a minimum quality standard on auditors, but this choice must take enforcement costs into account。 As a result, the optimal standard will fall short of the first-best audit quality level, and must be lower the less efficient the enforcement technology。

2 On 6 March 2003, the auditing firm Grant Thornton accepted a copy of a fax sent by Bank of America as valid evidence of a € 3,6bn credit and € 336m cash held by Bonlat (a subsidiary of Parmalat), altogether worth 36 percent of Parmalat’s debt and accounting for almost all the liquidity of the conglomerate。 On 18 December 2003, the fax was revealed to be false。 If the auditor had checked directly the existence of the credit with Bank of America, this fraud would have been revealed。

3 Deloitte Touche was group auditor and Grant Thornton dealt with subsidiaries, including  the Bonlat offshore unit in the Cayman Islands that is at the centre of the scandal。 Deloitte failed to detect the frauds because it took at face value the reports produced by Grant Thornton about Bonlat。 If regulation had made Deloitte Touche the only auditor responsible for the entire group, it would have raised its incentive to check the subsidiaries’ accounts directly。 Italy, the US and South Africa are among the few countries where this rule is absent, although legislation currently being passed in Italy will eliminate this deficiency。 (We thank Roberto Tizzano for bringing this point to our attention。)