# Conformed to Federal Register version > Briefs, arguments, decisions, and more. URL: https://www.frixlaw.com/law-library/documents/agency%3Asec%3A653d433b5d9d9c06 ## Record - **Collection:** Agency decision - **Document type:** Agency decision ## Text Conformed to Federal Register version SECURITIES AND EXCHANGE COMMISSION [Release No. 34-106372; File No. PCAOB-2026-01] September 15, 2026. Public Company Accounting Oversight Board; Notice of Filing of Proposed Rules on Amendments to QC 1000, A Firm’s System of Quality Control, and Related Rule and Forms Pursuant to section 107(b) of the Sarbanes-Oxley Act of 2002 (the “Act”), notice is hereby given that on September 10, 2026, the Public Company Accounting Oversight Board (the “Board” or the “PCAOB”) filed with the Securities and Exchange Commission (the “Commission” or the “SEC”) the proposed rules described in items I and II below, which items have been prepared by the Board. On September 14, 2026, the Board filed with the Commission a technical correction to one of the proposed rules. The Commission is publishing this notice to solicit comments on the proposed rules from interested persons. I. Board’s Statement of the Terms of Substance of the Proposed Rules On September 9, 2026, the Board adopted proposed rule amendments to QC 1000, A Firm’s System of Quality Control, related amendments to PCAOB Rule 2203A, PCAOB forms, and technical amendments to AS 2101, Audit Planning. (collectively, the “proposed rules”). On September 11, 2026, the Board adopted a technical correction to the proposed rule amendments to QC 1000. The text of the proposed rules appears in Exhibit A to the SEC Filing Form 19b-4 and is available on the Board’s website at https://pcaobus.org/about/rules-rulemaking/rulemakingdockets/docket-057. II. Board’s Statement of the Purpose of, and Statutory Basis for, the Proposed Rules In its filing with the Commission, the Board included statements concerning the purpose of and basis for the proposed rules and discussed any comments it received on the proposed rules. The text of these statements may be examined at the places specified in Item IV below. The Board has prepared summaries, set forth in sections A, B, and C below, of the most significant aspects of such statements. In addition, to the extent necessary, the Board is requesting that the Commission approve the proposed rules pursuant to section 103(a)(3)(C) of the Act for application to audits of emerging growth companies (“EGCs”), as that term is defined in section 3(a)(80) of the Securities Exchange Act of 1934 (“Exchange Act”). The Board’s request is set forth in section D. A. Board’s Statement of the Purpose of, and Statutory Basis for, the Proposed Rules (a) Purpose The Board adopted QC 1000, A Firm’s System of Quality Control (“QC 1000”), on May 13, 2024, 1 to lead registered public accounting firms (“firms”) to significantly improve their quality control (“QC”) systems. The Board believes that, as firms prepare for the effective date of QC 1000, many such improvements have been and will continue to be implemented as firms develop more rigorous QC systems. The Board’s experience during the implementation period led us, however, to consider whether the new standard imposes costs that may not be necessary for us to achieve the Board’s regulatory goals 1 A Firm’s System of Quality Control and Other Amendments to PCAOB Standards, Rules, and Forms, PCAOB Rel. No. 2024-005 (May 13, 2024) (“QC 1000 2024 adopting release”). and, relatedly, whether there were certain aspects of QC 1000 that could be brought into closer alignment with other audit firm quality management standards. 2 The Board adopted amendments to QC 1000 that it believes address concerns regarding the implementation challenges identified by firms and better align certain provisions with other quality management standards. These amendments are designed to reduce compliance costs while maintaining the investor protection benefits of QC 1000. The principal amendments the Board adopted: • Rescind the “design-only” requirement so that QC 1000 imposes requirements only on firms that are required to comply with applicable professional and legal requirements with respect to any “engagement” as defined in QC 1000 (QC 1000.06 and .07d); • Provide increased flexibility in filling certain specified roles in the QC system by permitting roles to be assigned to non-firm personnel and divided among multiple individuals (QC 1000.12); • Rescind the requirement to have an External QC Function (“EQCF”) (QC 1000.28); • Narrow and simplify communication requirements relating to metrics that the firm communicates to external parties about its audit practice, firm personnel, or engagements (QC 1000.53e); 2 See International Standard on Quality Management (“ISQM”) 1, Quality Management for Firms that Perform Audits or Reviews of Financial Statements, or Other Assurance or Related Services Engagements (“ISQM 1”), issued by the International Auditing and Assurance Standards Board; Statement on Quality Management Standards (“SQMS”) No. 1, A Firm’s System of Quality Management (“SQMS 1”), issued by the Auditing Standards Board of the American Institute of CPAs. • With respect to identified engagement deficiencies, require evaluation of whether similar engagement deficiencies exist on other engagements only if the identified deficiency resulted or could result in (i) a failure to obtain sufficient appropriate evidence to support the conclusion reached on an engagement or (ii) an inappropriate overall conclusion on the subject matter of an engagement (QC 1000.68d); • Revise the definition of QC deficiency to make clear that, when firms have implemented more than one quality response to address the same quality risk, they can take those other quality responses (e.g., compensating responses) into account when determining whether a QC deficiency exists (QC 1000.A8); • Allow firms to select the date as of which they annually evaluate the effectiveness of their QC system, rather than requiring firms to evaluate as of September 30 (QC 1000.77); • Revise the QC system evaluation conclusions to align more closely with the conclusions in other quality management standards, while retaining a structured process, including specified factors for consideration, to guide the evaluation (QC 1000.77 and .78); and • Simplify the requirements for retention of QC system documentation and abbreviate the retention period from seven to five years (QC 1000.84 and .86). Additional amendments the Board adopted, including conforming amendments, are discussed below. Several of the amendments the Board adopted bring QC 1000 into closer alignment with other quality management standards, both internationally and in the United States. However, differences remain in areas where the Board continues to believe that alternative or incremental provisions of QC 1000 better address its legal and regulatory environment, the needs and priorities of the Board’s stakeholders, and the Board’s statutory mandate of protecting investors and the public interest. QC 1000 and the related amendments to PCAOB standards, rules, and forms adopted in 2024 will take effect on December 15, 2026. If approved by the SEC, the amendments to QC 1000 that the Board adopted and the related amendments to a PCAOB rule and PCAOB forms will also take effect on December 15, 2026. The proposed rules also include technical amendments to AS 2101, Audit Planning, to remove references to an auditing standard that was rescinded by another rulemaking. 3 The Board adopted these amendments as final due to their technical nature, and the Board did not seek public comment on these amendments. These amendments will be effective upon SEC approval. (b) Statutory Basis The statutory basis for the proposed rules is Title I of the Act. B. Board’s Statement on Burden on Competition Not applicable. The Board’s consideration of the economic impacts of the proposed rules is discussed in section D below. C. Board’s Statement on Comments on the Proposed Rule Change Received from Members, Participants, or Others 3 See General Responsibilities of the Auditor in Conducting an Audit and Amendments to PCAOB Standards, PCAOB Rel. No. 2024-004 (May 13, 2024) (rescinding AS 1015, Due Professional Care in the Performance of Work). The Board released proposed rule amendments for public comment on June 9, 2026, in its release titled Supplemental Request for Comment: Proposed Amendments to QC 1000, A Firm’s System of Quality Control, and Related Rule and Forms, PCAOB Release No. 2026-002. The Board received 25 comment letters in response to that supplemental request for comment. See Comment Letters for Docket 057, https://pcaobus.org/about/rules-rulemaking/rulemaking-dockets/docket-057/commentletters. The Board also received 26 comment letters in response to a request for public comment on the PCAOB strategic priorities, identified at footnote 12 below, and 4 comment letters in response to a request for public comment on PCAOB standard setting, identified at footnote 289 below, and 1 comment letter in response to a request for public comment on the Draft 2026-2030 Strategic Plan Goals and Objective, identified at footnote 300 below, which all raised comments specifically to QC 1000, among other things. See Comment Letters on the PCAOB website available at https://pcaobus.org/about/strategic-plan-budget/public-comments-on-pcaob-strategicpriorities, https://pcaobus.org/oversight/standards/standard-setting-researchprojects/agenda-consultation--request-for-public-comment-on-pcaob-standard-setting, and https://pcaobus.org/about/strategic-plan-budget/public-comments-on-goals-andobjectives-for-pcaob-strategic-plan-2026-2030, respectively. The Board has carefully considered all comments received. The Board’s responses to the comments received, including revisions to the proposed rule amendments, are discussed below. BACKGROUND This section presents background information on this rulemaking, including recent rulemaking history and staff implementation support efforts since SEC approval of QC 1000 in September 2024. RECENT RULEMAKING HISTORY On May 13, 2024, the Board adopted QC 1000 and related amendments. They were approved by the SEC on September 9, 2024, with an effective date of December 15, 2025. 4 On August 28, 2025, to provide firms with additional time for implementation, the Board proposed to delay the effective date of QC 1000 and the related amendments to December 15, 2026, and that postponement became immediately effective. 5 The SEC received 15 comment letters in response to its notice regarding the postponement. 