Conformed to Federal Register version

Agency decision

Ask Donna

What actually matters in this document.

Text

SECURITIES AND EXCHANGE COMMISSION

[Release No. 34-106372; File No. PCAOB-2026-01]

September 15, 2026.

Public Company Accounting Oversight Board; Notice of Filing of Proposed Rules

on Amendments to QC 1000, A Firm’s System of Quality Control, and Related Rule

and Forms

Pursuant to section 107(b) of the Sarbanes-Oxley Act of 2002 (the “Act”), notice

is hereby given that on September 10, 2026, the Public Company Accounting Oversight

Board (the “Board” or the “PCAOB”) filed with the Securities and Exchange

Commission (the “Commission” or the “SEC”) the proposed rules described in items I

and II below, which items have been prepared by the Board. On September 14, 2026, the

Board filed with the Commission a technical correction to one of the proposed rules. The

Commission is publishing this notice to solicit comments on the proposed rules from

interested persons.

Board’s Statement of the Terms of Substance of the Proposed Rules

On September 9, 2026, the Board adopted proposed rule amendments to

QC 1000, A Firm’s System of Quality Control, related amendments to PCAOB

Rule 2203A, PCAOB forms, and technical amendments to AS 2101, Audit Planning.

(collectively, the “proposed rules”). On September 11, 2026, the Board adopted a

technical correction to the proposed rule amendments to QC 1000. The text of the

proposed rules appears in Exhibit A to the SEC Filing Form 19b-4 and is available on the

Board’s website at https://pcaobus.org/about/rules-rulemaking/rulemakingdockets/docket-057.

II.

Board’s Statement of the Purpose of, and Statutory Basis for, the Proposed

Rules

In its filing with the Commission, the Board included statements concerning the

purpose of and basis for the proposed rules and discussed any comments it received on

the proposed rules. The text of these statements may be examined at the places specified

in Item IV below. The Board has prepared summaries, set forth in sections A, B, and C

below, of the most significant aspects of such statements. In addition, to the extent

necessary, the Board is requesting that the Commission approve the proposed rules

pursuant to section 103(a)(3)(C) of the Act for application to audits of emerging growth

companies (“EGCs”), as that term is defined in section 3(a)(80) of the Securities

Exchange Act of 1934 (“Exchange Act”). The Board’s request is set forth in section D.

Board’s Statement of the Purpose of, and Statutory Basis for, the Proposed Rules

(a)

Purpose

The Board adopted QC 1000, A Firm’s System of Quality Control (“QC 1000”),

on May 13, 2024, 1 to lead registered public accounting firms (“firms”) to significantly

improve their quality control (“QC”) systems. The Board believes that, as firms prepare

for the effective date of QC 1000, many such improvements have been and will continue

to be implemented as firms develop more rigorous QC systems. The Board’s experience

during the implementation period led us, however, to consider whether the new standard

imposes costs that may not be necessary for us to achieve the Board’s regulatory goals

A Firm’s System of Quality Control and Other Amendments to PCAOB Standards, Rules, and

Forms, PCAOB Rel. No. 2024-005 (May 13, 2024) (“QC 1000 2024 adopting release”).

and, relatedly, whether there were certain aspects of QC 1000 that could be brought into

closer alignment with other audit firm quality management standards. 2

The Board adopted amendments to QC 1000 that it believes address concerns

regarding the implementation challenges identified by firms and better align certain

provisions with other quality management standards. These amendments are designed to

reduce compliance costs while maintaining the investor protection benefits of QC 1000.

The principal amendments the Board adopted:

•

Rescind the “design-only” requirement so that QC 1000 imposes requirements

only on firms that are required to comply with applicable professional and

legal requirements with respect to any “engagement” as defined in QC 1000

(QC 1000.06 and .07d);

•

Provide increased flexibility in filling certain specified roles in the QC system

by permitting roles to be assigned to non-firm personnel and divided among

multiple individuals (QC 1000.12);

•

Rescind the requirement to have an External QC Function (“EQCF”)

(QC 1000.28);

•

Narrow and simplify communication requirements relating to metrics that the

firm communicates to external parties about its audit practice, firm personnel,

or engagements (QC 1000.53e);

See International Standard on Quality Management (“ISQM”) 1, Quality Management for Firms

that Perform Audits or Reviews of Financial Statements, or Other Assurance or Related Services

Engagements (“ISQM 1”), issued by the International Auditing and Assurance Standards Board;

Statement on Quality Management Standards (“SQMS”) No. 1, A Firm’s System of Quality

Management (“SQMS 1”), issued by the Auditing Standards Board of the American Institute of

CPAs.

•

With respect to identified engagement deficiencies, require evaluation of

whether similar engagement deficiencies exist on other engagements only if

the identified deficiency resulted or could result in (i) a failure to obtain

sufficient appropriate evidence to support the conclusion reached on an

engagement or (ii) an inappropriate overall conclusion on the subject matter of

an engagement (QC 1000.68d);

•

Revise the definition of QC deficiency to make clear that, when firms have

implemented more than one quality response to address the same quality risk,

they can take those other quality responses (e.g., compensating responses) into

account when determining whether a QC deficiency exists (QC 1000.A8);

•

Allow firms to select the date as of which they annually evaluate the

effectiveness of their QC system, rather than requiring firms to evaluate as of

September 30 (QC 1000.77);

•

Revise the QC system evaluation conclusions to align more closely with the

conclusions in other quality management standards, while retaining a

structured process, including specified factors for consideration, to guide the

evaluation (QC 1000.77 and .78); and

•

Simplify the requirements for retention of QC system documentation and

abbreviate the retention period from seven to five years (QC 1000.84 and .86).

Additional amendments the Board adopted, including conforming amendments,

are discussed below.

Several of the amendments the Board adopted bring QC 1000 into closer

alignment with other quality management standards, both internationally and in the

United States. However, differences remain in areas where the Board continues to believe

that alternative or incremental provisions of QC 1000 better address its legal and

regulatory environment, the needs and priorities of the Board’s stakeholders, and the

Board’s statutory mandate of protecting investors and the public interest.

QC 1000 and the related amendments to PCAOB standards, rules, and forms

adopted in 2024 will take effect on December 15, 2026. If approved by the SEC, the

amendments to QC 1000 that the Board adopted and the related amendments to a

PCAOB rule and PCAOB forms will also take effect on December 15, 2026.

The proposed rules also include technical amendments to AS 2101, Audit

Planning, to remove references to an auditing standard that was rescinded by another

rulemaking. 3 The Board adopted these amendments as final due to their technical nature,

and the Board did not seek public comment on these amendments. These amendments

will be effective upon SEC approval.

(b)

Statutory Basis

The statutory basis for the proposed rules is Title I of the Act.

Board’s Statement on Burden on Competition

Not applicable. The Board’s consideration of the economic impacts of the

proposed rules is discussed in section D below.

Board’s Statement on Comments on the Proposed Rule Change Received from

Members, Participants, or Others

See General Responsibilities of the Auditor in Conducting an Audit and Amendments to PCAOB

Standards, PCAOB Rel. No. 2024-004 (May 13, 2024) (rescinding AS 1015, Due Professional

Care in the Performance of Work).

The Board released proposed rule amendments for public comment on June 9,

2026, in its release titled Supplemental Request for Comment: Proposed Amendments to

QC 1000, A Firm’s System of Quality Control, and Related Rule and Forms, PCAOB

Release No. 2026-002. The Board received 25 comment letters in response to that

supplemental request for comment. See Comment Letters for Docket 057,

https://pcaobus.org/about/rules-rulemaking/rulemaking-dockets/docket-057/commentletters. The Board also received 26 comment letters in response to a request for public

comment on the PCAOB strategic priorities, identified at footnote 12 below, and 4

comment letters in response to a request for public comment on PCAOB standard setting,

identified at footnote 289 below, and 1 comment letter in response to a request for public

comment on the Draft 2026-2030 Strategic Plan Goals and Objective, identified at

footnote 300 below, which all raised comments specifically to QC 1000, among other

things. See Comment Letters on the PCAOB website available at

https://pcaobus.org/about/strategic-plan-budget/public-comments-on-pcaob-strategicpriorities, https://pcaobus.org/oversight/standards/standard-setting-researchprojects/agenda-consultation--request-for-public-comment-on-pcaob-standard-setting,

and https://pcaobus.org/about/strategic-plan-budget/public-comments-on-goals-andobjectives-for-pcaob-strategic-plan-2026-2030, respectively. The Board has carefully

considered all comments received. The Board’s responses to the comments received,

including revisions to the proposed rule amendments, are discussed below.

BACKGROUND

This section presents background information on this rulemaking, including

recent rulemaking history and staff implementation support efforts since SEC approval of

QC 1000 in September 2024.

RECENT RULEMAKING HISTORY

On May 13, 2024, the Board adopted QC 1000 and related amendments. They

were approved by the SEC on September 9, 2024, with an effective date of December 15,

2025. 4

On August 28, 2025, to provide firms with additional time for implementation,

the Board proposed to delay the effective date of QC 1000 and the related amendments to

December 15, 2026, and that postponement became immediately effective. 5 The SEC

received 15 comment letters in response to its notice regarding the postponement. 6

Commenters generally supported providing additional implementation time but raised

concerns regarding certain provisions of QC 1000 that they viewed as more prescriptive

than other quality management standards and as creating unnecessary operational

complexity and cost.

For more details regarding the rulemaking history of QC 1000, see Rulemaking Docket No. 046

on the Board’s website, available at https://pcaobus.org/about/rules-rulemaking/rulemakingdockets/docket-046-quality-control; see also Public Company Accounting Oversight Board; Order

Granting Approval of QC 1000, A Firm’s System of Quality Control and Related Amendments to

PCAOB Standards, Rules, and Forms, SEC Rel. No. 34-100968 (Sept. 9, 2024).

See Public Company Accounting Oversight Board; Notice of Filing and Immediate Effectiveness

of Proposed Rule Change Postponing the Effective Date of Amendments to Board Standards,

Rules, and Forms Adopted on May 13, 2024, SEC Rel. No. 34-103803 (Aug. 28, 2025).

The comment letters received are available on the SEC’s webpage, available at

https://www.sec.gov/comments/pcaob-2025-01/pcaob202501.htm.

On July 23, 2025, and March 20, 2026, the PCAOB received letters from a firmrelated group regarding implementation of QC 1000 and related implementation

challenges. 7

On March 31, 2026, the Board issued a request for public comment on the

PCAOB’s strategic priorities, including future standard-setting activity. 8 Several

commenters provided observations regarding QC 1000. 9 The comments relating to QC

1000 were generally consistent with themes raised in comment letters submitted to the

PCAOB and SEC in connection with the extension of the effective date of QC 1000.

Most commenters urged the Board to adopt or align more closely with ISQM 1,

suggesting it may better support global implementation, while emphasizing that

differences in structure, terminology, and prescriptive requirements in QC 1000 create

operational challenges, limit firm judgment, and increase complexity for global firms.

After considering feedback and information obtained through implementation

support efforts, 10 on June 9, 2026, the Board issued a supplemental request for comment

on potential targeted amendments to certain provisions of QC 1000 and related

See letter from the Center for Audit Quality dated July 23, 2025, available at

https://www.thecaq.org/comment-letter-pcaob-requesting-deferral-qc-1000; and letter from the

Center for Audit Quality dated March 20, 2026, available at https://www.thecaq.org/letter-to-thepcaob-on-qc1000-implementation-experience-and-costs.

See Request for Public Comment, PCAOB Strategic Priorities, PCAOB Rel. No. 2026-001 (Mar.

31, 2026).

The comment letters received are on the Board’s website, available at

https://pcaobus.org/about/strategic-plan-budget/public-comments-on-pcaob-strategic-priorities.

See discussion below regarding PCAOB staff’s implementation support efforts, including

implementation guidance, workshops, stakeholder outreach, and feedback received from firms and

other stakeholders regarding QC 1000 implementation.

amendments to the QC reporting rule and PCAOB forms. 11 The Board received

26 comment letters. 12 Commenters included firms and firm-related groups, investorrelated groups, and others. Firms, firm-related groups, and most other commenters

generally supported the Board’s objective of making targeted amendments to QC 1000

and most of the proposed amendments, particularly those intended to increase flexibility,

improve operability, reduce unnecessary compliance burdens, and better align QC 1000

with other quality management standards. 13 One investor-related group did not support

the proposed amendments overall because of the proposed rescission of the EQCF

requirement. 14 Other investor-related groups generally supported the proposed

amendments that reduce compliance costs without reducing audit quality, but opposed the

removal of the EQCF requirement, emphasizing the importance of independent oversight

See Supplemental Request for Comment: Proposed Amendments to QC 1000, A Firm’s System of

Quality Control, and Related Rule and Forms, PCAOB Rel. No. 2026-002 (June 9, 2026)

(proposing amendments to QC 1000, PCAOB Rule 2203A, and PCAOB Forms 1, 2, and QC).

See comment letters on the Supplemental Request for Comment from the Auditing Standards

Committee, Auditing Section - American Accounting Association (July 3, 2026) (“AAA”); Baker

Tilly US, LLP (July 9, 2026) (“Baker Tilly”); BDO USA, P.C. (July 9, 2026) (“BDO”); CBIZ

CPAs P.C. (July 9, 2026) (“CBIZ”); Center for Audit Quality (July 9, 2026) (“CAQ”); CFA

Institute (Aug. 31, 2026) (“CFA”); Council of Institutional Investors (July 9, 2026) (“CII”);

Crowe LLP (July 9, 2026) (“Crowe”); Deloitte & Touche LLP (July 9, 2026) (“Deloitte”); Ernst &

Young LLP (July 9, 2026) (“EY”); Forvis Mazars, LLP (July 9, 2026) (“Forvis”); George R.

Kramer (July 6, 2026) (“Kramer”); Grant Thornton LLP (July 9, 2026) (“GT”); International

Corporate Governance Network (July 9, 2026) (“ICGN”); James Grosvenor (July 9, 2026)

(“Grosvenor”); KPMG LLP (July 9, 2026) (“KPMG”); MaloneBailey, LLP (June 26, 2026)

(“Malone Bailey”); Members of the Investor Advisory Group (July 9, 2026) (“MIAG”);

Pennsylvania Institute of CPAs (July 9, 2026) (“PICPA”); Plante & Moran, PLLC (July 10, 2026)

(“Plante & Moran”); PricewaterhouseCoopers LLP (July 9, 2026) (“PwC”); RSM US LLP (July 9,

2026) (“RSM”); St. Charles Consulting Group (June 12, 2026) (“SCCG”); Thomas H. Spitters

(July 6, 2026) (“Spitters”); and Virginia Society of CPAs (July 9, 2026) (“VSCPA”). One

additional comment letter was withdrawn.

See, e.g., comment letters from AAA, Baker Tilly, BDO, CAQ, CBIZ, Crowe, Deloitte, EY,

Forvis, Grosvenor, GT, KPMG, Kramer, Malone Bailey, PICPA, Plante & Moran, PwC, RSM,

SCCG, Spitters, and VSCPA.

See comment letter from CII.

and investor protection, and other amendments they viewed as weakening investorprotection-focused provisions of QC 1000. 15 Many commenters, particularly firms and

firm-related groups, also requested implementation guidance and clarification in certain

areas discussed below. 16

The Board considered all comments received on the supplemental request for

comment. As discussed below, the Board is adopting the proposed amendments to QC

1000, with certain modifications.

IMPLEMENTATION SUPPORT EFFORTS

Since SEC approval of QC 1000, PCAOB staff have supported implementation

through guidance, workshops, outreach activities, and engagement with stakeholders,

which provided insight into implementation progress, challenges, and questions and

informed the Board’s consideration of the proposed amendments. 17 Additionally, as part

of inspection outreach activities, the Board obtained feedback on the progress made by

firms in implementing QC 1000 in their QC systems. 18

See comment letters from CFA, ICGN, and MIAG.

See, e.g., comment letters from Baker Tilly, BDO, CAQ, CBIZ, Crowe, Deloitte, EY, Forvis, GT,

KPMG, Kramer, Plante & Moran, RSM, SCCG, and VSCPA.

