Notice2026-19148
Public Company Accounting Oversight Board; Notice of Filing of Proposed Rules on Amendments to QC 1000, A Firm's System of Quality Control, and Related Rule and Forms
Primary source
Metadata and text below are from the Federal Register, a public-domain U.S. government work. Always verify the official published version before relying on it for any legal matter.
Published
September 18, 2026
Issuing agencies
Securities and Exchange Commission
Full Text
<html>
<head>
<title>Federal Register, Volume 91 Issue 180 (Friday, September 18, 2026)</title>
</head>
<body><pre>
[Federal Register Volume 91, Number 180 (Friday, September 18, 2026)]
[Notices]
[Pages 59354-59403]
From the Federal Register Online via the Government Publishing Office [<a href="http://www.gpo.gov">www.gpo.gov</a>]
[FR Doc No: 2026-19148]
[[Page 59353]]
Vol. 91
Friday,
No. 180
September 18, 2026
Part III
Securities and Exchange Commission
-----------------------------------------------------------------------
Public Company Accounting Oversight Board; Notice of Filing of Proposed
Rules on Amendments to QC 1000, A Firm's System of Quality Control, and
Related Rule and Forms; Notice
Federal Register / Vol. 91 , No. 180 / Friday, September 18, 2026 /
Notices
[[Page 59354]]
-----------------------------------------------------------------------
SECURITIES AND EXCHANGE COMMISSION
[Release No. 34-106372; File No. PCAOB-2026-01]
Public Company Accounting Oversight Board; Notice of Filing of
Proposed Rules on Amendments to QC 1000, A Firm's System of Quality
Control, and Related Rule and Forms
September 15, 2026.
Pursuant to section 107(b) of the Sarbanes-Oxley Act of 2002 (the
``Act''), notice is hereby given that on September 10, 2026, the Public
Company Accounting Oversight Board (the ``Board'' or the ``PCAOB'')
filed with the Securities and Exchange Commission (the ``Commission''
or the ``SEC'') the proposed rules described in items I and II below,
which items have been prepared by the Board. On September 14, 2026, the
Board filed with the Commission a technical correction to one of the
proposed rules. The Commission is publishing this notice to solicit
comments on the proposed rules from interested persons.
I. Board's Statement of the Terms of Substance of the Proposed Rules
On September 9, 2026, the Board adopted proposed rule amendments to
QC 1000, A Firm's System of Quality Control, related amendments to
PCAOB Rule 2203A, PCAOB forms, and technical amendments to AS 2101,
Audit Planning. (collectively, the ``proposed rules''). On September
11, 2026, the Board adopted a technical correction to the proposed rule
amendments to QC 1000. The text of the proposed rules appears in
Exhibit A to the SEC Filing Form 19b-4 and is available on the Board's
website at <a href="https://pcaobus.org/about/rules-rulemaking/rulemaking-dockets/docket-057">https://pcaobus.org/about/rules-rulemaking/rulemaking-dockets/docket-057</a>.
II. Board's Statement of the Purpose of, and Statutory Basis for, the
Proposed Rules
In its filing with the Commission, the Board included statements
concerning the purpose of and basis for the proposed rules and
discussed any comments it received on the proposed rules. The text of
these statements may be examined at the places specified in Item IV
below. The Board has prepared summaries, set forth in sections A, B,
and C below, of the most significant aspects of such statements. In
addition, to the extent necessary, the Board is requesting that the
Commission approve the proposed rules pursuant to section 103(a)(3)(C)
of the Act for application to audits of emerging growth companies
(``EGCs''), as that term is defined in section 3(a)(80) of the
Securities Exchange Act of 1934 (``Exchange Act''). The Board's request
is set forth in section D.
A. Board's Statement of the Purpose of, and Statutory Basis for, the
Proposed Rules
(a) Purpose
The Board adopted QC 1000, A Firm's System of Quality Control (``QC
1000''), on May 13, 2024,\1\ to lead registered public accounting firms
(``firms'') to significantly improve their quality control (``QC'')
systems. The Board believes that, as firms prepare for the effective
date of QC 1000, many such improvements have been and will continue to
be implemented as firms develop more rigorous QC systems. The Board's
experience during the implementation period led us, however, to
consider whether the new standard imposes costs that may not be
necessary for us to achieve the Board's regulatory goals and,
relatedly, whether there were certain aspects of QC 1000 that could be
brought into closer alignment with other audit firm quality management
standards.\2\
---------------------------------------------------------------------------
\1\ A Firm's System of Quality Control and Other Amendments to
PCAOB Standards, Rules, and Forms, PCAOB Rel. No. 2024-005 (May 13,
2024) (``QC 1000 2024 adopting release'').
\2\ See International Standard on Quality Management (``ISQM'')
1, Quality Management for Firms that Perform Audits or Reviews of
Financial Statements, or Other Assurance or Related Services
Engagements (``ISQM 1''), issued by the International Auditing and
Assurance Standards Board; Statement on Quality Management Standards
(``SQMS'') No. 1, A Firm's System of Quality Management (``SQMS
1''), issued by the Auditing Standards Board of the American
Institute of CPAs.
---------------------------------------------------------------------------
The Board adopted amendments to QC 1000 that it believes address
concerns regarding the implementation challenges identified by firms
and better align certain provisions with other quality management
standards. These amendments are designed to reduce compliance costs
while maintaining the investor protection benefits of QC 1000.
The principal amendments the Board adopted:
<bullet> Rescind the ``design-only'' requirement so that QC 1000
imposes requirements only on firms that are required to comply with
applicable professional and legal requirements with respect to any
``engagement'' as defined in QC 1000 (QC 1000.06 and .07d);
<bullet> Provide increased flexibility in filling certain specified
roles in the QC system by permitting roles to be assigned to non-firm
personnel and divided among multiple individuals (QC 1000.12);
<bullet> Rescind the requirement to have an External QC Function
(``EQCF'') (QC 1000.28);
<bullet> Narrow and simplify communication requirements relating to
metrics that the firm communicates to external parties about its audit
practice, firm personnel, or engagements (QC 1000.53e);
<bullet> With respect to identified engagement deficiencies,
require evaluation of whether similar engagement deficiencies exist on
other engagements only if the identified deficiency resulted or could
result in (i) a failure to obtain sufficient appropriate evidence to
support the conclusion reached on an engagement or (ii) an
inappropriate overall conclusion on the subject matter of an engagement
(QC 1000.68d);
<bullet> Revise the definition of QC deficiency to make clear that,
when firms have implemented more than one quality response to address
the same quality risk, they can take those other quality responses
(e.g., compensating responses) into account when determining whether a
QC deficiency exists (QC 1000.A8);
<bullet> Allow firms to select the date as of which they annually
evaluate the effectiveness of their QC system, rather than requiring
firms to evaluate as of September 30 (QC 1000.77);
<bullet> Revise the QC system evaluation conclusions to align more
closely with the conclusions in other quality management standards,
while retaining a structured process, including specified factors for
consideration, to guide the evaluation (QC 1000.77 and .78); and
<bullet> Simplify the requirements for retention of QC system
documentation and abbreviate the retention period from seven to five
years (QC 1000.84 and .86).
Additional amendments the Board adopted, including conforming
amendments, are discussed below.
Several of the amendments the Board adopted bring QC 1000 into
closer alignment with other quality management standards, both
internationally and in the United States. However, differences remain
in areas where the Board continues to believe that alternative or
incremental provisions of QC 1000 better address its legal and
regulatory environment, the needs and priorities of the Board's
stakeholders, and the Board's statutory mandate of protecting investors
and the public interest.
QC 1000 and the related amendments to PCAOB standards, rules, and
forms adopted in 2024 will take effect on December 15, 2026. If
approved by the
[[Page 59355]]
SEC, the amendments to QC 1000 that the Board adopted and the related
amendments to a PCAOB rule and PCAOB forms will also take effect on
December 15, 2026.
The proposed rules also include technical amendments to AS 2101,
Audit Planning, to remove references to an auditing standard that was
rescinded by another rulemaking.\3\ The Board adopted these amendments
as final due to their technical nature, and the Board did not seek
public comment on these amendments. These amendments will be effective
upon SEC approval.
---------------------------------------------------------------------------
\3\ See General Responsibilities of the Auditor in Conducting an
Audit and Amendments to PCAOB Standards, PCAOB Rel. No. 2024-004
(May 13, 2024) (rescinding AS 1015, Due Professional Care in the
Performance of Work).
---------------------------------------------------------------------------
(b) Statutory Basis
The statutory basis for the proposed rules is Title I of the Act.
B. Board's Statement on Burden on Competition
Not applicable. The Board's consideration of the economic impacts
of the proposed rules is discussed in section D below.
C. Board's Statement on Comments on the Proposed Rule Change Received
From Members, Participants, or Others
The Board released proposed rule amendments for public comment on
June 9, 2026, in its release titled Supplemental Request for Comment:
Proposed Amendments to QC 1000, A Firm's System of Quality Control, and
Related Rule and Forms, PCAOB Release No. 2026-002. The Board received
25 comment letters in response to that supplemental request for
comment. See Comment Letters for Docket 057, <a href="https://pcaobus.org/about/rules-rulemaking/rulemaking-dockets/docket-057/comment-letters">https://pcaobus.org/about/rules-rulemaking/rulemaking-dockets/docket-057/comment-letters</a>. The
Board also received 26 comment letters in response to a request for
public comment on the PCAOB strategic priorities, identified at
footnote 12 below, and 4 comment letters in response to a request for
public comment on PCAOB standard setting, identified at footnote 289
below, and 1 comment letter in response to a request for public comment
on the Draft 2026-2030 Strategic Plan Goals and Objective, identified
at footnote 300 below, which all raised comments specifically to QC
1000, among other things. See Comment Letters on the PCAOB website
available at <a href="https://pcaobus.org/about/strategic-plan-budget/public-comments-on-pcaob-strategic-priorities">https://pcaobus.org/about/strategic-plan-budget/public-comments-on-pcaob-strategic-priorities</a>, <a href="https://pcaobus.org/oversight/standards/standard-setting-research-projects/agenda-consultation--request-for-public-comment-on-pcaob-standard-setting">https://pcaobus.org/oversight/standards/standard-setting-research-projects/agenda-consultation--request-for-public-comment-on-pcaob-standard-setting</a>, and <a href="https://pcaobus.org/about/strategic-plan-budget/public-comments-on-goals-and-objectives-for-pcaob-strategic-plan-2026-2030">https://pcaobus.org/about/strategic-plan-budget/public-comments-on-goals-and-objectives-for-pcaob-strategic-plan-2026-2030</a>, respectively. The Board
has carefully considered all comments received. The Board's responses
to the comments received, including revisions to the proposed rule
amendments, are discussed below.
Background
This section presents background information on this rulemaking,
including recent rulemaking history and staff implementation support
efforts since SEC approval of QC 1000 in September 2024.
Recent Rulemaking History
On May 13, 2024, the Board adopted QC 1000 and related amendments.
They were approved by the SEC on September 9, 2024, with an effective
date of December 15, 2025.\4\
---------------------------------------------------------------------------
\4\ For more details regarding the rulemaking history of QC
1000, see Rulemaking Docket No. 046 on the Board's website,
available at <a href="https://pcaobus.org/about/rules-rulemaking/rulemaking-dockets/docket-046-quality-control">https://pcaobus.org/about/rules-rulemaking/rulemaking-dockets/docket-046-quality-control</a>; see also Public Company
Accounting Oversight Board; Order Granting Approval of QC 1000, A
Firm's System of Quality Control and Related Amendments to PCAOB
Standards, Rules, and Forms, SEC Rel. No. 34-100968 (Sept. 9, 2024).
---------------------------------------------------------------------------
On August 28, 2025, to provide firms with additional time for
implementation, the Board proposed to delay the effective date of QC
1000 and the related amendments to December 15, 2026, and that
postponement became immediately effective.\5\ The SEC received 15
comment letters in response to its notice regarding the
postponement.\6\ Commenters generally supported providing additional
implementation time but raised concerns regarding certain provisions of
QC 1000 that they viewed as more prescriptive than other quality
management standards and as creating unnecessary operational complexity
and cost.
---------------------------------------------------------------------------
\5\ See Public Company Accounting Oversight Board; Notice of
Filing and Immediate Effectiveness of Proposed Rule Change
Postponing the Effective Date of Amendments to Board Standards,
Rules, and Forms Adopted on May 13, 2024, SEC Rel. No. 34-103803
(Aug. 28, 2025).
\6\ The comment letters received are available on the SEC's web
page, available at <a href="https://www.sec.gov/comments/pcaob-2025-01/pcaob202501.htm">https://www.sec.gov/comments/pcaob-2025-01/pcaob202501.htm</a>.
---------------------------------------------------------------------------
On July 23, 2025, and March 20, 2026, the PCAOB received letters
from a firm-related group regarding implementation of QC 1000 and
related implementation challenges.\7\
---------------------------------------------------------------------------
\7\ See letter from the Center for Audit Quality dated July 23,
2025, available at <a href="https://www.thecaq.org/comment-letter-pcaob-requesting-deferral-qc-1000">https://www.thecaq.org/comment-letter-pcaob-requesting-deferral-qc-1000</a>; and letter from the Center for Audit
Quality dated March 20, 2026, available at <a href="https://www.thecaq.org/letter-to-the-pcaob-on-qc1000-implementation-experience-and-costs">https://www.thecaq.org/letter-to-the-pcaob-on-qc1000-implementation-experience-and-costs</a>.
---------------------------------------------------------------------------
On March 31, 2026, the Board issued a request for public comment on
the PCAOB's strategic priorities, including future standard-setting
activity.\8\ Several commenters provided observations regarding QC
1000.\9\ The comments relating to QC 1000 were generally consistent
with themes raised in comment letters submitted to the PCAOB and SEC in
connection with the extension of the effective date of QC 1000. Most
commenters urged the Board to adopt or align more closely with ISQM 1,
suggesting it may better support global implementation, while
emphasizing that differences in structure, terminology, and
prescriptive requirements in QC 1000 create operational challenges,
limit firm judgment, and increase complexity for global firms.
---------------------------------------------------------------------------
\8\ See Request for Public Comment, PCAOB Strategic Priorities,
PCAOB Rel. No. 2026-001 (Mar. 31, 2026).
\9\ The comment letters received are on the Board's website,
available at <a href="https://pcaobus.org/about/strategic-plan-budget/public-comments-on-pcaob-strategic-priorities">https://pcaobus.org/about/strategic-plan-budget/public-comments-on-pcaob-strategic-priorities</a>.
---------------------------------------------------------------------------
After considering feedback and information obtained through
implementation support efforts,\10\ on June 9, 2026, the Board issued a
supplemental request for comment on potential targeted amendments to
certain provisions of QC 1000 and related amendments to the QC
reporting rule and PCAOB forms.\11\ The Board received 26 comment
letters.\12\
[[Page 59356]]
Commenters included firms and firm-related groups, investor-related
groups, and others. Firms, firm-related groups, and most other
commenters generally supported the Board's objective of making targeted
amendments to QC 1000 and most of the proposed amendments, particularly
those intended to increase flexibility, improve operability, reduce
unnecessary compliance burdens, and better align QC 1000 with other
quality management standards.\13\ One investor-related group did not
support the proposed amendments overall because of the proposed
rescission of the EQCF requirement.\14\ Other investor-related groups
generally supported the proposed amendments that reduce compliance
costs without reducing audit quality, but opposed the removal of the
EQCF requirement, emphasizing the importance of independent oversight
and investor protection, and other amendments they viewed as weakening
investor-protection-focused provisions of QC 1000.\15\ Many commenters,
particularly firms and firm-related groups, also requested
implementation guidance and clarification in certain areas discussed
below.\16\
---------------------------------------------------------------------------
\10\ See discussion below regarding PCAOB staff's implementation
support efforts, including implementation guidance, workshops,
stakeholder outreach, and feedback received from firms and other
stakeholders regarding QC 1000 implementation.
\11\ See Supplemental Request for Comment: Proposed Amendments
to QC 1000, A Firm's System of Quality Control, and Related Rule and
Forms, PCAOB Rel. No. 2026-002 (June 9, 2026) (proposing amendments
to QC 1000, PCAOB Rule 2203A, and PCAOB Forms 1, 2, and QC).
\12\ See comment letters on the Supplemental Request for Comment
from the Auditing Standards Committee, Auditing Section--American
Accounting Association (July 3, 2026) (``AAA''); Baker Tilly US, LLP
(July 9, 2026) (``Baker Tilly''); BDO USA, P.C. (July 9, 2026)
(``BDO''); CBIZ CPAs P.C. (July 9, 2026) (``CBIZ''); Center for
Audit Quality (July 9, 2026) (``CAQ''); CFA Institute (Aug. 31,
2026) (``CFA''); Council of Institutional Investors (July 9, 2026)
(``CII''); Crowe LLP (July 9, 2026) (``Crowe''); Deloitte & Touche
LLP (July 9, 2026) (``Deloitte''); Ernst & Young LLP (July 9, 2026)
(``EY''); Forvis Mazars, LLP (July 9, 2026) (``Forvis''); George R.
Kramer (July 6, 2026) (``Kramer''); Grant Thornton LLP (July 9,
2026) (``GT''); International Corporate Governance Network (July 9,
2026) (``ICGN''); James Grosvenor (July 9, 2026) (``Grosvenor'');
KPMG LLP (July 9, 2026) (``KPMG''); MaloneBailey, LLP (June 26,
2026) (``Malone Bailey''); Members of the Investor Advisory Group
(July 9, 2026) (``MIAG''); Pennsylvania Institute of CPAs (July 9,
2026) (``PICPA''); Plante & Moran, PLLC (July 10, 2026) (``Plante &
Moran''); PricewaterhouseCoopers LLP (July 9, 2026) (``PwC''); RSM
US LLP (July 9, 2026) (``RSM''); St. Charles Consulting Group (June
12, 2026) (``SCCG''); Thomas H. Spitters (July 6, 2026)
(``Spitters''); and Virginia Society of CPAs (July 9, 2026)
(``VSCPA''). One additional comment letter was withdrawn.
\13\ See, e.g., comment letters from AAA, Baker Tilly, BDO, CAQ,
CBIZ, Crowe, Deloitte, EY, Forvis, Grosvenor, GT, KPMG, Kramer,
Malone Bailey, PICPA, Plante & Moran, PwC, RSM, SCCG, Spitters, and
VSCPA.
\14\ See comment letter from CII.
\15\ See comment letters from CFA, ICGN, and MIAG.
\16\ See, e.g., comment letters from Baker Tilly, BDO, CAQ,
CBIZ, Crowe, Deloitte, EY, Forvis, GT, KPMG, Kramer, Plante & Moran,
RSM, SCCG, and VSCPA.
---------------------------------------------------------------------------
The Board considered all comments received on the supplemental
request for comment. As discussed below, the Board is adopting the
proposed amendments to QC 1000, with certain modifications.
Implementation Support Efforts
Since SEC approval of QC 1000, PCAOB staff have supported
implementation through guidance, workshops, outreach activities, and
engagement with stakeholders, which provided insight into
implementation progress, challenges, and questions and informed the
Board's consideration of the proposed amendments.\17\ Additionally, as
part of inspection outreach activities, the Board obtained feedback on
the progress made by firms in implementing QC 1000 in their QC
systems.\18\
---------------------------------------------------------------------------
\17\ See PCAOB, Quality Control--Implementation Resources,
available at <a href="https://pcaobus.org/oversight/standards/implementation-resources-PCAOB-standards-rules/quality-control">https://pcaobus.org/oversight/standards/implementation-resources-PCAOB-standards-rules/quality-control</a>, which includes
staff guidance and other materials issued to support implementation
of QC1000 and the related amendments.