6 Commenters generally supported providing additional implementation time but raised concerns regarding certain provisions of QC 1000 that they viewed as more prescriptive than other quality management standards and as creating unnecessary operational complexity and cost. 4 For more details regarding the rulemaking history of QC 1000, see Rulemaking Docket No. 046 on the Board’s website, available at https://pcaobus.org/about/rules-rulemaking/rulemakingdockets/docket-046-quality-control; see also Public Company Accounting Oversight Board; Order Granting Approval of QC 1000, A Firm’s System of Quality Control and Related Amendments to PCAOB Standards, Rules, and Forms, SEC Rel. No. 34-100968 (Sept. 9, 2024). 5 See Public Company Accounting Oversight Board; Notice of Filing and Immediate Effectiveness of Proposed Rule Change Postponing the Effective Date of Amendments to Board Standards, Rules, and Forms Adopted on May 13, 2024, SEC Rel. No. 34-103803 (Aug. 28, 2025). 6 The comment letters received are available on the SEC’s webpage, available at https://www.sec.gov/comments/pcaob-2025-01/pcaob202501.htm. On July 23, 2025, and March 20, 2026, the PCAOB received letters from a firmrelated group regarding implementation of QC 1000 and related implementation challenges. 7 On March 31, 2026, the Board issued a request for public comment on the PCAOB’s strategic priorities, including future standard-setting activity. 8 Several commenters provided observations regarding QC 1000. 9 The comments relating to QC 1000 were generally consistent with themes raised in comment letters submitted to the PCAOB and SEC in connection with the extension of the effective date of QC 1000. Most commenters urged the Board to adopt or align more closely with ISQM 1, suggesting it may better support global implementation, while emphasizing that differences in structure, terminology, and prescriptive requirements in QC 1000 create operational challenges, limit firm judgment, and increase complexity for global firms. After considering feedback and information obtained through implementation support efforts, 10 on June 9, 2026, the Board issued a supplemental request for comment on potential targeted amendments to certain provisions of QC 1000 and related 7 See letter from the Center for Audit Quality dated July 23, 2025, available at https://www.thecaq.org/comment-letter-pcaob-requesting-deferral-qc-1000; and letter from the Center for Audit Quality dated March 20, 2026, available at https://www.thecaq.org/letter-to-thepcaob-on-qc1000-implementation-experience-and-costs. 8 See Request for Public Comment, PCAOB Strategic Priorities, PCAOB Rel. No. 2026-001 (Mar. 31, 2026). 9 The comment letters received are on the Board’s website, available at https://pcaobus.org/about/strategic-plan-budget/public-comments-on-pcaob-strategic-priorities. 10 See discussion below regarding PCAOB staff’s implementation support efforts, including implementation guidance, workshops, stakeholder outreach, and feedback received from firms and other stakeholders regarding QC 1000 implementation. amendments to the QC reporting rule and PCAOB forms. 11 The Board received 26 comment letters. 12 Commenters included firms and firm-related groups, investorrelated groups, and others. Firms, firm-related groups, and most other commenters generally supported the Board’s objective of making targeted amendments to QC 1000 and most of the proposed amendments, particularly those intended to increase flexibility, improve operability, reduce unnecessary compliance burdens, and better align QC 1000 with other quality management standards. 13 One investor-related group did not support the proposed amendments overall because of the proposed rescission of the EQCF requirement. 14 Other investor-related groups generally supported the proposed amendments that reduce compliance costs without reducing audit quality, but opposed the removal of the EQCF requirement, emphasizing the importance of independent oversight 11 See Supplemental Request for Comment: Proposed Amendments to QC 1000, A Firm’s System of Quality Control, and Related Rule and Forms, PCAOB Rel. No. 2026-002 (June 9, 2026) (proposing amendments to QC 1000, PCAOB Rule 2203A, and PCAOB Forms 1, 2, and QC). 12 See comment letters on the Supplemental Request for Comment from the Auditing Standards Committee, Auditing Section - American Accounting Association (July 3, 2026) (“AAA”); Baker Tilly US, LLP (July 9, 2026) (“Baker Tilly”); BDO USA, P.C. (July 9, 2026) (“BDO”); CBIZ CPAs P.C. (July 9, 2026) (“CBIZ”); Center for Audit Quality (July 9, 2026) (“CAQ”); CFA Institute (Aug. 31, 2026) (“CFA”); Council of Institutional Investors (July 9, 2026) (“CII”); Crowe LLP (July 9, 2026) (“Crowe”); Deloitte & Touche LLP (July 9, 2026) (“Deloitte”); Ernst & Young LLP (July 9, 2026) (“EY”); Forvis Mazars, LLP (July 9, 2026) (“Forvis”); George R. Kramer (July 6, 2026) (“Kramer”); Grant Thornton LLP (July 9, 2026) (“GT”); International Corporate Governance Network (July 9, 2026) (“ICGN”); James Grosvenor (July 9, 2026) (“Grosvenor”); KPMG LLP (July 9, 2026) (“KPMG”); MaloneBailey, LLP (June 26, 2026) (“Malone Bailey”); Members of the Investor Advisory Group (July 9, 2026) (“MIAG”); Pennsylvania Institute of CPAs (July 9, 2026) (“PICPA”); Plante & Moran, PLLC (July 10, 2026) (“Plante & Moran”); PricewaterhouseCoopers LLP (July 9, 2026) (“PwC”); RSM US LLP (July 9, 2026) (“RSM”); St. Charles Consulting Group (June 12, 2026) (“SCCG”); Thomas H. Spitters (July 6, 2026) (“Spitters”); and Virginia Society of CPAs (July 9, 2026) (“VSCPA”). One additional comment letter was withdrawn. 13 See, e.g., comment letters from AAA, Baker Tilly, BDO, CAQ, CBIZ, Crowe, Deloitte, EY, Forvis, Grosvenor, GT, KPMG, Kramer, Malone Bailey, PICPA, Plante & Moran, PwC, RSM, SCCG, Spitters, and VSCPA. 14 See comment letter from CII. and investor protection, and other amendments they viewed as weakening investorprotection-focused provisions of QC 1000. 15 Many commenters, particularly firms and firm-related groups, also requested implementation guidance and clarification in certain areas discussed below. 16 The Board considered all comments received on the supplemental request for comment. As discussed below, the Board is adopting the proposed amendments to QC 1000, with certain modifications. IMPLEMENTATION SUPPORT EFFORTS Since SEC approval of QC 1000, PCAOB staff have supported implementation through guidance, workshops, outreach activities, and engagement with stakeholders, which provided insight into implementation progress, challenges, and questions and informed the Board’s consideration of the proposed amendments. 17 Additionally, as part of inspection outreach activities, the Board obtained feedback on the progress made by firms in implementing QC 1000 in their QC systems. 18 15 See comment letters from CFA, ICGN, and MIAG. 16 See, e.g., comment letters from Baker Tilly, BDO, CAQ, CBIZ, Crowe, Deloitte, EY, Forvis, GT, KPMG, Kramer, Plante & Moran, RSM, SCCG, and VSCPA. 17 See PCAOB, Quality Control—Implementation Resources, available at https://pcaobus.org/oversight/standards/implementation-resources-PCAOB-standardsrules/quality-control, which includes staff guidance and other materials issued to support implementation of QC 1000 and the related amendments. 18 See section titled “Need” under “Economic Considerations” below for additional information on data received through these inspection outreach activities. As part of staff implementation support efforts, the PCAOB staff released QC 1000 Questions and Answers (“QC 1000 Q&As”) in August 2026. 19 The QC 1000 Q&As provide technical guidance on various aspects of QC 1000, including roles and responsibilities, evaluation and reporting, documentation, and other areas of designing, implementing, operating, and evaluating a firm’s QC system. The QC 1000 Q&As were developed in response to questions and requests for clarification received from firms through staff implementation support efforts and are intended to reduce uncertainty and support firms’ implementation of the standard. The QC 1000 Q&As do not address the specific topics that are the subject of the amendments to QC 1000 that the Board adopted, but they do address some questions and clarification requests on other topics that were included in comment letters submitted in response to the supplemental request for comment. As implementation continues, additional guidance, including updates to the QC 1000 Q&As, may be issued to help address other areas identified by commenters or through staff implementation support efforts. AMENDMENTS TO QC 1000, PCAOB RULE 2203A, AND PCAOB FORM QC This section describes the requirements of QC 1000, Rule 2203A, and Form QC that the Board amended. REQUIREMENT TO DESIGN, IMPLEMENT, AND OPERATE A QC SYSTEM 19 See QC 1000 Questions and Answers, available at https://pcaobus.org/oversight/standards/standard-setting-research-projects/quality-control/qc1000-questions-and-answers. As originally adopted, QC 1000.06 requires all firms to design a QC system that complies with the standard, regardless of whether the firm is subject to applicable professional and legal requirements with respect to an engagement as defined in QC 1000. As explained in the supplemental request for comment, the Board understands that this “design-only” requirement would impose costs on firms that do not perform engagements requiring registration under the Sarbanes-Oxley Act of 2002 (“SarbanesOxley”) 20 or PCAOB rules 21 without commensurate benefits for investors and the public. Therefore, the Board proposed to eliminate the requirement and sought comment on potential alternatives, as well as any circumstances that potentially could trigger a design requirement. As proposed in the supplemental request for comment, paragraphs .05 through .07 of QC 1000 would be revised to eliminate the separate obligation to design a QC system and would maintain unchanged the obligation to design, implement, and operate a QC system in compliance with QC 1000 when a firm is subject to applicable professional and legal requirements with respect to any of the firm’s engagements. Many commenters supported the proposal to rescind the design-only requirement. 22 One commenter stated that they did not object to rescinding the designonly requirement when a firm neither performs nor intends to perform PCAOB 20 See section 102(a) of Sarbanes-Oxley, 15 U.S.C. 7212(a). 21 See PCAOB Rule 2100, Registration Requirements for Public Accounting Firms. 22 See comment letters from AAA, Baker Tilly, BDO, CAQ, Crowe, Deloitte, GT, KPMG, Kramer, MIAG, PICPA, PwC, and RSM. But see comment letters from ICGN and Spitters. One commenter expressed support for eliminating the “design-only reporting requirement,” described as the “requirement for firms to report once a quality control system has merely been designed.” See comment letter from VSCPA. engagements. 23 One of the commenters supporting rescission stated that it did not believe registered firms should be required to comply with PCAOB standards until the firm undertakes an engagement requiring compliance with those standards and that the designonly requirement was inconsistent with the text of Sarbanes-Oxley. 