See PCAOB, Quality Control—Implementation Resources, available at

https://pcaobus.org/oversight/standards/implementation-resources-PCAOB-standardsrules/quality-control, which includes staff guidance and other materials issued to support

implementation of QC 1000 and the related amendments.

See section titled “Need” under “Economic Considerations” below for additional information on

data received through these inspection outreach activities.

As part of staff implementation support efforts, the PCAOB staff released QC

1000 Questions and Answers (“QC 1000 Q&As”) in August 2026. 19 The QC 1000 Q&As

provide technical guidance on various aspects of QC 1000, including roles and

responsibilities, evaluation and reporting, documentation, and other areas of designing,

implementing, operating, and evaluating a firm’s QC system. The QC 1000 Q&As were

developed in response to questions and requests for clarification received from firms

through staff implementation support efforts and are intended to reduce uncertainty and

support firms’ implementation of the standard.

The QC 1000 Q&As do not address the specific topics that are the subject of the

amendments to QC 1000 that the Board adopted, but they do address some questions and

clarification requests on other topics that were included in comment letters submitted in

response to the supplemental request for comment. As implementation continues,

additional guidance, including updates to the QC 1000 Q&As, may be issued to help

address other areas identified by commenters or through staff implementation support

efforts.

AMENDMENTS TO QC 1000, PCAOB RULE 2203A, AND PCAOB FORM QC

This section describes the requirements of QC 1000, Rule 2203A, and Form QC

that the Board amended.

REQUIREMENT TO DESIGN, IMPLEMENT, AND OPERATE A QC

SYSTEM

See QC 1000 Questions and Answers, available at

https://pcaobus.org/oversight/standards/standard-setting-research-projects/quality-control/qc1000-questions-and-answers.

As originally adopted, QC 1000.06 requires all firms to design a QC system that

complies with the standard, regardless of whether the firm is subject to applicable

professional and legal requirements with respect to an engagement as defined in QC

1000. As explained in the supplemental request for comment, the Board understands that

this “design-only” requirement would impose costs on firms that do not perform

engagements requiring registration under the Sarbanes-Oxley Act of 2002 (“SarbanesOxley”) 20 or PCAOB rules 21 without commensurate benefits for investors and the public.

Therefore, the Board proposed to eliminate the requirement and sought comment on

potential alternatives, as well as any circumstances that potentially could trigger a design

requirement. As proposed in the supplemental request for comment, paragraphs .05

through .07 of QC 1000 would be revised to eliminate the separate obligation to design a

QC system and would maintain unchanged the obligation to design, implement, and

operate a QC system in compliance with QC 1000 when a firm is subject to applicable

professional and legal requirements with respect to any of the firm’s engagements.

Many commenters supported the proposal to rescind the design-only

requirement. 22 One commenter stated that they did not object to rescinding the designonly requirement when a firm neither performs nor intends to perform PCAOB

See section 102(a) of Sarbanes-Oxley, 15 U.S.C. 7212(a).

See PCAOB Rule 2100, Registration Requirements for Public Accounting Firms.

See comment letters from AAA, Baker Tilly, BDO, CAQ, Crowe, Deloitte, GT, KPMG, Kramer,

MIAG, PICPA, PwC, and RSM. But see comment letters from ICGN and Spitters. One

commenter expressed support for eliminating the “design-only reporting requirement,” described

as the “requirement for firms to report once a quality control system has merely been designed.”

See comment letter from VSCPA.

engagements. 23 One of the commenters supporting rescission stated that it did not believe

registered firms should be required to comply with PCAOB standards until the firm

undertakes an engagement requiring compliance with those standards and that the designonly requirement was inconsistent with the text of Sarbanes-Oxley. 24 Commenters that

addressed the question of whether the Board should adopt an alternative design-only

requirement generally did not support such a requirement. 25

However, one commenter stated support for a QC design requirement that

included effective operation of a system of quality management under relevant standards

for the jurisdiction in which the firm operates, such as ISQM 1 or SQMS 1. 26 This

commenter noted that, in practice, registered firms would already maintain some form of

a system of quality management to support their PCAOB registration. 27 The Board does

not believe QC 1000 should explicitly require compliance with rules of local

jurisdictions, as PCAOB standards generally do not impose such requirements. Another

commenter noted that, although some registered firms do not conduct audits, that fact

does not necessarily signify the need for an exemption from standard best practices or

audit quality requirements; such firms should be subject to QC 1000 on the level of

preparedness or some QC regime that parallels QC 1000 in its design, implementation,

See comment letter from CFA.

See comment letter from RSM.

See comment letters from AAA, BDO, GT, KPMG, Kramer, and PICPA.

See comment letter from RSM.

See id.

and operation. 28 The Board does not believe that the suggestion to base a design-only

requirement on a level of preparedness or a system paralleling QC 1000 is workable

because it is too vague as to the requirements that would apply to firms not performing

PCAOB engagements.

Commenters raised concerns over the costs of the design-only requirement in

relation to the benefits. 29 One commenter stated that the requirement would have resulted

in unnecessary costs of compliance without commensurate benefits. 30 Another

commenter similarly stated that requiring firms not performing PCAOB engagements to

comply with the design-only requirement did not provide a commensurate benefit to

investor protection, as such firms do not present risk to U.S. capital markets. 31 Another

commenter stated that requiring firms to build compliance infrastructure for work they

may never undertake imposes cost without a corresponding investor benefit. 32 Another

commenter observed that, because firms performing engagements would be fully subject

to the requirement to design, implement, and operate a QC 1000-compliant system,

rescinding the requirement for firms not performing such work would preserve the

Board’s objective of promoting high-quality audits, while reducing unnecessary burdens

for those firms. 33 Another commenter stated that, while the value to the public of the

See comment letter from Spitters.

See, e.g., comment letters from KPMG, PICPA, and PwC.

See comment letter from PwC.

See comment letter from KPMG.

See comment letter from CFA.

See comment letter from GT.

design-only requirement was unclear, the costs would be real in the form of training

costs, consulting costs, and professional time. 34 Other commenters noted the limited

benefits of the requirement for investors, stating that rescission would not diminish

investor protection 35 or introduce any risk to investors, 36 or that retaining the requirement

would not help ensure improved audit quality. 37

Two commenters also raised concerns about requiring firms to address

hypothetical situations. One of these commenters stated that it would be difficult for a

firm not subject to applicable professional and legal requirements with respect to any

engagement to design a QC system based on hypothetical circumstances. 38 The second

commenter stated that such a firm’s QC system “would be hypothetical at best and would

likely become obsolete over time as practice conditions change, leading to the false

pretense that [the firm is] in a position to immediately implement these standards.” 39

The Board is rescinding the design-only requirement and adopting paragraphs .05

through .07 as proposed. 40 The Board believes rescinding the design-only requirement

will reduce costs for firms without any significant detriment to audit quality.

See comment letter from PICPA.

See comment letter from GT.

See comment letter from Baker Tilly.

See comment letter from PICPA.

See comment letter from AAA.

See comment letter from PICPA.

As noted in the supplemental request for comment, the Board does not believe that this action

would violate the mandate in section 103(a)(2)(B) of Sarbanes-Oxley, 15 U.S.C. 7213(a)(2)(B), to

adopt requirements “for every registered public accounting firm” that address certain enumerated

areas in “the quality control standards that [the PCAOB] adopts with respect to the issuance of

audit reports.” Under the Board’s approach, QC 1000 will apply to every firm with respect to the

As confirmed by commenter feedback, implementing the design-only requirement

has proven more difficult and costly than originally anticipated. The requirement may

compel some firms that have no intention of performing PCAOB engagements in the

foreseeable future to design a QC 1000-compliant system, perhaps based on hypothetical

circumstances. As described in the supplemental request for comment, the Board believes

that the design-only requirement may have contributed to an increase in withdrawals

from registration by firms that are not performing engagements. Although the impact of

such activity on the marketplace (discussed below in the economic analysis) may be

limited, the Board believes investors and the public interest are better served by

incentivizing firms to register and consider seeking PCAOB engagements, thereby

promoting competition. 41

In the Board’s view, rescission of the design-only requirement would entail

foregoing the benefits associated with greater preparedness of firms to take on a PCAOB

engagement for the first time. The Board believes this benefit to be modest, as any firm

that actually takes on such an engagement will have become subject to the requirement to

design, implement, and operate a QC 1000 system. 42 In any event, and as noted by one

issuance of “audit reports” (which are limited under Sarbanes-Oxley to those relating to audits of

issuers and broker-dealers).

As noted in the supplemental request for comment, some firms may register with the Board to

perform activities not subject to the PCAOB’s jurisdiction. See, e.g., Guiding and Establishing

National Innovation for U.S. Stablecoins Act, Pub. L. No. 119-27 (July 18, 2025), section

4(a)(3)(A), 12 U.S.C. 5903(a)(3)(A) (requiring month-end reports of permitted payment stablecoin

issuers to be examined by a PCAOB-registered firm).

Firms could still choose to design (and for that matter, implement and operate) a QC system that

complies with QC 1000. Firms may choose to do so if, for example, they are planning to bid for a

PCAOB engagement, are taking on work on other firms’ engagements that could potentially

constitute a substantial role, or otherwise want to put themselves in a position to implement and

operate a QC 1000-compliant system on short notice.

commenter, registered firms that do not perform PCAOB engagements are generally

well-positioned to implement QC 1000 if or when required to do so. 43 This is so because

most such firms, as some commenters observed, are generally either non-U.S. firms

subject to international auditing standards or U.S.-based firms that conduct private

company audits under the standards of the Auditing Standards Board of the American

Institute of CPAs (“AICPA”); as such, those firms would be subject to ISQM 1 or

SQMS 1, which both share a common basic structure with QC 1000. 44 Finally, as stated

in the supplemental request for comment, the investor protection concerns encompassed

by the Board’s statutory mandate are reduced where a firm is not performing PCAOB

engagements.

Based on the above considerations, the Board decided not to adopt any of the

design-only alternatives discussed in the supplemental request for comment.

The Board also considered whether to include provisions in QC 1000 specifying

an earlier trigger for the requirement to design, implement, and operate a QC 1000compliant system under QC 1000.06-.07. In this regard, one commenter encouraged the

Board to consider whether compliance with QC 1000 after its December 15, 2026

effective date could be tied to an established evaluation period and measurement date

rather than a specific triggering event. 45 The same commenter suggested that under such

an approach, a firm would determine at the beginning of its selected evaluation cycle

See comment letter from KPMG.

See comment letters from AAA, CAQ, KPMG, and PwC.

See comment letter from BDO.

whether it is required to comply with QC 1000 during that period. 46 Another commenter

stated that a firm must have “an appropriately designed and operational QC system

before accepting or commencing PCAOB audit work.” 47 Another commenter suggested

that “a QC system must be in place prior to a firm tendering an offer for a public

company audit and/or getting registered.” 48 Another commenter requested that the Board

specify an earlier trigger—for example, when a firm bids for or is appointed to issuer or

broker-dealer work—by which time a compliant QC system must be designed and

operating, well in advance of the firm commencing that work. 49

While an earlier trigger may promote readiness by firms to commence PCAOB

engagements, the Board expects that the effort required to design, implement, and operate

a QC 1000-compliant system may vary significantly across firms. That variation could

arise from several different factors, including the status of their existing QC systems, the

nature of their assurance practice (if any), the experience of their personnel, and the

nature of their governance systems, operating processes, and technology, among other

things. The Board also understands that some firms may pursue engagements for issuers

and broker-dealers months, or even years, before these firms are awarded and commence

such work. In light of these considerations, it may not be necessary in all circumstances

for a firm to have a QC system that fully complies with QC 1000 before it pursues an

issuer or broker-dealer engagement that might not be awarded to it or that might not

See id.

See comment letter from MIAG.

See comment letter from ICGN.

See comment letter from CFA.

commence for a significant period of time. Therefore, the Board believes that requiring

firms to design, implement, and operate a QC 1000-compliant system when a firm

becomes subject to applicable professional and legal requirements with respect to any

engagement is appropriate, and an earlier trigger is not warranted.

ROLES AND RESPONSIBILITIES

1. ASSIGNMENT OF ROLES AND RESPONSIBILITIES

As originally adopted, QC 1000 requires that the operational roles and

responsibilities specified in paragraph .12 be assigned only to “firm personnel.” 50 The

note to paragraph .12 provides that responsibility for the roles in subparagraphs a-c

cannot be shared and is required to be assigned to only one individual, to reinforce that

the individual assigned to a specified role would be responsible and accountable for the

role.

The Board proposed amendments to paragraph .12 to allow flexibility in assigning

the specified roles and responsibilities to any individual (whether firm personnel or an

“other participant” 51), rather than limiting those roles and responsibilities to firm

personnel. In connection with that change, the Board proposed a new footnote 5A to

paragraph .12 to clarify that such individuals would be “associated persons” of the firm.

As the Board explained in the supplemental request for comment, any individual who

was not already an associated person would become an associated person by virtue of that

See QC 1000.A5.

See QC 1000.A7.

assignment. 52 The proposed amendments would align with ISQM 1 and SQMS 1 by

permitting any qualified individual to fill the specified QC system roles.

To preserve the accountability and responsibility objectives of paragraph .12, the

Board also proposed an amendment to emphasize that the individuals assigned specific

roles understand and be accountable for their roles and responsibilities. The Board also

proposed an amendment to the note to paragraph .12 to allow firms to divide the

responsibilities of a role specified in paragraph .12 among multiple individuals. The

proposed amendments align with ISQM 1 and SQMS 1.

Commenters generally supported allowing the specified roles to be assigned to

other participants and divided among multiple individuals. 53 Many commenters indicated

the amendments would promote audit quality, for example, by enabling the firm to place

the most experienced and qualified individuals in those roles. 54 Several commenters also

supported allowing firms the flexibility to assign roles and responsibilities to multiple

individuals based on their specialized expertise and capacity, including within their

existing structures, while maintaining accountability. 55 Several commenters stated that

the proposed amendments to paragraph .12 were sufficiently clear and appropriate. 56

See PCAOB Rule 1001(p)(i).

See comment letters from AAA, Baker Tilly, BDO, CAQ, CBIZ, Crowe, Deloitte, EY, Forvis,

GT, ICGN, KPMG, Kramer, MIAG, PICPA, PwC, RSM, SCCG, and Spitters.

See comment letters from CAQ, Deloitte, GT, KPMG, MIAG, PICPA, RSM, SCCG, and Spitters.

See comment letters from AAA, Baker Tilly, CAQ, CFA, EY, GT, KPMG, and SCCG.

See comment letters from GT, KPMG, MIAG, RSM, and Spitters.

A commenter stated that the proposed amendments would be especially helpful to

firms that issued audit reports with respect to less than 100 issuers. 57 Another commenter

supported the addition of footnote 5A, which clarifies that an individual assigned

operational responsibility for any of the roles in paragraph .12 would become an

associated person of the firm by virtue of that assignment. 58 One commenter

recommended retaining clear firm-level accountability and documentation requirements

to avoid diffusion of responsibility. 59 Another commenter recommended the final

standard require clear identification of those ultimately responsible for the QC system

and key QC areas; this commenter further suggested that the PCAOB encourage firms to

consider the firms’ retirees for QC system roles, as such individuals would provide

valuable experience. 60

One commenter did not support assigning roles to individuals outside the firm

because individuals outside the firm may have conflicting interests, and they cannot

provide the day-to-day ownership the roles require. 61 The same commenter stated that

there remains a need for an ultimate point of accountability and there needs to be

assurance that accountability is not diffused when responsibilities are divided. 62 Further,

the commenter requested that whenever a QC role is divided among multiple individuals,

See comment letter from Kramer.

See comment letter from PICPA.

See comment letter from SCCG.

See comment letter from MIAG.

See comment letter from CFA.