\18\ See section titled ``Need'' under ``Economic
Considerations'' below for additional information on data received
through these inspection outreach activities.
---------------------------------------------------------------------------
As part of staff implementation support efforts, the PCAOB staff
released QC 1000 Questions and Answers (``QC 1000 Q&As'') in August
2026.\19\ The QC 1000 Q&As provide technical guidance on various
aspects of QC 1000, including roles and responsibilities, evaluation
and reporting, documentation, and other areas of designing,
implementing, operating, and evaluating a firm's QC system. The QC 1000
Q&As were developed in response to questions and requests for
clarification received from firms through staff implementation support
efforts and are intended to reduce uncertainty and support firms'
implementation of the standard.
---------------------------------------------------------------------------
\19\ See QC 1000 Questions and Answers, available at <a href="https://pcaobus.org/oversight//setting-research-projects/quality-control/qc-1000-questions-and-answers">https://pcaobus.org/oversight//setting-research-projects/quality-control/qc-1000-questions-and-answers</a>.
---------------------------------------------------------------------------
The QC 1000 Q&As do not address the specific topics that are the
subject of the amendments to QC 1000 that the Board adopted, but they
do address some questions and clarification requests on other topics
that were included in comment letters submitted in response to the
supplemental request for comment. As implementation continues,
additional guidance, including updates to the QC 1000 Q&As, may be
issued to help address other areas identified by commenters or through
staff implementation support efforts.
Amendments to QC 1000, PCAOB Rule 2203A, and PCAOB Form QC
This section describes the requirements of QC 1000, Rule 2203A, and
Form QC that the Board amended.
Requirement To Design, Implement, and Operate a QC System
As originally adopted, QC 1000.06 requires all firms to design a QC
system that complies with the standard, regardless of whether the firm
is subject to applicable professional and legal requirements with
respect to an engagement as defined in QC 1000. As explained in the
supplemental request for comment, the Board understands that this
``design-only'' requirement would impose costs on firms that do not
perform engagements requiring registration under the Sarbanes-Oxley Act
of 2002 (``Sarbanes-Oxley'') \20\ or PCAOB rules \21\ without
commensurate benefits for investors and the public. Therefore, the
Board proposed to eliminate the requirement and sought comment on
potential alternatives, as well as any circumstances that potentially
could trigger a design requirement. As proposed in the supplemental
request for comment, paragraphs .05 through .07 of QC 1000 would be
revised to eliminate the separate obligation to design a QC system and
would maintain unchanged the obligation to design, implement, and
operate a QC system in compliance with QC 1000 when a firm is subject
to applicable professional and legal requirements with respect to any
of the firm's engagements.
---------------------------------------------------------------------------
\20\ See section 102(a) of Sarbanes-Oxley, 15 U.S.C. 7212(a).
\21\ See PCAOB Rule 2100, Registration Requirements for Public
Accounting Firms.
---------------------------------------------------------------------------
Many commenters supported the proposal to rescind the design-only
requirement.\22\ One commenter stated that they did not object to
rescinding the design-only requirement when a firm neither performs nor
intends to perform PCAOB engagements.\23\ One of the commenters
supporting rescission stated that it did not believe registered firms
should be required to comply with PCAOB standards until the firm
undertakes an engagement requiring compliance with those standards and
that the design-only requirement was inconsistent with the text of
Sarbanes-Oxley.\24\ Commenters that addressed the question of whether
the Board should adopt an alternative design-only requirement generally
did not support such a requirement.\25\
---------------------------------------------------------------------------
\22\ See comment letters from AAA, Baker Tilly, BDO, CAQ, Crowe,
Deloitte, GT, KPMG, Kramer, MIAG, PICPA, PwC, and RSM. But see
comment letters from ICGN and Spitters. One commenter expressed
support for eliminating the ``design-only reporting requirement,''
described as the ``requirement for firms to report once a quality
control system has merely been designed.'' See comment letter from
VSCPA.
\23\ See comment letter from CFA.
\24\ See comment letter from RSM.
\25\ See comment letters from AAA, BDO, GT, KPMG, Kramer, and
PICPA.
---------------------------------------------------------------------------
However, one commenter stated support for a QC design requirement
that included effective operation of a system of quality management
under relevant standards for the jurisdiction in which the firm
operates, such as ISQM 1 or SQMS 1.\26\ This commenter noted that, in
practice, registered firms would already maintain some form of a system
of quality management to support their
[[Page 59357]]
PCAOB registration.\27\ The Board does not believe QC 1000 should
explicitly require compliance with rules of local jurisdictions, as
PCAOB standards generally do not impose such requirements. Another
commenter noted that, although some registered firms do not conduct
audits, that fact does not necessarily signify the need for an
exemption from standard best practices or audit quality requirements;
such firms should be subject to QC 1000 on the level of preparedness or
some QC regime that parallels QC 1000 in its design, implementation,
and operation.\28\ The Board does not believe that the suggestion to
base a design-only requirement on a level of preparedness or a system
paralleling QC 1000 is workable because it is too vague as to the
requirements that would apply to firms not performing PCAOB
engagements.
---------------------------------------------------------------------------
\26\ See comment letter from RSM.
\27\ See id.
\28\ See comment letter from Spitters.
---------------------------------------------------------------------------
Commenters raised concerns over the costs of the design-only
requirement in relation to the benefits.\29\ One commenter stated that
the requirement would have resulted in unnecessary costs of compliance
without commensurate benefits.\30\ Another commenter similarly stated
that requiring firms not performing PCAOB engagements to comply with
the design-only requirement did not provide a commensurate benefit to
investor protection, as such firms do not present risk to U.S. capital
markets.\31\ Another commenter stated that requiring firms to build
compliance infrastructure for work they may never undertake imposes
cost without a corresponding investor benefit.\32\ Another commenter
observed that, because firms performing engagements would be fully
subject to the requirement to design, implement, and operate a QC 1000-
compliant system, rescinding the requirement for firms not performing
such work would preserve the Board's objective of promoting high-
quality audits, while reducing unnecessary burdens for those firms.\33\
Another commenter stated that, while the value to the public of the
design-only requirement was unclear, the costs would be real in the
form of training costs, consulting costs, and professional time.\34\
Other commenters noted the limited benefits of the requirement for
investors, stating that rescission would not diminish investor
protection \35\ or introduce any risk to investors,\36\ or that
retaining the requirement would not help ensure improved audit
quality.\37\
---------------------------------------------------------------------------
\29\ See, e.g., comment letters from KPMG, PICPA, and PwC.
\30\ See comment letter from PwC.
\31\ See comment letter from KPMG.
\32\ See comment letter from CFA.
\33\ See comment letter from GT.
\34\ See comment letter from PICPA.
\35\ See comment letter from GT.
\36\ See comment letter from Baker Tilly.
\37\ See comment letter from PICPA.
---------------------------------------------------------------------------
Two commenters also raised concerns about requiring firms to
address hypothetical situations. One of these commenters stated that it
would be difficult for a firm not subject to applicable professional
and legal requirements with respect to any engagement to design a QC
system based on hypothetical circumstances.\38\ The second commenter
stated that such a firm's QC system ``would be hypothetical at best and
would likely become obsolete over time as practice conditions change,
leading to the false pretense that [the firm is] in a position to
immediately implement these standards.'' \39\
---------------------------------------------------------------------------
\38\ See comment letter from AAA.
\39\ See comment letter from PICPA.
---------------------------------------------------------------------------
The Board is rescinding the design-only requirement and adopting
paragraphs .05 through .07 as proposed.\40\ The Board believes
rescinding the design-only requirement will reduce costs for firms
without any significant detriment to audit quality.
---------------------------------------------------------------------------
\40\ As noted in the supplemental request for comment, the Board
does not believe that this action would violate the mandate in
section 103(a)(2)(B) of Sarbanes-Oxley, 15 U.S.C. 7213(a)(2)(B), to
adopt requirements ``for every registered public accounting firm''
that address certain enumerated areas in ``the quality control
standards that [the PCAOB] adopts with respect to the issuance of
audit reports.'' Under the Board's approach, QC 1000 will apply to
every firm with respect to the issuance of ``audit reports'' (which
are limited under Sarbanes-Oxley to those relating to audits of
issuers and broker-dealers).
---------------------------------------------------------------------------
As confirmed by commenter feedback, implementing the design-only
requirement has proven more difficult and costly than originally
anticipated. The requirement may compel some firms that have no
intention of performing PCAOB engagements in the foreseeable future to
design a QC 1000-compliant system, perhaps based on hypothetical
circumstances. As described in the supplemental request for comment,
the Board believes that the design-only requirement may have
contributed to an increase in withdrawals from registration by firms
that are not performing engagements. Although the impact of such
activity on the marketplace (discussed below in the economic analysis)
may be limited, the Board believes investors and the public interest
are better served by incentivizing firms to register and consider
seeking PCAOB engagements, thereby promoting competition.\41\
---------------------------------------------------------------------------
\41\ As noted in the supplemental request for comment, some
firms may register with the Board to perform activities not subject
to the PCAOB's jurisdiction. See, e.g., Guiding and Establishing
National Innovation for U.S. Stablecoins Act, Pub. L. 119-27 (July
18, 2025), section 4(a)(3)(A), 12 U.S.C. 5903(a)(3)(A) (requiring
month-end reports of permitted payment stablecoin issuers to be
examined by a PCAOB-registered firm).
---------------------------------------------------------------------------
In the Board's view, rescission of the design-only requirement
would entail foregoing the benefits associated with greater
preparedness of firms to take on a PCAOB engagement for the first time.
The Board believes this benefit to be modest, as any firm that actually
takes on such an engagement will have become subject to the requirement
to design, implement, and operate a QC 1000 system.\42\ In any event,
and as noted by one commenter, registered firms that do not perform
PCAOB engagements are generally well-positioned to implement QC 1000 if
or when required to do so.\43\ This is so because most such firms, as
some commenters observed, are generally either non-U.S. firms subject
to international auditing standards or U.S.-based firms that conduct
private company audits under the standards of the Auditing Standards
Board of the American Institute of CPAs (``AICPA''); as such, those
firms would be subject to ISQM 1 or SQMS 1, which both share a common
basic structure with QC 1000.\44\ Finally, as stated in the
supplemental request for comment, the investor protection concerns
encompassed by the Board's statutory mandate are reduced where a firm
is not performing PCAOB engagements.
---------------------------------------------------------------------------
\42\ Firms could still choose to design (and for that matter,
implement and operate) a QC system that complies with QC 1000. Firms
may choose to do so if, for example, they are planning to bid for a
PCAOB engagement, are taking on work on other firms' engagements
that could potentially constitute a substantial role, or otherwise
want to put themselves in a position to implement and operate a QC
1000-compliant system on short notice.
\43\ See comment letter from KPMG.
\44\ See comment letters from AAA, CAQ, KPMG, and PwC.
---------------------------------------------------------------------------
Based on the above considerations, the Board decided not to adopt
any of the design-only alternatives discussed in the supplemental
request for comment.
The Board also considered whether to include provisions in QC 1000
specifying an earlier trigger for the requirement to design, implement,
and operate a QC 1000-compliant system under QC 1000.06-.07. In this
regard, one commenter encouraged the Board to consider whether
compliance with QC 1000 after its December 15, 2026 effective date
could be tied to an
[[Page 59358]]
established evaluation period and measurement date rather than a
specific triggering event.\45\ The same commenter suggested that under
such an approach, a firm would determine at the beginning of its
selected evaluation cycle whether it is required to comply with QC 1000
during that period.\46\ Another commenter stated that a firm must have
``an appropriately designed and operational QC system before accepting
or commencing PCAOB audit work.'' \47\ Another commenter suggested that
``a QC system must be in place prior to a firm tendering an offer for a
public company audit and/or getting registered.'' \48\ Another
commenter requested that the Board specify an earlier trigger--for
example, when a firm bids for or is appointed to issuer or broker-
dealer work--by which time a compliant QC system must be designed and
operating, well in advance of the firm commencing that work.\49\
---------------------------------------------------------------------------
\45\ See comment letter from BDO.
\46\ See id.
\47\ See comment letter from MIAG.
\48\ See comment letter from ICGN.
\49\ See comment letter from CFA.
---------------------------------------------------------------------------
While an earlier trigger may promote readiness by firms to commence
PCAOB engagements, the Board expects that the effort required to
design, implement, and operate a QC 1000-compliant system may vary
significantly across firms. That variation could arise from several
different factors, including the status of their existing QC systems,
the nature of their assurance practice (if any), the experience of
their personnel, and the nature of their governance systems, operating
processes, and technology, among other things. The Board also
understands that some firms may pursue engagements for issuers and
broker-dealers months, or even years, before these firms are awarded
and commence such work. In light of these considerations, it may not be
necessary in all circumstances for a firm to have a QC system that
fully complies with QC 1000 before it pursues an issuer or broker-
dealer engagement that might not be awarded to it or that might not
commence for a significant period of time. Therefore, the Board
believes that requiring firms to design, implement, and operate a QC
1000-compliant system when a firm becomes subject to applicable
professional and legal requirements with respect to any engagement is
appropriate, and an earlier trigger is not warranted.
Roles and Responsibilities
1. Assignment of Roles and Responsibilities
As originally adopted, QC 1000 requires that the operational roles
and responsibilities specified in paragraph .12 be assigned only to
``firm personnel.'' \50\ The note to paragraph .12 provides that
responsibility for the roles in subparagraphs a-c cannot be shared and
is required to be assigned to only one individual, to reinforce that
the individual assigned to a specified role would be responsible and
accountable for the role.
---------------------------------------------------------------------------
\50\ See QC 1000.A5.
---------------------------------------------------------------------------
The Board proposed amendments to paragraph .12 to allow flexibility
in assigning the specified roles and responsibilities to any individual
(whether firm personnel or an ``other participant'' \51\), rather than
limiting those roles and responsibilities to firm personnel. In
connection with that change, the Board proposed a new footnote 5A to
paragraph .12 to clarify that such individuals would be ``associated
persons'' of the firm. As the Board explained in the supplemental
request for comment, any individual who was not already an associated
person would become an associated person by virtue of that
assignment.\52\ The proposed amendments would align with ISQM 1 and
SQMS 1 by permitting any qualified individual to fill the specified QC
system roles.
---------------------------------------------------------------------------
\51\ See QC 1000.A7.
\52\ See PCAOB Rule 1001(p)(i).
---------------------------------------------------------------------------
To preserve the accountability and responsibility objectives of
paragraph .12, the Board also proposed an amendment to emphasize that
the individuals assigned specific roles understand and be accountable
for their roles and responsibilities. The Board also proposed an
amendment to the note to paragraph .12 to allow firms to divide the
responsibilities of a role specified in paragraph .12 among multiple
individuals. The proposed amendments align with ISQM 1 and SQMS 1.
Commenters generally supported allowing the specified roles to be
assigned to other participants and divided among multiple
individuals.\53\ Many commenters indicated the amendments would promote
audit quality, for example, by enabling the firm to place the most
experienced and qualified individuals in those roles.\54\ Several
commenters also supported allowing firms the flexibility to assign
roles and responsibilities to multiple individuals based on their
specialized expertise and capacity, including within their existing
structures, while maintaining accountability.\55\ Several commenters
stated that the proposed amendments to paragraph .12 were sufficiently
clear and appropriate.\56\
---------------------------------------------------------------------------
\53\ See comment letters from AAA, Baker Tilly, BDO, CAQ, CBIZ,
Crowe, Deloitte, EY, Forvis, GT, ICGN, KPMG, Kramer, MIAG, PICPA,
PwC, RSM, SCCG, and Spitters.
\54\ See comment letters from CAQ, Deloitte, GT, KPMG, MIAG,
PICPA, RSM, SCCG, and Spitters.
\55\ See comment letters from AAA, Baker Tilly, CAQ, CFA, EY,
GT, KPMG, and SCCG.
\56\ See comment letters from GT, KPMG, MIAG, RSM, and Spitters.
---------------------------------------------------------------------------
A commenter stated that the proposed amendments would be especially
helpful to firms that issued audit reports with respect to less than
100 issuers.\57\ Another commenter supported the addition of footnote
5A, which clarifies that an individual assigned operational
responsibility for any of the roles in paragraph .12 would become an
associated person of the firm by virtue of that assignment.\58\ One
commenter recommended retaining clear firm-level accountability and
documentation requirements to avoid diffusion of responsibility.\59\
Another commenter recommended the final standard require clear
identification of those ultimately responsible for the QC system and
key QC areas; this commenter further suggested that the PCAOB encourage
firms to consider the firms' retirees for QC system roles, as such
individuals would provide valuable experience.\60\
---------------------------------------------------------------------------
\57\ See comment letter from Kramer.
\58\ See comment letter from PICPA.
\59\ See comment letter from SCCG.
\60\ See comment letter from MIAG.
---------------------------------------------------------------------------
One commenter did not support assigning roles to individuals
outside the firm because individuals outside the firm may have
conflicting interests, and they cannot provide the day-to-day ownership
the roles require.\61\ The same commenter stated that there remains a
need for an ultimate point of accountability and there needs to be
assurance that accountability is not diffused when responsibilities are
divided.\62\ Further, the commenter requested that whenever a QC role
is divided among multiple individuals, the firm's reporting to the
PCAOB identify (1) who holds ultimate responsibility and accountability
for the QC system as a whole; (2) who is accountable for each function,
such as ethics, independence, monitoring, and remediation; and (3) the
scope of each individual's assigned responsibilities, so that no part
of any role is left unassigned.\63\
---------------------------------------------------------------------------
\61\ See comment letter from CFA.
\62\ See id.
\63\ See id.
---------------------------------------------------------------------------
As to the question of whether the flexibility afforded by the
proposed amendments should be available only
[[Page 59359]]
on a scaled basis to certain firms, many commenters generally favored
applying the amendments to all firms.\64\ Several of these commenters
emphasized that the flexibility the proposed amendments would offer is
important for firms of all sizes, although for reasons that may differ
between larger and smaller firms.\65\ One commenter said such
flexibility appears appropriate regardless of firm size, while noting
that larger firms may be better equipped to operate under a more
restrictive and specialized set of requirements.\66\ Another commenter
stated they would not be opposed to a limited degree of scaling these
requirements to address cost considerations for small and large
firms.\67\
---------------------------------------------------------------------------
\64\ See comment letters from AAA, BDO, CAQ, CBIZ, GT, KPMG,
PICPA, PwC, RSM, and Spitters.
\65\ See comment letters from AAA, BDO, CAQ, CBIZ, GT, KPMG,
PwC, and RSM.
\66\ See comment letter from Kramer.
\67\ See comment letter from ICGN.
---------------------------------------------------------------------------
After consideration of the comments received, the Board is adopting
these amendments as proposed. The Board believes the flexibility
afforded by the amendments should be available to all firms rather than
on a scaled basis, because audit quality is enhanced when firms can
assign the specified roles and responsibilities to the most qualified
individuals, whether or not they are firm personnel. In the Board's
view, the amendments will expand the pool of individuals with the
requisite experience, competence, authority, and time to serve in
specified roles. For example, a firm may improve its QC system and
overall audit quality by assigning to one individual operational
responsibility for ethics and to another individual operational
responsibility for independence, where each individual has specific
expertise in their respective area.