24 Commenters that addressed the question of whether the Board should adopt an alternative design-only requirement generally did not support such a requirement. 25 However, one commenter stated support for a QC design requirement that included effective operation of a system of quality management under relevant standards for the jurisdiction in which the firm operates, such as ISQM 1 or SQMS 1. 26 This commenter noted that, in practice, registered firms would already maintain some form of a system of quality management to support their PCAOB registration. 27 The Board does not believe QC 1000 should explicitly require compliance with rules of local jurisdictions, as PCAOB standards generally do not impose such requirements. Another commenter noted that, although some registered firms do not conduct audits, that fact does not necessarily signify the need for an exemption from standard best practices or audit quality requirements; such firms should be subject to QC 1000 on the level of preparedness or some QC regime that parallels QC 1000 in its design, implementation, 23 See comment letter from CFA. 24 See comment letter from RSM. 25 See comment letters from AAA, BDO, GT, KPMG, Kramer, and PICPA. 26 See comment letter from RSM. 27 See id. and operation. 28 The Board does not believe that the suggestion to base a design-only requirement on a level of preparedness or a system paralleling QC 1000 is workable because it is too vague as to the requirements that would apply to firms not performing PCAOB engagements. Commenters raised concerns over the costs of the design-only requirement in relation to the benefits. 29 One commenter stated that the requirement would have resulted in unnecessary costs of compliance without commensurate benefits. 30 Another commenter similarly stated that requiring firms not performing PCAOB engagements to comply with the design-only requirement did not provide a commensurate benefit to investor protection, as such firms do not present risk to U.S. capital markets. 31 Another commenter stated that requiring firms to build compliance infrastructure for work they may never undertake imposes cost without a corresponding investor benefit. 32 Another commenter observed that, because firms performing engagements would be fully subject to the requirement to design, implement, and operate a QC 1000-compliant system, rescinding the requirement for firms not performing such work would preserve the Board’s objective of promoting high-quality audits, while reducing unnecessary burdens for those firms. 33 Another commenter stated that, while the value to the public of the 28 See comment letter from Spitters. 29 See, e.g., comment letters from KPMG, PICPA, and PwC. 30 See comment letter from PwC. 31 See comment letter from KPMG. 32 See comment letter from CFA. 33 See comment letter from GT. design-only requirement was unclear, the costs would be real in the form of training costs, consulting costs, and professional time. 34 Other commenters noted the limited benefits of the requirement for investors, stating that rescission would not diminish investor protection 35 or introduce any risk to investors, 36 or that retaining the requirement would not help ensure improved audit quality. 37 Two commenters also raised concerns about requiring firms to address hypothetical situations. One of these commenters stated that it would be difficult for a firm not subject to applicable professional and legal requirements with respect to any engagement to design a QC system based on hypothetical circumstances. 38 The second commenter stated that such a firm’s QC system “would be hypothetical at best and would likely become obsolete over time as practice conditions change, leading to the false pretense that [the firm is] in a position to immediately implement these standards.” 39 The Board is rescinding the design-only requirement and adopting paragraphs .05 through .07 as proposed. 40 The Board believes rescinding the design-only requirement will reduce costs for firms without any significant detriment to audit quality. 34 See comment letter from PICPA. 35 See comment letter from GT. 36 See comment letter from Baker Tilly. 37 See comment letter from PICPA. 38 See comment letter from AAA. 39 See comment letter from PICPA. 40 As noted in the supplemental request for comment, the Board does not believe that this action would violate the mandate in section 103(a)(2)(B) of Sarbanes-Oxley, 15 U.S.C. 7213(a)(2)(B), to adopt requirements “for every registered public accounting firm” that address certain enumerated areas in “the quality control standards that [the PCAOB] adopts with respect to the issuance of audit reports.” Under the Board’s approach, QC 1000 will apply to every firm with respect to the As confirmed by commenter feedback, implementing the design-only requirement has proven more difficult and costly than originally anticipated. The requirement may compel some firms that have no intention of performing PCAOB engagements in the foreseeable future to design a QC 1000-compliant system, perhaps based on hypothetical circumstances. As described in the supplemental request for comment, the Board believes that the design-only requirement may have contributed to an increase in withdrawals from registration by firms that are not performing engagements. Although the impact of such activity on the marketplace (discussed below in the economic analysis) may be limited, the Board believes investors and the public interest are better served by incentivizing firms to register and consider seeking PCAOB engagements, thereby promoting competition. 41 In the Board’s view, rescission of the design-only requirement would entail foregoing the benefits associated with greater preparedness of firms to take on a PCAOB engagement for the first time. The Board believes this benefit to be modest, as any firm that actually takes on such an engagement will have become subject to the requirement to design, implement, and operate a QC 1000 system. 42 In any event, and as noted by one issuance of “audit reports” (which are limited under Sarbanes-Oxley to those relating to audits of issuers and broker-dealers). 41 As noted in the supplemental request for comment, some firms may register with the Board to perform activities not subject to the PCAOB’s jurisdiction. See, e.g., Guiding and Establishing National Innovation for U.S. Stablecoins Act, Pub. L. No. 119-27 (July 18, 2025), section 4(a)(3)(A), 12 U.S.C. 5903(a)(3)(A) (requiring month-end reports of permitted payment stablecoin issuers to be examined by a PCAOB-registered firm). 42 Firms could still choose to design (and for that matter, implement and operate) a QC system that complies with QC 1000. Firms may choose to do so if, for example, they are planning to bid for a PCAOB engagement, are taking on work on other firms’ engagements that could potentially constitute a substantial role, or otherwise want to put themselves in a position to implement and operate a QC 1000-compliant system on short notice. commenter, registered firms that do not perform PCAOB engagements are generally well-positioned to implement QC 1000 if or when required to do so. 43 This is so because most such firms, as some commenters observed, are generally either non-U.S. firms subject to international auditing standards or U.S.-based firms that conduct private company audits under the standards of the Auditing Standards Board of the American Institute of CPAs (“AICPA”); as such, those firms would be subject to ISQM 1 or SQMS 1, which both share a common basic structure with QC 1000. 44 Finally, as stated in the supplemental request for comment, the investor protection concerns encompassed by the Board’s statutory mandate are reduced where a firm is not performing PCAOB engagements. Based on the above considerations, the Board decided not to adopt any of the design-only alternatives discussed in the supplemental request for comment. The Board also considered whether to include provisions in QC 1000 specifying an earlier trigger for the requirement to design, implement, and operate a QC 1000compliant system under QC 1000.06-.07. In this regard, one commenter encouraged the Board to consider whether compliance with QC 1000 after its December 15, 2026 effective date could be tied to an established evaluation period and measurement date rather than a specific triggering event. 45 The same commenter suggested that under such an approach, a firm would determine at the beginning of its selected evaluation cycle 43 See comment letter from KPMG. 44 See comment letters from AAA, CAQ, KPMG, and PwC. 45 See comment letter from BDO. whether it is required to comply with QC 1000 during that period. 46 Another commenter stated that a firm must have “an appropriately designed and operational QC system before accepting or commencing PCAOB audit work.” 47 Another commenter suggested that “a QC system must be in place prior to a firm tendering an offer for a public company audit and/or getting registered.” 48 Another commenter requested that the Board specify an earlier trigger—for example, when a firm bids for or is appointed to issuer or broker-dealer work—by which time a compliant QC system must be designed and operating, well in advance of the firm commencing that work. 49 While an earlier trigger may promote readiness by firms to commence PCAOB engagements, the Board expects that the effort required to design, implement, and operate a QC 1000-compliant system may vary significantly across firms. That variation could arise from several different factors, including the status of their existing QC systems, the nature of their assurance practice (if any), the experience of their personnel, and the nature of their governance systems, operating processes, and technology, among other things. The Board also understands that some firms may pursue engagements for issuers and broker-dealers months, or even years, before these firms are awarded and commence such work. In light of these considerations, it may not be necessary in all circumstances for a firm to have a QC system that fully complies with QC 1000 before it pursues an issuer or broker-dealer engagement that might not be awarded to it or that might not 46 See id. 47 See comment letter from MIAG. 48 See comment letter from ICGN. 49 See comment letter from CFA. commence for a significant period of time. Therefore, the Board believes that requiring firms to design, implement, and operate a QC 1000-compliant system when a firm becomes subject to applicable professional and legal requirements with respect to any engagement is appropriate, and an earlier trigger is not warranted. ROLES AND RESPONSIBILITIES 1. ASSIGNMENT OF ROLES AND RESPONSIBILITIES As originally adopted, QC 1000 requires that the operational roles and responsibilities specified in paragraph .12 be assigned only to “firm personnel.” 