See id.

the firm’s reporting to the PCAOB identify (1) who holds ultimate responsibility and

accountability for the QC system as a whole; (2) who is accountable for each function,

such as ethics, independence, monitoring, and remediation; and (3) the scope of each

individual’s assigned responsibilities, so that no part of any role is left unassigned. 63

As to the question of whether the flexibility afforded by the proposed

amendments should be available only on a scaled basis to certain firms, many

commenters generally favored applying the amendments to all firms. 64 Several of these

commenters emphasized that the flexibility the proposed amendments would offer is

important for firms of all sizes, although for reasons that may differ between larger and

smaller firms. 65 One commenter said such flexibility appears appropriate regardless of

firm size, while noting that larger firms may be better equipped to operate under a more

restrictive and specialized set of requirements. 66 Another commenter stated they would

not be opposed to a limited degree of scaling these requirements to address cost

considerations for small and large firms. 67

After consideration of the comments received, the Board is adopting these

amendments as proposed. The Board believes the flexibility afforded by the amendments

should be available to all firms rather than on a scaled basis, because audit quality is

enhanced when firms can assign the specified roles and responsibilities to the most

See id.

See comment letters from AAA, BDO, CAQ, CBIZ, GT, KPMG, PICPA, PwC, RSM, and

Spitters.

See comment letters from AAA, BDO, CAQ, CBIZ, GT, KPMG, PwC, and RSM.

See comment letter from Kramer.

See comment letter from ICGN.

qualified individuals, whether or not they are firm personnel. In the Board’s view, the

amendments will expand the pool of individuals with the requisite experience,

competence, authority, and time to serve in specified roles. For example, a firm may

improve its QC system and overall audit quality by assigning to one individual

operational responsibility for ethics and to another individual operational responsibility

for independence, where each individual has specific expertise in their respective area.

In response to commenters that recommended clear firm-level accountability and

documentation when roles are divided, paragraph .27 requires a firm to establish and

maintain clear lines of responsibility and supervision within the QC system, including

defining authorities, responsibilities, accountabilities, and supervisory and reporting lines

for roles within the firm up to and including the principal executive officer(s).

Additionally, paragraph .82a requires the firm to document the lines of responsibility and

supervision required by paragraph .27. In response to a commenter’s call for specific

reporting to the PCAOB about divided roles, the Board notes that Item 3.1 of Form QC

requires firms to disclose (1) who holds ultimate responsibility and accountability for the

QC system as a whole and (2) which individual or individuals have operational

responsibility for ethics and independence and for monitoring and remediation. Although

the specific scope of each individual’s assigned responsibilities would not be reported,

that information must be documented under paragraph .82a and would be available to the

PCAOB in connection with its oversight activities, including inspections. 68

2. RESPONSIBILITIES FOR ROLES WITH OPERATIONAL

RESPONSIBILITY

See PCAOB Rule 4000(b), General.

To align with the amendments to QC 1000.12, the Board proposed conforming

amendments to paragraphs .15-.17 that would acknowledge the possibility that multiple

individuals could share the specified roles and clarify that such individuals’ obligations

would be limited to the scope of their assigned responsibilities.

In addition, the Board proposed amendments to paragraph .17b(2) through (3) to

delete the communication requirements related to major QC deficiencies to align with the

amendments to the evaluation requirement in paragraph .77 discussed below.

Commenters who addressed these amendments supported the proposed changes to

paragraphs .15-.17 and stated they are sufficiently clear. 69 Two commenters

acknowledged that the conforming amendments are appropriately aligned with the

revisions to paragraph .12. 70 One commenter stated the conforming amendments

reinforce a more principles-based approach 71 and another commenter stated the

conforming amendments increase flexibility. 72 After consideration of the comments

received, the Board is adopting these conforming amendments as proposed.

EXTERNAL QC FUNCTION

As originally adopted, paragraph .28 of QC 1000 includes a specified quality

response that requires firms with a larger PCAOB audit practice 73 to incorporate into

See comment letters from CAQ, GT, KPMG, PICPA, RSM, and Spitters.

See comment letters from GT and RSM.

See comment letter from GT.

See comment letter from KPMG.

Firms with a larger PCAOB audit practice are considered those firms that issued audit reports for

more than 100 issuers in the prior calendar year.

their governance structure an EQCF for the QC system composed of one or more persons

who:

•

Are not partners, shareholders, members, other principals, or employees of the

firm;

•

Do not otherwise have a commercial, familial, or other relationship with the

firm that would interfere with the exercise of independent judgment with

regard to matters related to the QC system; and

•

Have the experience, competence, authority, and time necessary to enable

them to carry out the responsibilities assigned to the EQCF by the firm.

The EQCF’s responsibilities include, at a minimum, evaluating the significant

judgments made and the related conclusions reached by the firm when evaluating and

reporting on the effectiveness of its QC system.

The Board proposed rescinding the EQCF requirement based on information

obtained in connection with staff implementation support efforts and outreach

discussions, which revealed that implementing this requirement had proven more difficult

and more costly than originally anticipated. The Board was concerned that the potential

benefits may not justify the potential costs of the EQCF requirement, except potentially

for the largest U.S. global network firms.

Many commenters expressed support for rescinding the EQCF requirement. 74

Some of these commenters said rescission would allow firms the flexibility to utilize

existing external governance structures to promote audit quality in a manner tailored to

See comment letters from AAA (majority of AAA committee members), Baker Tilly, BDO, CAQ,

CBIZ, Crowe, Deloitte, EY, Forvis, GT, KPMG, PICPA, Plante & Moran, PwC, RSM, and

VSCPA.

their specific circumstances. 75 Some commenters stated that removing the EQCF

requirement would not diminish the focus on quality because QC 1000 advances the

objectives of strengthening trust in governance, reinforcing accountability, and

supporting a commitment to quality through other provisions in the standard. 76 Other

commenters offered support for the proposed rescission by asserting that existing

governance structures, leadership accountability, monitoring activities, reporting

processes, and PCAOB inspections already provide meaningful oversight or help

promote the effective operation of the QC system. 77

In addition, many commenters observed that the costs associated with the EQCF

requirement, as well as any incremental benefits to audit quality, remain uncertain. 78

Some commenters who supported removing the requirement cited significant

implementation challenges and costs associated with identifying, recruiting, and

onboarding individuals with the necessary expertise, independence, and availability to

serve in the role. 79 Other commenters pointed to additional costs, including obtaining

liability insurance and making governance-related structural changes, as further reasons

to support the proposed rescission. 80 One commenter cautioned that rescission of the

EQCF requirement would remove a level of assurance with respect to internal processes

See comment letters from BDO, CBIZ, Deloitte, EY, GT, KPMG, Plante & Moran, PwC, RSM,

and VSCPA.

See comment letters from BDO, CBIZ, Crowe, KPMG, and PwC.

See comment letters from CAQ, EY, PICPA, and VSCPA.

See comment letters from CAQ, Deloitte, GT, KPMG, PICPA, Plante & Moran, and RSM.

See comment letters from BDO, CAQ, Crowe, EY, GT, PICPA, and VSCPA.

See comment letters from BDO, Deloitte, KPMG, PICPA, and RSM.

and audit quality in firms but described the requirement as expensive, redundant,

overreaching, and unnecessary. 81 Two commenters acknowledged the narrow

responsibilities of an individual serving in an EQCF role, but asserted that the Board may

have overstated the potential costs of the EQCF requirement by using particular

benchmarks involving compensation of non-employee company directors to estimate

potential costs. 82 These commenters also suggested that the Board may have understated

the potential benefits of the EQCF requirement by failing to consider the ongoing trend of

private equity investing in accounting firms. 83 Another commenter stated that many of

the firms most likely to be affected already use external advisers and that the incremental

burden of establishing the mandated function may be less substantial than the proposal

implies. 84 This commenter also stated that the Board did not have direct evidence on the

cost of the EQCF to firms. 85

One commenter raised concerns that the size and complexity of a large firm’s QC

system would create practical constraints on the depth of engagement individuals serving

in the EQCF role can achieve, thereby limiting the EQCF’s overall effectiveness and

value beyond the oversight already available through existing channels. 86 Another

See comment letter from Spitters.

See comment letters from CII and MIAG.

See id.

See comment letter from CFA.

See id.

See comment letter from Deloitte.

commenter supported rescission of the EQCF requirement because its current form is not

scalable for firms only moderately above the 100-issuer threshold. 87

Some commenters opposed the proposed rescission of the EQCF requirement. 88

Two commenters disagreed with the PCAOB’s reasoning “that the benefits of the

requirement may not justify the costs, except potentially for the largest U.S. global

network firms.” 89 The same commenters, while acknowledging concerns related to

potential costs, liability, and implementation, stated that some form of independent

challenge remains a critical component of an effective QC system. 90 Another commenter

viewed the EQCF as essential to audit quality. 91 One commenter expressed concern that

rescinding the EQCF requirement would leave judgments about the firms’ QC systems

entirely to the firms themselves. 92 This commenter stated the EQCF is the clearest

structural safeguard against the commercial and network pressures and interests that can

affect a firm’s judgments regarding its QC system. 93 This commenter further asserted

that, as the PCAOB moves the focus of its audit inspections to the firm rather than the

engagement level, and as private-equity ownership and other commercial pressures

See comment letter from Baker Tilly.

See comment letters from AAA (minority of AAA committee members), CFA, CII, ICGN, and

MIAG.

See comment letters from CII and MIAG.

See id.

See comment letter from ICGN.

See comment letter from CFA.

See id.

within the auditing profession continue to grow, retaining such a safeguard is particularly

important. 94

Two commenters also asserted that the requirement for larger PCAOB audit

practices to have an EQCF would be applicable to only five firms. 95 However, absent

rescission of the EQCF requirement, 13 firms, based on 2025 data, would become subject

to that requirement. 96

In responding to the question regarding an alternative threshold for the EQCF

requirement, many commenters stated it was not necessary to impose the EQCF

requirement on any firm, regardless of size or number of issuers audited. 97 Some

commenters did not support an alternative threshold (e.g., restricting the requirement only

to firms auditing more than 500 issuers) because retaining the requirement in any form

would not resolve the underlying concerns about operability, costs, availability of

qualified individuals, and uncertain incremental benefit. 98 Some commenters said that

firms should have the flexibility to create governance structures that align with the nature

and extent of their existing structure and risks of the firm. 99

One commenter stated that if the Board concludes that some relief is necessary, it

is better to retain the EQCF requirement as adopted for firms auditing more than 500

See id.

See comment letters from CII and MIAG.

See footnote 401 for a list of the 13 firms.

See comment letters from Baker Tilly, BDO, Crowe, GT, PICPA, PwC, and RSM.

See comment letters from BDO, CAQ, GT, KPMG, PICPA, and RSM.

See comment letters from BDO, CAQ, Crowe, and KPMG.

issuers because it would apply to the five firms where nearly all U.S. public market

capitalization sits. 100 One commenter stated that if the current 100-issuer threshold were

not retained, they would not oppose amending the threshold to firms that issued audit

reports for more than 200 issuers during the prior calendar year, because they believe that

the large revenue base received from those firms’ issuer audit clients could support the

incremental costs associated with the EQCF requirement. 101 One commenter suggested

retaining the EQCF requirement for firms that have accepted any form of outside

investment, other than traditional debt financing, and operate through an alternative

practice structure. 102 In addition, one commenter who opposed removing the EQCF

requirement expressed the view that smaller firms (under 100 audits per year) should not

be exempted from robust and functioning alternative EQCF requirements if the PCAOB

were to scale the provisions. 103 Another commenter noted that, given the unchanged

effective date of QC 1000, adopting alternative oversight frameworks could present

implementation challenges and leave firms with limited time to thoughtfully design and

integrate new requirements into their governance structures. 104

In the supplemental request for comment, the Board sought input on the

alternative of reverting the requirement for an independent oversight function to that

contained in the 2022 proposal. Several commenters did not support such an

100

See comment letter from CFA.

101

See comment letter from MIAG.

102

See comment letter from AAA.

103

See comment letter from ICGN.

104

See comment letter from KPMG.

alternative. 105 One commenter stated that the 2022 proposed requirement lacked

sufficient clarity and could create uncertainty regarding whether existing firm governance

and oversight arrangements would satisfy such a requirement. 106 Another commenter

indicated that the effect or impact of adopting the requirement as initially proposed in

2022 could not be determined. 107 One commenter did not support reverting back to the

2022 proposed requirement because it carried no defined duty to evaluate the firm’s QC

conclusions—the very check the EQCF was adopted to provide. 108

After consideration of the comments received, the Board is rescinding the EQCF

requirement. Based on staff implementation support efforts, the Board understands that

implementation of this requirement may have proven more difficult and costly than

originally anticipated. The Board also acknowledges the concerns raised by commenters

about the costs, operability, and potential limited benefit of the EQCF requirement,

including the availability of qualified individuals to serve in an EQCF role, for firms of

any size. In the Board’s view, rescinding the EQCF requirement means giving up the

benefits of an external second look. That external second look would have focused on the

significant judgments made and related conclusions reached when evaluating and

reporting on the effectiveness of firms’ QC systems. The Board believes those

incremental benefits are difficult to quantify and potentially limited. They would come

from the fresh perspectives of an individual serving in an EQCF role, beyond the benefits

105

See comment letters from CAQ, CFA, GT, KPMG, PICPA, PwC, and RSM.

106

See comment letter from KPMG.

107

See comment letter from Spitters.

108

See comment letter from CFA.

already provided by other aspects of QC 1000. See below for further discussion on

economic impacts.

The Board believes that the implementation concerns apply equally to all firms,

including those operating under alternative practice structures or accepting private equity

investments, regardless of the number of issuers they audit.

One commenter opposed the rescission, asserting that firm leadership should be

held accountable through independent oversight. 109 Further, the commenter suggested

that firms might lack the ability to “convince investors they can do the right thing when

left to their own judgment.” 110 As designed, though, the EQCF lacks a mechanism or the

authority to hold firm leadership accountable; the EQCF is not required to provide

concurring approval of the firm’s evaluation or reporting. 111 Nor would the EQCF

supplant the firm’s judgment.

Furthermore, the Board notes that the QC 1000 quality objectives for the

governance and leadership component continue to call for (i) firm leadership to

communicate and promote the firm’s commitment to quality; (ii) the firm to clearly

define leadership’s responsibility for quality and hold them accountable; (iii) firm

leadership to demonstrate a commitment to quality through actions and behaviors;

(iv) the firm’s strategic decisions and actions to be consistent with and support the firm’s

commitment to quality; and (v) resources to be obtained, developed, allocated, and

assigned in a manner that enables an effective QC system and the performance of

109

See id.

110

See id.

111

See PCAOB Rel. No. 2024-005, at 121.

engagements in accordance with applicable professional and legal requirements. 112 To

achieve these quality objectives, firms are required to design and implement quality

responses that are based on the related quality risks and on the reasons for the

assessments given to the quality risks and to reduce to an appropriately low level the risk

that quality objectives will not be achieved. The Board has also observed that several

firms already incorporate external advisors into their organizational and governance

structures and they may continue to do so as part of their response to the quality risks

associated with these quality objectives. The Board has long considered firm governance

and leadership to be an important aspect of firms’ QC systems that will continue to be

subject to oversight by the PCAOB, including as part of PCAOB inspections.

INFORMATION AND COMMUNICATION

QC 1000 requires a firm to establish a quality objective that, if the firm

communicates firm-level or engagement-level information with respect to the firm’s audit

practice, firm personnel, or engagements, such as firm or engagement metrics, to external

parties, such information is accurate and not misleading and, with respect to any such

metrics that are communicated in writing, the communication explains in reasonable

detail how the metrics were determined and, if applicable, how the method of

determining them changed since the metrics were last communicated.

As discussed in the QC 1000 2024 adopting release, the information that this

requirement applies to includes public communications about firm-level or engagementlevel information, such as firm metrics and financial data. 113 For example, some firms

112

See QC 1000.25.

113

See PCAOB Rel. No. 2024-005, at 186.

publish transparency or audit quality reports, either voluntarily or in response to the

requirements of other jurisdictions, that contain data such as:

•

Revenue breakdown by service line, by year, or by geographic segment;

•

Professional staff ratios;

•

Staff turnover ratios;

•

Average training hours per professional; and

•

Partner workload.