In response to commenters that recommended clear firm-level
accountability and documentation when roles are divided, paragraph .27
requires a firm to establish and maintain clear lines of responsibility
and supervision within the QC system, including defining authorities,
responsibilities, accountabilities, and supervisory and reporting lines
for roles within the firm up to and including the principal executive
officer(s). Additionally, paragraph .82a requires the firm to document
the lines of responsibility and supervision required by paragraph .27.
In response to a commenter's call for specific reporting to the PCAOB
about divided roles, the Board notes that Item 3.1 of Form QC requires
firms to disclose (1) who holds ultimate responsibility and
accountability for the QC system as a whole and (2) which individual or
individuals have operational responsibility for ethics and independence
and for monitoring and remediation. Although the specific scope of each
individual's assigned responsibilities would not be reported, that
information must be documented under paragraph .82a and would be
available to the PCAOB in connection with its oversight activities,
including inspections.\68\
---------------------------------------------------------------------------
\68\ See PCAOB Rule 4000(b), General.
---------------------------------------------------------------------------
2. Responsibilities for Roles With Operational Responsibility
To align with the amendments to QC 1000.12, the Board proposed
conforming amendments to paragraphs .15-.17 that would acknowledge the
possibility that multiple individuals could share the specified roles
and clarify that such individuals' obligations would be limited to the
scope of their assigned responsibilities.
In addition, the Board proposed amendments to paragraph .17b(2)
through (3) to delete the communication requirements related to major
QC deficiencies to align with the amendments to the evaluation
requirement in paragraph .77 discussed below.
Commenters who addressed these amendments supported the proposed
changes to paragraphs .15-.17 and stated they are sufficiently
clear.\69\ Two commenters acknowledged that the conforming amendments
are appropriately aligned with the revisions to paragraph .12.\70\ One
commenter stated the conforming amendments reinforce a more principles-
based approach \71\ and another commenter stated the conforming
amendments increase flexibility.\72\ After consideration of the
comments received, the Board is adopting these conforming amendments as
proposed.
---------------------------------------------------------------------------
\69\ See comment letters from CAQ, GT, KPMG, PICPA, RSM, and
Spitters.
\70\ See comment letters from GT and RSM.
\71\ See comment letter from GT.
\72\ See comment letter from KPMG.
---------------------------------------------------------------------------
External QC Function
As originally adopted, paragraph .28 of QC 1000 includes a
specified quality response that requires firms with a larger PCAOB
audit practice \73\ to incorporate into their governance structure an
EQCF for the QC system composed of one or more persons who:
---------------------------------------------------------------------------
\73\ Firms with a larger PCAOB audit practice are considered
those firms that issued audit reports for more than 100 issuers in
the prior calendar year.
---------------------------------------------------------------------------
<bullet> Are not partners, shareholders, members, other principals,
or employees of the firm;
<bullet> Do not otherwise have a commercial, familial, or other
relationship with the firm that would interfere with the exercise of
independent judgment with regard to matters related to the QC system;
and
<bullet> Have the experience, competence, authority, and time
necessary to enable them to carry out the responsibilities assigned to
the EQCF by the firm.
The EQCF's responsibilities include, at a minimum, evaluating the
significant judgments made and the related conclusions reached by the
firm when evaluating and reporting on the effectiveness of its QC
system.
The Board proposed rescinding the EQCF requirement based on
information obtained in connection with staff implementation support
efforts and outreach discussions, which revealed that implementing this
requirement had proven more difficult and more costly than originally
anticipated. The Board was concerned that the potential benefits may
not justify the potential costs of the EQCF requirement, except
potentially for the largest U.S. global network firms.
Many commenters expressed support for rescinding the EQCF
requirement.\74\ Some of these commenters said rescission would allow
firms the flexibility to utilize existing external governance
structures to promote audit quality in a manner tailored to their
specific circumstances.\75\ Some commenters stated that removing the
EQCF requirement would not diminish the focus on quality because QC
1000 advances the objectives of strengthening trust in governance,
reinforcing accountability, and supporting a commitment to quality
through other provisions in the standard.\76\ Other commenters offered
support for the proposed rescission by asserting that existing
governance structures, leadership accountability, monitoring
activities, reporting processes, and PCAOB inspections already provide
meaningful oversight or help promote the effective operation of the QC
system.\77\
---------------------------------------------------------------------------
\74\ See comment letters from AAA (majority of AAA committee
members), Baker Tilly, BDO, CAQ, CBIZ, Crowe, Deloitte, EY, Forvis,
GT, KPMG, PICPA, Plante & Moran, PwC, RSM, and VSCPA.
\75\ See comment letters from BDO, CBIZ, Deloitte, EY, GT, KPMG,
Plante & Moran, PwC, RSM, and VSCPA.
\76\ See comment letters from BDO, CBIZ, Crowe, KPMG, and PwC.
\77\ See comment letters from CAQ, EY, PICPA, and VSCPA.
---------------------------------------------------------------------------
In addition, many commenters observed that the costs associated
with
[[Page 59360]]
the EQCF requirement, as well as any incremental benefits to audit
quality, remain uncertain.\78\ Some commenters who supported removing
the requirement cited significant implementation challenges and costs
associated with identifying, recruiting, and onboarding individuals
with the necessary expertise, independence, and availability to serve
in the role.\79\ Other commenters pointed to additional costs,
including obtaining liability insurance and making governance-related
structural changes, as further reasons to support the proposed
rescission.\80\ One commenter cautioned that rescission of the EQCF
requirement would remove a level of assurance with respect to internal
processes and audit quality in firms but described the requirement as
expensive, redundant, overreaching, and unnecessary.\81\ Two commenters
acknowledged the narrow responsibilities of an individual serving in an
EQCF role, but asserted that the Board may have overstated the
potential costs of the EQCF requirement by using particular benchmarks
involving compensation of non-employee company directors to estimate
potential costs.\82\ These commenters also suggested that the Board may
have understated the potential benefits of the EQCF requirement by
failing to consider the ongoing trend of private equity investing in
accounting firms.\83\ Another commenter stated that many of the firms
most likely to be affected already use external advisers and that the
incremental burden of establishing the mandated function may be less
substantial than the proposal implies.\84\ This commenter also stated
that the Board did not have direct evidence on the cost of the EQCF to
firms.\85\
---------------------------------------------------------------------------
\78\ See comment letters from CAQ, Deloitte, GT, KPMG, PICPA,
Plante & Moran, and RSM.
\79\ See comment letters from BDO, CAQ, Crowe, EY, GT, PICPA,
and VSCPA.
\80\ See comment letters from BDO, Deloitte, KPMG, PICPA, and
RSM.
\81\ See comment letter from Spitters.
\82\ See comment letters from CII and MIAG.
\83\ See id.
\84\ See comment letter from CFA.
\85\ See id.
---------------------------------------------------------------------------
One commenter raised concerns that the size and complexity of a
large firm's QC system would create practical constraints on the depth
of engagement individuals serving in the EQCF role can achieve, thereby
limiting the EQCF's overall effectiveness and value beyond the
oversight already available through existing channels.\86\ Another
commenter supported rescission of the EQCF requirement because its
current form is not scalable for firms only moderately above the 100-
issuer threshold.\87\
---------------------------------------------------------------------------
\86\ See comment letter from Deloitte.
\87\ See comment letter from Baker Tilly.
---------------------------------------------------------------------------
Some commenters opposed the proposed rescission of the EQCF
requirement.\88\ Two commenters disagreed with the PCAOB's reasoning
``that the benefits of the requirement may not justify the costs,
except potentially for the largest U.S. global network firms.'' \89\
The same commenters, while acknowledging concerns related to potential
costs, liability, and implementation, stated that some form of
independent challenge remains a critical component of an effective QC
system.\90\ Another commenter viewed the EQCF as essential to audit
quality.\91\ One commenter expressed concern that rescinding the EQCF
requirement would leave judgments about the firms' QC systems entirely
to the firms themselves.\92\ This commenter stated the EQCF is the
clearest structural safeguard against the commercial and network
pressures and interests that can affect a firm's judgments regarding
its QC system.\93\ This commenter further asserted that, as the PCAOB
moves the focus of its audit inspections to the firm rather than the
engagement level, and as private-equity ownership and other commercial
pressures within the auditing profession continue to grow, retaining
such a safeguard is particularly important.\94\
---------------------------------------------------------------------------
\88\ See comment letters from AAA (minority of AAA committee
members), CFA, CII, ICGN, and MIAG.
\89\ See comment letters from CII and MIAG.
\90\ See id.
\91\ See comment letter from ICGN.
\92\ See comment letter from CFA.
\93\ See id.
\94\ See id.
---------------------------------------------------------------------------
Two commenters also asserted that the requirement for larger PCAOB
audit practices to have an EQCF would be applicable to only five
firms.\95\ However, absent rescission of the EQCF requirement, 13
firms, based on 2025 data, would become subject to that
requirement.\96\
---------------------------------------------------------------------------
\95\ See comment letters from CII and MIAG.
\96\ See footnote 401 for a list of the 13 firms.
---------------------------------------------------------------------------
In responding to the question regarding an alternative threshold
for the EQCF requirement, many commenters stated it was not necessary
to impose the EQCF requirement on any firm, regardless of size or
number of issuers audited.\97\ Some commenters did not support an
alternative threshold (e.g., restricting the requirement only to firms
auditing more than 500 issuers) because retaining the requirement in
any form would not resolve the underlying concerns about operability,
costs, availability of qualified individuals, and uncertain incremental
benefit.\98\ Some commenters said that firms should have the
flexibility to create governance structures that align with the nature
and extent of their existing structure and risks of the firm.\99\
---------------------------------------------------------------------------
\97\ See comment letters from Baker Tilly, BDO, Crowe, GT,
PICPA, PwC, and RSM.
\98\ See comment letters from BDO, CAQ, GT, KPMG, PICPA, and
RSM.
\99\ See comment letters from BDO, CAQ, Crowe, and KPMG.
---------------------------------------------------------------------------
One commenter stated that if the Board concludes that some relief
is necessary, it is better to retain the EQCF requirement as adopted
for firms auditing more than 500 issuers because it would apply to the
five firms where nearly all U.S. public market capitalization
sits.\100\ One commenter stated that if the current 100-issuer
threshold were not retained, they would not oppose amending the
threshold to firms that issued audit reports for more than 200 issuers
during the prior calendar year, because they believe that the large
revenue base received from those firms' issuer audit clients could
support the incremental costs associated with the EQCF
requirement.\101\ One commenter suggested retaining the EQCF
requirement for firms that have accepted any form of outside
investment, other than traditional debt financing, and operate through
an alternative practice structure.\102\ In addition, one commenter who
opposed removing the EQCF requirement expressed the view that smaller
firms (under 100 audits per year) should not be exempted from robust
and functioning alternative EQCF requirements if the PCAOB were to
scale the provisions.\103\ Another commenter noted that, given the
unchanged effective date of QC 1000, adopting alternative oversight
frameworks could present implementation challenges and leave firms with
limited time to thoughtfully design and integrate new requirements into
their governance structures.\104\
---------------------------------------------------------------------------
\100\ See comment letter from CFA.
\101\ See comment letter from MIAG.
\102\ See comment letter from AAA.
\103\ See comment letter from ICGN.
\104\ See comment letter from KPMG.
---------------------------------------------------------------------------
In the supplemental request for comment, the Board sought input on
the alternative of reverting the requirement for an independent
oversight function to that contained in the 2022 proposal. Several
commenters did not support such an alternative.\105\ One commenter
stated that the 2022 proposed requirement lacked sufficient clarity
[[Page 59361]]
and could create uncertainty regarding whether existing firm governance
and oversight arrangements would satisfy such a requirement.\106\
Another commenter indicated that the effect or impact of adopting the
requirement as initially proposed in 2022 could not be determined.\107\
One commenter did not support reverting back to the 2022 proposed
requirement because it carried no defined duty to evaluate the firm's
QC conclusions--the very check the EQCF was adopted to provide.\108\
---------------------------------------------------------------------------
\105\ See comment letters from CAQ, CFA, GT, KPMG, PICPA, PwC,
and RSM.
\106\ See comment letter from KPMG.
\107\ See comment letter from Spitters.
\108\ See comment letter from CFA.
---------------------------------------------------------------------------
After consideration of the comments received, the Board is
rescinding the EQCF requirement. Based on staff implementation support
efforts, the Board understands that implementation of this requirement
may have proven more difficult and costly than originally anticipated.
The Board also acknowledges the concerns raised by commenters about the
costs, operability, and potential limited benefit of the EQCF
requirement, including the availability of qualified individuals to
serve in an EQCF role, for firms of any size. In the Board's view,
rescinding the EQCF requirement means giving up the benefits of an
external second look. That external second look would have focused on
the significant judgments made and related conclusions reached when
evaluating and reporting on the effectiveness of firms' QC systems. The
Board believes those incremental benefits are difficult to quantify and
potentially limited. They would come from the fresh perspectives of an
individual serving in an EQCF role, beyond the benefits already
provided by other aspects of QC 1000. See below for further discussion
on economic impacts.
The Board believes that the implementation concerns apply equally
to all firms, including those operating under alternative practice
structures or accepting private equity investments, regardless of the
number of issuers they audit.
One commenter opposed the rescission, asserting that firm
leadership should be held accountable through independent
oversight.\109\ Further, the commenter suggested that firms might lack
the ability to ``convince investors they can do the right thing when
left to their own judgment.'' \110\ As designed, though, the EQCF lacks
a mechanism or the authority to hold firm leadership accountable; the
EQCF is not required to provide concurring approval of the firm's
evaluation or reporting.\111\ Nor would the EQCF supplant the firm's
judgment.
---------------------------------------------------------------------------
\109\ See id.
\110\ See id.
\111\ See PCAOB Rel. No. 2024-005, at 121.
---------------------------------------------------------------------------
Furthermore, the Board notes that the QC 1000 quality objectives
for the governance and leadership component continue to call for (i)
firm leadership to communicate and promote the firm's commitment to
quality; (ii) the firm to clearly define leadership's responsibility
for quality and hold them accountable; (iii) firm leadership to
demonstrate a commitment to quality through actions and behaviors; (iv)
the firm's strategic decisions and actions to be consistent with and
support the firm's commitment to quality; and (v) resources to be
obtained, developed, allocated, and assigned in a manner that enables
an effective QC system and the performance of engagements in accordance
with applicable professional and legal requirements.\112\ To achieve
these quality objectives, firms are required to design and implement
quality responses that are based on the related quality risks and on
the reasons for the assessments given to the quality risks and to
reduce to an appropriately low level the risk that quality objectives
will not be achieved. The Board has also observed that several firms
already incorporate external advisors into their organizational and
governance structures and they may continue to do so as part of their
response to the quality risks associated with these quality objectives.
The Board has long considered firm governance and leadership to be an
important aspect of firms' QC systems that will continue to be subject
to oversight by the PCAOB, including as part of PCAOB inspections.
---------------------------------------------------------------------------
\112\ See QC 1000.25.
---------------------------------------------------------------------------
Information and Communication
QC 1000 requires a firm to establish a quality objective that, if
the firm communicates firm-level or engagement-level information with
respect to the firm's audit practice, firm personnel, or engagements,
such as firm or engagement metrics, to external parties, such
information is accurate and not misleading and, with respect to any
such metrics that are communicated in writing, the communication
explains in reasonable detail how the metrics were determined and, if
applicable, how the method of determining them changed since the
metrics were last communicated.
As discussed in the QC 1000 2024 adopting release, the information
that this requirement applies to includes public communications about
firm-level or engagement-level information, such as firm metrics and
financial data.\113\ For example, some firms publish transparency or
audit quality reports, either voluntarily or in response to the
requirements of other jurisdictions, that contain data such as:
---------------------------------------------------------------------------
\113\ See PCAOB Rel. No. 2024-005, at 186.
---------------------------------------------------------------------------
<bullet> Revenue breakdown by service line, by year, or by
geographic segment;
<bullet> Professional staff ratios;
<bullet> Staff turnover ratios;
<bullet> Average training hours per professional; and
<bullet> Partner workload.
Firms may also communicate such data via web pages or other media,
such as promotional publications, social media, interviews, or
presentations via webcast or video.\114\
---------------------------------------------------------------------------
\114\ See PCAOB Rel. No. 2024-005, at 186-187.
---------------------------------------------------------------------------
In the supplemental request for comment, the Board proposed to
narrow the requirements of QC 1000.53e regarding the need for an
explanation of written metrics to those metrics that the firm makes
publicly available. This was consistent with the initial focus of the
requirement on public communications.\115\ The Board believes that
recipients of nonpublic communications regarding metrics, such as
regulators, company management, and audit committees, are generally in
a position to request additional information about the metrics if they
desire it. Further, some nonpublic metrics may already be calculated in
accordance with a method prescribed by the recipient (for example, in
response to a regulatory requirement or an audit committee request for
proposal). In contrast, where metrics are publicly available, such as
in firm transparency reports or promotional publications, these are
usually one-way communications in which the external parties do not
have the ability to ask questions or request clarification from the
firm.
---------------------------------------------------------------------------
\115\ See id.
---------------------------------------------------------------------------
Several commenters supported the proposed amendments to paragraph
.53e.\116\ One commenter said they did not object to confining the
explanation requirement to metrics the firm makes publicly
available.\117\ One of these commenters stated that the proposed
amendments were generally clear and seem appropriate but suggested that
the term ``metric'' be defined or explained in the rule text.\118\
Another commenter stated that the PCAOB must clearly communicate to
firms that the intent of the provision is that firms ensure that
[[Page 59362]]
the explanation remains accurate and publicly available.\119\ Another
commenter encouraged the Board to make explicit that simplification of
communication requirements does not alter the firm's monitoring
obligations.\120\ One commenter stated that it would be helpful to
further clarify whether the requirement applies only to those
communications required under applicable professional and legal
requirements or to all such metrics publicly disclosed.\121\ The
commenter further requested clarification of whether all changes to the
calculation of disclosed metrics to which this requirement applies must
be explained or whether this requirement applies only to material
changes in the calculation of the disclosed metrics.\122\
---------------------------------------------------------------------------
\116\ See comment letters from AAA, BDO, CAQ, Deloitte, EY, GT,
KPMG, Kramer, MIAG, PICPA, RSM, SCCG, and Spitters.
\117\ See comment letter from CFA.
\118\ See comment letter from Kramer.
\119\ See comment letter from MIAG.
\120\ See comment letter from SCCG.
\121\ See comment letter from RSM.
\122\ See id.
---------------------------------------------------------------------------
One commenter stated that the operability of the requirement could
be further enhanced by restructuring the requirement into two distinct
quality objectives--one that addresses whether the information is
accurate and not misleading, and a second, conditional objective
requiring an explanation for publicly communicated metrics.\123\
---------------------------------------------------------------------------
\123\ See comment letter from KPMG.
---------------------------------------------------------------------------
The Board is adopting the proposed amendments to QC 1000.53e with
modifications. Specifically, the Board is revising paragraph .53e by
adding subparagraphs .e(1) and .e(2) to more clearly distinguish firm
responsibilities when communicating firm-level or engagement-level
information to external parties and in written public communications.