50 The note to paragraph .12 provides that responsibility for the roles in subparagraphs a-c cannot be shared and is required to be assigned to only one individual, to reinforce that the individual assigned to a specified role would be responsible and accountable for the role. The Board proposed amendments to paragraph .12 to allow flexibility in assigning the specified roles and responsibilities to any individual (whether firm personnel or an “other participant” 51), rather than limiting those roles and responsibilities to firm personnel. In connection with that change, the Board proposed a new footnote 5A to paragraph .12 to clarify that such individuals would be “associated persons” of the firm. As the Board explained in the supplemental request for comment, any individual who was not already an associated person would become an associated person by virtue of that 50 See QC 1000.A5. 51 See QC 1000.A7. assignment. 52 The proposed amendments would align with ISQM 1 and SQMS 1 by permitting any qualified individual to fill the specified QC system roles. To preserve the accountability and responsibility objectives of paragraph .12, the Board also proposed an amendment to emphasize that the individuals assigned specific roles understand and be accountable for their roles and responsibilities. The Board also proposed an amendment to the note to paragraph .12 to allow firms to divide the responsibilities of a role specified in paragraph .12 among multiple individuals. The proposed amendments align with ISQM 1 and SQMS 1. Commenters generally supported allowing the specified roles to be assigned to other participants and divided among multiple individuals. 53 Many commenters indicated the amendments would promote audit quality, for example, by enabling the firm to place the most experienced and qualified individuals in those roles. 54 Several commenters also supported allowing firms the flexibility to assign roles and responsibilities to multiple individuals based on their specialized expertise and capacity, including within their existing structures, while maintaining accountability. 55 Several commenters stated that the proposed amendments to paragraph .12 were sufficiently clear and appropriate. 56 52 See PCAOB Rule 1001(p)(i). 53 See comment letters from AAA, Baker Tilly, BDO, CAQ, CBIZ, Crowe, Deloitte, EY, Forvis, GT, ICGN, KPMG, Kramer, MIAG, PICPA, PwC, RSM, SCCG, and Spitters. 54 See comment letters from CAQ, Deloitte, GT, KPMG, MIAG, PICPA, RSM, SCCG, and Spitters. 55 See comment letters from AAA, Baker Tilly, CAQ, CFA, EY, GT, KPMG, and SCCG. 56 See comment letters from GT, KPMG, MIAG, RSM, and Spitters. A commenter stated that the proposed amendments would be especially helpful to firms that issued audit reports with respect to less than 100 issuers. 57 Another commenter supported the addition of footnote 5A, which clarifies that an individual assigned operational responsibility for any of the roles in paragraph .12 would become an associated person of the firm by virtue of that assignment. 58 One commenter recommended retaining clear firm-level accountability and documentation requirements to avoid diffusion of responsibility. 59 Another commenter recommended the final standard require clear identification of those ultimately responsible for the QC system and key QC areas; this commenter further suggested that the PCAOB encourage firms to consider the firms’ retirees for QC system roles, as such individuals would provide valuable experience. 60 One commenter did not support assigning roles to individuals outside the firm because individuals outside the firm may have conflicting interests, and they cannot provide the day-to-day ownership the roles require. 61 The same commenter stated that there remains a need for an ultimate point of accountability and there needs to be assurance that accountability is not diffused when responsibilities are divided. 62 Further, the commenter requested that whenever a QC role is divided among multiple individuals, 57 See comment letter from Kramer. 58 See comment letter from PICPA. 59 See comment letter from SCCG. 60 See comment letter from MIAG. 61 See comment letter from CFA. 62 See id. the firm’s reporting to the PCAOB identify (1) who holds ultimate responsibility and accountability for the QC system as a whole; (2) who is accountable for each function, such as ethics, independence, monitoring, and remediation; and (3) the scope of each individual’s assigned responsibilities, so that no part of any role is left unassigned. 63 As to the question of whether the flexibility afforded by the proposed amendments should be available only on a scaled basis to certain firms, many commenters generally favored applying the amendments to all firms. 64 Several of these commenters emphasized that the flexibility the proposed amendments would offer is important for firms of all sizes, although for reasons that may differ between larger and smaller firms. 65 One commenter said such flexibility appears appropriate regardless of firm size, while noting that larger firms may be better equipped to operate under a more restrictive and specialized set of requirements. 66 Another commenter stated they would not be opposed to a limited degree of scaling these requirements to address cost considerations for small and large firms. 67 After consideration of the comments received, the Board is adopting these amendments as proposed. The Board believes the flexibility afforded by the amendments should be available to all firms rather than on a scaled basis, because audit quality is enhanced when firms can assign the specified roles and responsibilities to the most 63 See id. 64 See comment letters from AAA, BDO, CAQ, CBIZ, GT, KPMG, PICPA, PwC, RSM, and Spitters. 65 See comment letters from AAA, BDO, CAQ, CBIZ, GT, KPMG, PwC, and RSM. 66 See comment letter from Kramer. 67 See comment letter from ICGN. qualified individuals, whether or not they are firm personnel. In the Board’s view, the amendments will expand the pool of individuals with the requisite experience, competence, authority, and time to serve in specified roles. For example, a firm may improve its QC system and overall audit quality by assigning to one individual operational responsibility for ethics and to another individual operational responsibility for independence, where each individual has specific expertise in their respective area. In response to commenters that recommended clear firm-level accountability and documentation when roles are divided, paragraph .27 requires a firm to establish and maintain clear lines of responsibility and supervision within the QC system, including defining authorities, responsibilities, accountabilities, and supervisory and reporting lines for roles within the firm up to and including the principal executive officer(s). Additionally, paragraph .82a requires the firm to document the lines of responsibility and supervision required by paragraph .27. In response to a commenter’s call for specific reporting to the PCAOB about divided roles, the Board notes that Item 3.1 of Form QC requires firms to disclose (1) who holds ultimate responsibility and accountability for the QC system as a whole and (2) which individual or individuals have operational responsibility for ethics and independence and for monitoring and remediation. Although the specific scope of each individual’s assigned responsibilities would not be reported, that information must be documented under paragraph .82a and would be available to the PCAOB in connection with its oversight activities, including inspections. 68 2. RESPONSIBILITIES FOR ROLES WITH OPERATIONAL RESPONSIBILITY 68 See PCAOB Rule 4000(b), General. To align with the amendments to QC 1000.12, the Board proposed conforming amendments to paragraphs .15-.17 that would acknowledge the possibility that multiple individuals could share the specified roles and clarify that such individuals’ obligations would be limited to the scope of their assigned responsibilities. In addition, the Board proposed amendments to paragraph .17b(2) through (3) to delete the communication requirements related to major QC deficiencies to align with the amendments to the evaluation requirement in paragraph .77 discussed below. Commenters who addressed these amendments supported the proposed changes to paragraphs .15-.17 and stated they are sufficiently clear. 69 Two commenters acknowledged that the conforming amendments are appropriately aligned with the revisions to paragraph .12. 70 One commenter stated the conforming amendments reinforce a more principles-based approach 71 and another commenter stated the conforming amendments increase flexibility. 72 After consideration of the comments received, the Board is adopting these conforming amendments as proposed. EXTERNAL QC FUNCTION As originally adopted, paragraph .28 of QC 1000 includes a specified quality response that requires firms with a larger PCAOB audit practice 73 to incorporate into 69 See comment letters from CAQ, GT, KPMG, PICPA, RSM, and Spitters. 70 See comment letters from GT and RSM. 71 See comment letter from GT. 72 See comment letter from KPMG. 73 Firms with a larger PCAOB audit practice are considered those firms that issued audit reports for more than 100 issuers in the prior calendar year. their governance structure an EQCF for the QC system composed of one or more persons who: • Are not partners, shareholders, members, other principals, or employees of the firm; • Do not otherwise have a commercial, familial, or other relationship with the firm that would interfere with the exercise of independent judgment with regard to matters related to the QC system; and • Have the experience, competence, authority, and time necessary to enable them to carry out the responsibilities assigned to the EQCF by the firm. The EQCF’s responsibilities include, at a minimum, evaluating the significant judgments made and the related conclusions reached by the firm when evaluating and reporting on the effectiveness of its QC system. The Board proposed rescinding the EQCF requirement based on information obtained in connection with staff implementation support efforts and outreach discussions, which revealed that implementing this requirement had proven more difficult and more costly than originally anticipated. The Board was concerned that the potential benefits may not justify the potential costs of the EQCF requirement, except potentially for the largest U.S. global network firms. Many commenters expressed support for rescinding the EQCF requirement. 74 Some of these commenters said rescission would allow firms the flexibility to utilize existing external governance structures to promote audit quality in a manner tailored to 74 See comment letters from AAA (majority of AAA committee members), Baker Tilly, BDO, CAQ, CBIZ, Crowe, Deloitte, EY, Forvis, GT, KPMG, PICPA, Plante & Moran, PwC, RSM, and VSCPA. their specific circumstances. 