Firms may also communicate such data via webpages or other media, such as

promotional publications, social media, interviews, or presentations via webcast or

video. 114

In the supplemental request for comment, the Board proposed to narrow the

requirements of QC 1000.53e regarding the need for an explanation of written metrics to

those metrics that the firm makes publicly available. This was consistent with the initial

focus of the requirement on public communications. 115 The Board believes that recipients

of nonpublic communications regarding metrics, such as regulators, company

management, and audit committees, are generally in a position to request additional

information about the metrics if they desire it. Further, some nonpublic metrics may

already be calculated in accordance with a method prescribed by the recipient (for

example, in response to a regulatory requirement or an audit committee request for

proposal). In contrast, where metrics are publicly available, such as in firm transparency

reports or promotional publications, these are usually one-way communications in which

114

See PCAOB Rel. No. 2024-005, at 186-187.

115

See id.

the external parties do not have the ability to ask questions or request clarification from

the firm.

Several commenters supported the proposed amendments to paragraph .53e. 116

One commenter said they did not object to confining the explanation requirement to

metrics the firm makes publicly available. 117 One of these commenters stated that the

proposed amendments were generally clear and seem appropriate but suggested that the

term “metric” be defined or explained in the rule text. 118 Another commenter stated that

the PCAOB must clearly communicate to firms that the intent of the provision is that

firms ensure that the explanation remains accurate and publicly available. 119 Another

commenter encouraged the Board to make explicit that simplification of communication

requirements does not alter the firm’s monitoring obligations. 120 One commenter stated

that it would be helpful to further clarify whether the requirement applies only to those

communications required under applicable professional and legal requirements or to all

such metrics publicly disclosed. 121 The commenter further requested clarification of

whether all changes to the calculation of disclosed metrics to which this requirement

116

See comment letters from AAA, BDO, CAQ, Deloitte, EY, GT, KPMG, Kramer, MIAG, PICPA,

RSM, SCCG, and Spitters.

117

See comment letter from CFA.

118

See comment letter from Kramer.

119

See comment letter from MIAG.

120

See comment letter from SCCG.

121

See comment letter from RSM.

applies must be explained or whether this requirement applies only to material changes in

the calculation of the disclosed metrics. 122

One commenter stated that the operability of the requirement could be further

enhanced by restructuring the requirement into two distinct quality objectives—one that

addresses whether the information is accurate and not misleading, and a second,

conditional objective requiring an explanation for publicly communicated metrics. 123

The Board is adopting the proposed amendments to QC 1000.53e with

modifications. Specifically, the Board is revising paragraph .53e by adding

subparagraphs .e(1) and .e(2) to more clearly distinguish firm responsibilities when

communicating firm-level or engagement-level information to external parties and in

written public communications. The Board agrees with the commenter that this change

will improve the operability of paragraph .53e without changing a firm’s responsibilities.

In addition, the Board believes that the change will help to address a commenter’s

concern regarding the clarity of the provision’s intent with respect to metrics

communicated in writing and made publicly available by the firm.

The requirement in paragraph .53e(2) applies to any metrics that are

communicated in writing and made publicly available by the firm—it is not limited in

application to metrics that are required to be communicated under applicable professional

and legal requirements. Paragraph .53e(2) also requires a firm to communicate how the

method of determining any metrics changed since previously communicated, if

applicable, and that requirement applies to any such change in methodology, without

122

See id.

123

See comment letter from KPMG.

regard to the firm’s assessment of its materiality. The Board does not believe that it is

necessary to define the term “metric” for purposes of applying paragraph .53e(2). The

Board believes the term is reasonably understood in practice, and the Board previously

clarified, in the supplemental request for comment, that the Board intends for the

requirement to apply only to calculated measures, not to underlying data. 124 As illustrated

in the supplemental request for comment, if a firm publicly discloses its auditoremployee headcount for a region or office, the firm will not need to describe how it

counted the employees. 125 The requirement will apply, however, to any calculated figures

derived using that data, such as the average years of experience for audit personnel (i.e.,

total years of audit experience divided by auditor-employee headcount).

The Board also does not believe it is necessary to clarify that the proposed

amendment would not alter a firm’s monitoring obligations. As stated by the commenter

who suggested doing so, the amendments simplify communication requirements but do

not affect QC 1000 monitoring obligations.

The Board believes that the amendments will carry out its initial intent for public

communications and avoid unnecessary costs associated with making additional

disclosures to recipients who can request more information if they need it, while still

ensuring that recipients of written public communications have access to an explanation

of any metric provided.

In addition, the Board proposed adding a note to paragraph .53e stating that the

explanation of the method for determining metrics can be provided either within the

124

See PCAOB Rel. No. 2026-002, at 25-26.

125

See id.

public written communication that includes the metrics or by referring in the

communication to a publicly available explanation presented elsewhere, such as the

firm’s website.

Several commenters supported allowing firms to provide explanations of metrics

in a publicly available location, such as the firm’s website. 126 One commenter stated that

they supported the proposed amendment provided that those explanations are clear,

balanced, accessible, and sufficiently specific to help users of the metrics. 127 Another

commenter stated that they favored public disclosures in one place for ease of use and

that placement on the relevant website seems appropriate as long as there are clear

instructions on how to access the explanation. 128 The commenter further stated that, while

disclosures on websites are useful, investors would want to make sure that any

restatements, changes in definitions, or metrics are clearly noted, communicated in

writing, and updated on a timely basis. 129 While one commenter agreed that publishing

an explanation of metrics on a website would not adversely affect the utility of metrics

made public, this commenter questioned whether public information about firm metrics

should be subject to certification or verification before publication. 130 Another

commenter said that an explanation that was accurate on the day it was published is of

little use to an investor comparing metrics two or three years later, and that simplification

126

See comment letters from BDO, CFA, GT, KPMG, MIAG, PICPA, and RSM.

127

See comment letter from CAQ.

128

See comment letter from ICGN.

129

See id.

130

See comment letter from Spitters.

of the requirement should not come at the expense of transparency or comparability over

time within a single firm. 131 This commenter requested that the Board require that any

report containing a publicly disclosed metric include, in the report itself, a hyperlink to

the explanation of how that metric is calculated, maintained on the firm’s own website,

and stated that the hyperlink must remain stable, archived, and year specific. 132 This

commenter also said that when a metric or its methodology changes from one year to the

next, the change must be prominently identified in the base report itself—not only in the

linked explanation—together with a description of the change and a presentation of the

comparable prior year metric. 133

After consideration of the comments received, 134 the Board is adopting the note to

paragraph .53e as proposed but relocating it under new paragraph .53e(2).

The Board believes that allowing firms to explain metrics either in the same

communication as the metric itself or by reference to another publicly available

explanation would streamline firms’ communications about their audit practices without

adversely affecting the quality of information received by external parties. The Board

does not believe that permitting firms this flexibility will create confusion for

stakeholders. Given the volume of information that a firm might communicate about

itself, and the possibility that the same information may be repeated through various

131

See comment letter from CFA.

132

See id.

133

See id.

134

One commenter stated that the PCAOB should use existing artificial intelligence technology to

aggregate metrics and related information from firms’ websites or other public sources and make

that information available in a centralized location on the PCAOB’s website. See comment letter

from MIAG. This suggestion is beyond the scope of this rulemaking.

communication platforms, the Board believes that permitting a firm to make reference to

a single publicly available explanation could reduce unnecessary duplication of

disclosures and provide additional clarity to stakeholders. Also for this reason, the Board

believes it is not necessary to require a change made to a metric or its methodology be

identified in the written communication. The Board is not requiring firms to provide

hyperlinks for the metrics because the Board seeks to preserve the principles-based nature

of the requirement and avoid prescribing a specific method that may become less

effective as technology changes over time.

To satisfy paragraph .53e(2), any publicly available explanation, including one

provided through a website, would need to be clear, accessible, and sufficiently specific

to explain how the metric was determined and any changes in the method used to

determine the metric since it was last communicated. In addition, the Board does not

believe that requiring certification or verification of such explanations is necessary to

achieve the objectives of paragraph .53e(2). Firms would need to ensure that their

explanations remained specific as to the public metric to which they relate and are

publicly available for as long as they continue to make available the written public

communication that refers to the location of the metrics. Firms may update the publicly

available explanation as necessary to maintain its accuracy; however, such updates do not

require the issuance of a new written public communication identifying or describing

those updates.

MONITORING AND REMEDIATION PROCESS

1. RESPONDING TO ENGAGEMENT DEFICIENCIES

Engagement monitoring activities are designed to provide information on whether

engagement or QC system-level areas may require additional attention. These activities

may identify pervasive issues where a number of engagements have similar problems,

possibly highlighting the need to revise methodologies, provide additional training, or

take other actions at the QC-system level. QC 1000 requires monitoring activities to

include determining, on a timely basis, whether engagement deficiencies exist and, if so,

taking certain actions in response to the identified engagement deficiencies.

QC 1000 defines an engagement deficiency as an instance of noncompliance with

applicable professional and legal requirements by the firm, firm personnel, or other

participants with respect to an engagement of the firm, or by the firm or firm personnel

with respect to an engagement of another firm. Under QC 1000.68, a firm is required to

take certain action when an engagement deficiency exists, with the required action

depending on circumstances such as whether the engagement is completed or still inprocess or is related to work performed on other firms’ engagements.

i. Engagement deficiency related to an in-process engagement

(QC 1000.68a)

As originally adopted, QC 1000 requires firms, for engagement deficiencies

relating to in-process engagements, to take action to address the deficiency in accordance

with applicable professional and legal requirements (to the extent necessary, before the

issuance of the engagement report(s)), such that the engagement report(s) are appropriate

in the circumstances.

The Board proposed to amend paragraph .68a to (i) replace the language “the

engagement report(s) are appropriate in the circumstances” with “the engagement is free

of significant engagement deficiencies” and (ii) add a footnote describing what

significant engagement deficiencies are. The concept of a significant engagement

deficiency is derived from AS 1220, and the description used in the proposed footnote in

paragraph .68a aligns with that in AS 1220. The footnote to QC 1000.68a also clarifies

that the concept applies to all engagements as that term is defined in QC 1000 (which

includes, for example, engagements performed pursuant to PCAOB interim attestation

standards), not only those engagements described in AS 1220.

Many commenters supported the proposed amendments to paragraph .68a. 135

However, one commenter stated that the proposed threshold for a “significant

engagement deficiency” remained overly broad and could be interpreted to encompass

any instance in which an engagement team failed to perform a procedure required by

PCAOB standards, regardless of whether the omission affected the sufficiency or

appropriateness of audit evidence supporting a material assertion or the engagement

conclusions. 136 This commenter suggested that the definition should incorporate the

concepts of materiality, relevant assertions, and the significance of the deficiency to the

overall audit. 137

The proposed description for when a significant engagement deficiency exists is

consistent with concepts in AS 1220. Under AS 1220, an engagement quality reviewer

(“EQR”) may provide concurring approval of issuance only if, after performing with due

professional care the review required by the standard, the EQR is not aware of a

135

See comment letters from Baker Tilly, CAQ, Deloitte, GT, KPMG, Plante & Moran, and Spitters.

136

See comment letter from PICPA.

137

See id.

significant engagement deficiency. 138 The description of significant engagement

deficiency in the proposed amendments to paragraph .68a appropriately focuses firms on

matters that must be corrected before an audit report is issued or before an engagement

conclusion is communicated to the company. 139 Therefore, the Board does not agree that

the description is overly broad; a significant engagement deficiency would not be any

instance in which an engagement team failed to perform a procedure required by PCAOB

standards but rather is specifically related to the circumstances described in footnote 40A.

Further, the Board believes the concept is well understood by the profession and does not

require any revision.

The Board is adopting the amendments to paragraph .68a as proposed.

ii. Evaluating whether similar engagement deficiencies exist on

other engagements (QC 1000.68d)

As originally adopted, QC 1000 requires that, when the firm determines that an

engagement deficiency exists, the firm should evaluate whether similar engagement

deficiencies exist in other in-process engagements, completed engagements (unless it is

probable that the engagement report is not being relied upon), and work performed on

other firms’ engagements, and if so, take actions as required by paragraphs .68a-c, as

applicable.

The Board proposed to limit the requirement to evaluate whether similar

engagement deficiencies exist so it would apply only with respect to a subset of

138

See Notes to AS 1220.12, .17, .18B.

139

See Proposed Auditing Standard—Engagement Quality Review and Conforming Amendment to

the Board's Interim Quality Control Standards, PCAOB Rel. No. 2008-002 (Feb. 26, 2008), at 16

(describing significant engagement deficiencies).

engagement deficiencies, specifically those that resulted or could result (i) a failure to

obtain sufficient appropriate evidence to support the conclusion reached on an

engagement 140 or (ii) an inappropriate overall conclusion on the subject matter of an

engagement.

Most commenters generally supported the proposed amendments to

paragraph .68d. 141 The Board is adopting the amendments to paragraph .68d as proposed,

along with a new note discussed further below.

The discussion below addresses specific commenter feedback related to the

proposed amendments.

a. “Resulted or could result in”

Several commenters raised concern regarding the proposed language “resulted or

could result in.” 142 Commenters stated that the language would introduce new

complexity 143 and interpretation challenges, 144 or would involve substantial

implementation effort with limited incremental investor protection. 145 One commenter

stated that without further context, the term “could” effectively sets a threshold closer to

a remote possibility, which, in practice, would require firms to evaluate an unbounded

140

Because QC 1000 covers not only audit engagements but also review engagements and attestation

engagements, reference to “sufficient appropriate evidence” is necessary as this concept aligns

with the audit, review, and attestation standards.

141

See comment letters from Baker Tilly, BDO, CAQ, CBIZ, Deloitte, EY, GT, ICGN, KPMG,

PICPA, Plante & Moran, RSM, SCCG, and Spitters.

142

See comment letters from BDO, GT, KPMG, PICPA, and RSM.

143

See comment letter from KPMG.

144

See comment letters from GT and KPMG.

145

See comment letter from PICPA.

population of engagements. 146 This commenter suggested that the Board consider

revising the language to specify that the requirement applies “where there is a reasonable

possibility” that an engagement deficiency could result in either a failure to obtain

sufficient appropriate audit evidence or an inappropriate overall conclusion, to

distinguish from those that represent more remote possibilities. 147 Another commenter

recommended changing the proposed language to “reasonably could result.” 148 Another

commenter stated that it was not clear whether “could” should be assessed at the

individual engagement level or at a broader thematic level, such as when a theme or trend

of similar engagement deficiencies emerges. 149 Another commenter stated that a

deficiency that appears immaterial on the engagement where it was first identified can

still be a symptom of a firm-wide QC weakness and a narrower trigger reduces the

number of opportunities a firm has to find that pattern before it results in an audit

failure. 150 One commenter highlighted that the intended benefits of the proposed

amendment could be offset by concerns regarding specific provisions (i.e., the “could

result in” language). 151 Another commenter stated that it was difficult to determine

whether the proposed amendment will meaningfully reduce complexity, subjectivity, or

implementation costs. 152 The Board is concerned that some commenters may have

146

See comment letter from KPMG.

147

See id.

148

See comment letter from BDO.

149

See comment letter from RSM.

150

See comment letter from CFA.

151

See comment letter from KPMG.

152

See comment letter from GT.

misinterpreted the intent of the phrase “could result in.” As adopted, QC 1000 requires

the firm to evaluate all engagement deficiencies under paragraph .68d. The goal of the

amendment is to narrow the types of engagement deficiencies subject to the evaluation to

only those that relate to obtaining sufficient appropriate evidence or the overall

conclusion of an engagement. 153 Other engagement deficiencies would not need to be

evaluated under paragraph .68d, as amended. Such other engagement deficiencies

include, for example, engagement deficiencies related to communications to the audit

committee; the filing of Form AP, Auditor Reporting of Certain Audit Participants; or the

registration status of an other auditor that performed substantial role work. 154 In other

words, this “could result in” language is not intended to introduce an assessment of the

likelihood that the engagement deficiency could result in, for example, a failure to obtain

sufficient appropriate evidence to support the conclusion on another engagement. This

language is instead intended to help firms assess whether a particular engagement

deficiency falls within either of the two types of engagement deficiencies subject to the

evaluation under the revised paragraph .68d.