The Board agrees with the commenter that this change will improve the
operability of paragraph .53e without changing a firm's
responsibilities. In addition, the Board believes that the change will
help to address a commenter's concern regarding the clarity of the
provision's intent with respect to metrics communicated in writing and
made publicly available by the firm.
The requirement in paragraph .53e(2) applies to any metrics that
are communicated in writing and made publicly available by the firm--it
is not limited in application to metrics that are required to be
communicated under applicable professional and legal requirements.
Paragraph .53e(2) also requires a firm to communicate how the method of
determining any metrics changed since previously communicated, if
applicable, and that requirement applies to any such change in
methodology, without regard to the firm's assessment of its
materiality. The Board does not believe that it is necessary to define
the term ``metric'' for purposes of applying paragraph .53e(2). The
Board believes the term is reasonably understood in practice, and the
Board previously clarified, in the supplemental request for comment,
that the Board intends for the requirement to apply only to calculated
measures, not to underlying data.\124\ As illustrated in the
supplemental request for comment, if a firm publicly discloses its
auditor-employee headcount for a region or office, the firm will not
need to describe how it counted the employees.\125\ The requirement
will apply, however, to any calculated figures derived using that data,
such as the average years of experience for audit personnel (i.e.,
total years of audit experience divided by auditor-employee headcount).
---------------------------------------------------------------------------
\124\ See PCAOB Rel. No. 2026-002, at 25-26.
\125\ See id.
---------------------------------------------------------------------------
The Board also does not believe it is necessary to clarify that the
proposed amendment would not alter a firm's monitoring obligations. As
stated by the commenter who suggested doing so, the amendments simplify
communication requirements but do not affect QC 1000 monitoring
obligations.
The Board believes that the amendments will carry out its initial
intent for public communications and avoid unnecessary costs associated
with making additional disclosures to recipients who can request more
information if they need it, while still ensuring that recipients of
written public communications have access to an explanation of any
metric provided.
In addition, the Board proposed adding a note to paragraph .53e
stating that the explanation of the method for determining metrics can
be provided either within the public written communication that
includes the metrics or by referring in the communication to a publicly
available explanation presented elsewhere, such as the firm's website.
Several commenters supported allowing firms to provide explanations
of metrics in a publicly available location, such as the firm's
website.\126\ One commenter stated that they supported the proposed
amendment provided that those explanations are clear, balanced,
accessible, and sufficiently specific to help users of the
metrics.\127\ Another commenter stated that they favored public
disclosures in one place for ease of use and that placement on the
relevant website seems appropriate as long as there are clear
instructions on how to access the explanation.\128\ The commenter
further stated that, while disclosures on websites are useful,
investors would want to make sure that any restatements, changes in
definitions, or metrics are clearly noted, communicated in writing, and
updated on a timely basis.\129\ While one commenter agreed that
publishing an explanation of metrics on a website would not adversely
affect the utility of metrics made public, this commenter questioned
whether public information about firm metrics should be subject to
certification or verification before publication.\130\ Another
commenter said that an explanation that was accurate on the day it was
published is of little use to an investor comparing metrics two or
three years later, and that simplification of the requirement should
not come at the expense of transparency or comparability over time
within a single firm.\131\ This commenter requested that the Board
require that any report containing a publicly disclosed metric include,
in the report itself, a hyperlink to the explanation of how that metric
is calculated, maintained on the firm's own website, and stated that
the hyperlink must remain stable, archived, and year specific.\132\
This commenter also said that when a metric or its methodology changes
from one year to the next, the change must be prominently identified in
the base report itself--not only in the linked explanation--together
with a description of the change and a presentation of the comparable
prior year metric.\133\
---------------------------------------------------------------------------
\126\ See comment letters from BDO, CFA, GT, KPMG, MIAG, PICPA,
and RSM.
\127\ See comment letter from CAQ.
\128\ See comment letter from ICGN.
\129\ See id.
\130\ See comment letter from Spitters.
\131\ See comment letter from CFA.
\132\ See id.
\133\ See id.
---------------------------------------------------------------------------
After consideration of the comments received,\134\ the Board is
adopting the note to paragraph .53e as proposed but relocating it under
new paragraph .53e(2).
---------------------------------------------------------------------------
\134\ One commenter stated that the PCAOB should use existing
artificial intelligence technology to aggregate metrics and related
information from firms' websites or other public sources and make
that information available in a centralized location on the PCAOB's
website. See comment letter from MIAG. This suggestion is beyond the
scope of this rulemaking.
---------------------------------------------------------------------------
The Board believes that allowing firms to explain metrics either in
the same communication as the metric itself or by reference to another
publicly available explanation would streamline firms' communications
about their audit practices without adversely affecting the quality of
information received by
[[Page 59363]]
external parties. The Board does not believe that permitting firms this
flexibility will create confusion for stakeholders. Given the volume of
information that a firm might communicate about itself, and the
possibility that the same information may be repeated through various
communication platforms, the Board believes that permitting a firm to
make reference to a single publicly available explanation could reduce
unnecessary duplication of disclosures and provide additional clarity
to stakeholders. Also for this reason, the Board believes it is not
necessary to require a change made to a metric or its methodology be
identified in the written communication. The Board is not requiring
firms to provide hyperlinks for the metrics because the Board seeks to
preserve the principles-based nature of the requirement and avoid
prescribing a specific method that may become less effective as
technology changes over time.
To satisfy paragraph .53e(2), any publicly available explanation,
including one provided through a website, would need to be clear,
accessible, and sufficiently specific to explain how the metric was
determined and any changes in the method used to determine the metric
since it was last communicated. In addition, the Board does not believe
that requiring certification or verification of such explanations is
necessary to achieve the objectives of paragraph .53e(2). Firms would
need to ensure that their explanations remained specific as to the
public metric to which they relate and are publicly available for as
long as they continue to make available the written public
communication that refers to the location of the metrics. Firms may
update the publicly available explanation as necessary to maintain its
accuracy; however, such updates do not require the issuance of a new
written public communication identifying or describing those updates.
Monitoring and Remediation Process
1. Responding to Engagement Deficiencies
Engagement monitoring activities are designed to provide
information on whether engagement or QC system-level areas may require
additional attention. These activities may identify pervasive issues
where a number of engagements have similar problems, possibly
highlighting the need to revise methodologies, provide additional
training, or take other actions at the QC-system level. QC 1000
requires monitoring activities to include determining, on a timely
basis, whether engagement deficiencies exist and, if so, taking certain
actions in response to the identified engagement deficiencies.
QC 1000 defines an engagement deficiency as an instance of
noncompliance with applicable professional and legal requirements by
the firm, firm personnel, or other participants with respect to an
engagement of the firm, or by the firm or firm personnel with respect
to an engagement of another firm. Under QC 1000.68, a firm is required
to take certain action when an engagement deficiency exists, with the
required action depending on circumstances such as whether the
engagement is completed or still in-process or is related to work
performed on other firms' engagements.
i. Engagement Deficiency Related to an In-Process Engagement (QC
1000.68a)
As originally adopted, QC 1000 requires firms, for engagement
deficiencies relating to in-process engagements, to take action to
address the deficiency in accordance with applicable professional and
legal requirements (to the extent necessary, before the issuance of the
engagement report(s)), such that the engagement report(s) are
appropriate in the circumstances.
The Board proposed to amend paragraph .68a to (i) replace the
language ``the engagement report(s) are appropriate in the
circumstances'' with ``the engagement is free of significant engagement
deficiencies'' and (ii) add a footnote describing what significant
engagement deficiencies are. The concept of a significant engagement
deficiency is derived from AS 1220, and the description used in the
proposed footnote in paragraph .68a aligns with that in AS 1220. The
footnote to QC 1000.68a also clarifies that the concept applies to all
engagements as that term is defined in QC 1000 (which includes, for
example, engagements performed pursuant to PCAOB interim attestation
standards), not only those engagements described in AS 1220.
Many commenters supported the proposed amendments to paragraph
.68a.\135\ However, one commenter stated that the proposed threshold
for a ``significant engagement deficiency'' remained overly broad and
could be interpreted to encompass any instance in which an engagement
team failed to perform a procedure required by PCAOB standards,
regardless of whether the omission affected the sufficiency or
appropriateness of audit evidence supporting a material assertion or
the engagement conclusions.\136\ This commenter suggested that the
definition should incorporate the concepts of materiality, relevant
assertions, and the significance of the deficiency to the overall
audit.\137\
---------------------------------------------------------------------------
\135\ See comment letters from Baker Tilly, CAQ, Deloitte, GT,
KPMG, Plante & Moran, and Spitters.
\136\ See comment letter from PICPA.
\137\ See id.
---------------------------------------------------------------------------
The proposed description for when a significant engagement
deficiency exists is consistent with concepts in AS 1220. Under AS
1220, an engagement quality reviewer (``EQR'') may provide concurring
approval of issuance only if, after performing with due professional
care the review required by the standard, the EQR is not aware of a
significant engagement deficiency.\138\ The description of significant
engagement deficiency in the proposed amendments to paragraph .68a
appropriately focuses firms on matters that must be corrected before an
audit report is issued or before an engagement conclusion is
communicated to the company.\139\ Therefore, the Board does not agree
that the description is overly broad; a significant engagement
deficiency would not be any instance in which an engagement team failed
to perform a procedure required by PCAOB standards but rather is
specifically related to the circumstances described in footnote 40A.
Further, the Board believes the concept is well understood by the
profession and does not require any revision.
---------------------------------------------------------------------------
\138\ See Notes to AS 1220.12, .17, .18B.
\139\ See Proposed Auditing Standard--Engagement Quality Review
and Conforming Amendment to the Board's Interim Quality Control
Standards, PCAOB Rel. No. 2008-002 (Feb. 26, 2008), at 16
(describing significant engagement deficiencies).
---------------------------------------------------------------------------
The Board is adopting the amendments to paragraph .68a as proposed.
ii. Evaluating Whether Similar Engagement Deficiencies Exist on Other
Engagements (QC 1000.68d)
As originally adopted, QC 1000 requires that, when the firm
determines that an engagement deficiency exists, the firm should
evaluate whether similar engagement deficiencies exist in other in-
process engagements, completed engagements (unless it is probable that
the engagement report is not being relied upon), and work performed on
other firms' engagements, and if so, take actions as required by
paragraphs .68a-c, as applicable.
The Board proposed to limit the requirement to evaluate whether
similar engagement deficiencies exist so it would apply only with
respect to a
[[Page 59364]]
subset of engagement deficiencies, specifically those that resulted or
could result (i) a failure to obtain sufficient appropriate evidence to
support the conclusion reached on an engagement \140\ or (ii) an
inappropriate overall conclusion on the subject matter of an
engagement.
---------------------------------------------------------------------------
\140\ Because QC 1000 covers not only audit engagements but also
review engagements and attestation engagements, reference to
``sufficient appropriate evidence'' is necessary as this concept
aligns with the audit, review, and attestation standards.
---------------------------------------------------------------------------
Most commenters generally supported the proposed amendments to
paragraph .68d.\141\ The Board is adopting the amendments to paragraph
.68d as proposed, along with a new note discussed further below.
---------------------------------------------------------------------------
\141\ See comment letters from Baker Tilly, BDO, CAQ, CBIZ,
Deloitte, EY, GT, ICGN, KPMG, PICPA, Plante & Moran, RSM, SCCG, and
Spitters.
---------------------------------------------------------------------------
The discussion below addresses specific commenter feedback related
to the proposed amendments.
a. ``Resulted or Could Result in''
Several commenters raised concern regarding the proposed language
``resulted or could result in.'' \142\ Commenters stated that the
language would introduce new complexity \143\ and interpretation
challenges,\144\ or would involve substantial implementation effort
with limited incremental investor protection.\145\ One commenter stated
that without further context, the term ``could'' effectively sets a
threshold closer to a remote possibility, which, in practice, would
require firms to evaluate an unbounded population of engagements.\146\
This commenter suggested that the Board consider revising the language
to specify that the requirement applies ``where there is a reasonable
possibility'' that an engagement deficiency could result in either a
failure to obtain sufficient appropriate audit evidence or an
inappropriate overall conclusion, to distinguish from those that
represent more remote possibilities.\147\ Another commenter recommended
changing the proposed language to ``reasonably could result.'' \148\
Another commenter stated that it was not clear whether ``could'' should
be assessed at the individual engagement level or at a broader thematic
level, such as when a theme or trend of similar engagement deficiencies
emerges.\149\ Another commenter stated that a deficiency that appears
immaterial on the engagement where it was first identified can still be
a symptom of a firm-wide QC weakness and a narrower trigger reduces the
number of opportunities a firm has to find that pattern before it
results in an audit failure.\150\ One commenter highlighted that the
intended benefits of the proposed amendment could be offset by concerns
regarding specific provisions (i.e., the ``could result in''
language).\151\ Another commenter stated that it was difficult to
determine whether the proposed amendment will meaningfully reduce
complexity, subjectivity, or implementation costs.\152\ The Board is
concerned that some commenters may have misinterpreted the intent of
the phrase ``could result in.'' As adopted, QC 1000 requires the firm
to evaluate all engagement deficiencies under paragraph .68d. The goal
of the amendment is to narrow the types of engagement deficiencies
subject to the evaluation to only those that relate to obtaining
sufficient appropriate evidence or the overall conclusion of an
engagement.\153\ Other engagement deficiencies would not need to be
evaluated under paragraph .68d, as amended. Such other engagement
deficiencies include, for example, engagement deficiencies related to
communications to the audit committee; the filing of Form AP, Auditor
Reporting of Certain Audit Participants; or the registration status of
an other auditor that performed substantial role work.\154\ In other
words, this ``could result in'' language is not intended to introduce
an assessment of the likelihood that the engagement deficiency could
result in, for example, a failure to obtain sufficient appropriate
evidence to support the conclusion on another engagement. This language
is instead intended to help firms assess whether a particular
engagement deficiency falls within either of the two types of
engagement deficiencies subject to the evaluation under the revised
paragraph .68d.
---------------------------------------------------------------------------
\142\ See comment letters from BDO, GT, KPMG, PICPA, and RSM.
\143\ See comment letter from KPMG.
\144\ See comment letters from GT and KPMG.
\145\ See comment letter from PICPA.
\146\ See comment letter from KPMG.
\147\ See id.
\148\ See comment letter from BDO.
\149\ See comment letter from RSM.
\150\ See comment letter from CFA.
\151\ See comment letter from KPMG.
\152\ See comment letter from GT.
\153\ With respect to examples of the type of engagement
deficiencies that relate to reaching an inappropriate overall
conclusion on the subject matter of an engagement, see PCAOB Rel.
No. 2008-002, at 16 n.29, which states that ``[i]nappropriate
conclusions on the subject matter of the engagement would include,
for example, a failure to appropriately modify the engagement
conclusion in response to: (1) a material departure from generally
accepted accounting principles or (2) a material weakness in
internal control over financial reporting.''
\154\ These types of engagement deficiencies would still be
required to be addressed in accordance with paragraphs .68a-c and to
be evaluated to determine whether QC deficiencies exist in
accordance with paragraph .72.
---------------------------------------------------------------------------
For example, if the engagement deficiency related to not making a
required communication to the audit committee, this type of engagement
deficiency does not affect the auditor's ability to obtain sufficient
appropriate audit evidence or reach the appropriate overall conclusion
of the engagement and, therefore, would not be within the scope of the
revised paragraph .68d. In contrast, if the engagement deficiency
related to the auditor not making or observing a physical inventory
count in accordance with AS 2510, Auditing Inventories, this type of an
engagement deficiency would be within the scope of paragraph .68d,
because it relates to obtaining sufficient appropriate evidence.
Some commenters requested clarification of an example the Board
provided in the supplemental request for comment.\155\ To clarify and
illustrate the application of the ``resulted or could result in''
language in paragraph .68d, consider the following scenario: During
internal monitoring activities for the current year, a firm selected
one of its completed engagements for inspection and identified that the
engagement team failed to evaluate cash confirmation exceptions
pursuant to AS 2310.20. As a result, the engagement team violated PCAOB
requirements (i.e., applicable professional and legal requirements) and
the firm determined that an engagement deficiency exists. Because
noncompliance with the requirement of AS 2310.20 (that is, the failure
to evaluate confirmation exceptions) relates to obtaining sufficient
appropriate evidence (i.e., it could result in a failure to obtain such
evidence), this engagement deficiency meets the requirement for
evaluation under the revised language of paragraph .68d.\156\
---------------------------------------------------------------------------
\155\ See comment letters from Baker Tilly, BDO, CAQ, Deloitte,
EY, GT, PICPA, and RSM.
\156\ The Board has provided a continuation of this example
below.
---------------------------------------------------------------------------
The Board believes that the amendment appropriately focuses a
firm's attention and efforts on the types of engagement deficiencies
that represent the greatest risk to audit quality. It also reduces
compliance costs by narrowing the population of engagement deficiencies
that a firm is required to evaluate.
b. ``Evaluate Whether Similar Engagement Deficiencies Exist''
A commenter stated that the nature and extent of the procedures
required to evaluate whether similar engagement
[[Page 59365]]
deficiencies exist should be more explicitly grounded in the root cause
of the engagement deficiency identified and an assessment of whether
that root cause suggests a potential QC deficiency.\157\ This commenter
suggested that an evaluation anchored to root cause would provide a
more meaningful and risk-based framework for determining the scope of
further procedures.\158\ As it relates to the evaluation required under
paragraph .68d, another commenter requested scenarios to help firms
distinguish between engagement deficiencies and identified root causes
that are (i) indicative of systemic issues and (ii) isolated
incidents.\159\
---------------------------------------------------------------------------
\157\ See comment letter from Deloitte.
\158\ See id.
\159\ See comment letter from GT.
---------------------------------------------------------------------------
As described in the QC 1000 2024 adopting release, understanding
the nature of the engagement deficiency will assist the firm in
determining the extent of the necessary evaluation.\160\ The intent of
the requirement to evaluate whether similar engagement deficiencies
exist was not to require an unbounded look at every engagement the firm
has. The Board believes understanding the circumstances that led to the
engagement deficiency (e.g., the underlying cause) would help the firm
identify other engagements to evaluate for similar engagement
deficiencies. The Board acknowledges, as commenters suggested, that
this was not clear in the proposed amendments. Therefore, the Board is
adding a new note to paragraph .68d to indicate that understanding the
circumstances that led to the engagement deficiency may assist the firm
in identifying other engagements (or work performed by the firm on
other firms' engagements) to evaluate for similar engagement
deficiencies.
---------------------------------------------------------------------------
\160\ See PCAOB Rel. No. 2024-005, at 225.
---------------------------------------------------------------------------
The procedures performed can be scalable and practical in the
circumstances and may be developed based on the nature of the
engagement deficiency. However, it would not be appropriate for a
firm's evaluation to be based on narrower criteria than those
underlying the cause(s) for the engagement deficiency, nor would it be
appropriate to include only a subset of the engagements that are
identified based on the understanding of the circumstances that led to
the engagement deficiency.