75 Some commenters stated that removing the EQCF requirement would not diminish the focus on quality because QC 1000 advances the objectives of strengthening trust in governance, reinforcing accountability, and supporting a commitment to quality through other provisions in the standard. 76 Other commenters offered support for the proposed rescission by asserting that existing governance structures, leadership accountability, monitoring activities, reporting processes, and PCAOB inspections already provide meaningful oversight or help promote the effective operation of the QC system. 77 In addition, many commenters observed that the costs associated with the EQCF requirement, as well as any incremental benefits to audit quality, remain uncertain. 78 Some commenters who supported removing the requirement cited significant implementation challenges and costs associated with identifying, recruiting, and onboarding individuals with the necessary expertise, independence, and availability to serve in the role. 79 Other commenters pointed to additional costs, including obtaining liability insurance and making governance-related structural changes, as further reasons to support the proposed rescission. 80 One commenter cautioned that rescission of the EQCF requirement would remove a level of assurance with respect to internal processes 75 See comment letters from BDO, CBIZ, Deloitte, EY, GT, KPMG, Plante & Moran, PwC, RSM, and VSCPA. 76 See comment letters from BDO, CBIZ, Crowe, KPMG, and PwC. 77 See comment letters from CAQ, EY, PICPA, and VSCPA. 78 See comment letters from CAQ, Deloitte, GT, KPMG, PICPA, Plante & Moran, and RSM. 79 See comment letters from BDO, CAQ, Crowe, EY, GT, PICPA, and VSCPA. 80 See comment letters from BDO, Deloitte, KPMG, PICPA, and RSM. and audit quality in firms but described the requirement as expensive, redundant, overreaching, and unnecessary. 81 Two commenters acknowledged the narrow responsibilities of an individual serving in an EQCF role, but asserted that the Board may have overstated the potential costs of the EQCF requirement by using particular benchmarks involving compensation of non-employee company directors to estimate potential costs. 82 These commenters also suggested that the Board may have understated the potential benefits of the EQCF requirement by failing to consider the ongoing trend of private equity investing in accounting firms. 83 Another commenter stated that many of the firms most likely to be affected already use external advisers and that the incremental burden of establishing the mandated function may be less substantial than the proposal implies. 84 This commenter also stated that the Board did not have direct evidence on the cost of the EQCF to firms. 85 One commenter raised concerns that the size and complexity of a large firm’s QC system would create practical constraints on the depth of engagement individuals serving in the EQCF role can achieve, thereby limiting the EQCF’s overall effectiveness and value beyond the oversight already available through existing channels. 86 Another 81 See comment letter from Spitters. 82 See comment letters from CII and MIAG. 83 See id. 84 See comment letter from CFA. 85 See id. 86 See comment letter from Deloitte. commenter supported rescission of the EQCF requirement because its current form is not scalable for firms only moderately above the 100-issuer threshold. 87 Some commenters opposed the proposed rescission of the EQCF requirement. 88 Two commenters disagreed with the PCAOB’s reasoning “that the benefits of the requirement may not justify the costs, except potentially for the largest U.S. global network firms.” 89 The same commenters, while acknowledging concerns related to potential costs, liability, and implementation, stated that some form of independent challenge remains a critical component of an effective QC system. 90 Another commenter viewed the EQCF as essential to audit quality. 91 One commenter expressed concern that rescinding the EQCF requirement would leave judgments about the firms’ QC systems entirely to the firms themselves. 92 This commenter stated the EQCF is the clearest structural safeguard against the commercial and network pressures and interests that can affect a firm’s judgments regarding its QC system. 93 This commenter further asserted that, as the PCAOB moves the focus of its audit inspections to the firm rather than the engagement level, and as private-equity ownership and other commercial pressures 87 See comment letter from Baker Tilly. 88 See comment letters from AAA (minority of AAA committee members), CFA, CII, ICGN, and MIAG. 89 See comment letters from CII and MIAG. 90 See id. 91 See comment letter from ICGN. 92 See comment letter from CFA. 93 See id. within the auditing profession continue to grow, retaining such a safeguard is particularly important. 94 Two commenters also asserted that the requirement for larger PCAOB audit practices to have an EQCF would be applicable to only five firms. 95 However, absent rescission of the EQCF requirement, 13 firms, based on 2025 data, would become subject to that requirement. 96 In responding to the question regarding an alternative threshold for the EQCF requirement, many commenters stated it was not necessary to impose the EQCF requirement on any firm, regardless of size or number of issuers audited. 97 Some commenters did not support an alternative threshold (e.g., restricting the requirement only to firms auditing more than 500 issuers) because retaining the requirement in any form would not resolve the underlying concerns about operability, costs, availability of qualified individuals, and uncertain incremental benefit. 98 Some commenters said that firms should have the flexibility to create governance structures that align with the nature and extent of their existing structure and risks of the firm. 99 One commenter stated that if the Board concludes that some relief is necessary, it is better to retain the EQCF requirement as adopted for firms auditing more than 500 94 See id. 95 See comment letters from CII and MIAG. 96 See footnote 401 for a list of the 13 firms. 97 See comment letters from Baker Tilly, BDO, Crowe, GT, PICPA, PwC, and RSM. 98 See comment letters from BDO, CAQ, GT, KPMG, PICPA, and RSM. 99 See comment letters from BDO, CAQ, Crowe, and KPMG. issuers because it would apply to the five firms where nearly all U.S. public market capitalization sits. 100 One commenter stated that if the current 100-issuer threshold were not retained, they would not oppose amending the threshold to firms that issued audit reports for more than 200 issuers during the prior calendar year, because they believe that the large revenue base received from those firms’ issuer audit clients could support the incremental costs associated with the EQCF requirement. 101 One commenter suggested retaining the EQCF requirement for firms that have accepted any form of outside investment, other than traditional debt financing, and operate through an alternative practice structure. 102 In addition, one commenter who opposed removing the EQCF requirement expressed the view that smaller firms (under 100 audits per year) should not be exempted from robust and functioning alternative EQCF requirements if the PCAOB were to scale the provisions. 103 Another commenter noted that, given the unchanged effective date of QC 1000, adopting alternative oversight frameworks could present implementation challenges and leave firms with limited time to thoughtfully design and integrate new requirements into their governance structures. 104 In the supplemental request for comment, the Board sought input on the alternative of reverting the requirement for an independent oversight function to that contained in the 2022 proposal. Several commenters did not support such an 100 See comment letter from CFA. 101 See comment letter from MIAG. 102 See comment letter from AAA. 103 See comment letter from ICGN. 104 See comment letter from KPMG. alternative. 105 One commenter stated that the 2022 proposed requirement lacked sufficient clarity and could create uncertainty regarding whether existing firm governance and oversight arrangements would satisfy such a requirement. 106 Another commenter indicated that the effect or impact of adopting the requirement as initially proposed in 2022 could not be determined. 107 One commenter did not support reverting back to the 2022 proposed requirement because it carried no defined duty to evaluate the firm’s QC conclusions—the very check the EQCF was adopted to provide. 108 After consideration of the comments received, the Board is rescinding the EQCF requirement. Based on staff implementation support efforts, the Board understands that implementation of this requirement may have proven more difficult and costly than originally anticipated. The Board also acknowledges the concerns raised by commenters about the costs, operability, and potential limited benefit of the EQCF requirement, including the availability of qualified individuals to serve in an EQCF role, for firms of any size. In the Board’s view, rescinding the EQCF requirement means giving up the benefits of an external second look. That external second look would have focused on the significant judgments made and related conclusions reached when evaluating and reporting on the effectiveness of firms’ QC systems. The Board believes those incremental benefits are difficult to quantify and potentially limited. They would come from the fresh perspectives of an individual serving in an EQCF role, beyond the benefits 105 See comment letters from CAQ, CFA, GT, KPMG, PICPA, PwC, and RSM. 106 See comment letter from KPMG. 107 See comment letter from Spitters. 108 See comment letter from CFA. already provided by other aspects of QC 1000. See below for further discussion on economic impacts. The Board believes that the implementation concerns apply equally to all firms, including those operating under alternative practice structures or accepting private equity investments, regardless of the number of issuers they audit. One commenter opposed the rescission, asserting that firm leadership should be held accountable through independent oversight. 109 Further, the commenter suggested that firms might lack the ability to “convince investors they can do the right thing when left to their own judgment.” 110 As designed, though, the EQCF lacks a mechanism or the authority to hold firm leadership accountable; the EQCF is not required to provide concurring approval of the firm’s evaluation or reporting. 