For example, if the engagement deficiency related to not making a required

communication to the audit committee, this type of engagement deficiency does not

affect the auditor’s ability to obtain sufficient appropriate audit evidence or reach the

153

With respect to examples of the type of engagement deficiencies that relate to reaching an

inappropriate overall conclusion on the subject matter of an engagement, see PCAOB Rel. No.

2008-002, at 16 n.29, which states that “[i]nappropriate conclusions on the subject matter of the

engagement would include, for example, a failure to appropriately modify the engagement

conclusion in response to: (1) a material departure from generally accepted accounting principles

or (2) a material weakness in internal control over financial reporting.”

154

These types of engagement deficiencies would still be required to be addressed in accordance with

paragraphs .68a-c and to be evaluated to determine whether QC deficiencies exist in accordance

with paragraph .72.

appropriate overall conclusion of the engagement and, therefore, would not be within the

scope of the revised paragraph .68d. In contrast, if the engagement deficiency related to

the auditor not making or observing a physical inventory count in accordance with AS

2510, Auditing Inventories, this type of an engagement deficiency would be within the

scope of paragraph .68d, because it relates to obtaining sufficient appropriate evidence.

Some commenters requested clarification of an example the Board provided in the

supplemental request for comment. 155 To clarify and illustrate the application of the

“resulted or could result in” language in paragraph .68d, consider the following scenario:

During internal monitoring activities for the current year, a firm selected one of its

completed engagements for inspection and identified that the engagement team failed to

evaluate cash confirmation exceptions pursuant to AS 2310.20. As a result, the

engagement team violated PCAOB requirements (i.e., applicable professional and legal

requirements) and the firm determined that an engagement deficiency exists. Because

noncompliance with the requirement of AS 2310.20 (that is, the failure to evaluate

confirmation exceptions) relates to obtaining sufficient appropriate evidence (i.e., it could

result in a failure to obtain such evidence), this engagement deficiency meets the

requirement for evaluation under the revised language of paragraph .68d. 156

The Board believes that the amendment appropriately focuses a firm’s attention

and efforts on the types of engagement deficiencies that represent the greatest risk to

audit quality. It also reduces compliance costs by narrowing the population of

engagement deficiencies that a firm is required to evaluate.

155

See comment letters from Baker Tilly, BDO, CAQ, Deloitte, EY, GT, PICPA, and RSM.

156

The Board has provided a continuation of this example below.

b. “Evaluate whether similar engagement deficiencies exist”

A commenter stated that the nature and extent of the procedures required to

evaluate whether similar engagement deficiencies exist should be more explicitly

grounded in the root cause of the engagement deficiency identified and an assessment of

whether that root cause suggests a potential QC deficiency. 157 This commenter suggested

that an evaluation anchored to root cause would provide a more meaningful and riskbased framework for determining the scope of further procedures. 158 As it relates to the

evaluation required under paragraph .68d, another commenter requested scenarios to help

firms distinguish between engagement deficiencies and identified root causes that are

(i) indicative of systemic issues and (ii) isolated incidents. 159

As described in the QC 1000 2024 adopting release, understanding the nature of

the engagement deficiency will assist the firm in determining the extent of the necessary

evaluation. 160 The intent of the requirement to evaluate whether similar engagement

deficiencies exist was not to require an unbounded look at every engagement the firm

has. The Board believes understanding the circumstances that led to the engagement

deficiency (e.g., the underlying cause) would help the firm identify other engagements to

evaluate for similar engagement deficiencies. The Board acknowledges, as commenters

suggested, that this was not clear in the proposed amendments. Therefore, the Board is

adding a new note to paragraph .68d to indicate that understanding the circumstances that

157

See comment letter from Deloitte.

158

See id.

159

See comment letter from GT.

160

See PCAOB Rel. No. 2024-005, at 225.

led to the engagement deficiency may assist the firm in identifying other engagements (or

work performed by the firm on other firms’ engagements) to evaluate for similar

engagement deficiencies.

The procedures performed can be scalable and practical in the circumstances and

may be developed based on the nature of the engagement deficiency. However, it would

not be appropriate for a firm’s evaluation to be based on narrower criteria than those

underlying the cause(s) for the engagement deficiency, nor would it be appropriate to

include only a subset of the engagements that are identified based on the understanding of

the circumstances that led to the engagement deficiency.

To continue with the example provided above regarding cash confirmations, the

firm then gained an understanding of the circumstances that led to the engagement

deficiency (e.g., the underlying cause) to identify which other engagements to evaluate

for similar engagement deficiencies. In this example, the firm might determine that the

engagement deficiency was caused by an error in the firm’s cash confirmations

methodology, which is required to be used on all engagements that use cash

confirmations. To identify whether other engagements used the same methodology (or, in

the case of in-process engagements, are currently using the same methodology), the firm

sends an inquiry email to each engagement partner. Based on the responses received to

the emails and any follow-up with non-respondents, the firm identifies the engagements

(and work performed on other firms’ engagements) that followed the same methodology.

It is these engagements and work performed on another firm’s engagements that followed

the same methodology that the firm will evaluate for similar engagement deficiencies.

If the firm identifies, for example, twenty engagements that followed the same

cash confirmations methodology, the firm evaluates whether a similar engagement

deficiency exists on each of the twenty engagements, i.e., a failure to evaluate

confirmation exceptions pursuant to AS 2310.20. Out of the twenty engagements, if the

firm identifies four engagements in which the engagement team did not perform

procedures to evaluate confirmation exceptions pursuant to AS 2310.20, then the firm

would need to take appropriate actions pursuant to subparagraphs a-c of paragraph .68 on

each of those four engagements.

Importantly, paragraph .68d does not prescribe the manner in which the firm

would identify engagements to evaluate. In the above example, the firm decided to send

an email to each engagement partner to identify engagements that followed the same

methodology. However, the firm could use other approaches, such as a data analysis tool

or performing a search of engagement files, to identify engagements that followed the

same methodology. The evaluation approach a firm takes may differ depending on the

nature of the engagement deficiency, the circumstances that led to the engagement

deficiency, and a firm’s specific facts and circumstances. As discussed above, once the

firm identifies the population of engagements subject to the evaluation of whether similar

engagement deficiencies exist, it would not be appropriate for a firm’s evaluation to be

based on narrower criteria nor would it be appropriate to evaluate only a subset of the

engagements that were identified.

The following graphic illustrates the process for evaluating whether similar

engagement deficiencies exist:

c. Response to other commenter feedback

One commenter did not support a requirement that would require the firm, after

finding an engagement deficiency in one engagement, to evaluate whether similar

deficiencies exist in all other completed engagements. 161 This commenter stated that the

cost of the requirement could be extremely high and it is unclear whether the benefit

would outweigh the cost. 162 This commenter suggested that the Board instead change the

requirement so that examining a completed engagement would be required only when,

161

See comment letter from AAA.

162

See id.

based on the information available at the time, the firm believed that it was probable the

financial statements were materially misstated and the likelihood was more than remote

that the audit report was still being relied upon. 163 The Board does not agree with the

commenter who stated that the amendment would require that the firm evaluate whether

similar deficiencies exist in all other completed engagements, as the note to

paragraph .68d indicates understanding the circumstances that led to the engagement

deficiency may assist the firm in identifying other engagements to evaluate for similar

engagement deficiencies.

A commenter stated that a deficiency found in one engagement should prompt the

firm to ask whether the same problem exists in other engagements and why it occurred,

with the answers feeding back into the firm’s risk assessment. 164 The Board agrees that

an engagement deficiency identified in one engagement may provide information that is

relevant to the firm’s broader monitoring and remediation and risk assessment processes.

All engagement deficiencies are subject to action as required under paragraph .68a-c (in

that particular engagement), and certain engagement deficiencies will require evaluation

under paragraph .68d. Furthermore, all engagement deficiencies are treated as QC

observations under paragraph .72 and must be evaluated to determine whether they are

QC deficiencies. Additionally, under paragraph .20a(3), the firm obtains an

understanding of information from the firm’s monitoring and remediation activities,

including its identification of engagement deficiencies, in identifying and assessing

quality risks. In this way, the evaluation of engagement deficiencies represents one part

163

See id.

164

See comment letter from CFA.

of the broader monitoring and remediation feedback loop: information identified through

that process informs the firm’s evaluation of QC observations and feeds back into the

firm’s identification and assessment of quality risks.

This commenter also stated that deficiency rates are not materially better than in

the early years of the inspection program more than twenty years ago and suggested this

is not the moment to narrow the lens through which firms look for systemic problems. 165

The Board believes that the amendments to paragraph .68d appropriately focus firms’

evaluations on engagement deficiencies related to obtaining sufficient appropriate

evidence to support the conclusion reached on an engagement or the overall conclusion

on the subject matter of an engagement that may indicate systemic issues on the firm’s

engagements.

A commenter suggested that the Board could further enhance the proposed

amendment by aligning more closely with ISQM 1, which permits firms to use their

judgment to determine the nature and extent of any investigation of identified

engagement deficiencies and whether those deficiencies might indicate a deficiency in

the system of quality management. 166 The Board believes the requirement in

paragraph .68d is fundamental to achieving the objective of the QC system that each

engagement report issued by the firm is in accordance with applicable professional and

legal requirements. 167

165

See id.

166

See comment letter from PICPA.

167

See QC 1000.05.

A commenter questioned why only items (1) and (2) from footnote 40A to

proposed paragraph .68a were included in proposed paragraph .68d, while items (3) and

(4) (the engagement report is not appropriate in the circumstances and the ﬁrm is not

independent of its client, respectively) were not. 168 With regard to paragraph .68d, the

amendment focuses on those types of engagement deficiencies that most directly affect

the sufficiency and appropriateness of procedures performed on the engagement as well

as the ultimate opinion expressed by the firm.

2. DEFINITION OF QC DEFICIENCY

As originally adopted, the note to paragraph .A8(1) of the definition of QC

deficiency states that the likelihood of not achieving the reasonable assurance objective

or one or more quality objectives would be above an acceptably low level if, for example,

a quality objective is not established, a quality risk is not properly identified or assessed,

or a quality response is not properly designed or implemented or is not operating

effectively.

The Board proposed to amend this note to clarify that a failure of a quality

response would be regarded as evidencing a QC deficiency only if other quality

responses do not achieve the relevant objective(s). As stated in the QC 1000 2024

adopting release, the relationship across quality objectives, quality risks, and quality

responses is generally not one-to-one. 169 Most quality objectives are likely to have

multiple quality risks. Some quality risks may affect one or more quality objectives,

168

See comment letter from Grosvenor.

169

See PCAOB Rel. No. 2024-005, at 42.

either within a single component or across several components, and may require multiple

quality responses. Some quality responses may address multiple quality risks.

Many commenters supported the proposed amendment to the definition of QC

deficiency, 170 noting, for example, that allowing firms to take compensating quality

responses into account when determining whether a QC deficiency exists better reflects

how a risk-based system of quality control operates in practice and also aligns more

closely with the principles-based framework of other quality management standards, such

as ISQM 1.

Two commenters suggested revisions to the proposed amendment. 171 One

commenter stated that the rule text could clarify that multiple other quality responses are

not necessarily required by adding the words “one or more” before “other quality

responses” in the Note to paragraph .A8(1) for situations where there is just one other

quality response. 172 The Board believes the rule text is sufficiently clear that the clause

“and other quality responses do not achieve the relevant objective(s)” applies only if the

firm has designed and implemented at least one other quality response relative to the

objective(s). Another commenter suggested amending the definition as follows: “(other

quality responses have been implemented to address the same risk, and) ‘other quality

responses do not achieve the relevant objectives.’” 173 The Board does not believe it is

necessary for the rule text to specify that “other quality responses” must have been

170

See comment letters from AAA, Baker Tilly, BDO, CAQ, Crowe, Deloitte, EY, GT, KPMG,

Kramer, PICPA, Plante & Moran, PwC, RSM, and SCCG.

171

See comment letters from Kramer and Spitters.

172

See comment letter from Kramer.

173

See comment letter from Spitters.

designed and implemented to address the particular quality risk. As stated in the

supplemental request for comment and reiterated here, when firms have implemented

more than one quality response to address the same quality risk, they can take those other

quality responses into account when determining whether a QC deficiency exists.

One commenter expressed concern that without a documented, inspectable basis

for concluding that a “compensating response” actually operated effectively, this

amendment risks becoming a way to explain away deficiencies rather than a genuine test

of whether investors remain protected. 174 Another commenter expressed concern that the

proposed amendment would give firms/networks additional temptation to identify

compensating responses when the linkage is tenuous. 175 The Board believes the revised

note makes clear that, when a quality response is not properly designed or implemented

or is not operating effectively, the other quality responses would need to achieve the

relevant objective(s), that is, they would need to be properly designed, implemented,

tested, and found to operate effectively. And, as one commenter observed, paragraph .82

requires firms to document their evaluation of QC observations to determine whether QC

deficiencies exist and the basis for each determination. 176

Another commenter stated that it is unclear how allowing the evaluation of

compensating controls will work in practice. 177 For example, where a quality risk has a

single response that fails, the commenter stated it was unclear whether firms may

174

See comment letter from CFA.

175

See comment letter from Grosvenor.

176

See comment letter from CFA.

177

See comment letter from RSM.

consider other responses that mitigate other identified risks to support achievement of the

overall objective. 178 This commenter suggested that there may be responses where a

precision level is too high to singularly address a specific risk on their own, but when

considered collectively, may reduce the risk of failing to achieve the objective to an

acceptable level. 179

As explained in the QC 1000 2024 adopting release, the purpose of this note is to

provide examples of circumstances where the likelihood of the firm not achieving the

reasonable assurance objective or one or more quality objectives would not be reduced to

an acceptably low level. 180 The amendments to this note further emphasize that, when a

quality response is not properly designed or implemented or is not operating effectively

and other quality responses do not achieve the relevant objective(s), the likelihood of the

firm not achieving the reasonable assurance objective or one or more quality objectives

has not been reduced to an acceptably low level. Under QC 1000, quality risks are

defined as “[r]isks (whether or not related to intentional acts by firm personnel or other

participants to deceive or to violate applicable professional and legal requirements) that,

individually or in combination with other risks, have a reasonable possibility of occurring

and, if they were to occur, a reasonable possibility of adversely affecting the firm’s

achievement of one or more quality objectives.” The amendment clarifies that, when

firms have implemented more than one quality response to address the same quality risk,

they can take those other quality responses into account when determining whether a QC

178

See id.

179

See id.

180

See PCAOB Rel. No. 2024-005, at 231.

deficiency exists; if the other quality responses were effective in achieving the relevant

objective(s), no QC deficiency would exist.

After consideration of the comments received, the Board is adopting the

amendment to the definition of QC deficiency as proposed.

EVALUATION OF AND REPORTING ON THE QC SYSTEM

1. ANNUAL EVALUATION OF THE QC SYSTEM

i. Evaluation date

As originally adopted, QC 1000 requires that the firm perform an evaluation of

the effectiveness of its QC system annually as of September 30.

The Board proposed to amend QC 1000 to permit firms to select their own annual

evaluation date for their QC system by adding a new defined term, “evaluation date,”

defined as the date selected by the firm as of which to evaluate its QC system under

paragraph .77, and making conforming changes to paragraph .77.

The Board also proposed to include language in a new footnote to guide the firm’s

selection of its evaluation date by recognizing that the firm’s choice may be influenced

by the nature and circumstances of the firm and its engagements, including, for example,

the firm’s fiscal year-end or the timing of monitoring activities.