To continue with the example provided above regarding cash
confirmations, the firm then gained an understanding of the
circumstances that led to the engagement deficiency (e.g., the
underlying cause) to identify which other engagements to evaluate for
similar engagement deficiencies. In this example, the firm might
determine that the engagement deficiency was caused by an error in the
firm's cash confirmations methodology, which is required to be used on
all engagements that use cash confirmations. To identify whether other
engagements used the same methodology (or, in the case of in-process
engagements, are currently using the same methodology), the firm sends
an inquiry email to each engagement partner. Based on the responses
received to the emails and any follow-up with non-respondents, the firm
identifies the engagements (and work performed on other firms'
engagements) that followed the same methodology. It is these
engagements and work performed on another firm's engagements that
followed the same methodology that the firm will evaluate for similar
engagement deficiencies.
If the firm identifies, for example, twenty engagements that
followed the same cash confirmations methodology, the firm evaluates
whether a similar engagement deficiency exists on each of the twenty
engagements, i.e., a failure to evaluate confirmation exceptions
pursuant to AS 2310.20. Out of the twenty engagements, if the firm
identifies four engagements in which the engagement team did not
perform procedures to evaluate confirmation exceptions pursuant to AS
2310.20, then the firm would need to take appropriate actions pursuant
to subparagraphs a-c of paragraph .68 on each of those four
engagements.
Importantly, paragraph .68d does not prescribe the manner in which
the firm would identify engagements to evaluate. In the above example,
the firm decided to send an email to each engagement partner to
identify engagements that followed the same methodology. However, the
firm could use other approaches, such as a data analysis tool or
performing a search of engagement files, to identify engagements that
followed the same methodology. The evaluation approach a firm takes may
differ depending on the nature of the engagement deficiency, the
circumstances that led to the engagement deficiency, and a firm's
specific facts and circumstances. As discussed above, once the firm
identifies the population of engagements subject to the evaluation of
whether similar engagement deficiencies exist, it would not be
appropriate for a firm's evaluation to be based on narrower criteria
nor would it be appropriate to evaluate only a subset of the
engagements that were identified.
The following graphic illustrates the process for evaluating
whether similar engagement deficiencies exist:
[[Page 59366]]
[GRAPHIC] [TIFF OMITTED] TN18SE26.007
c. Response to Other Commenter Feedback
One commenter did not support a requirement that would require the
firm, after finding an engagement deficiency in one engagement, to
evaluate whether similar deficiencies exist in all other completed
engagements.\161\ This commenter stated that the cost of the
requirement could be extremely high and it is unclear whether the
benefit would outweigh the cost.\162\ This commenter suggested that the
Board instead change the requirement so that examining a completed
engagement would be required only when, based on the information
available at the time, the firm believed that it was probable the
financial statements were materially misstated and the likelihood was
more than remote that the audit report was still being relied
upon.\163\ The Board does not agree with the commenter who stated that
the amendment would require that the firm evaluate whether similar
deficiencies exist in all other completed engagements, as the note to
paragraph .68d indicates understanding the circumstances that led to
the engagement deficiency may assist the firm in identifying other
engagements to evaluate for similar engagement deficiencies.
---------------------------------------------------------------------------
\161\ See comment letter from AAA.
\162\ See id.
\163\ See id.
---------------------------------------------------------------------------
A commenter stated that a deficiency found in one engagement should
prompt the firm to ask whether the same problem exists in other
engagements and why it occurred, with the answers feeding back into the
firm's risk assessment.\164\ The Board agrees that an engagement
deficiency identified in one engagement may provide information that is
relevant to the firm's broader monitoring and remediation and risk
assessment processes. All engagement deficiencies are subject to action
as required under paragraph .68a-c (in that particular engagement), and
certain engagement deficiencies will require evaluation under paragraph
.68d. Furthermore, all engagement deficiencies are treated as QC
observations under paragraph .72 and must be evaluated to determine
whether they are QC deficiencies. Additionally, under paragraph
.20a(3), the firm obtains an understanding of information from the
firm's monitoring and remediation activities, including its
identification of engagement deficiencies, in identifying and assessing
quality risks. In this way, the evaluation of engagement deficiencies
represents one part of the broader monitoring and remediation feedback
loop: information identified through that process informs the firm's
evaluation of QC observations and feeds back into the firm's
identification and assessment of quality risks.
---------------------------------------------------------------------------
\164\ See comment letter from CFA.
---------------------------------------------------------------------------
This commenter also stated that deficiency rates are not materially
better than in the early years of the inspection program more than
twenty years ago and suggested this is not the moment to narrow the
lens through which firms look for systemic problems.\165\ The Board
believes that the amendments to paragraph .68d appropriately focus
firms' evaluations on engagement deficiencies related to obtaining
sufficient appropriate evidence to
[[Page 59367]]
support the conclusion reached on an engagement or the overall
conclusion on the subject matter of an engagement that may indicate
systemic issues on the firm's engagements.
---------------------------------------------------------------------------
\165\ See id.
---------------------------------------------------------------------------
A commenter suggested that the Board could further enhance the
proposed amendment by aligning more closely with ISQM 1, which permits
firms to use their judgment to determine the nature and extent of any
investigation of identified engagement deficiencies and whether those
deficiencies might indicate a deficiency in the system of quality
management.\166\ The Board believes the requirement in paragraph .68d
is fundamental to achieving the objective of the QC system that each
engagement report issued by the firm is in accordance with applicable
professional and legal requirements.\167\
---------------------------------------------------------------------------
\166\ See comment letter from PICPA.
\167\ See QC 1000.05.
---------------------------------------------------------------------------
A commenter questioned why only items (1) and (2) from footnote 40A
to proposed paragraph .68a were included in proposed paragraph .68d,
while items (3) and (4) (the engagement report is not appropriate in
the circumstances and the [filig]rm is not independent of its client,
respectively) were not.\168\ With regard to paragraph .68d, the
amendment focuses on those types of engagement deficiencies that most
directly affect the sufficiency and appropriateness of procedures
performed on the engagement as well as the ultimate opinion expressed
by the firm.
---------------------------------------------------------------------------
\168\ See comment letter from Grosvenor.
---------------------------------------------------------------------------
2. Definition of QC Deficiency
As originally adopted, the note to paragraph .A8(1) of the
definition of QC deficiency states that the likelihood of not achieving
the reasonable assurance objective or one or more quality objectives
would be above an acceptably low level if, for example, a quality
objective is not established, a quality risk is not properly identified
or assessed, or a quality response is not properly designed or
implemented or is not operating effectively.
The Board proposed to amend this note to clarify that a failure of
a quality response would be regarded as evidencing a QC deficiency only
if other quality responses do not achieve the relevant objective(s). As
stated in the QC 1000 2024 adopting release, the relationship across
quality objectives, quality risks, and quality responses is generally
not one-to-one.\169\ Most quality objectives are likely to have
multiple quality risks. Some quality risks may affect one or more
quality objectives, either within a single component or across several
components, and may require multiple quality responses. Some quality
responses may address multiple quality risks.
---------------------------------------------------------------------------
\169\ See PCAOB Rel. No. 2024-005, at 42.
---------------------------------------------------------------------------
Many commenters supported the proposed amendment to the definition
of QC deficiency,\170\ noting, for example, that allowing firms to take
compensating quality responses into account when determining whether a
QC deficiency exists better reflects how a risk-based system of quality
control operates in practice and also aligns more closely with the
principles-based framework of other quality management standards, such
as ISQM 1.
---------------------------------------------------------------------------
\170\ See comment letters from AAA, Baker Tilly, BDO, CAQ,
Crowe, Deloitte, EY, GT, KPMG, Kramer, PICPA, Plante & Moran, PwC,
RSM, and SCCG.
---------------------------------------------------------------------------
Two commenters suggested revisions to the proposed amendment.\171\
One commenter stated that the rule text could clarify that multiple
other quality responses are not necessarily required by adding the
words ``one or more'' before ``other quality responses'' in the Note to
paragraph .A8(1) for situations where there is just one other quality
response.\172\ The Board believes the rule text is sufficiently clear
that the clause ``and other quality responses do not achieve the
relevant objective(s)'' applies only if the firm has designed and
implemented at least one other quality response relative to the
objective(s). Another commenter suggested amending the definition as
follows: ``(other quality responses have been implemented to address
the same risk, and) `other quality responses do not achieve the
relevant objectives.' '' \173\ The Board does not believe it is
necessary for the rule text to specify that ``other quality responses''
must have been designed and implemented to address the particular
quality risk. As stated in the supplemental request for comment and
reiterated here, when firms have implemented more than one quality
response to address the same quality risk, they can take those other
quality responses into account when determining whether a QC deficiency
exists.
---------------------------------------------------------------------------
\171\ See comment letters from Kramer and Spitters.
\172\ See comment letter from Kramer.
\173\ See comment letter from Spitters.
---------------------------------------------------------------------------
One commenter expressed concern that without a documented,
inspectable basis for concluding that a ``compensating response''
actually operated effectively, this amendment risks becoming a way to
explain away deficiencies rather than a genuine test of whether
investors remain protected.\174\ Another commenter expressed concern
that the proposed amendment would give firms/networks additional
temptation to identify compensating responses when the linkage is
tenuous.\175\ The Board believes the revised note makes clear that,
when a quality response is not properly designed or implemented or is
not operating effectively, the other quality responses would need to
achieve the relevant objective(s), that is, they would need to be
properly designed, implemented, tested, and found to operate
effectively. And, as one commenter observed, paragraph .82 requires
firms to document their evaluation of QC observations to determine
whether QC deficiencies exist and the basis for each
determination.\176\
---------------------------------------------------------------------------
\174\ See comment letter from CFA.
\175\ See comment letter from Grosvenor.
\176\ See comment letter from CFA.
---------------------------------------------------------------------------
Another commenter stated that it is unclear how allowing the
evaluation of compensating controls will work in practice.\177\ For
example, where a quality risk has a single response that fails, the
commenter stated it was unclear whether firms may consider other
responses that mitigate other identified risks to support achievement
of the overall objective.\178\ This commenter suggested that there may
be responses where a precision level is too high to singularly address
a specific risk on their own, but when considered collectively, may
reduce the risk of failing to achieve the objective to an acceptable
level.\179\
---------------------------------------------------------------------------
\177\ See comment letter from RSM.
\178\ See id.
\179\ See id.
---------------------------------------------------------------------------
As explained in the QC 1000 2024 adopting release, the purpose of
this note is to provide examples of circumstances where the likelihood
of the firm not achieving the reasonable assurance objective or one or
more quality objectives would not be reduced to an acceptably low
level.\180\ The amendments to this note further emphasize that, when a
quality response is not properly designed or implemented or is not
operating effectively and other quality responses do not achieve the
relevant objective(s), the likelihood of the firm not achieving the
reasonable assurance objective or one or more quality objectives has
not been reduced to an acceptably low level. Under QC 1000, quality
risks are defined as ``[r]isks (whether or not related to intentional
acts by firm personnel or other participants to deceive or to violate
applicable professional and legal requirements) that, individually or
in combination
[[Page 59368]]
with other risks, have a reasonable possibility of occurring and, if
they were to occur, a reasonable possibility of adversely affecting the
firm's achievement of one or more quality objectives.'' The amendment
clarifies that, when firms have implemented more than one quality
response to address the same quality risk, they can take those other
quality responses into account when determining whether a QC deficiency
exists; if the other quality responses were effective in achieving the
relevant objective(s), no QC deficiency would exist.
---------------------------------------------------------------------------
\180\ See PCAOB Rel. No. 2024-005, at 231.
---------------------------------------------------------------------------
After consideration of the comments received, the Board is adopting
the amendment to the definition of QC deficiency as proposed.
Evaluation of and Reporting on the QC System
1. Annual Evaluation of the QC System
i. Evaluation Date
As originally adopted, QC 1000 requires that the firm perform an
evaluation of the effectiveness of its QC system annually as of
September 30.
The Board proposed to amend QC 1000 to permit firms to select their
own annual evaluation date for their QC system by adding a new defined
term, ``evaluation date,'' defined as the date selected by the firm as
of which to evaluate its QC system under paragraph .77, and making
conforming changes to paragraph .77.
The Board also proposed to include language in a new footnote to
guide the firm's selection of its evaluation date by recognizing that
the firm's choice may be influenced by the nature and circumstances of
the firm and its engagements, including, for example, the firm's fiscal
year-end or the timing of monitoring activities.
All commenters who commented on this aspect of the proposed
amendments expressed support.\181\ One commenter, who did not object to
this aspect of the proposed amendments, expressed concern that timing
should not become a tool for managing findings and a firm should not be
able to use its initial selection, or a later change of date, to defer
capturing known or anticipated inspection findings within an evaluation
period.\182\ This commenter, however, acknowledged that under the
amendments, no period of time escapes evaluation altogether and any
change of evaluation date must be reported to the Board together with
the firm's rationale for the change.\183\ The Board agrees with the
commenter that these are useful guardrails.\184\
---------------------------------------------------------------------------
\181\ See comment letters from AAA, Baker Tilly, BDO, CAQ, CBIZ,
Crowe, Deloitte, EY, Forvis, GT, ICGN, KPMG, MIAG, PICPA, Plante &
Moran, PwC, RSM, and Spitters.
\182\ See comment letter from CFA.
\183\ See id.
\184\ See id.
---------------------------------------------------------------------------
The choice of evaluation date is an aspect of QC system design and,
as such, has to be made and documented by the time the firm becomes
subject to the QC 1000.06 requirement to design, implement, and operate
an effective QC system. The firm has to have the information needed to
identify unremediated QC deficiencies and to reach a conclusion about
the effectiveness of its QC system as of the evaluation date, and for
the individuals with ultimate responsibility and accountability and
operational responsibility and accountability for the QC system as a
whole, acting with due professional care, to certify the firm's report
to the PCAOB on its annual evaluation of the QC system. This suggests
that the evaluation date and the firm's monitoring and remediation
cycle ought to be coordinated so that sufficient, timely information is
available when needed about the implementation and operation of the QC
system (including the status of remediation efforts) and the compliance
of the firm's engagements with applicable professional and legal
requirements. Because of the relationship between the evaluation date
and the firm's monitoring and remediation activities, The Board does
not anticipate that firms will change their selected evaluation date
without a specific reason (e.g., regulatory requirements, business
combination transactions, or changes in fiscal year or business
cycles).
The Board is adopting these amendments as proposed.
The Board believes allowing each firm to select its evaluation date
based on the firm's particular facts and circumstances responds to the
implementation challenges experienced by some firms and, in particular,
could reduce the burden and costs of multiple annual evaluations that
some firms could have experienced due to differences in required
evaluation dates under QC 1000 versus other regulations to which they
are subject. This change better aligns with the flexibility provided by
other quality management standards, which permit firms to choose their
own evaluation date. Additionally, the Board does not believe that
allowing firms to select their own evaluation date impairs the Board's
ability to carry out its inspection program.
ii. Five-Month Threshold for the Initial Evaluation of the Firm's QC
System
The Board proposed to add language to paragraph .77 that would
require a minimum period of operation before a firm is first required
to evaluate its QC system. Under the proposed amendment, a firm would
be required to evaluate its QC system once the firm has been subject to
the requirement to design, implement, and operate a QC system under
paragraph .06 for at least five consecutive months (whether due to the
effectiveness of QC 1000 on December 15, 2026, or to the firm's later
becoming subject to the requirements of QC 1000.06).
Most commenters who commented on this topic supported the proposed
amendment.\185\
---------------------------------------------------------------------------
\185\ See comment letters from Baker Tilly, CAQ, ICGN, KPMG,
PICPA, RSM, and Spitters.
---------------------------------------------------------------------------
However, one commenter stated that the proposed approach may create
practical challenges for firms seeking to align their QC 1000
evaluation process with evaluations performed under other quality
management standards, which contemplate annual evaluation periods that
generally do not exceed twelve months.\186\ This commenter observed
that a firm that has chosen, for example, March 31 as its evaluation
date would likely be required to perform an evaluation under ISQM 1 or
SQMS 1 as of March 31, 2027, while the corresponding QC 1000 evaluation
would not occur until March 31, 2028, and would encompass a 15-month
evaluation period.\187\ This commenter suggested that the Board could
permit firms to perform their initial evaluation of their QC system as
of their selected evaluation date, consistent with their normal quality
control processes, but require the first Form QC filing only for the
first 12-month evaluation period ending after September 30, 2027.\188\
This commenter believes that the Board could obtain information
regarding that firm's initial evaluation, implementation progress,
significant findings, and remediation activities through its oversight
activities (e.g., inspections, implementation outreach, annual data
requests, and other regulatory interactions) prior to the firm's first
Form QC filing.\189\ Another commenter stated that, combined with a
free choice of evaluation date, the proposed five-month threshold could
defer some firms' first evaluation well into 2028.\190\ This commenter
stated
[[Page 59369]]
that the Board should set an outer limit so that every firm completes
its first evaluation within a reasonable period of becoming subject to
the standard.\191\
---------------------------------------------------------------------------
\186\ See comment letter from BDO.
\187\ See id.
\188\ See id.
\189\ See id.
\190\ See comment letter from CFA.
\191\ See id.
---------------------------------------------------------------------------
The Board acknowledges that, depending on the evaluation date
chosen by the firm, the first evaluation period may encompass more than
12 months, but observes that subsequent periods would proceed on a 12-
month cycle (absent a change of the evaluation date). The Board
believes that this approach sets a reasonable outer limit for a firm's
first evaluation. The Board also believes that the five-month minimum
duration of the initial evaluation period ensures that firms have
sufficient information to evaluate the effectiveness of their QC
system. A firm can elect to voluntarily perform its initial evaluation
covering a less-than-five-month period, but that evaluation would not
be a required evaluation under QC 1000. Consequently, under General
Instruction 4(a) to Form QC, the firm's first Form QC filing would be
required to cover the period beginning on the date the firm first
incurred an obligation to implement and operate a QC system under QC
1000.06 and ending on the firm's evaluation date.
Another commenter suggested that the five-month period should
commence on the first day of the month immediately following the event
that triggers the firm's obligation to design, implement, and operate
its QC system, which would allow firms a full five-month operating
period on which to base their evaluation.\192\ This commenter also
requested that the Board clarify that the five-month period applies
solely to the initial operation of the broader QC system and does not
establish a mandatory minimum operating period for concluding that a
specific remedial action is effective.\193\ To clarify, as noted above,
a firm becomes subject to the requirements of QC 1000 on (1) December
15, 2026 (the effective date of QC 1000), or (2) the day the firm
becomes subject to the requirement to design, implement, and operate a
QC system under paragraph .06. Therefore, in all circumstances, a
firm's QC system will have operated for a full five months or longer
before the firm is required to evaluate the effectiveness of its QC
system. Additionally, because the five-month threshold refers to the
evaluation of the effectiveness of the firm's QC system as a whole, it
does not impose any minimum time requirement for any other purpose
other than for QC 1000.77.
---------------------------------------------------------------------------
\192\ See comment letter from KPMG.
\193\ See id.
---------------------------------------------------------------------------
Another commenter also suggested that the Board clarify whether
engagements should be included in a firm's evaluation based on the
financial statement year-end or the date the auditor's report is
issued.\194\ This commenter encouraged the Board to clarify how firms
should approach the initial evaluation when the completion of a firm's
engagements falls outside this five-month timeframe and when the
initial evaluation has little or no engagement activity within the
evaluation period.\195\
---------------------------------------------------------------------------
\194\ See comment letter from PICPA.
\195\ See id.