111 Nor would the EQCF supplant the firm’s judgment. Furthermore, the Board notes that the QC 1000 quality objectives for the governance and leadership component continue to call for (i) firm leadership to communicate and promote the firm’s commitment to quality; (ii) the firm to clearly define leadership’s responsibility for quality and hold them accountable; (iii) firm leadership to demonstrate a commitment to quality through actions and behaviors; (iv) the firm’s strategic decisions and actions to be consistent with and support the firm’s commitment to quality; and (v) resources to be obtained, developed, allocated, and assigned in a manner that enables an effective QC system and the performance of 109 See id. 110 See id. 111 See PCAOB Rel. No. 2024-005, at 121. engagements in accordance with applicable professional and legal requirements. 112 To achieve these quality objectives, firms are required to design and implement quality responses that are based on the related quality risks and on the reasons for the assessments given to the quality risks and to reduce to an appropriately low level the risk that quality objectives will not be achieved. The Board has also observed that several firms already incorporate external advisors into their organizational and governance structures and they may continue to do so as part of their response to the quality risks associated with these quality objectives. The Board has long considered firm governance and leadership to be an important aspect of firms’ QC systems that will continue to be subject to oversight by the PCAOB, including as part of PCAOB inspections. INFORMATION AND COMMUNICATION QC 1000 requires a firm to establish a quality objective that, if the firm communicates firm-level or engagement-level information with respect to the firm’s audit practice, firm personnel, or engagements, such as firm or engagement metrics, to external parties, such information is accurate and not misleading and, with respect to any such metrics that are communicated in writing, the communication explains in reasonable detail how the metrics were determined and, if applicable, how the method of determining them changed since the metrics were last communicated. As discussed in the QC 1000 2024 adopting release, the information that this requirement applies to includes public communications about firm-level or engagementlevel information, such as firm metrics and financial data. 113 For example, some firms 112 See QC 1000.25. 113 See PCAOB Rel. No. 2024-005, at 186. publish transparency or audit quality reports, either voluntarily or in response to the requirements of other jurisdictions, that contain data such as: • Revenue breakdown by service line, by year, or by geographic segment; • Professional staff ratios; • Staff turnover ratios; • Average training hours per professional; and • Partner workload. Firms may also communicate such data via webpages or other media, such as promotional publications, social media, interviews, or presentations via webcast or video. 114 In the supplemental request for comment, the Board proposed to narrow the requirements of QC 1000.53e regarding the need for an explanation of written metrics to those metrics that the firm makes publicly available. This was consistent with the initial focus of the requirement on public communications. 115 The Board believes that recipients of nonpublic communications regarding metrics, such as regulators, company management, and audit committees, are generally in a position to request additional information about the metrics if they desire it. Further, some nonpublic metrics may already be calculated in accordance with a method prescribed by the recipient (for example, in response to a regulatory requirement or an audit committee request for proposal). In contrast, where metrics are publicly available, such as in firm transparency reports or promotional publications, these are usually one-way communications in which 114 See PCAOB Rel. No. 2024-005, at 186-187. 115 See id. the external parties do not have the ability to ask questions or request clarification from the firm. Several commenters supported the proposed amendments to paragraph .53e. 116 One commenter said they did not object to confining the explanation requirement to metrics the firm makes publicly available. 117 One of these commenters stated that the proposed amendments were generally clear and seem appropriate but suggested that the term “metric” be defined or explained in the rule text. 118 Another commenter stated that the PCAOB must clearly communicate to firms that the intent of the provision is that firms ensure that the explanation remains accurate and publicly available. 119 Another commenter encouraged the Board to make explicit that simplification of communication requirements does not alter the firm’s monitoring obligations. 120 One commenter stated that it would be helpful to further clarify whether the requirement applies only to those communications required under applicable professional and legal requirements or to all such metrics publicly disclosed. 121 The commenter further requested clarification of whether all changes to the calculation of disclosed metrics to which this requirement 116 See comment letters from AAA, BDO, CAQ, Deloitte, EY, GT, KPMG, Kramer, MIAG, PICPA, RSM, SCCG, and Spitters. 117 See comment letter from CFA. 118 See comment letter from Kramer. 119 See comment letter from MIAG. 120 See comment letter from SCCG. 121 See comment letter from RSM. applies must be explained or whether this requirement applies only to material changes in the calculation of the disclosed metrics. 122 One commenter stated that the operability of the requirement could be further enhanced by restructuring the requirement into two distinct quality objectives—one that addresses whether the information is accurate and not misleading, and a second, conditional objective requiring an explanation for publicly communicated metrics. 123 The Board is adopting the proposed amendments to QC 1000.53e with modifications. Specifically, the Board is revising paragraph .53e by adding subparagraphs .e(1) and .e(2) to more clearly distinguish firm responsibilities when communicating firm-level or engagement-level information to external parties and in written public communications. The Board agrees with the commenter that this change will improve the operability of paragraph .53e without changing a firm’s responsibilities. In addition, the Board believes that the change will help to address a commenter’s concern regarding the clarity of the provision’s intent with respect to metrics communicated in writing and made publicly available by the firm. The requirement in paragraph .53e(2) applies to any metrics that are communicated in writing and made publicly available by the firm—it is not limited in application to metrics that are required to be communicated under applicable professional and legal requirements. Paragraph .53e(2) also requires a firm to communicate how the method of determining any metrics changed since previously communicated, if applicable, and that requirement applies to any such change in methodology, without 122 See id. 123 See comment letter from KPMG. regard to the firm’s assessment of its materiality. The Board does not believe that it is necessary to define the term “metric” for purposes of applying paragraph .53e(2). The Board believes the term is reasonably understood in practice, and the Board previously clarified, in the supplemental request for comment, that the Board intends for the requirement to apply only to calculated measures, not to underlying data. 124 As illustrated in the supplemental request for comment, if a firm publicly discloses its auditoremployee headcount for a region or office, the firm will not need to describe how it counted the employees. 125 The requirement will apply, however, to any calculated figures derived using that data, such as the average years of experience for audit personnel (i.e., total years of audit experience divided by auditor-employee headcount). The Board also does not believe it is necessary to clarify that the proposed amendment would not alter a firm’s monitoring obligations. As stated by the commenter who suggested doing so, the amendments simplify communication requirements but do not affect QC 1000 monitoring obligations. The Board believes that the amendments will carry out its initial intent for public communications and avoid unnecessary costs associated with making additional disclosures to recipients who can request more information if they need it, while still ensuring that recipients of written public communications have access to an explanation of any metric provided. In addition, the Board proposed adding a note to paragraph .53e stating that the explanation of the method for determining metrics can be provided either within the 124 See PCAOB Rel. No. 2026-002, at 25-26. 125 See id. public written communication that includes the metrics or by referring in the communication to a publicly available explanation presented elsewhere, such as the firm’s website. Several commenters supported allowing firms to provide explanations of metrics in a publicly available location, such as the firm’s website. 126 One commenter stated that they supported the proposed amendment provided that those explanations are clear, balanced, accessible, and sufficiently specific to help users of the metrics. 127 Another commenter stated that they favored public disclosures in one place for ease of use and that placement on the relevant website seems appropriate as long as there are clear instructions on how to access the explanation. 128 The commenter further stated that, while disclosures on websites are useful, investors would want to make sure that any restatements, changes in definitions, or metrics are clearly noted, communicated in writing, and updated on a timely basis. 129 While one commenter agreed that publishing an explanation of metrics on a website would not adversely affect the utility of metrics made public, this commenter questioned whether public information about firm metrics should be subject to certification or verification before publication. 130 Another commenter said that an explanation that was accurate on the day it was published is of little use to an investor comparing metrics two or three years later, and that simplification 126 See comment letters from BDO, CFA, GT, KPMG, MIAG, PICPA, and RSM. 127 See comment letter from CAQ. 128 See comment letter from ICGN. 129 See id. 130 See comment letter from Spitters. of the requirement should not come at the expense of transparency or comparability over time within a single firm. 131 This commenter requested that the Board require that any report containing a publicly disclosed metric include, in the report itself, a hyperlink to the explanation of how that metric is calculated, maintained on the firm’s own website, and stated that the hyperlink must remain stable, archived, and year specific. 