All commenters who commented on this aspect of the proposed amendments

expressed support. 181 One commenter, who did not object to this aspect of the proposed

amendments, expressed concern that timing should not become a tool for managing

findings and a firm should not be able to use its initial selection, or a later change of date,

181

See comment letters from AAA, Baker Tilly, BDO, CAQ, CBIZ, Crowe, Deloitte, EY, Forvis,

GT, ICGN, KPMG, MIAG, PICPA, Plante & Moran, PwC, RSM, and Spitters.

to defer capturing known or anticipated inspection findings within an evaluation

period. 182 This commenter, however, acknowledged that under the amendments, no

period of time escapes evaluation altogether and any change of evaluation date must be

reported to the Board together with the firm’s rationale for the change. 183 The Board

agrees with the commenter that these are useful guardrails. 184

The choice of evaluation date is an aspect of QC system design and, as such, has

to be made and documented by the time the firm becomes subject to the QC 1000.06

requirement to design, implement, and operate an effective QC system. The firm has to

have the information needed to identify unremediated QC deficiencies and to reach a

conclusion about the effectiveness of its QC system as of the evaluation date, and for the

individuals with ultimate responsibility and accountability and operational responsibility

and accountability for the QC system as a whole, acting with due professional care, to

certify the firm’s report to the PCAOB on its annual evaluation of the QC system. This

suggests that the evaluation date and the firm’s monitoring and remediation cycle ought

to be coordinated so that sufficient, timely information is available when needed about

the implementation and operation of the QC system (including the status of remediation

efforts) and the compliance of the firm’s engagements with applicable professional and

legal requirements. Because of the relationship between the evaluation date and the

firm’s monitoring and remediation activities, The Board does not anticipate that firms

will change their selected evaluation date without a specific reason (e.g., regulatory

182

See comment letter from CFA.

183

See id.

184

See id.

requirements, business combination transactions, or changes in fiscal year or business

cycles).

The Board is adopting these amendments as proposed.

The Board believes allowing each firm to select its evaluation date based on the

firm’s particular facts and circumstances responds to the implementation challenges

experienced by some firms and, in particular, could reduce the burden and costs of

multiple annual evaluations that some firms could have experienced due to differences in

required evaluation dates under QC 1000 versus other regulations to which they are

subject. This change better aligns with the flexibility provided by other quality

management standards, which permit firms to choose their own evaluation date.

Additionally, the Board does not believe that allowing firms to select their own

evaluation date impairs the Board’s ability to carry out its inspection program.

ii. Five-month threshold for the initial evaluation of the firm’s

QC system

The Board proposed to add language to paragraph .77 that would require a

minimum period of operation before a firm is first required to evaluate its QC system.

Under the proposed amendment, a firm would be required to evaluate its QC system once

the firm has been subject to the requirement to design, implement, and operate a QC

system under paragraph .06 for at least five consecutive months (whether due to the

effectiveness of QC 1000 on December 15, 2026, or to the firm’s later becoming subject

to the requirements of QC 1000.06).

Most commenters who commented on this topic supported the proposed

amendment. 185

However, one commenter stated that the proposed approach may create practical

challenges for firms seeking to align their QC 1000 evaluation process with evaluations

performed under other quality management standards, which contemplate annual

evaluation periods that generally do not exceed twelve months. 186 This commenter

observed that a firm that has chosen, for example, March 31 as its evaluation date would

likely be required to perform an evaluation under ISQM 1 or SQMS 1 as of March 31,

2027, while the corresponding QC 1000 evaluation would not occur until March 31,

2028, and would encompass a 15-month evaluation period. 187 This commenter suggested

that the Board could permit firms to perform their initial evaluation of their QC system as

of their selected evaluation date, consistent with their normal quality control processes,

but require the first Form QC filing only for the first 12-month evaluation period ending

after September 30, 2027. 188 This commenter believes that the Board could obtain

information regarding that firm’s initial evaluation, implementation progress, significant

findings, and remediation activities through its oversight activities (e.g., inspections,

implementation outreach, annual data requests, and other regulatory interactions) prior to

the firm’s first Form QC filing. 189 Another commenter stated that, combined with a free

185

See comment letters from Baker Tilly, CAQ, ICGN, KPMG, PICPA, RSM, and Spitters.

186

See comment letter from BDO.

187

See id.

188

See id.

189

See id.

choice of evaluation date, the proposed five-month threshold could defer some firms’

first evaluation well into 2028. 190 This commenter stated that the Board should set an

outer limit so that every firm completes its first evaluation within a reasonable period of

becoming subject to the standard. 191

The Board acknowledges that, depending on the evaluation date chosen by the

firm, the first evaluation period may encompass more than 12 months, but observes that

subsequent periods would proceed on a 12-month cycle (absent a change of the

evaluation date). The Board believes that this approach sets a reasonable outer limit for a

firm’s first evaluation. The Board also believes that the five-month minimum duration of

the initial evaluation period ensures that firms have sufficient information to evaluate the

effectiveness of their QC system. A firm can elect to voluntarily perform its initial

evaluation covering a less-than-five-month period, but that evaluation would not be a

required evaluation under QC 1000. Consequently, under General Instruction 4(a) to

Form QC, the firm’s first Form QC filing would be required to cover the period

beginning on the date the firm first incurred an obligation to implement and operate a QC

system under QC 1000.06 and ending on the firm’s evaluation date.

Another commenter suggested that the five-month period should commence on

the first day of the month immediately following the event that triggers the firm’s

obligation to design, implement, and operate its QC system, which would allow firms a

full five-month operating period on which to base their evaluation. 192 This commenter

190

See comment letter from CFA.

191

See id.

192

See comment letter from KPMG.

also requested that the Board clarify that the five-month period applies solely to the initial

operation of the broader QC system and does not establish a mandatory minimum

operating period for concluding that a specific remedial action is effective. 193 To clarify,

as noted above, a firm becomes subject to the requirements of QC 1000 on

(1) December 15, 2026 (the effective date of QC 1000), or (2) the day the firm becomes

subject to the requirement to design, implement, and operate a QC system under

paragraph .06. Therefore, in all circumstances, a firm’s QC system will have operated for

a full five months or longer before the firm is required to evaluate the effectiveness of its

QC system. Additionally, because the five-month threshold refers to the evaluation of the

effectiveness of the firm’s QC system as a whole, it does not impose any minimum time

requirement for any other purpose other than for QC 1000.77.

Another commenter also suggested that the Board clarify whether engagements

should be included in a firm’s evaluation based on the financial statement year-end or the

date the auditor’s report is issued. 194 This commenter encouraged the Board to clarify

how firms should approach the initial evaluation when the completion of a firm’s

engagements falls outside this five-month timeframe and when the initial evaluation has

little or no engagement activity within the evaluation period. 195

QC 1000 requires that the firm design, implement, and operate a monitoring and

remediation process to provide relevant, reliable, and timely information about the

design, implementation, and operation of the QC system and to provide a reasonable

193

See id.

194

See comment letter from PICPA.

195

See id.

basis for timely detection of engagement deficiencies and QC deficiencies. 196 Firms are

required to monitor completed engagements. 197 A completed engagement is one for

which the firm has issued an engagement report. Firms also are required, depending on

the size of their PCAOB audit practice, to either perform in-process engagement

monitoring 198 or consider doing so. 199 If the firm has no completed engagements during

the firm’s initial evaluation of its QC system, in-process monitoring could provide

relevant, reliable, and timely information about the performance of the firm’s

engagements.

Finally, one commenter questioned the rationale behind the Board’s decision to

use five months as opposed to, for example, six months. 200 In developing the minimum

time period for the initial QC system evaluation, the Board determined and continues to

believe that the five-month threshold strikes the right balance such that the QC system

has ample time to operate while also ensuring the PCAOB’s timely receipt of information

related to firms’ QC systems.

Accordingly, the Board is adopting this amendment as proposed.

To illustrate how the five-month threshold for the initial evaluation of the firm’s

QC system would operate, if a firm that is subject to the requirements of QC 1000.06

when the standard becomes effective (on December 15, 2026) selects June 30 as its

196

QC 1000.59a and b.

197

QC 1000.62a.

198

QC 1000.63a.

199

QC 1000.63b.

200

See comment letter from Spitters.

evaluation date, the firm would first evaluate the effectiveness of its QC system in

accordance with QC 1000 as of June 30, 2027, because the firm would have been

required to operate a QC 1000-compliant system for at least five months (specifically,

from December 15 to June 30) as of June 30, 2027. Alternatively, if such a firm selects

March 31 as its evaluation date, the firm would be required to first evaluate the

effectiveness of its QC system as of March 31, 2028, because the firm would not have

been required to operate a QC 1000-compliant system for at least five months as of

March 31, 2027. As another example, if a firm first became subject to the requirements of

QC 1000.06 on June 1, 2027 (because the firm became subject to applicable professional

and legal requirements with respect to an engagement at that time), and the firm selects

July 31 as its evaluation date, the firm would be required to first evaluate the

effectiveness of its QC system as of July 31, 2028, because the firm would not have been

required to operate a QC 1000-compliant system for at least five months as of July 31,

2027.

iii. Evaluation conclusions

As originally adopted, QC 1000 requires the firm to evaluate its QC system

annually and conclude that the QC system is effective, is effective except for one or more

unremediated QC deficiencies that are not major QC deficiencies, or is not effective (i.e.,

one or more major QC deficiencies exist).

The Board proposed to amend the above three conclusions to align QC 1000 more

closely with other quality management frameworks. Under proposed paragraph .77, the

firm would be required to conclude, as of the evaluation date, that its QC system:

•

Is effective in achieving the reasonable assurance objective; or

•

Is effective in achieving the reasonable assurance objective except for

unremediated QC deficiencies that have a severe but not pervasive effect on

the design, implementation, and operation of the QC system (and do not

render the QC system not effective); or

•

Is not effective in achieving the reasonable assurance objective.

To clarify when a firm may conclude that its QC system is effective in achieving

the reasonable assurance objective under paragraph .77a, the Board proposed to include a

note explaining that such a conclusion would be appropriate when, as of the evaluation

date, there are no unremediated QC deficiencies other than those that, individually or in

combination, are not severe. This clarification was intended to emphasize that the

presence of unremediated QC deficiencies did not, in all cases, preclude a conclusion

under paragraph .77a that the QC system is effective. Rather, the determination would

depend on the severity of those deficiencies and their effect on the firm’s ability to

achieve the reasonable assurance objective. Under the proposed approach, QC

deficiencies that are not severe, whether considered individually or in combination,

would not indicate that the QC system is failing to operate effectively, which would be

consistent with the ISQM 1 evaluation framework and the reasonable assurance objective

of QC 1000.

Under proposed paragraph .77b, a firm would conclude that its QC system was

effective in achieving the reasonable assurance objective except for unremediated QC

deficiencies that have a severe but not pervasive effect on the design, implementation,

and operation of the QC system (and do not render the QC system not effective). To

clarify, when evaluating the effect of unremediated QC deficiencies on the QC system, a

firm would evaluate whether the QC deficiencies have a severe but not pervasive effect

on each of the following: (1) the design of the QC system, (2) the implementation of the

QC system, and (3) the operation of the QC system. Therefore, with respect to the

conclusion under paragraph .77b, QC deficiencies may have a severe but not pervasive

effect on the design, implementation, or operation of the QC system; they need not have

such an effect on all three aspects of the QC system for a firm to reach the conclusion

under proposed paragraph .77b. The parenthetical statement is intended to clarify that if

QC deficiencies are so severe as to prevent the firm from achieving the reasonable

assurance objective, the appropriate conclusion would be under proposed paragraph .77c.

A firm would reach the conclusion set forth in paragraph .77c if its QC system was not

effective in achieving the reasonable assurance objective.

QC 1000 specifies that an unremediated QC deficiency is one for which remedial

actions that completely address the QC deficiency have not been fully implemented,

tested, and found effective. The Board proposed to modify the existing note to

paragraph .77 to explain that, while remedial actions must be fully implemented as of the

evaluation date, they can be tested and found effective no later than the date Form QC is

due under paragraph .79 (or, if earlier, the date Form QC is filed). The note distinguishes

between the implementation of remedial actions and the demonstration of their

effectiveness. For purposes of determining whether a QC deficiency is remediated, firms

are expected to have fully implemented remedial actions as of the evaluation date, but the

assessment of whether those actions are operating effectively may be supported by testing

their operating effectiveness after the evaluation date but before the Form QC filing date.

Commenters supported the proposed amendments to the evaluation framework

and evaluation conclusions, particularly the effort to align more closely with other quality

management standards. 201 Several commenters noted that this alignment would reduce

the complexity of managing evaluations under multiple frameworks and help avoid

potential confusion among stakeholders. 202 Two commenters observed that the threetiered conclusions framework better supports informed decision-making and meaningful

communication with stakeholders, and reflects a more accurate representation of how QC

systems operate in practice. 203 Two other commenters noted that the proposed evaluation

framework would enhance transparency by allowing firms to distinguish among varying

degrees of effectiveness, including through the use of the “except for” conclusion. 204 One

commenter further stated that the proposed evaluation framework better aligns with the

reasonable assurance objective because it clarifies that a QC system may provide

reasonable assurance even when unremediated QC deficiencies exist. 205 In addition, some

commenters indicated that the proposed conclusions in paragraph .77 were sufficiently

clear and appropriate. 206 One commenter stated the evaluation framework in proposed

paragraphs .77-.78 is generally clear but requested clarification on the latitude of firms to

201

See comment letters from AAA, Baker Tilly, BDO, CAQ, CBIZ, Deloitte, EY, Forvis, GT, ICGN,

KPMG, PICPA, Plante & Moran, PwC, and RSM.

202

See comment letters from Baker Tilly, Deloitte, EY, Forvis, and KPMG.

203

See comment letters from BDO and CBIZ.

204

See comment letters from Baker Tilly and GT.

205

See comment letter from KPMG.

206

See comment letters from GT, KPMG, and Spitters.

change their conclusions as of the evaluation date if, before the date that Form QC is

filed, a firm identifies shortcomings when further testing its remedial actions. 207

While commenters generally supported the proposed framework, one commenter

recommended expanding the “except for” category to include both “severe but not

pervasive” and “pervasive but not severe” unremediated QC deficiencies to minimize

potential blurring among the conclusion categories. 208 This commenter expressed concern

that a conclusion under paragraph .77a could be confusing because a firm may arrive at a

favorable conclusion despite having experienced significant quality control issues during

the evaluation period that were subsequently remediated. 209 The same commenter also

noted that deficiencies may take time to become apparent and suggested requiring

statements or certifications indicating that firms considered previously unidentified

deficiencies relating to prior years in their evaluations. 210 Another commenter urged the

Board to retain the “effective, with no unremediated QC deficiencies” conclusion as

originally adopted. 211 The commenter expressed concern that allowing firms to reach an

unqualified “effective” conclusion despite the existence of unremediated QC deficiencies

would broaden the circumstances in which firms may reach a favorable conclusion. 212

207

See comment letter from Kramer.

208

See comment letter from Grosvenor.

209

See id.

210

See id.

211

See comment letter from CFA.

212

See id.

One commenter supported the proposed modification to the existing note to

paragraph .77 because it provides helpful guidance and better reflects how remediation

occurs in practice. 213 Another commenter questioned whether the phrase “completely

address” in the first sentence of the note, which is not part of the proposed modification,

establishes an unnecessarily stringent standard and suggested replacing it with

“sufficiently address.” 214 Another commenter requested clarification on the description in

the release for determining whether a QC deficiency is remediated, specifically whether

the phrase “may be supported by evidence obtained from testing after the evaluation

date” refers to testing of instances that occurred before the evaluation date or the related

response activities after the evaluation date. 215 One commenter requested clarification on

how firms should assess the effect of remediation efforts when frequency constraints

preclude testing enough instances of the remedial actions in evaluating remaining QC

deficiencies. 216

In developing the proposed amendments to paragraph .77, the Board also

considered an alternative evaluation framework under which a firm would be required to

reach a binary conclusion (i.e., that its QC system is either effective or not effective in

achieving the reasonable assurance objective).