---------------------------------------------------------------------------
QC 1000 requires that the firm design, implement, and operate a
monitoring and remediation process to provide relevant, reliable, and
timely information about the design, implementation, and operation of
the QC system and to provide a reasonable basis for timely detection of
engagement deficiencies and QC deficiencies.\196\ Firms are required to
monitor completed engagements.\197\ A completed engagement is one for
which the firm has issued an engagement report. Firms also are
required, depending on the size of their PCAOB audit practice, to
either perform in-process engagement monitoring \198\ or consider doing
so.\199\ If the firm has no completed engagements during the firm's
initial evaluation of its QC system, in-process monitoring could
provide relevant, reliable, and timely information about the
performance of the firm's engagements.
---------------------------------------------------------------------------
\196\ QC 1000.59a and b.
\197\ QC 1000.62a.
\198\ QC 1000.63a.
\199\ QC 1000.63b.
---------------------------------------------------------------------------
Finally, one commenter questioned the rationale behind the Board's
decision to use five months as opposed to, for example, six
months.\200\ In developing the minimum time period for the initial QC
system evaluation, the Board determined and continues to believe that
the five-month threshold strikes the right balance such that the QC
system has ample time to operate while also ensuring the PCAOB's timely
receipt of information related to firms' QC systems.
---------------------------------------------------------------------------
\200\ See comment letter from Spitters.
---------------------------------------------------------------------------
Accordingly, the Board is adopting this amendment as proposed.
To illustrate how the five-month threshold for the initial
evaluation of the firm's QC system would operate, if a firm that is
subject to the requirements of QC 1000.06 when the standard becomes
effective (on December 15, 2026) selects June 30 as its evaluation
date, the firm would first evaluate the effectiveness of its QC system
in accordance with QC 1000 as of June 30, 2027, because the firm would
have been required to operate a QC 1000-compliant system for at least
five months (specifically, from December 15 to June 30) as of June 30,
2027. Alternatively, if such a firm selects March 31 as its evaluation
date, the firm would be required to first evaluate the effectiveness of
its QC system as of March 31, 2028, because the firm would not have
been required to operate a QC 1000-compliant system for at least five
months as of March 31, 2027. As another example, if a firm first became
subject to the requirements of QC 1000.06 on June 1, 2027 (because the
firm became subject to applicable professional and legal requirements
with respect to an engagement at that time), and the firm selects July
31 as its evaluation date, the firm would be required to first evaluate
the effectiveness of its QC system as of July 31, 2028, because the
firm would not have been required to operate a QC 1000-compliant system
for at least five months as of July 31, 2027.
iii. Evaluation Conclusions
As originally adopted, QC 1000 requires the firm to evaluate its QC
system annually and conclude that the QC system is effective, is
effective except for one or more unremediated QC deficiencies that are
not major QC deficiencies, or is not effective (i.e., one or more major
QC deficiencies exist).
The Board proposed to amend the above three conclusions to align QC
1000 more closely with other quality management frameworks. Under
proposed paragraph .77, the firm would be required to conclude, as of
the evaluation date, that its QC system:
<bullet> Is effective in achieving the reasonable assurance
objective; or
<bullet> Is effective in achieving the reasonable assurance
objective except for unremediated QC deficiencies that have a severe
but not pervasive effect on the design, implementation, and operation
of the QC system (and do not render the QC system not effective); or
<bullet> Is not effective in achieving the reasonable assurance
objective.
To clarify when a firm may conclude that its QC system is effective
in achieving the reasonable assurance objective under paragraph .77a,
the Board proposed to include a note explaining that such a conclusion
would be appropriate when, as of the evaluation date, there are no
unremediated QC deficiencies other than those that, individually or in
[[Page 59370]]
combination, are not severe. This clarification was intended to
emphasize that the presence of unremediated QC deficiencies did not, in
all cases, preclude a conclusion under paragraph .77a that the QC
system is effective. Rather, the determination would depend on the
severity of those deficiencies and their effect on the firm's ability
to achieve the reasonable assurance objective. Under the proposed
approach, QC deficiencies that are not severe, whether considered
individually or in combination, would not indicate that the QC system
is failing to operate effectively, which would be consistent with the
ISQM 1 evaluation framework and the reasonable assurance objective of
QC 1000.
Under proposed paragraph .77b, a firm would conclude that its QC
system was effective in achieving the reasonable assurance objective
except for unremediated QC deficiencies that have a severe but not
pervasive effect on the design, implementation, and operation of the QC
system (and do not render the QC system not effective). To clarify,
when evaluating the effect of unremediated QC deficiencies on the QC
system, a firm would evaluate whether the QC deficiencies have a severe
but not pervasive effect on each of the following: (1) the design of
the QC system, (2) the implementation of the QC system, and (3) the
operation of the QC system. Therefore, with respect to the conclusion
under paragraph .77b, QC deficiencies may have a severe but not
pervasive effect on the design, implementation, or operation of the QC
system; they need not have such an effect on all three aspects of the
QC system for a firm to reach the conclusion under proposed paragraph
.77b. The parenthetical statement is intended to clarify that if QC
deficiencies are so severe as to prevent the firm from achieving the
reasonable assurance objective, the appropriate conclusion would be
under proposed paragraph .77c. A firm would reach the conclusion set
forth in paragraph .77c if its QC system was not effective in achieving
the reasonable assurance objective.
QC 1000 specifies that an unremediated QC deficiency is one for
which remedial actions that completely address the QC deficiency have
not been fully implemented, tested, and found effective. The Board
proposed to modify the existing note to paragraph .77 to explain that,
while remedial actions must be fully implemented as of the evaluation
date, they can be tested and found effective no later than the date
Form QC is due under paragraph .79 (or, if earlier, the date Form QC is
filed). The note distinguishes between the implementation of remedial
actions and the demonstration of their effectiveness. For purposes of
determining whether a QC deficiency is remediated, firms are expected
to have fully implemented remedial actions as of the evaluation date,
but the assessment of whether those actions are operating effectively
may be supported by testing their operating effectiveness after the
evaluation date but before the Form QC filing date.
Commenters supported the proposed amendments to the evaluation
framework and evaluation conclusions, particularly the effort to align
more closely with other quality management standards.\201\ Several
commenters noted that this alignment would reduce the complexity of
managing evaluations under multiple frameworks and help avoid potential
confusion among stakeholders.\202\ Two commenters observed that the
three-tiered conclusions framework better supports informed decision-
making and meaningful communication with stakeholders, and reflects a
more accurate representation of how QC systems operate in
practice.\203\ Two other commenters noted that the proposed evaluation
framework would enhance transparency by allowing firms to distinguish
among varying degrees of effectiveness, including through the use of
the ``except for'' conclusion.\204\ One commenter further stated that
the proposed evaluation framework better aligns with the reasonable
assurance objective because it clarifies that a QC system may provide
reasonable assurance even when unremediated QC deficiencies exist.\205\
In addition, some commenters indicated that the proposed conclusions in
paragraph .77 were sufficiently clear and appropriate.\206\ One
commenter stated the evaluation framework in proposed paragraphs
.77-.78 is generally clear but requested clarification on the latitude
of firms to change their conclusions as of the evaluation date if,
before the date that Form QC is filed, a firm identifies shortcomings
when further testing its remedial actions.\207\
---------------------------------------------------------------------------
\201\ See comment letters from AAA, Baker Tilly, BDO, CAQ, CBIZ,
Deloitte, EY, Forvis, GT, ICGN, KPMG, PICPA, Plante & Moran, PwC,
and RSM.
\202\ See comment letters from Baker Tilly, Deloitte, EY,
Forvis, and KPMG.
\203\ See comment letters from BDO and CBIZ.
\204\ See comment letters from Baker Tilly and GT.
\205\ See comment letter from KPMG.
\206\ See comment letters from GT, KPMG, and Spitters.
\207\ See comment letter from Kramer.
---------------------------------------------------------------------------
While commenters generally supported the proposed framework, one
commenter recommended expanding the ``except for'' category to include
both ``severe but not pervasive'' and ``pervasive but not severe''
unremediated QC deficiencies to minimize potential blurring among the
conclusion categories.\208\ This commenter expressed concern that a
conclusion under paragraph .77a could be confusing because a firm may
arrive at a favorable conclusion despite having experienced significant
quality control issues during the evaluation period that were
subsequently remediated.\209\ The same commenter also noted that
deficiencies may take time to become apparent and suggested requiring
statements or certifications indicating that firms considered
previously unidentified deficiencies relating to prior years in their
evaluations.\210\ Another commenter urged the Board to retain the
``effective, with no unremediated QC deficiencies'' conclusion as
originally adopted.\211\ The commenter expressed concern that allowing
firms to reach an unqualified ``effective'' conclusion despite the
existence of unremediated QC deficiencies would broaden the
circumstances in which firms may reach a favorable conclusion.\212\
---------------------------------------------------------------------------
\208\ See comment letter from Grosvenor.
\209\ See id.
\210\ See id.
\211\ See comment letter from CFA.
\212\ See id.
---------------------------------------------------------------------------
One commenter supported the proposed modification to the existing
note to paragraph .77 because it provides helpful guidance and better
reflects how remediation occurs in practice.\213\ Another commenter
questioned whether the phrase ``completely address'' in the first
sentence of the note, which is not part of the proposed modification,
establishes an unnecessarily stringent standard and suggested replacing
it with ``sufficiently address.'' \214\ Another commenter requested
clarification on the description in the release for determining whether
a QC deficiency is remediated, specifically whether the phrase ``may be
supported by evidence obtained from testing after the evaluation date''
refers to testing of instances that occurred before the evaluation date
or the related response activities after the evaluation date.\215\ One
commenter requested clarification on how firms should assess the effect
of remediation efforts when frequency constraints preclude testing
enough instances of the remedial actions in
[[Page 59371]]
evaluating remaining QC deficiencies.\216\
---------------------------------------------------------------------------
\213\ See comment letter from KPMG.
\214\ See comment letter from Grosvenor.
\215\ See comment letter from RSM.
\216\ See comment letter from CBIZ.
---------------------------------------------------------------------------
In developing the proposed amendments to paragraph .77, the Board
also considered an alternative evaluation framework under which a firm
would be required to reach a binary conclusion (i.e., that its QC
system is either effective or not effective in achieving the reasonable
assurance objective).
One commenter stated that a binary conclusion may be particularly
appropriate for many triennial firms and suggested that a binary
framework would simplify the evaluation process.\217\ Another commenter
stated that whether the alternative evaluation framework with a binary
conclusion is more appropriate is undefined, and it would be
appropriate and constructive to retain the factors included in
paragraph .78 (which are discussed further below) under this
alternative framework.\218\
---------------------------------------------------------------------------
\217\ See comment letter from Kramer.
\218\ See comment letter from Spitters.
---------------------------------------------------------------------------
Many commenters did not support the binary approach for the
evaluation framework.\219\ Some commenters were concerned that it would
limit firms' ability to communicate the nature and severity of
identified deficiencies and would decrease alignment with other quality
management frameworks.\220\ In addition, some commenters stated that a
binary framework could provide insufficient information regarding
significant deficiencies that are not pervasive enough to warrant a
conclusion that the QC system is ineffective.\221\ Two commenters noted
that a binary framework would be less informative.\222\ Another
commenter expressed concern that the binary approach could reduce the
rigor of the evaluation process.\223\ Another commenter stated that the
existing three-tiered conclusion structure provides more meaningful
information by distinguishing QC systems with severe but not yet
pervasive QC deficiencies and serves as an important early-warning
mechanism.\224\ This commenter also stated that the middle category
allows severe but not yet pervasive unremediated QC deficiencies to be
identified, escalated, and remediated before the QC system fails.\225\
---------------------------------------------------------------------------
\219\ See comment letters from AAA, Baker Tilly, BDO, CAQ, CBIZ,
CFA, GT, ICGN, KPMG, MIAG, PICPA, PwC, and RSM.
\220\ See comment letters from BDO, CBIZ, and GT.
\221\ See comment letters from CAQ, KPMG, and PICPA.
\222\ See comment letters from AAA and MIAG.
\223\ See comment letter from MIAG.
\224\ See comment letter from CFA.
\225\ See id.
---------------------------------------------------------------------------
After considering the comments received, the Board is adopting the
amendments to paragraph .77 as proposed.
The Board believes that unremediated QC deficiencies that are
pervasive but not severe may nevertheless allow the QC system to
achieve its reasonable assurance objective and therefore support a
conclusion under paragraph .77a. The Board also believes the evaluation
framework appropriately focuses on the condition of the QC system as of
the evaluation date and provides firms with the incentive to timely and
effectively remediate identified QC deficiencies as of the evaluation
date to reach a conclusion under paragraph .77a.
The Board notes that, despite increased alignment between the
evaluation conclusions under QC 1000 and other quality management
standards, the possibility remains that firms may reach different
conclusions regarding the effectiveness of their QC systems under QC
1000 and ISQM 1 or SQMS 1. For example, there are differences in the
professional and legal requirements that apply to a firm's audit
practice under PCAOB standards compared to other standards, including
variations between applicable auditing standards and independence
requirements. The relevant populations of engagements are different.
There could also be differences relating to the individuals who perform
such engagements or perform activities within the QC system, including
with regard to training and supervision. In addition, QC 1000 would
continue to require a more structured approach to the evaluation
process than other standards, including through the application of
specific defined terms and factors that are required to be considered.
The Board believes this more structured approach is important both in
supporting consistent and appropriate evaluation of the QC system by
firms and in providing a foundation for PCAOB oversight in the future.
The Board does not believe that an additional certification
requirement, as suggested by one commenter, is necessary because QC
1000 already requires firms to consider the results of prior monitoring
activities and remedial actions when determining the nature, timing,
and extent of the firm's monitoring activities. The Board is also
retaining the phrase ``completely address'' in the first sentence of
the note to paragraph .77 describing the meaning of an unremediated QC
deficiency. The commenter's suggested phrase ``sufficiently address''
could introduce subjectivity regarding whether a QC deficiency has been
adequately remediated. The Board believes the phrase ``completely
address'' conveys the expected level of remediation necessary before
concluding that a QC deficiency is fully remediated.
With respect to requests for clarifications of (i) the phrase ``may
be supported by evidence obtained from testing after the evaluation
date'' and (ii) frequency constraints on testing remedial actions, the
note to paragraph .77 distinguishes between the implementation of
remedial actions and the demonstration of their effectiveness. For
purposes of determining whether a QC deficiency is remediated, firms
are expected to have fully implemented remedial actions as of the
evaluation date, but the assessment of whether those actions are
operating effectively may be supported by testing their operating
effectiveness after the evaluation date but before the Form QC filing
date. For example, when a remedial action has been implemented prior to
the evaluation date but evidence from multiple instances of operation
is needed to conclude that the remediation is effective, the firm may
test one or more instances of operation of the remedial action that
took place after the evaluation date but before the filing of Form QC
to demonstrate effectiveness of the remedial action. However, if
multiple instances of operation are needed to conclude that a remedial
action is effective and, due to frequency constraints, only one
instance of operation can be tested before the filing of Form QC, then
the QC deficiency would be considered an unremediated QC deficiency.
Regarding the requested clarification of a firm's ability to change
its conclusion on QC effectiveness between the evaluation date and the
date Form QC is filed, the Board notes that the firm's final conclusion
about the effectiveness of its QC system is the conclusion reported on
Form QC. When additional information related to the QC system as of the
evaluation date becomes available before Form QC is filed, the firm is
expected to evaluate that information and make appropriate
determinations regarding the information in a timely manner and report
any relevant conclusions it reaches.
[[Page 59372]]
iv. Evaluating the Severity and Pervasiveness of Unremediated QC
Deficiencies
As originally adopted, QC 1000.78 includes the concept of a ``major
QC deficiency'' and provides presumptions and factors to determine
whether a major QC deficiency exists and, therefore, the QC system is
not effective. The Board proposed to eliminate the concept of a ``major
QC deficiency,'' including the associated presumptions. The Board
proposed to retain, in modified form, the factors to consider in
evaluating the severity and pervasiveness of unremediated QC
deficiencies.
Specifically, the Board proposed to amend paragraph .78 to require
firms to evaluate the severity and pervasiveness of unremediated QC
deficiencies in reaching the evaluation conclusion under paragraph .77.
Proposed paragraph .78 clarifies that the firm's evaluation would
consider all unremediated QC deficiencies individually and in
combination, considering both quantitative and qualitative
implications. The proposed paragraph .78 also describes severity and
pervasiveness for purposes of this evaluation. Severity reflects the
seriousness of a QC deficiency or combination of QC deficiencies,
including the potential impact on the firm's ability to achieve the
reasonable assurance objective. Pervasiveness reflects the breadth of
impact of the QC deficiency or combination of QC deficiencies on the QC
system or across the firm's portfolio of engagements.
Commenters generally supported removing the concept of a ``major QC
deficiency'' from QC 1000.\226\ Some commenters noted that the concept
constituted a fundamental departure from other quality management
standards and reduced consistency across quality management
frameworks.\227\ One commenter stated that the removal of the major QC
deficiency concept and related presumptions could reduce the
information value of the evaluation conclusions and lessen the
prominence with which serious QC issues are escalated and
communicated.\228\ The commenter urged the Board to preserve escalation
presumptions in some form and clarify how serious QC issues that fall
short of overall ineffectiveness will be escalated and communicated if
the ``major QC deficiency'' concept is removed.\229\
---------------------------------------------------------------------------
\226\ See comment letters from BDO, CAQ, GT, KPMG, PICPA, RSM,
and Spitters.
\227\ See comment letters from GT, KPMG, PICPA, and RSM.
\228\ See comment letter from CFA.
\229\ See id.
---------------------------------------------------------------------------
Some commenters supported the factors used to evaluate the severity
and pervasiveness of unremediated QC deficiencies, stating that the
factors promote consistency and rigor in the evaluation process.\230\
One commenter stated that the factors in proposed paragraph .78
appropriately address QC deficiencies individually and collectively and
account for both qualitative and quantitative considerations.\231\
---------------------------------------------------------------------------
\230\ See comment letters from BDO, CAQ, GT, and KPMG.
\231\ See comment letter from Spitters.
---------------------------------------------------------------------------
One commenter stated that considering deficiencies ``in
combination'' when assessing severity may blur the distinction between
the concepts of severity and pervasiveness.\232\ The same commenter
also indicated that this distinction may be further blurred because the
same factors are used to evaluate both severity and pervasiveness.\233\
Another commenter supported the objective of providing a structured
framework for evaluating the severity and pervasiveness of unremediated
QC deficiencies but viewed proposed paragraph .78 as overly complex and
prescriptive.\234\ The same commenter suggested an alternative model
for paragraph .78, incorporating concepts from the AICPA Peer Review
Program guidance for evaluating deficiencies, that would focus on the
nature, cause, and effect of the deficiency, including: (1) whether the
deficiency is an isolated event or a systemic weakness; (2) the
significance of the deficiency to the firm's practice, including the
likelihood to affect other engagements or components of the QC system;
(3) the effect of the deficiency on the firm's ability to achieve the
reasonable assurance objective; and (4) the extent to which remedial
actions have been implemented and demonstrated to be effective.\235\
---------------------------------------------------------------------------
\232\ See comment letter from Grosvenor.
\233\ See id.
\234\ See comment letter from PICPA.
\235\ See id.