132 This commenter also said that when a metric or its methodology changes from one year to the next, the change must be prominently identified in the base report itself—not only in the linked explanation—together with a description of the change and a presentation of the comparable prior year metric. 133 After consideration of the comments received, 134 the Board is adopting the note to paragraph .53e as proposed but relocating it under new paragraph .53e(2). The Board believes that allowing firms to explain metrics either in the same communication as the metric itself or by reference to another publicly available explanation would streamline firms’ communications about their audit practices without adversely affecting the quality of information received by external parties. The Board does not believe that permitting firms this flexibility will create confusion for stakeholders. Given the volume of information that a firm might communicate about itself, and the possibility that the same information may be repeated through various 131 See comment letter from CFA. 132 See id. 133 See id. 134 One commenter stated that the PCAOB should use existing artificial intelligence technology to aggregate metrics and related information from firms’ websites or other public sources and make that information available in a centralized location on the PCAOB’s website. See comment letter from MIAG. This suggestion is beyond the scope of this rulemaking. communication platforms, the Board believes that permitting a firm to make reference to a single publicly available explanation could reduce unnecessary duplication of disclosures and provide additional clarity to stakeholders. Also for this reason, the Board believes it is not necessary to require a change made to a metric or its methodology be identified in the written communication. The Board is not requiring firms to provide hyperlinks for the metrics because the Board seeks to preserve the principles-based nature of the requirement and avoid prescribing a specific method that may become less effective as technology changes over time. To satisfy paragraph .53e(2), any publicly available explanation, including one provided through a website, would need to be clear, accessible, and sufficiently specific to explain how the metric was determined and any changes in the method used to determine the metric since it was last communicated. In addition, the Board does not believe that requiring certification or verification of such explanations is necessary to achieve the objectives of paragraph .53e(2). Firms would need to ensure that their explanations remained specific as to the public metric to which they relate and are publicly available for as long as they continue to make available the written public communication that refers to the location of the metrics. Firms may update the publicly available explanation as necessary to maintain its accuracy; however, such updates do not require the issuance of a new written public communication identifying or describing those updates. MONITORING AND REMEDIATION PROCESS 1. RESPONDING TO ENGAGEMENT DEFICIENCIES Engagement monitoring activities are designed to provide information on whether engagement or QC system-level areas may require additional attention. These activities may identify pervasive issues where a number of engagements have similar problems, possibly highlighting the need to revise methodologies, provide additional training, or take other actions at the QC-system level. QC 1000 requires monitoring activities to include determining, on a timely basis, whether engagement deficiencies exist and, if so, taking certain actions in response to the identified engagement deficiencies. QC 1000 defines an engagement deficiency as an instance of noncompliance with applicable professional and legal requirements by the firm, firm personnel, or other participants with respect to an engagement of the firm, or by the firm or firm personnel with respect to an engagement of another firm. Under QC 1000.68, a firm is required to take certain action when an engagement deficiency exists, with the required action depending on circumstances such as whether the engagement is completed or still inprocess or is related to work performed on other firms’ engagements. i. Engagement deficiency related to an in-process engagement (QC 1000.68a) As originally adopted, QC 1000 requires firms, for engagement deficiencies relating to in-process engagements, to take action to address the deficiency in accordance with applicable professional and legal requirements (to the extent necessary, before the issuance of the engagement report(s)), such that the engagement report(s) are appropriate in the circumstances. The Board proposed to amend paragraph .68a to (i) replace the language “the engagement report(s) are appropriate in the circumstances” with “the engagement is free of significant engagement deficiencies” and (ii) add a footnote describing what significant engagement deficiencies are. The concept of a significant engagement deficiency is derived from AS 1220, and the description used in the proposed footnote in paragraph .68a aligns with that in AS 1220. The footnote to QC 1000.68a also clarifies that the concept applies to all engagements as that term is defined in QC 1000 (which includes, for example, engagements performed pursuant to PCAOB interim attestation standards), not only those engagements described in AS 1220. Many commenters supported the proposed amendments to paragraph .68a. 135 However, one commenter stated that the proposed threshold for a “significant engagement deficiency” remained overly broad and could be interpreted to encompass any instance in which an engagement team failed to perform a procedure required by PCAOB standards, regardless of whether the omission affected the sufficiency or appropriateness of audit evidence supporting a material assertion or the engagement conclusions. 136 This commenter suggested that the definition should incorporate the concepts of materiality, relevant assertions, and the significance of the deficiency to the overall audit. 137 The proposed description for when a significant engagement deficiency exists is consistent with concepts in AS 1220. Under AS 1220, an engagement quality reviewer (“EQR”) may provide concurring approval of issuance only if, after performing with due professional care the review required by the standard, the EQR is not aware of a 135 See comment letters from Baker Tilly, CAQ, Deloitte, GT, KPMG, Plante & Moran, and Spitters. 136 See comment letter from PICPA. 137 See id. significant engagement deficiency. 138 The description of significant engagement deficiency in the proposed amendments to paragraph .68a appropriately focuses firms on matters that must be corrected before an audit report is issued or before an engagement conclusion is communicated to the company. 139 Therefore, the Board does not agree that the description is overly broad; a significant engagement deficiency would not be any instance in which an engagement team failed to perform a procedure required by PCAOB standards but rather is specifically related to the circumstances described in footnote 40A. Further, the Board believes the concept is well understood by the profession and does not require any revision. The Board is adopting the amendments to paragraph .68a as proposed. ii. Evaluating whether similar engagement deficiencies exist on other engagements (QC 1000.68d) As originally adopted, QC 1000 requires that, when the firm determines that an engagement deficiency exists, the firm should evaluate whether similar engagement deficiencies exist in other in-process engagements, completed engagements (unless it is probable that the engagement report is not being relied upon), and work performed on other firms’ engagements, and if so, take actions as required by paragraphs .68a-c, as applicable. The Board proposed to limit the requirement to evaluate whether similar engagement deficiencies exist so it would apply only with respect to a subset of 138 See Notes to AS 1220.12, .17, .18B. 139 See Proposed Auditing Standard—Engagement Quality Review and Conforming Amendment to the Board's Interim Quality Control Standards, PCAOB Rel. No. 2008-002 (Feb. 26, 2008), at 16 (describing significant engagement deficiencies). engagement deficiencies, specifically those that resulted or could result (i) a failure to obtain sufficient appropriate evidence to support the conclusion reached on an engagement 140 or (ii) an inappropriate overall conclusion on the subject matter of an engagement. Most commenters generally supported the proposed amendments to paragraph .68d. 141 The Board is adopting the amendments to paragraph .68d as proposed, along with a new note discussed further below. The discussion below addresses specific commenter feedback related to the proposed amendments. a. “Resulted or could result in” Several commenters raised concern regarding the proposed language “resulted or could result in.” 142 Commenters stated that the language would introduce new complexity 143 and interpretation challenges, 144 or would involve substantial implementation effort with limited incremental investor protection. 145 One commenter stated that without further context, the term “could” effectively sets a threshold closer to a remote possibility, which, in practice, would require firms to evaluate an unbounded 140 Because QC 1000 covers not only audit engagements but also review engagements and attestation engagements, reference to “sufficient appropriate evidence” is necessary as this concept aligns with the audit, review, and attestation standards. 141 See comment letters from Baker Tilly, BDO, CAQ, CBIZ, Deloitte, EY, GT, ICGN, KPMG, PICPA, Plante & Moran, RSM, SCCG, and Spitters. 142 See comment letters from BDO, GT, KPMG, PICPA, and RSM. 143 See comment letter from KPMG. 144 See comment letters from GT and KPMG. 145 See comment letter from PICPA. population of engagements. 146 This commenter suggested that the Board consider revising the language to specify that the requirement applies “where there is a reasonable possibility” that an engagement deficiency could result in either a failure to obtain sufficient appropriate audit evidence or an inappropriate overall conclusion, to distinguish from those that represent more remote possibilities. 147 Another commenter recommended changing the proposed language to “reasonably could result.” 148 Another commenter stated that it was not clear whether “could” should be assessed at the individual engagement level or at a broader thematic level, such as when a theme or trend of similar engagement deficiencies emerges. 149 Another commenter stated that a deficiency that appears immaterial on the engagement where it was first identified can still be a symptom of a firm-wide QC weakness and a narrower trigger reduces the number of opportunities a firm has to find that pattern before it results in an audit failure. 