One commenter stated that a binary conclusion may be particularly appropriate

for many triennial firms and suggested that a binary framework would simplify the

213

See comment letter from KPMG.

214

See comment letter from Grosvenor.

215

See comment letter from RSM.

216

See comment letter from CBIZ.

evaluation process. 217 Another commenter stated that whether the alternative evaluation

framework with a binary conclusion is more appropriate is undefined, and it would be

appropriate and constructive to retain the factors included in paragraph .78 (which are

discussed further below) under this alternative framework. 218

Many commenters did not support the binary approach for the evaluation

framework. 219 Some commenters were concerned that it would limit firms’ ability to

communicate the nature and severity of identified deficiencies and would decrease

alignment with other quality management frameworks. 220 In addition, some commenters

stated that a binary framework could provide insufficient information regarding

significant deficiencies that are not pervasive enough to warrant a conclusion that the QC

system is ineffective. 221 Two commenters noted that a binary framework would be less

informative. 222 Another commenter expressed concern that the binary approach could

reduce the rigor of the evaluation process. 223 Another commenter stated that the existing

three-tiered conclusion structure provides more meaningful information by distinguishing

QC systems with severe but not yet pervasive QC deficiencies and serves as an important

217

See comment letter from Kramer.

218

See comment letter from Spitters.

219

See comment letters from AAA, Baker Tilly, BDO, CAQ, CBIZ, CFA, GT, ICGN, KPMG,

MIAG, PICPA, PwC, and RSM.

220

See comment letters from BDO, CBIZ, and GT.

221

See comment letters from CAQ, KPMG, and PICPA.

222

See comment letters from AAA and MIAG.

223

See comment letter from MIAG.

early-warning mechanism. 224 This commenter also stated that the middle category allows

severe but not yet pervasive unremediated QC deficiencies to be identified, escalated, and

remediated before the QC system fails. 225

After considering the comments received, the Board is adopting the amendments

to paragraph .77 as proposed.

The Board believes that unremediated QC deficiencies that are pervasive but not

severe may nevertheless allow the QC system to achieve its reasonable assurance

objective and therefore support a conclusion under paragraph .77a. The Board also

believes the evaluation framework appropriately focuses on the condition of the QC

system as of the evaluation date and provides firms with the incentive to timely and

effectively remediate identified QC deficiencies as of the evaluation date to reach a

conclusion under paragraph .77a.

The Board notes that, despite increased alignment between the evaluation

conclusions under QC 1000 and other quality management standards, the possibility

remains that firms may reach different conclusions regarding the effectiveness of their

QC systems under QC 1000 and ISQM 1 or SQMS 1. For example, there are differences

in the professional and legal requirements that apply to a firm’s audit practice under

PCAOB standards compared to other standards, including variations between applicable

auditing standards and independence requirements. The relevant populations of

engagements are different. There could also be differences relating to the individuals who

perform such engagements or perform activities within the QC system, including with

224

See comment letter from CFA.

225

See id.

regard to training and supervision. In addition, QC 1000 would continue to require a

more structured approach to the evaluation process than other standards, including

through the application of specific defined terms and factors that are required to be

considered. The Board believes this more structured approach is important both in

supporting consistent and appropriate evaluation of the QC system by firms and in

providing a foundation for PCAOB oversight in the future.

The Board does not believe that an additional certification requirement, as

suggested by one commenter, is necessary because QC 1000 already requires firms to

consider the results of prior monitoring activities and remedial actions when determining

the nature, timing, and extent of the firm’s monitoring activities. The Board is also

retaining the phrase “completely address” in the first sentence of the note to

paragraph .77 describing the meaning of an unremediated QC deficiency. The

commenter’s suggested phrase “sufficiently address” could introduce subjectivity

regarding whether a QC deficiency has been adequately remediated. The Board believes

the phrase “completely address” conveys the expected level of remediation necessary

before concluding that a QC deficiency is fully remediated.

With respect to requests for clarifications of (i) the phrase “may be supported by

evidence obtained from testing after the evaluation date” and (ii) frequency constraints on

testing remedial actions, the note to paragraph .77 distinguishes between the

implementation of remedial actions and the demonstration of their effectiveness. For

purposes of determining whether a QC deficiency is remediated, firms are expected to

have fully implemented remedial actions as of the evaluation date, but the assessment of

whether those actions are operating effectively may be supported by testing their

operating effectiveness after the evaluation date but before the Form QC filing date. For

example, when a remedial action has been implemented prior to the evaluation date but

evidence from multiple instances of operation is needed to conclude that the remediation

is effective, the firm may test one or more instances of operation of the remedial action

that took place after the evaluation date but before the filing of Form QC to demonstrate

effectiveness of the remedial action. However, if multiple instances of operation are

needed to conclude that a remedial action is effective and, due to frequency constraints,

only one instance of operation can be tested before the filing of Form QC, then the QC

deficiency would be considered an unremediated QC deficiency.

Regarding the requested clarification of a firm’s ability to change its conclusion

on QC effectiveness between the evaluation date and the date Form QC is filed, the

Board notes that the firm’s final conclusion about the effectiveness of its QC system is

the conclusion reported on Form QC. When additional information related to the QC

system as of the evaluation date becomes available before Form QC is filed, the firm is

expected to evaluate that information and make appropriate determinations regarding the

information in a timely manner and report any relevant conclusions it reaches.

iv. Evaluating the severity and pervasiveness of unremediated QC

deficiencies

As originally adopted, QC 1000.78 includes the concept of a “major QC

deficiency” and provides presumptions and factors to determine whether a major QC

deficiency exists and, therefore, the QC system is not effective. The Board proposed to

eliminate the concept of a “major QC deficiency,” including the associated presumptions.

The Board proposed to retain, in modified form, the factors to consider in evaluating the

severity and pervasiveness of unremediated QC deficiencies.

Specifically, the Board proposed to amend paragraph .78 to require firms to

evaluate the severity and pervasiveness of unremediated QC deficiencies in reaching the

evaluation conclusion under paragraph .77. Proposed paragraph .78 clarifies that the

firm’s evaluation would consider all unremediated QC deficiencies individually and in

combination, considering both quantitative and qualitative implications. The proposed

paragraph .78 also describes severity and pervasiveness for purposes of this evaluation.

Severity reflects the seriousness of a QC deficiency or combination of QC deficiencies,

including the potential impact on the firm’s ability to achieve the reasonable assurance

objective. Pervasiveness reflects the breadth of impact of the QC deficiency or

combination of QC deficiencies on the QC system or across the firm’s portfolio of

engagements.

Commenters generally supported removing the concept of a “major QC

deficiency” from QC 1000. 226 Some commenters noted that the concept constituted a

fundamental departure from other quality management standards and reduced consistency

across quality management frameworks. 227 One commenter stated that the removal of the

major QC deficiency concept and related presumptions could reduce the information

value of the evaluation conclusions and lessen the prominence with which serious QC

issues are escalated and communicated. 228 The commenter urged the Board to preserve

226

See comment letters from BDO, CAQ, GT, KPMG, PICPA, RSM, and Spitters.

227

See comment letters from GT, KPMG, PICPA, and RSM.

228

See comment letter from CFA.

escalation presumptions in some form and clarify how serious QC issues that fall short of

overall ineffectiveness will be escalated and communicated if the “major QC deficiency”

concept is removed. 229

Some commenters supported the factors used to evaluate the severity and

pervasiveness of unremediated QC deficiencies, stating that the factors promote

consistency and rigor in the evaluation process. 230 One commenter stated that the factors

in proposed paragraph .78 appropriately address QC deficiencies individually and

collectively and account for both qualitative and quantitative considerations. 231

One commenter stated that considering deficiencies “in combination” when

assessing severity may blur the distinction between the concepts of severity and

pervasiveness. 232 The same commenter also indicated that this distinction may be further

blurred because the same factors are used to evaluate both severity and pervasiveness. 233

Another commenter supported the objective of providing a structured framework for

evaluating the severity and pervasiveness of unremediated QC deficiencies but viewed

proposed paragraph .78 as overly complex and prescriptive. 234 The same commenter

suggested an alternative model for paragraph .78, incorporating concepts from the

AICPA Peer Review Program guidance for evaluating deficiencies, that would focus on

229

See id.

230

See comment letters from BDO, CAQ, GT, and KPMG.

231

See comment letter from Spitters.

232

See comment letter from Grosvenor.

233

See id.

234

See comment letter from PICPA.

the nature, cause, and effect of the deficiency, including: (1) whether the deficiency is an

isolated event or a systemic weakness; (2) the significance of the deficiency to the firm’s

practice, including the likelihood to affect other engagements or components of the QC

system; (3) the effect of the deficiency on the firm’s ability to achieve the reasonable

assurance objective; and (4) the extent to which remedial actions have been implemented

and demonstrated to be effective. 235

The Board does not believe that removing the major QC deficiency concept

removes the framework’s ability to identify and appropriately distinguish particularly

severe QC deficiencies. Under the amended evaluation framework, firms would still be

required to evaluate the severity and pervasiveness of all unremediated QC deficiencies,

individually and in combination, and report information regarding unremediated QC

deficiencies in Form QC regardless of the evaluation conclusion reached. The evaluation

conclusions in paragraph .77 and the factors in paragraph .78 would provide a structured

framework for identifying and assessing unremediated QC deficiencies and for

communicating unremediated QC deficiencies to the PCAOB. Further, the conclusion

under paragraph .77b can only be selected when unremediated QC deficiencies have a

severe but not pervasive effect on the QC system and also do not render the QC system

not effective. As reflected in the parenthetical statement in paragraph .77b, if

unremediated QC deficiencies are so severe as to prevent the firm from achieving the

reasonable assurance objective, the firm would be required to conclude under

paragraph .77c that its QC system is not effective in achieving the reasonable assurance

objective.

235

See id.

The Board believes it is important to consider unremediated QC deficiencies both

individually and in combination because doing so may reveal patterns of similar findings

or indicate a broader issue that may not be evident from evaluating each deficiency in

isolation. The Board also believes that allowing the same factors to inform assessments of

both severity and pervasiveness provides firms with relevant information for their

evaluations. In many cases, it may not be practicable to categorize a factor as relating

exclusively to either severity or pervasiveness. Additionally, the Board believes the

alternative factors for evaluating deficiencies, suggested by one commenter, are already

reflected in paragraph .78 as proposed. The factors in paragraph .78 are intended to assist

firms in performing the internal evaluation required to reach a conclusion under

paragraph .77. The Board believes the approach in paragraph .78 provides clear direction

to firms in evaluating the severity and pervasiveness of unremediated QC deficiencies.

One commenter noted that the term “component” in proposed paragraph .78a is

undefined and could be unclear and recommended that the standard more explicitly link

the term to the eight integrated components of a firm’s QC system described in QC

1000.03, either through a cross-reference or by using consistent terminology. 236 To

clarify the intended meaning of the term “component” in proposed paragraph .78a, the

Board is revising the paragraph to refer to the “components of the firm’s QC system.”

Another commenter questioned if the factor of persistence in paragraph .78d

affects the evaluation of severity and pervasiveness and provided an example of an issue

that persists unchanged for three years. 237 The Board continues to believe that the

236

See comment letter from Kramer.

237

See comment letter from Grosvenor.

persistence of a deficiency may provide useful information in assessing its severity and

pervasiveness. However, persistence alone may not determine the severity or

pervasiveness of a QC deficiency, and those assessments depend on the particular facts

and circumstances as well as other factors in paragraph .78.

Another commenter stated that the proposed amendments to paragraphs .78e-f

introduce the phrase “or could result in” and expressed concern that the use of “could”

may imply an evaluation threshold approaching absolute assurance because it

encompasses even remote possibilities. 238 This commenter suggested revising the

language to refer instead to circumstances “where there is a reasonable possibility.” 239

The factors to consider in evaluating the severity and pervasiveness of unremediated

deficiencies do not relate to providing any level of assurance. They are intended to help

the firm evaluate how severe or pervasive unremediated QC deficiencies are in

performing the evaluation and reaching a conclusion regarding the effectiveness of the

firm’s QC system. The use of “could” in these factors is intended for the firm to evaluate

whether the unremediated QC deficiencies remaining as of the evaluation date have the

potential to cause significant engagement deficiencies or revisions of engagement reports,

or to be associated with financial statement restatements or reissuances of management

reports on internal control over financial reporting or broker-dealer compliance or

exemption reports that are the subject of the firm’s audit or attestation engagements.

One commenter expressed concern that the wording regarding the significance to

the firm’s portfolio of engagements in paragraph .78g could unintentionally imply that

238

See comment letter from KPMG.

239

See id.

some engagements are less important than others. 240 While all unremediated QC

deficiencies are required to be evaluated for severity and pervasiveness, the Board

recognizes that there may be certain engagements where unremediated QC deficiencies

are more likely to affect the firm’s overall practice under PCAOB standards due to the

engagement’s significance to the firm’s portfolio. For example, if an unremediated QC

deficiency is likely to result in engagement deficiencies that occur across the primary

industry that represents a substantial portion of the firm’s PCAOB engagements, the

unremediated QC deficiency could be severe or pervasive because of its significance to

the firm’s engagement portfolio.

Another commenter supported the factors if they continue to include

consideration of whether remedial actions have been implemented, tested, and

determined to be effective, consistent with paragraph .78h. 241

The Board is adopting the factors in paragraph .78 as proposed with the revision

made to paragraph .78a discussed above. The Board believes these factors promote

consistency by identifying circumstances that are particularly relevant in assessing the

severity and pervasiveness of unremediated QC deficiencies. The final factors with

general descriptions are:

The number and nature of components of the firm’s QC system or quality

objectives directly or indirectly affected

240

See comment letter from PICPA.

241

See comment letter from ICGN.

This factor focuses on how many components of the firm’s QC system or quality

objectives are affected, what they are, and whether the impact is direct or spread through

other components or quality objectives.

The extent to which the unremediated QC deficiency or combination of

unremediated QC deficiencies relates to a component, quality objective, or quality

response that affects the design or operation of other aspects of the QC system

This factor focuses on how widespread the impact of the unremediated QC

deficiency or combination of unremediated QC deficiencies is throughout the QC system.

The number and pervasiveness of root causes

The factor focuses on what the firm’s root cause analysis reveals about why the

QC deficiency occurred and how significantly or broadly it affects the QC system.

The persistence of the unremediated QC deficiency or combination of

unremediated QC deficiencies over time

This factor focuses on the existence of a QC deficiency or combination of QC

deficiencies that recurs or continues unremediated year over year.

Whether the unremediated QC deficiency or combination of unremediated

QC deficiencies has resulted or could result in significant engagement deficiencies

This factor focuses on whether the unremediated QC deficiency or combination of

unremediated QC deficiencies is leading to or likely to lead to significant engagement

deficiencies.

Whether the unremediated QC deficiency or combination of unremediated

QC deficiencies has resulted or could result in the need for revisions to engagement

reports, or is or could be associated with restatements of financial statements or

reissuances of company-prepared reports that are the subject of audit or attestation

engagements 242

This factor focuses on whether the unremediated QC deficiency or combination of

unremediated QC deficiencies has already led or could lead to revisions of engagement

reports, or is or could be associated with financial statement restatements or reissuances

of management reports on internal control over financial reporting or broker-dealer

compliance or exemption reports.

With respect to the factors in subparagraphs d-f, the number and

significance (to the firm’s portfolio of engagements) of engagements that are affected by

the unremediated QC deficiency or combination of unremediated QC deficiencies or are

likely to be affected in the future in the absence of remediation, and the nature of the

effect

This factor focuses on how important the affected engagements are compared to

the firm’s overall practice under PCAOB standards. The number and significance of

affected engagements to the firm’s portfolio of engagements depends on, for example,

firm personnel affected or likely to be affected, the associated revenue or profit, the

associated risks, and the relevant industry.