---------------------------------------------------------------------------
The Board does not believe that removing the major QC deficiency
concept removes the framework's ability to identify and appropriately
distinguish particularly severe QC deficiencies. Under the amended
evaluation framework, firms would still be required to evaluate the
severity and pervasiveness of all unremediated QC deficiencies,
individually and in combination, and report information regarding
unremediated QC deficiencies in Form QC regardless of the evaluation
conclusion reached. The evaluation conclusions in paragraph .77 and the
factors in paragraph .78 would provide a structured framework for
identifying and assessing unremediated QC deficiencies and for
communicating unremediated QC deficiencies to the PCAOB. Further, the
conclusion under paragraph .77b can only be selected when unremediated
QC deficiencies have a severe but not pervasive effect on the QC system
and also do not render the QC system not effective. As reflected in the
parenthetical statement in paragraph .77b, if unremediated QC
deficiencies are so severe as to prevent the firm from achieving the
reasonable assurance objective, the firm would be required to conclude
under paragraph .77c that its QC system is not effective in achieving
the reasonable assurance objective.
The Board believes it is important to consider unremediated QC
deficiencies both individually and in combination because doing so may
reveal patterns of similar findings or indicate a broader issue that
may not be evident from evaluating each deficiency in isolation. The
Board also believes that allowing the same factors to inform
assessments of both severity and pervasiveness provides firms with
relevant information for their evaluations. In many cases, it may not
be practicable to categorize a factor as relating exclusively to either
severity or pervasiveness. Additionally, the Board believes the
alternative factors for evaluating deficiencies, suggested by one
commenter, are already reflected in paragraph .78 as proposed. The
factors in paragraph .78 are intended to assist firms in performing the
internal evaluation required to reach a conclusion under paragraph .77.
The Board believes the approach in paragraph .78 provides clear
direction to firms in evaluating the severity and pervasiveness of
unremediated QC deficiencies.
One commenter noted that the term ``component'' in proposed
paragraph .78a is undefined and could be unclear and recommended that
the standard more explicitly link the term to the eight integrated
components of a firm's QC system described in QC 1000.03, either
through a cross-reference or by using consistent terminology.\236\ To
clarify the intended meaning of the term ``component'' in proposed
paragraph .78a, the Board is revising the paragraph to refer to the
``components of the firm's QC system.''
---------------------------------------------------------------------------
\236\ See comment letter from Kramer.
---------------------------------------------------------------------------
[[Page 59373]]
Another commenter questioned if the factor of persistence in
paragraph .78d affects the evaluation of severity and pervasiveness and
provided an example of an issue that persists unchanged for three
years.\237\ The Board continues to believe that the persistence of a
deficiency may provide useful information in assessing its severity and
pervasiveness. However, persistence alone may not determine the
severity or pervasiveness of a QC deficiency, and those assessments
depend on the particular facts and circumstances as well as other
factors in paragraph .78.
---------------------------------------------------------------------------
\237\ See comment letter from Grosvenor.
---------------------------------------------------------------------------
Another commenter stated that the proposed amendments to paragraphs
.78e-f introduce the phrase ``or could result in'' and expressed
concern that the use of ``could'' may imply an evaluation threshold
approaching absolute assurance because it encompasses even remote
possibilities.\238\ This commenter suggested revising the language to
refer instead to circumstances ``where there is a reasonable
possibility.'' \239\ The factors to consider in evaluating the severity
and pervasiveness of unremediated deficiencies do not relate to
providing any level of assurance. They are intended to help the firm
evaluate how severe or pervasive unremediated QC deficiencies are in
performing the evaluation and reaching a conclusion regarding the
effectiveness of the firm's QC system. The use of ``could'' in these
factors is intended for the firm to evaluate whether the unremediated
QC deficiencies remaining as of the evaluation date have the potential
to cause significant engagement deficiencies or revisions of engagement
reports, or to be associated with financial statement restatements or
reissuances of management reports on internal control over financial
reporting or broker-dealer compliance or exemption reports that are the
subject of the firm's audit or attestation engagements.
---------------------------------------------------------------------------
\238\ See comment letter from KPMG.
\239\ See id.
---------------------------------------------------------------------------
One commenter expressed concern that the wording regarding the
significance to the firm's portfolio of engagements in paragraph .78g
could unintentionally imply that some engagements are less important
than others.\240\ While all unremediated QC deficiencies are required
to be evaluated for severity and pervasiveness, the Board recognizes
that there may be certain engagements where unremediated QC
deficiencies are more likely to affect the firm's overall practice
under PCAOB standards due to the engagement's significance to the
firm's portfolio. For example, if an unremediated QC deficiency is
likely to result in engagement deficiencies that occur across the
primary industry that represents a substantial portion of the firm's
PCAOB engagements, the unremediated QC deficiency could be severe or
pervasive because of its significance to the firm's engagement
portfolio.
---------------------------------------------------------------------------
\240\ See comment letter from PICPA.
---------------------------------------------------------------------------
Another commenter supported the factors if they continue to include
consideration of whether remedial actions have been implemented,
tested, and determined to be effective, consistent with paragraph
.78h.\241\
---------------------------------------------------------------------------
\241\ See comment letter from ICGN.
---------------------------------------------------------------------------
The Board is adopting the factors in paragraph .78 as proposed with
the revision made to paragraph .78a discussed above. The Board believes
these factors promote consistency by identifying circumstances that are
particularly relevant in assessing the severity and pervasiveness of
unremediated QC deficiencies. The final factors with general
descriptions are:
a. The number and nature of components of the firm's QC system or
quality objectives directly or indirectly affected.
This factor focuses on how many components of the firm's QC system
or quality objectives are affected, what they are, and whether the
impact is direct or spread through other components or quality
objectives.
b. The extent to which the unremediated QC deficiency or
combination of unremediated QC deficiencies relates to a component,
quality objective, or quality response that affects the design or
operation of other aspects of the QC system.
This factor focuses on how widespread the impact of the
unremediated QC deficiency or combination of unremediated QC
deficiencies is throughout the QC system.
c. The number and pervasiveness of root causes.
The factor focuses on what the firm's root cause analysis reveals
about why the QC deficiency occurred and how significantly or broadly
it affects the QC system.
d. The persistence of the unremediated QC deficiency or combination
of unremediated QC deficiencies over time.
This factor focuses on the existence of a QC deficiency or
combination of QC deficiencies that recurs or continues unremediated
year over year.
e. Whether the unremediated QC deficiency or combination of
unremediated QC deficiencies has resulted or could result in
significant engagement deficiencies.
This factor focuses on whether the unremediated QC deficiency or
combination of unremediated QC deficiencies is leading to or likely to
lead to significant engagement deficiencies.
f. Whether the unremediated QC deficiency or combination of
unremediated QC deficiencies has resulted or could result in the need
for revisions to engagement reports, or is or could be associated with
restatements of financial statements or reissuances of company-prepared
reports that are the subject of audit or attestation engagements.\242\
---------------------------------------------------------------------------
\242\ Company-prepared reports subject to audit or attestation
engagements include the report on internal control over financial
reporting and broker-dealer compliance and exemption reports.
---------------------------------------------------------------------------
This factor focuses on whether the unremediated QC deficiency or
combination of unremediated QC deficiencies has already led or could
lead to revisions of engagement reports, or is or could be associated
with financial statement restatements or reissuances of management
reports on internal control over financial reporting or broker-dealer
compliance or exemption reports.
g. With respect to the factors in subparagraphs d-f, the number and
significance (to the firm's portfolio of engagements) of engagements
that are affected by the unremediated QC deficiency or combination of
unremediated QC deficiencies or are likely to be affected in the future
in the absence of remediation, and the nature of the effect.
This factor focuses on how important the affected engagements are
compared to the firm's overall practice under PCAOB standards. The
number and significance of affected engagements to the firm's portfolio
of engagements depends on, for example, firm personnel affected or
likely to be affected, the associated revenue or profit, the associated
risks, and the relevant industry.
h. The effects of any remedial actions that have been implemented,
tested, and found to be effective.
Before the annual evaluation date, a firm may implement remedial
actions that may reduce the severity or pervasiveness of an
unremediated QC deficiency while not completely addressing it. For a
firm to take credit for the effects of these remedial actions, they
would need to be implemented as
[[Page 59374]]
of the evaluation date, and they would need to be tested and found to
be effective before Form QC is due and filed. For example, in response
to a QC deficiency related to a problem identified with a firm's audit
software, the firm designs and implements five remedial actions as of
the evaluation date. Of those five remedial actions, two remedial
actions have been tested and found to be effective before Form QC is
due and filed. When determining the severity and pervasiveness of the
unremediated QC deficiency, the firm can consider the effects of the
two remedial actions that have been tested and found to be effective.
The process flow that follows illustrates how to apply the above
considerations in reaching one of the three evaluation conclusions in
paragraph .77.
BILLING CODE 8011-01-P
[GRAPHIC] [TIFF OMITTED] TN18SE26.008
[[Page 59375]]
BILLING CODE 8011-01-C
2. Reporting to the PCAOB
i. Reporting on the Annual Evaluation of the Effectiveness of the QC
System
As originally adopted, QC 1000 provides that firms have until
November 30 each year to report to the PCAOB on Form QC the outcomes of
their QC system evaluations, based on a fixed evaluation date of
September 30. This provides firms with 61 days after the evaluation
date of September 30 to file Form QC. Based on the proposed amendment
to permit firms to select their own evaluation dates, the Board
proposed to amend the due date of Form QC in paragraph .79 to 60 days
after the firm's chosen evaluation date. The Board also proposed to
amend the Form QC reporting rule, PCAOB Rule 2203A, Report on the
Evaluation of the Firm's System of Quality Control, and General
Instruction 3 to Form QC to reflect this proposed amendment (see
below).
Commenters generally supported the proposed amendments to paragraph
.79, Rule 2203A, and Form QC.\243\
---------------------------------------------------------------------------
\243\ See comment letters from BDO, CFA, Crowe, EY, GT, KPMG,
Spitters, and VSCPA.
---------------------------------------------------------------------------
One commenter expressed concern related to the 60-day reporting
deadline for Form QC, stating that, for many smaller firms, completing
the annual evaluation of the system of quality control, hiring and
coordinating external resources, obtaining the necessary internal
reviews and approvals, and preparing the required report within 60 days
may not be practicable.\244\ This commenter recommended that the Board
adopt a more scalable approach, for example, by permitting firms below
an appropriate threshold to file Form QC within 180 days of their
evaluation date.\245\ In allowing firms to select their own evaluation
date, the Board believes it is appropriately providing firms with the
ability to select a date that works best for their business cycles;
however, the Board also believes that timely receipt by the PCAOB of
information contained in Form QC to support the Board's oversight
activities requires a shorter timeline than this commenter suggested.
The Board continues to believe that the 60-day filing requirement
provides firms with sufficient time from the evaluation date to the
reporting date to complete their evaluation and report to the PCAOB.
---------------------------------------------------------------------------
\244\ See comment letter from PICPA.
\245\ See id.
---------------------------------------------------------------------------
The Board also proposed an amendment to General Instruction 4 to
Form QC to clarify the reporting period covered by the firm's
evaluation. As proposed, the reporting period would be the period
beginning the day after the most recent previous evaluation date and
ending on the evaluation date, with the following exceptions as to the
beginning of the reporting period:
<bullet> If a firm has not previously been required to evaluate its
QC system under QC 1000, the reporting period is the period beginning
on the date the firm first incurred an obligation to design, implement,
and operate a QC system under QC 1000.06.
<bullet> If a firm was previously required to evaluate its QC
system under QC 1000, but such obligation lapsed because the firm
ceased having any obligations under applicable professional and legal
requirements with respect to one or more engagements, the reporting
period is the period beginning when the firm subsequently incurred an
obligation to design, implement, and operate a QC system under QC
1000.06.
Under this proposed amendment, the reporting period would generally
be twelve months long, but it would be longer or shorter if the
obligation to design, implement, and operate the QC system arises mid-
period (whether by virtue of the effective date of QC 1000 or the
firm's otherwise becoming subject to the requirement to design,
implement, and operate a QC system). For example, for a firm that
selects March 31 as its evaluation date, upon the effective date of QC
1000 the firm's first evaluation would cover the reporting period from
December 15, 2026, to March 31, 2028, resulting in a greater-than-15-
month reporting period, with the first Form QC due to be filed no later
than 60 days following March 31, 2028. This is because as of March 31,
2027, the firm would not have been subject to the requirement to
design, implement, and operate a QC system for at least five
consecutive months (under the five-month threshold in paragraph .77
discussed above). By contrast, for a firm that selects May 31 as its
evaluation date and is subject to QC 1000 on the standard's effective
date, this firm's first evaluation would cover approximately five and a
half months beginning on December 15, 2026, and ending on May 31, 2027,
with the first Form QC due to be filed no later than 60 days following
May 31, 2027.
The proposed amendment to General Instruction 4 did not draw
comment.
The Board is adopting as proposed the amendments to paragraph .79,
PCAOB Rule 2203A, and Form QC described above.
One commenter stated that two important elements of Form QC
reporting would be lost with the removal of the ``major QC deficiency''
concept: (1) the requirement to flag whether each unremediated
deficiency is major, and (2) the narrative required where a major
deficiency is presumed but determined not to exist.\246\ This commenter
requested that the Board preserve equivalent signals under the proposed
evaluation framework and require that firms (1) indicate, for each
unremediated QC deficiency, whether the firm assessed it as severe, and
(2) explain the basis for any determination that severe deficiencies do
not, individually or in combination, render the QC system not
effective.\247\ QC 1000 continues to require that firms report all
unremediated QC deficiencies as of the evaluation date on Form QC,
regardless of the conclusion reported under paragraph .80a.
Accordingly, a firm's Form QC reporting must include any unremediated
QC deficiencies identified as of the evaluation date, including QC
deficiencies that were determined not to be severe or pervasive. The
Board continues to believe that reporting of all unremediated QC
deficiencies will inform various aspects of the Board's oversight
activities. Upon receipt of a Form QC, the PCAOB will have the ability
to perform further inquiries of a firm regarding any of the information
provided. Additionally, the firm is required to document under
paragraph .82d the basis for the conclusion reached under paragraph
.77, which would include the firm's evaluation of the severity and
pervasiveness of unremediated QC deficiencies, and this information
would be available to the PCAOB in connection with its oversight
activities, including inspections.\248\
---------------------------------------------------------------------------
\246\ See comment letter from CFA.
\247\ See id.
\248\ See PCAOB Rule 4000(b), General.
---------------------------------------------------------------------------
Based on the amendments described above, the Board is adopting
additional conforming amendments to paragraph .80 and Form QC,
substantially as proposed.\249\ The Board is also adopting amendments
to paragraph .80 and Form QC to replace the language ``the issuance of
unsupported opinions'' with ``significant engagement deficiencies,''
consistent with the amendments to QC 1000.68a described above, as
proposed.
---------------------------------------------------------------------------
\249\ Note 1 to Item 3.2 within Form QC is amended to include a
reference to the evaluation date. Also, language related to Exhibit
3.2.b in Part VII of Form QC is amended to refer to individuals
``assigned'' operational responsibility and accountability for the
firm's QC system as a whole.
---------------------------------------------------------------------------
ii. Reporting Changes to the Firm's Evaluation Date
Under the amendments to QC 1000.77, as discussed above, each firm
selects its own evaluation date. The Board proposed that any change in
the
[[Page 59376]]
evaluation date, together with a brief statement of the firm's
rationale for making the change, be reported on Form QC within 30 days
after the firm's decision. The Board believes this information would
inform the timing of the Board's oversight efforts.
To codify this requirement, the Board proposed to recaption Rule
2203A as ``Reporting on the Evaluation of the Firm's System of Quality
Control,'' amend paragraph (a) of Rule 2203A to require notification of
a change in the evaluation date on Form QC, and amend paragraph (b) of
Rule 2203A to require such notification to be filed no later than 30
days after the firm's decision to change the evaluation date.
Relatedly, the Board proposed to amend Form QC to add a new Item
1.2, Change to the Evaluation Date, for providing notice of a change to
the evaluation date, including the new evaluation date and a brief
statement of the rationale for making the change. Additional language
was also proposed to be added to General Instruction 3 to explain that
Form QC is required to be filed no later than 30 days after the firm's
decision to change the evaluation date and that a notification of
change in the evaluation date need only include a completed Part I and
the signed certification in Part V of Form QC.
Several commenters expressed support for the proposed reporting
changes regarding the firm's evaluation date.\250\ Some commenters
requested additional clarifications regarding (1) whether the firm
should use business days or calendar days when calculating the deadline
for submitting Form QC to notify the Board of a new evaluation date,
(2) changes in the firm's evaluation date (for example, due to mergers
or acquisitions), and (3) changing an evaluation date after the first
year of implementation.\251\ Because the deadline for submitting Form
QC is greater than seven days, the 30-day submission deadline when
providing notice of a new evaluation date is based on calendar days,
taking into account the exception that applies if the last day of the
30-day period is a Saturday, Sunday, or Federal legal holiday.\252\
Additionally, the standard does not limit when a firm can change its
evaluation date, but a change to a firm's evaluation date would likely
involve significant changes to many aspects of the firm's QC processes,
so a firm will need to consider the implications to its QC system of
making such a change. As noted above, if the firm decides to change its
evaluation date, the change must be reported on Form QC within 30 days
after the firm's decision, together with a brief statement of the
firm's rationale for the change.
---------------------------------------------------------------------------
\250\ See comment letters from CFA, GT, and KPMG.
\251\ See comment letters from Baker Tilly, BDO, CAQ, and Plante
& Moran.
\252\ See PCAOB Rule 1002, Time Computation; see also PCAOB Rule
2203A, which states that pursuant to Rule 1002, in any year in which
the filing deadline falls on a Saturday, Sunday, or Federal legal
holiday, the deadline for filing Form QC shall be the next day that
is not a Saturday, Sunday, or Federal legal holiday.
---------------------------------------------------------------------------
The Board is adopting these amendments as proposed.
Documentation
As originally adopted, QC 1000 provides firms until December 14
following the firm's annual evaluation to assemble for retention a
complete and final set of QC documentation.
The Board proposed amendments to QC 1000.84 to clarify that the QC
documentation should be completed and retained ``in a manner that
permits timely retrieval,'' rather than ``assembled for retention,'' by
the QC documentation completion date. Documentation is considered
timely retrievable when it is made available in a manner that does not
hinder an experienced auditor's ability to understand the design,
implementation, and operation of the QC system during a particular
evaluation period in accordance with QC 1000.83b and the accompanying
note. In addition, in conjunction with the amendments to paragraphs .77
and .79 of QC 1000, which permit firms to select their own evaluation
date and require them to report on that evaluation no later than 60
days after that date, the Board proposed to amend the QC documentation
completion date to be 14 days after Form QC is filed (or due to be
filed, if earlier).
Many commenters supported the proposed amendments to paragraph .84
\253\ but some stated they continue to have concerns regarding the
scope of the documentation requirements, particularly the extent of
documentation required to be retained.\254\ One of these commenters
raised concerns regarding the clarity and practical application of
``timely retrieval of documentation'' that is not maintained in the
quality monitoring tool and stated that firms would otherwise need to
identify, monitor, and retain documentation across a broad range of
decentralized locations.\255\ One commenter stated that, while they did
not object to the proposed amendments, the proposed amendments did not
address a key issue related to real-time systems, namely, that such
systems may not allow for the reconstruction of information back to a
specific point in time unless versions are archived or captured
otherwise.\256\ Another commenter did not object to the proposed
amendments allowing firms to retain QC documentation within their
original systems of record, provided it remains promptly
retrievable.\257\
---------------------------------------------------------------------------
\253\ See comment letters from AAA, Baker Tilly, BDO, Forvis,
GT, KPMG, MIAG, PICPA, PwC, and Spitters.