The effects of any remedial actions that have been implemented, tested,

and found to be effective

Before the annual evaluation date, a firm may implement remedial actions that

may reduce the severity or pervasiveness of an unremediated QC deficiency while not

242

Company-prepared reports subject to audit or attestation engagements include the report on

internal control over financial reporting and broker-dealer compliance and exemption reports.

completely addressing it. For a firm to take credit for the effects of these remedial

actions, they would need to be implemented as of the evaluation date, and they would

need to be tested and found to be effective before Form QC is due and filed. For example,

in response to a QC deficiency related to a problem identified with a firm’s audit

software, the firm designs and implements five remedial actions as of the evaluation date.

Of those five remedial actions, two remedial actions have been tested and found to be

effective before Form QC is due and filed. When determining the severity and

pervasiveness of the unremediated QC deficiency, the firm can consider the effects of the

two remedial actions that have been tested and found to be effective.

The process flow that follows illustrates how to apply the above considerations in

reaching one of the three evaluation conclusions in paragraph .77.

2. REPORTING TO THE PCAOB

i. Reporting on the annual evaluation of the effectiveness of the

QC system

As originally adopted, QC 1000 provides that firms have until November 30 each

year to report to the PCAOB on Form QC the outcomes of their QC system evaluations,

based on a fixed evaluation date of September 30. This provides firms with 61 days after

the evaluation date of September 30 to file Form QC. Based on the proposed amendment

to permit firms to select their own evaluation dates, the Board proposed to amend the due

date of Form QC in paragraph .79 to 60 days after the firm’s chosen evaluation date. The

Board also proposed to amend the Form QC reporting rule, PCAOB Rule 2203A, Report

on the Evaluation of the Firm’s System of Quality Control, and General Instruction 3 to

Form QC to reflect this proposed amendment (see below).

Commenters generally supported the proposed amendments to paragraph .79,

Rule 2203A, and Form QC. 243

One commenter expressed concern related to the 60-day reporting deadline for

Form QC, stating that, for many smaller firms, completing the annual evaluation of the

system of quality control, hiring and coordinating external resources, obtaining the

necessary internal reviews and approvals, and preparing the required report within 60

days may not be practicable. 244 This commenter recommended that the Board adopt a

more scalable approach, for example, by permitting firms below an appropriate threshold

to file Form QC within 180 days of their evaluation date. 245 In allowing firms to select

their own evaluation date, the Board believes it is appropriately providing firms with the

ability to select a date that works best for their business cycles; however, the Board also

243

See comment letters from BDO, CFA, Crowe, EY, GT, KPMG, Spitters, and VSCPA.

244

See comment letter from PICPA.

245

See id.

believes that timely receipt by the PCAOB of information contained in Form QC to

support the Board’s oversight activities requires a shorter timeline than this commenter

suggested. The Board continues to believe that the 60-day filing requirement provides

firms with sufficient time from the evaluation date to the reporting date to complete their

evaluation and report to the PCAOB.

The Board also proposed an amendment to General Instruction 4 to Form QC to

clarify the reporting period covered by the firm’s evaluation. As proposed, the reporting

period would be the period beginning the day after the most recent previous evaluation

date and ending on the evaluation date, with the following exceptions as to the beginning

of the reporting period:

•

If a firm has not previously been required to evaluate its QC system under

QC 1000, the reporting period is the period beginning on the date the firm first

incurred an obligation to design, implement, and operate a QC system under

QC 1000.06.

•

If a firm was previously required to evaluate its QC system under QC 1000,

but such obligation lapsed because the firm ceased having any obligations

under applicable professional and legal requirements with respect to one or

more engagements, the reporting period is the period beginning when the firm

subsequently incurred an obligation to design, implement, and operate a QC

system under QC 1000.06.

Under this proposed amendment, the reporting period would generally be twelve

months long, but it would be longer or shorter if the obligation to design, implement, and

operate the QC system arises mid-period (whether by virtue of the effective date of

QC 1000 or the firm’s otherwise becoming subject to the requirement to design,

implement, and operate a QC system). For example, for a firm that selects March 31 as

its evaluation date, upon the effective date of QC 1000 the firm’s first evaluation would

cover the reporting period from December 15, 2026, to March 31, 2028, resulting in a

greater-than-15-month reporting period, with the first Form QC due to be filed no later

than 60 days following March 31, 2028. This is because as of March 31, 2027, the firm

would not have been subject to the requirement to design, implement, and operate a QC

system for at least five consecutive months (under the five-month threshold in

paragraph .77 discussed above). By contrast, for a firm that selects May 31 as its

evaluation date and is subject to QC 1000 on the standard’s effective date, this firm’s first

evaluation would cover approximately five and a half months beginning on December 15,

2026, and ending on May 31, 2027, with the first Form QC due to be filed no later than

60 days following May 31, 2027.

The proposed amendment to General Instruction 4 did not draw comment.

The Board is adopting as proposed the amendments to paragraph .79, PCAOB

Rule 2203A, and Form QC described above.

One commenter stated that two important elements of Form QC reporting would

be lost with the removal of the “major QC deficiency” concept: (1) the requirement to

flag whether each unremediated deficiency is major, and (2) the narrative required where

a major deficiency is presumed but determined not to exist. 246 This commenter requested

that the Board preserve equivalent signals under the proposed evaluation framework and

require that firms (1) indicate, for each unremediated QC deficiency, whether the firm

246

See comment letter from CFA.

assessed it as severe, and (2) explain the basis for any determination that severe

deficiencies do not, individually or in combination, render the QC system not

effective. 247 QC 1000 continues to require that firms report all unremediated QC

deficiencies as of the evaluation date on Form QC, regardless of the conclusion reported

under paragraph .80a. Accordingly, a firm’s Form QC reporting must include any

unremediated QC deficiencies identified as of the evaluation date, including QC

deficiencies that were determined not to be severe or pervasive. The Board continues to

believe that reporting of all unremediated QC deficiencies will inform various aspects of

the Board’s oversight activities. Upon receipt of a Form QC, the PCAOB will have the

ability to perform further inquiries of a firm regarding any of the information provided.

Additionally, the firm is required to document under paragraph .82d the basis for the

conclusion reached under paragraph .77, which would include the firm’s evaluation of the

severity and pervasiveness of unremediated QC deficiencies, and this information would

be available to the PCAOB in connection with its oversight activities, including

inspections. 248

Based on the amendments described above, the Board is adopting additional

conforming amendments to paragraph .80 and Form QC, substantially as proposed. 249

The Board is also adopting amendments to paragraph .80 and Form QC to replace the

language “the issuance of unsupported opinions” with “significant engagement

247

See id.

248

See PCAOB Rule 4000(b), General.

249

Note 1 to Item 3.2 within Form QC is amended to include a reference to the evaluation date. Also,

language related to Exhibit 3.2.b in Part VII of Form QC is amended to refer to individuals

“assigned” operational responsibility and accountability for the firm’s QC system as a whole.

deficiencies,” consistent with the amendments to QC 1000.68a described above, as

proposed.

ii. Reporting changes to the firm’s evaluation date

Under the amendments to QC 1000.77, as discussed above, each firm selects its

own evaluation date. The Board proposed that any change in the evaluation date, together

with a brief statement of the firm’s rationale for making the change, be reported on Form

QC within 30 days after the firm’s decision. The Board believes this information would

inform the timing of the Board’s oversight efforts.

To codify this requirement, the Board proposed to recaption Rule 2203A as

“Reporting on the Evaluation of the Firm’s System of Quality Control,” amend paragraph

(a) of Rule 2203A to require notification of a change in the evaluation date on Form QC,

and amend paragraph (b) of Rule 2203A to require such notification to be filed no later

than 30 days after the firm’s decision to change the evaluation date.

Relatedly, the Board proposed to amend Form QC to add a new Item 1.2, Change

to the Evaluation Date, for providing notice of a change to the evaluation date, including

the new evaluation date and a brief statement of the rationale for making the change.

Additional language was also proposed to be added to General Instruction 3 to explain

that Form QC is required to be filed no later than 30 days after the firm’s decision to

change the evaluation date and that a notification of change in the evaluation date need

only include a completed Part I and the signed certification in Part V of Form QC.

Several commenters expressed support for the proposed reporting changes

regarding the firm’s evaluation date. 250 Some commenters requested additional

250

See comment letters from CFA, GT, and KPMG.

clarifications regarding (1) whether the firm should use business days or calendar days

when calculating the deadline for submitting Form QC to notify the Board of a new

evaluation date, (2) changes in the firm’s evaluation date (for example, due to mergers or

acquisitions), and (3) changing an evaluation date after the first year of

implementation. 251 Because the deadline for submitting Form QC is greater than seven

days, the 30-day submission deadline when providing notice of a new evaluation date is

based on calendar days, taking into account the exception that applies if the last day of

the 30-day period is a Saturday, Sunday, or Federal legal holiday. 252 Additionally, the

standard does not limit when a firm can change its evaluation date, but a change to a

firm’s evaluation date would likely involve significant changes to many aspects of the

firm’s QC processes, so a firm will need to consider the implications to its QC system of

making such a change. As noted above, if the firm decides to change its evaluation date,

the change must be reported on Form QC within 30 days after the firm’s decision,

together with a brief statement of the firm’s rationale for the change.

The Board is adopting these amendments as proposed.

DOCUMENTATION

As originally adopted, QC 1000 provides firms until December 14 following the

firm’s annual evaluation to assemble for retention a complete and final set of QC

documentation.

251

See comment letters from Baker Tilly, BDO, CAQ, and Plante & Moran.

252

See PCAOB Rule 1002, Time Computation; see also PCAOB Rule 2203A, which states that

pursuant to Rule 1002, in any year in which the filing deadline falls on a Saturday, Sunday, or

Federal legal holiday, the deadline for filing Form QC shall be the next day that is not a Saturday,

Sunday, or Federal legal holiday.

The Board proposed amendments to QC 1000.84 to clarify that the QC

documentation should be completed and retained “in a manner that permits timely

retrieval,” rather than “assembled for retention,” by the QC documentation completion

date. Documentation is considered timely retrievable when it is made available in a

manner that does not hinder an experienced auditor’s ability to understand the design,

implementation, and operation of the QC system during a particular evaluation period in

accordance with QC 1000.83b and the accompanying note. In addition, in conjunction

with the amendments to paragraphs .77 and .79 of QC 1000, which permit firms to select

their own evaluation date and require them to report on that evaluation no later than 60

days after that date, the Board proposed to amend the QC documentation completion date

to be 14 days after Form QC is filed (or due to be filed, if earlier).

Many commenters supported the proposed amendments to paragraph .84 253 but

some stated they continue to have concerns regarding the scope of the documentation

requirements, particularly the extent of documentation required to be retained. 254 One of

these commenters raised concerns regarding the clarity and practical application of

“timely retrieval of documentation” that is not maintained in the quality monitoring tool

and stated that firms would otherwise need to identify, monitor, and retain documentation

across a broad range of decentralized locations. 255 One commenter stated that, while they

did not object to the proposed amendments, the proposed amendments did not address a

key issue related to real-time systems, namely, that such systems may not allow for the

253

See comment letters from AAA, Baker Tilly, BDO, Forvis, GT, KPMG, MIAG, PICPA, PwC, and

Spitters.

254

See comment letters from Baker Tilly, GT, PICPA, and PwC.

255

See comment letter from GT.

reconstruction of information back to a specific point in time unless versions are archived

or captured otherwise. 256 Another commenter did not object to the proposed amendments

allowing firms to retain QC documentation within their original systems of record,

provided it remains promptly retrievable. 257

Two commenters expressed uncertainty as to the nature of the documentation

required to be retained, for example, emails or other documentation that relate to QC

processes. 258 One of these commenters requested clarification that other evidence of the

underlying documentation, such as system-generated reports or other reproducible

outputs, would meet the documentation requirements. 259 This commenter stated that the

release text in the supplemental request for comment indicated that firms were expected

to retrieve documentation from live systems “as it existed at the time that it was

considered complete,” which might not be feasible with continuously updating systems

and would appear to reintroduce the same operational challenges the proposed

amendment was intended to alleviate. 260 The other commenter stated that it was unclear

as to how to address documentation residing in systems or applications that have been

replaced during the evaluation period. 261

256

See comment letter from RSM.

257

See comment letter from CFA.

258

See comment letters from GT and KPMG.

259

See comment letter from KPMG.

260

See id.

261

See comment letter from GT.

Two commenters requested changes to documentation retention requirements,

including limiting the retention requirement to evidence generated through the firm’s

own monitoring activities and reducing the volume of documentation required to be

retained for five years. 262 Another commenter stated that the proposed amendments to

paragraph .84 do not clarify whether firms are required to retain evidence of every

instance of every response, or just those instances that were tested to support the firm’s

QC system evaluation. 263

After consideration of the comments received, the Board is adopting the

amendments to paragraph .84 as proposed.

The proposed amendments clarify that firms are afforded flexibility in

determining the manner(s) in which they retain documentation. Specifically, the proposed

amendment to this documentation requirement clarifies that firms are permitted to

maintain their QC documentation in the original system(s) of record, or in any manner or

combination of manners they deem appropriate, and do not have to undergo the

potentially costly and time-consuming process of transferring and assembling

documentation from various source systems into a single system for archiving and

retention. In addition, the Board believes that the proposed amendments clarify that it is

not necessary for the firm to implement new technology solutions for the purpose of

meeting QC 1000’s documentation requirements because the amendment makes clear

that documentation can continue to exist within the systems in which it originated or is

262

See comment letters from EY and PICPA.

263

See comment letter from RSM.

used as long as it remains available for retrieval, e.g., for purposes of subsequent

monitoring or inspection.

The Board believes the proposed amendments should provide operational relief

for firms when maintaining documentation of their QC systems. If circumstances arise,

such as when a firm decides to replace an existing system or determines that the

decentralization of a firm’s QC documentation is too broad, then a firm can maintain the

required documentation of its QC system in the manner that is most appropriate for the

firm—provided that the documentation is retained in a manner that permits timely

retrieval. QC 1000 does not impose requirements on firms with respect to the specific

systems in which QC documentation must be retained or the number of systems that

retain a firm’s QC documentation.

The Board acknowledges that a firm’s QC system is continuously operating and

the firm might not have the capability to take snapshots of system-based evidence at a

point in time or for the systems to be locked down to allow for documentation to be

archived. Therefore, the proposed amendment requires that the documentation be retained

in a manner that permits timely retrieval, but does not specify a particular approach.

Firms are not expected to continuously or periodically take snapshots of their system’s

data to meet this amended requirement. However, given that QC documentation may

reside within live systems, the firm will need to be able to access and timely retrieve

documentation sufficient to demonstrate compliance with paragraphs .81-.83 for the

applicable evaluation as of the time the documentation was considered complete. If

certain information related to the operation of the firm’s QC systems is relevant or

needed for the firm to monitor and evaluate whether a quality response operated as

intended, then the firm would need to retain that information.

In determining the nature of the QC documentation to be retained, a firm may

identify aspects within the QC system for which the evidence required to demonstrate

that the QC system was designed, implemented, or operating effectively may not entail

retention of all information that the system produces in its daily operation. For example,

rather than retaining printed copies or screenshots of the restricted entity list after each

change, the firm may produce the current listing along with a system-generated report

listing the changes after a specified date.

As noted in the QC 1000 2024 adopting release, in light of the scope of the

Board’s statutory mandate, the Board’s inspection procedures cannot be limited to quality

responses (and, to the extent applicable, samples of the operation of quality responses)

that the firm chose to monitor in the period. 264 On the contrary, firms will be expected to

provide evidence of the operating effectiveness of any quality responses selected for

inspection.

As originally adopted, QC 1000 includes a requirement that the firm retain QC

documentation for seven years from the QC documentation completion date, unless a

longer period is required by law.

The Board proposed to amend paragraph .86 to reduce the QC documentation

retention period to five years from the QC documentation completion date.

264

See PCAOB Rel. No. 2024-005, at 283.

Many commenters supported the proposed amendment to paragraph .86, 265 but

some of these commenters encouraged the Board to consider whet

This text is long and has been trimmed here. Open the source document for the complete record.

This is a copy of a public record, reproduced as it was published. It is not legal advice, and it may not be the version a court would rely on. Check the official source before you cite it.