\254\ See comment letters from Baker Tilly, GT, PICPA, and PwC.
\255\ See comment letter from GT.
\256\ See comment letter from RSM.
\257\ See comment letter from CFA.
---------------------------------------------------------------------------
Two commenters expressed uncertainty as to the nature of the
documentation required to be retained, for example, emails or other
documentation that relate to QC processes.\258\ One of these commenters
requested clarification that other evidence of the underlying
documentation, such as system-generated reports or other reproducible
outputs, would meet the documentation requirements.\259\ This commenter
stated that the release text in the supplemental request for comment
indicated that firms were expected to retrieve documentation from live
systems ``as it existed at the time that it was considered complete,''
which might not be feasible with continuously updating systems and
would appear to reintroduce the same operational challenges the
proposed amendment was intended to alleviate.\260\ The other commenter
stated that it was unclear as to how to address documentation residing
in systems or applications that have been replaced during the
evaluation period.\261\
---------------------------------------------------------------------------
\258\ See comment letters from GT and KPMG.
\259\ See comment letter from KPMG.
\260\ See id.
\261\ See comment letter from GT.
---------------------------------------------------------------------------
Two commenters requested changes to documentation retention
requirements, including limiting the retention requirement to evidence
generated through the firm's own monitoring activities and reducing the
volume of documentation required to be retained for five years.\262\
Another commenter stated that the proposed amendments to paragraph .84
do not clarify whether firms are required to retain evidence of every
instance of every response, or just those instances that were tested to
support the firm's QC system evaluation.\263\
---------------------------------------------------------------------------
\262\ See comment letters from EY and PICPA.
\263\ See comment letter from RSM.
---------------------------------------------------------------------------
After consideration of the comments received, the Board is adopting
the amendments to paragraph .84 as proposed.
[[Page 59377]]
The proposed amendments clarify that firms are afforded flexibility
in determining the manner(s) in which they retain documentation.
Specifically, the proposed amendment to this documentation requirement
clarifies that firms are permitted to maintain their QC documentation
in the original system(s) of record, or in any manner or combination of
manners they deem appropriate, and do not have to undergo the
potentially costly and time-consuming process of transferring and
assembling documentation from various source systems into a single
system for archiving and retention. In addition, the Board believes
that the proposed amendments clarify that it is not necessary for the
firm to implement new technology solutions for the purpose of meeting
QC 1000's documentation requirements because the amendment makes clear
that documentation can continue to exist within the systems in which it
originated or is used as long as it remains available for retrieval,
e.g., for purposes of subsequent monitoring or inspection.
The Board believes the proposed amendments should provide
operational relief for firms when maintaining documentation of their QC
systems. If circumstances arise, such as when a firm decides to replace
an existing system or determines that the decentralization of a firm's
QC documentation is too broad, then a firm can maintain the required
documentation of its QC system in the manner that is most appropriate
for the firm--provided that the documentation is retained in a manner
that permits timely retrieval. QC 1000 does not impose requirements on
firms with respect to the specific systems in which QC documentation
must be retained or the number of systems that retain a firm's QC
documentation.
The Board acknowledges that a firm's QC system is continuously
operating and the firm might not have the capability to take snapshots
of system-based evidence at a point in time or for the systems to be
locked down to allow for documentation to be archived. Therefore, the
proposed amendment requires that the documentation be retained in a
manner that permits timely retrieval, but does not specify a particular
approach. Firms are not expected to continuously or periodically take
snapshots of their system's data to meet this amended requirement.
However, given that QC documentation may reside within live systems,
the firm will need to be able to access and timely retrieve
documentation sufficient to demonstrate compliance with paragraphs
.81-.83 for the applicable evaluation as of the time the documentation
was considered complete. If certain information related to the
operation of the firm's QC systems is relevant or needed for the firm
to monitor and evaluate whether a quality response operated as
intended, then the firm would need to retain that information.
In determining the nature of the QC documentation to be retained, a
firm may identify aspects within the QC system for which the evidence
required to demonstrate that the QC system was designed, implemented,
or operating effectively may not entail retention of all information
that the system produces in its daily operation. For example, rather
than retaining printed copies or screenshots of the restricted entity
list after each change, the firm may produce the current listing along
with a system-generated report listing the changes after a specified
date.
As noted in the QC 1000 2024 adopting release, in light of the
scope of the Board's statutory mandate, the Board's inspection
procedures cannot be limited to quality responses (and, to the extent
applicable, samples of the operation of quality responses) that the
firm chose to monitor in the period.\264\ On the contrary, firms will
be expected to provide evidence of the operating effectiveness of any
quality responses selected for inspection.
---------------------------------------------------------------------------
\264\ See PCAOB Rel. No. 2024-005, at 283.
---------------------------------------------------------------------------
As originally adopted, QC 1000 includes a requirement that the firm
retain QC documentation for seven years from the QC documentation
completion date, unless a longer period is required by law.
The Board proposed to amend paragraph .86 to reduce the QC
documentation retention period to five years from the QC documentation
completion date.
Many commenters supported the proposed amendment to paragraph
.86,\265\ but some of these commenters encouraged the Board to consider
whether the retention period could be further reduced,\266\ with two of
them suggesting that a three-year retention period may be
sufficient.\267\ Another commenter stated that a single retention
period applied to all QC documentation may not be necessary and
encouraged consideration of an approach whereby documentation
supporting the firm's evaluation of its system of quality control be
retained for a period of five years, while broader system documentation
could be subject to a shorter retention period, such as three
years.\268\ Another commenter suggested that the Board should clarify
whether the same documentation expectations apply to both the firm's
overall evaluation and conclusion on its QC system and the day-to-day
execution of individual quality responses.\269\ The commenter added
that documentation supporting the firm's evaluation and conclusion is
generally more centralized and better suited to a five-year retention
period, whereas execution-level documentation is often more detailed
and may reside in several systems that change over time.\270\ One
commenter cited specific concerns relating to the need to update
systems and maintain system licenses for five years for the purpose of
retaining records,\271\ and another commenter stated that there are
still significant costs associated with retaining the required data for
five years.\272\
---------------------------------------------------------------------------
\265\ See comment letters from Baker Tilly, BDO, CAQ, Deloitte,
EY, Forvis, GT, KPMG, MIAG, PICPA, Plante & Moran, PwC, RSM, and
Spitters.
\266\ See comment letters from Baker Tilly, CAQ, Deloitte, GT,
and PICPA.
\267\ See comment letters from Baker Tilly and CAQ.
\268\ See comment letter from BDO.
\269\ See comment letter from Forvis.
\270\ See id.
\271\ See comment letter from CAQ.
\272\ See comment letter from RSM.
---------------------------------------------------------------------------
One commenter stated that an argument for requiring a seven-year
retention period is that the retention period for QC documentation
should be no shorter than that of the audit documentation requirements
included in AS 1215, Audit Documentation.\273\ However, the commenter
also stated that if that argument is not persuasive, then the minimum
retention period should be as low as possible based on users' needs,
including regulators', and in that context five years sounded
excessive.\274\ Another commenter stated that a consideration for
retaining the seven-year requirement could be that some U.S. Federal
and state tax retention periods are a minimum of seven years.\275\
Another commenter questioned whether it would be preferable to use the
term ``applicable professional and legal requirements'' instead of
``law'' in the phrase ``unless a longer period of time is required by
law.'' \276\
---------------------------------------------------------------------------
\273\ See comment letter from Grosvenor.
\274\ See id.
\275\ See comment letter from ICGN.
\276\ See comment letter from Grosvenor.
---------------------------------------------------------------------------
Another commenter asked the Board to reconsider the proposed
reduction from seven years to five years, stating that, under a five-
year QC documentation retention period, engagement workpapers would
remain available to inspection and enforcement for up to two years
after the QC records
[[Page 59378]]
that contextualize them--such as monitoring results, root cause
analyses, and remediation evidence--could have been lawfully
destroyed.\277\ The commenter said that, at a minimum, the retention
period must remain long enough for the PCAOB to identify deficiency
patterns that only become visible across more than one inspection
cycle.\278\ The commenter further stated that QC documentation relevant
to an identified deficiency, or to an open inspection or enforcement
matter, should be retained until the matter is resolved.\279\
---------------------------------------------------------------------------
\277\ See comment letter from CFA.
\278\ See id.
\279\ See id.
---------------------------------------------------------------------------
The Board has considered the costs and benefits of various
retention periods, including both retaining a seven-year retention
period to be consistent with audit documentation requirements under AS
1215 and adopting a retention period shorter than five years. The Board
believes that a five-year retention period appropriately balances the
objective of reducing unnecessary retention costs with the need to
preserve documentation relevant to the PCAOB's oversight activities. In
particular, the Board believes that a retention period shorter than
five years could adversely affect the PCAOB's ability to carry out its
oversight responsibilities and evaluate information relating to a
firm's QC system over time--and carrying out our responsibilities may
require access to information beyond that supporting the firm's
evaluation and conclusion.
The Board also does not believe that adopting multiple retention
periods for different categories of QC documentation would be
appropriate. QC 1000 contemplates an integrated and interrelated system
of quality control, and the documentation required by paragraphs
.81-.83 is intended to support an understanding of the design,
implementation, and operation of that system as a whole. Applying
different retention periods to different categories of QC documentation
could introduce unnecessary complexity and inconsistency and diminish
the usefulness of documentation in understanding the operation of the
firm's QC system over time.
Regarding commenter concerns relating to the need to update systems
or maintain system licenses over time, as discussed above in connection
with the proposed amendment to paragraph .84, QC 1000 does not
prescribe the systems in which QC documentation should be retained or
the number of systems that may be used to retain such documentation.
Firms may determine the most appropriate retention approaches based on
their own facts and circumstances, provided that the documentation of
the firm's QC system can be timely retrieved and is retained for five
years from the QC documentation completion date unless a longer period
of time is required by law.
QC 1000 acknowledges that firms may be subject to laws requiring
retention of QC documentation for a longer period than what the
standard requires. In such situations, firms would be required to
retain documentation for that longer period. This approach is
consistent with that used in AS 1215, which similarly recognizes that
longer retention periods required ``by law'' may override the period
specified in the standard. The Board acknowledges the comment
suggesting use of a longer period whenever required by applicable
professional and legal requirements, but the Board has determined to
follow the approach of AS 1215 for consistency.
After consideration of the comments received, the Board is adopting
this amendment as proposed.
Requests for Implementation Guidance and Additional Commenter Feedback
1. Requests for Implementation Guidance
Commenters requested additional guidance on QC 1000, including
specific examples and general guidance related to the proposed
amendments, noting that such guidance would help promote consistent and
effective implementation of the standard.\280\ While some of these
commenters acknowledged and appreciated the staff's ongoing engagement
with firms,\281\ a few commenters also requested that the Board
memorialize the substance of those discussions into interpretive
guidance available to all firms, suggesting that doing so would further
enhance consistency and effectiveness in implementing QC 1000.\282\
---------------------------------------------------------------------------
\280\ See comment letters from Baker Tilly, BDO, CAQ, CBIZ,
Crowe, Deloitte, EY, Forvis, GT, KPMG, Kramer, PICPA, Plante &
Moran, PwC, RSM, SCCG, and VSCPA.
\281\ See comment letters from CAQ, Crowe, Deloitte, and GT.
\282\ See comment letters from Baker Tilly, CAQ, and Deloitte.
---------------------------------------------------------------------------
Several commenters requested guidance on specific areas of QC 1000
and related changes to other PCAOB standards that are not subject to
this rulemaking, including:
a. The definition of quality response, suggesting that it is not
intended to require every quality response to consist of both a policy
and a procedure; \283\
---------------------------------------------------------------------------
\283\ See comment letter from EY.
---------------------------------------------------------------------------
b. The requirement in QC 1000.33e to monitor compliance by
affiliates of the firm with applicable professional and legal
requirements and related firm policies and procedures; \284\
---------------------------------------------------------------------------
\284\ See comment letter from Deloitte.
---------------------------------------------------------------------------
c. The requirement in QC 1000.34b to update and communicate at
least monthly additions to the restricted entities list; \285\
---------------------------------------------------------------------------
\285\ See comment letters from CAQ and EY.
---------------------------------------------------------------------------
d. The scope of the requirement in QC 1000.53d regarding
communications of information to external parties in accordance with
applicable professional and legal requirements; \286\
---------------------------------------------------------------------------
\286\ See id.
---------------------------------------------------------------------------
e. Evaluating and responding to information that becomes known
after the annual evaluation date but before the filing date on Form QC;
\287\
---------------------------------------------------------------------------
\287\ See comment letters from Baker Tilly, BDO, CAQ, CBIZ, GT,
Kramer, and Plante & Moran.
---------------------------------------------------------------------------
f. The nature and extent of documentation required to be retained,
including questions regarding reperformance and the level of
documentation necessary to support monitoring conclusions; \288\
---------------------------------------------------------------------------
\288\ See comment letters from Baker Tilly, BDO, CAQ, Deloitte,
EY, Forvis, GT, KPMG, Plante & Moran, PwC, and RSM.
---------------------------------------------------------------------------
g. QC considerations related to technological resources,
particularly due diligence on artificial intelligence tools, used on
engagements or in the firm's system of quality control; \289\
---------------------------------------------------------------------------
\289\ See comment letters on Request for Comment on PCAOB
Standard Setting, PCAOB Rel. No. 2026-005 (Jun. 23, 2026), from CBIZ
CPAs P.C. (Aug. 7, 2026), DNL Deep Neuron Lab GmbH (Aug. 7, 2026),
Pennsylvania Institute of Certified Public Accountants (Aug. 5,
2026), and PricewaterhouseCoopers LLP (Aug. 5, 2026), available
here: <a href="https://pcaobus.org//standards/standard-setting-research-projects/agenda-consultation--request-for-public-comment-on-pcaob-standard-setting">https://pcaobus.org//standards/standard-setting-research-projects/agenda-consultation--request-for-public-comment-on-pcaob-standard-setting</a>.
---------------------------------------------------------------------------
h. Clarification of the meaning of specified terms used in AS 1310,
Notification of Termination of the Auditor-Issuer Relationship; \290\
---------------------------------------------------------------------------
\290\ See comment letter from KPMG.
---------------------------------------------------------------------------
i. How to respond to engagement deficiencies on audits of internal
control over financial reporting under AS 2901, Responding to
Engagement Deficiencies After Issuance of the Auditor's Report; \291\
and
---------------------------------------------------------------------------
\291\ See id.
---------------------------------------------------------------------------
j. How to report on Form AP the use of other quality reviewers
given the rescission of SECPS section 1000.45, Appendix K--SECPS Member
Firms With Foreign Associated Firms That Audit SEC Registrants.\292\
---------------------------------------------------------------------------
\292\ See id.
---------------------------------------------------------------------------
[[Page 59379]]
As discussed, in the Background section above, the staff recently
issued QC 1000 Q&As.\293\ Those Q&As address the guidance requests
discussed in bullets a.-f. above. The staff will continue to evaluate
implementation questions and requests for clarification, including
those received through the Firm Consultation Process,\294\ and may
address additional matters through future updates to the QC 1000 Q&As
or other implementation guidance.
---------------------------------------------------------------------------
\293\ See QC 1000 Questions and Answers, available at <a href="https://pcaobus.org/oversight/standards/standard-setting-research-projects/quality-control/qc-1000-questions-and-answers">https://pcaobus.org/oversight/standards/standard-setting-research-projects/quality-control/qc-1000-questions-and-answers</a>.
\294\ See the Firm Consultation Process available on the PCAOB
website.
---------------------------------------------------------------------------
2. Additional Commenter Feedback
Some commenters also provided feedback on aspects of QC 1000 that
were outside the scope of the proposed amendments in the supplemental
request for comment and that were not requests for additional
implementation guidance.\295\ These comments recommended changes to
various other provisions of the standard and expressed concerns
regarding scalability and cost:
---------------------------------------------------------------------------
\295\ See comment letters from Baker Tilly, CBIZ, Grosvenor,
KPMG, Malone Bailey, PICPA, and SCCG.
---------------------------------------------------------------------------
<bullet> Two commenters requested the Board revisit the 100-issuer
threshold.\296\ One of these commenters expressed concern that the
requirement for firms auditing more than 100 issuers to maintain an
automated independence-monitoring process could impose significant
implementation costs on firms that currently use spreadsheet-based
processes.\297\
---------------------------------------------------------------------------
\296\ See comment letters from Malone Bailey and PICPA.
\297\ See comment letter from Malone Bailey.
---------------------------------------------------------------------------
<bullet> One commenter requested clarification or modification of
various provisions of QC 1000, including defined terms, risk
assessment, governance and leadership, communication, monitoring and
remediation, and documentation requirements.\298\
---------------------------------------------------------------------------
\298\ See comment letter from Grosvenor.
---------------------------------------------------------------------------
<bullet> Another commenter stated that they continued to have
concerns regarding the confidentiality of information submitted through
Form QC, particularly information relating to identified deficiencies,
root causes, remediation strategies, governance matters, and other
aspects of a firm's system of quality control, and suggested that
additional clarity on certain matters would provide firms with greater
certainty regarding the treatment of highly sensitive quality
management information.\299\
---------------------------------------------------------------------------
\299\ See comment letter from BDO.
---------------------------------------------------------------------------
<bullet> One commenter recommended that Form QC should, at a
minimum, be made public with the PCAOB-identified deficiencies
redacted, because the information included in it would be beneficial to
investors for investment or proxy voting decisions.\300\
---------------------------------------------------------------------------
\300\ See comment letter on Request for Public Comment on Draft
2026-2030 Strategic Plan Goals and Objectives, PCAOB Rel. No. 2026-
006 (July 20, 2026), from the Council of Institutional Investors
(Aug. 26, 2026), available here: <a href="https://assets.pcaobus.org/pcaob-dev/docs/default-source/about/administration/strategic-plan-goals-and-objectives-comments-2026-2030/5_cii.pdf?sfvrsn=aba1e9e7_2">https://assets.pcaobus.org/pcaob-dev/docs/default-source/about/administration/strategic-plan-goals-and-objectives-comments-2026-2030/5_cii.pdf?sfvrsn=aba1e9e7_2</a>.
---------------------------------------------------------------------------
<bullet> Another commenter recommended that the Board clarify that
quality responses addressing personnel competence and capability--
including structured programs to develop and assess professional
judgment--are valid quality responses within this framework.\301\
---------------------------------------------------------------------------
\301\ See comment letter from SCCG.
---------------------------------------------------------------------------
<bullet> Three commenters requested the PCAOB publish a
consolidated adopting release that provides the entirety of the revised
standard and relevant content from the original adopting release, and
updated interpretive guidance.\302\
---------------------------------------------------------------------------
\302\ See comment lett
[…truncated; see source link]Indexed from Federal Register on September 18, 2026.
This is legal information, not legal advice. Laws vary by jurisdiction and change frequently. Always verify current law with official sources and consult a licensed attorney in your jurisdiction for advice on your specific situation.