150 One commenter highlighted that the intended benefits of the proposed amendment could be offset by concerns regarding specific provisions (i.e., the “could result in” language). 151 Another commenter stated that it was difficult to determine whether the proposed amendment will meaningfully reduce complexity, subjectivity, or implementation costs. 152 The Board is concerned that some commenters may have 146 See comment letter from KPMG. 147 See id. 148 See comment letter from BDO. 149 See comment letter from RSM. 150 See comment letter from CFA. 151 See comment letter from KPMG. 152 See comment letter from GT. misinterpreted the intent of the phrase “could result in.” As adopted, QC 1000 requires the firm to evaluate all engagement deficiencies under paragraph .68d. The goal of the amendment is to narrow the types of engagement deficiencies subject to the evaluation to only those that relate to obtaining sufficient appropriate evidence or the overall conclusion of an engagement. 153 Other engagement deficiencies would not need to be evaluated under paragraph .68d, as amended. Such other engagement deficiencies include, for example, engagement deficiencies related to communications to the audit committee; the filing of Form AP, Auditor Reporting of Certain Audit Participants; or the registration status of an other auditor that performed substantial role work. 154 In other words, this “could result in” language is not intended to introduce an assessment of the likelihood that the engagement deficiency could result in, for example, a failure to obtain sufficient appropriate evidence to support the conclusion on another engagement. This language is instead intended to help firms assess whether a particular engagement deficiency falls within either of the two types of engagement deficiencies subject to the evaluation under the revised paragraph .68d. For example, if the engagement deficiency related to not making a required communication to the audit committee, this type of engagement deficiency does not affect the auditor’s ability to obtain sufficient appropriate audit evidence or reach the 153 With respect to examples of the type of engagement deficiencies that relate to reaching an inappropriate overall conclusion on the subject matter of an engagement, see PCAOB Rel. No. 2008-002, at 16 n.29, which states that “[i]nappropriate conclusions on the subject matter of the engagement would include, for example, a failure to appropriately modify the engagement conclusion in response to: (1) a material departure from generally accepted accounting principles or (2) a material weakness in internal control over financial reporting.” 154 These types of engagement deficiencies would still be required to be addressed in accordance with paragraphs .68a-c and to be evaluated to determine whether QC deficiencies exist in accordance with paragraph .72. appropriate overall conclusion of the engagement and, therefore, would not be within the scope of the revised paragraph .68d. In contrast, if the engagement deficiency related to the auditor not making or observing a physical inventory count in accordance with AS 2510, Auditing Inventories, this type of an engagement deficiency would be within the scope of paragraph .68d, because it relates to obtaining sufficient appropriate evidence. Some commenters requested clarification of an example the Board provided in the supplemental request for comment. 155 To clarify and illustrate the application of the “resulted or could result in” language in paragraph .68d, consider the following scenario: During internal monitoring activities for the current year, a firm selected one of its completed engagements for inspection and identified that the engagement team failed to evaluate cash confirmation exceptions pursuant to AS 2310.20. As a result, the engagement team violated PCAOB requirements (i.e., applicable professional and legal requirements) and the firm determined that an engagement deficiency exists. Because noncompliance with the requirement of AS 2310.20 (that is, the failure to evaluate confirmation exceptions) relates to obtaining sufficient appropriate evidence (i.e., it could result in a failure to obtain such evidence), this engagement deficiency meets the requirement for evaluation under the revised language of paragraph .68d. 156 The Board believes that the amendment appropriately focuses a firm’s attention and efforts on the types of engagement deficiencies that represent the greatest risk to audit quality. It also reduces compliance costs by narrowing the population of engagement deficiencies that a firm is required to evaluate. 155 See comment letters from Baker Tilly, BDO, CAQ, Deloitte, EY, GT, PICPA, and RSM. 156 The Board has provided a continuation of this example below. b. “Evaluate whether similar engagement deficiencies exist” A commenter stated that the nature and extent of the procedures required to evaluate whether similar engagement deficiencies exist should be more explicitly grounded in the root cause of the engagement deficiency identified and an assessment of whether that root cause suggests a potential QC deficiency. 157 This commenter suggested that an evaluation anchored to root cause would provide a more meaningful and riskbased framework for determining the scope of further procedures. 158 As it relates to the evaluation required under paragraph .68d, another commenter requested scenarios to help firms distinguish between engagement deficiencies and identified root causes that are (i) indicative of systemic issues and (ii) isolated incidents. 159 As described in the QC 1000 2024 adopting release, understanding the nature of the engagement deficiency will assist the firm in determining the extent of the necessary evaluation. 160 The intent of the requirement to evaluate whether similar engagement deficiencies exist was not to require an unbounded look at every engagement the firm has. The Board believes understanding the circumstances that led to the engagement deficiency (e.g., the underlying cause) would help the firm identify other engagements to evaluate for similar engagement deficiencies. The Board acknowledges, as commenters suggested, that this was not clear in the proposed amendments. Therefore, the Board is adding a new note to paragraph .68d to indicate that understanding the circumstances that 157 See comment letter from Deloitte. 158 See id. 159 See comment letter from GT. 160 See PCAOB Rel. No. 2024-005, at 225. led to the engagement deficiency may assist the firm in identifying other engagements (or work performed by the firm on other firms’ engagements) to evaluate for similar engagement deficiencies. The procedures performed can be scalable and practical in the circumstances and may be developed based on the nature of the engagement deficiency. However, it would not be appropriate for a firm’s evaluation to be based on narrower criteria than those underlying the cause(s) for the engagement deficiency, nor would it be appropriate to include only a subset of the engagements that are identified based on the understanding of the circumstances that led to the engagement deficiency. To continue with the example provided above regarding cash confirmations, the firm then gained an understanding of the circumstances that led to the engagement deficiency (e.g., the underlying cause) to identify which other engagements to evaluate for similar engagement deficiencies. In this example, the firm might determine that the engagement deficiency was caused by an error in the firm’s cash confirmations methodology, which is required to be used on all engagements that use cash confirmations. To identify whether other engagements used the same methodology (or, in the case of in-process engagements, are currently using the same methodology), the firm sends an inquiry email to each engagement partner. Based on the responses received to the emails and any follow-up with non-respondents, the firm identifies the engagements (and work performed on other firms’ engagements) that followed the same methodology. It is these engagements and work performed on another firm’s engagements that followed the same methodology that the firm will evaluate for similar engagement deficiencies. If the firm identifies, for example, twenty engagements that followed the same cash confirmations methodology, the firm evaluates whether a similar engagement deficiency exists on each of the twenty engagements, i.e., a failure to evaluate confirmation exceptions pursuant to AS 2310.20. Out of the twenty engagements, if the firm identifies four engagements in which the engagement team did not perform procedures to evaluate confirmation exceptions pursuant to AS 2310.20, then the firm would need to take appropriate actions pursuant to subparagraphs a-c of paragraph .68 on each of those four engagements. Importantly, paragraph .68d does not prescribe the manner in which the firm would identify engagements to evaluate. In the above example, the firm decided to send an email to each engagement partner to identify engagements that followed the same methodology. However, the firm could use other approaches, such as a data analysis tool or performing a search of engagement files, to identify engagements that followed the same methodology. The evaluation approach a firm takes may differ depending on the nature of the engagement deficiency, the circumstances that led to the engagement deficiency, and a firm’s specific facts and circumstances. As discussed above, once the firm identifies the population of engagements subject to the evaluation of whether similar engagement deficiencies exist, it would not be appropriate for a firm’s evaluation to be based on narrower criteria nor would it be appropriate to evaluate only a subset of the engagements that were identified. The following graphic illustrates the process for evaluating whether similar engagement deficiencies exist: c. Response to other commenter feedback One commenter did not support a requirement that would require the firm, after finding an engagement deficiency in one engagement, to evaluate whether similar deficiencies exist in all other completed engagements. 161 This commenter stated that the cost of the requirement could be extremely high and it is unclear whether the benefit would outweigh the cost. 162 This commenter suggested that the Board instead change the requirement so that examining a completed engagement would be required only when, 161 See comment letter from AAA. 162 See id. based on the information available at the time, the firm believed that it was probable the financial statements were materially misstated and the likelihood was more than remote that the audit report was still being relied upon. 163 The Board does not agree with the commenter who stated that the amendment would require that the firm evaluate whether similar deficiencies exist in all other completed engagements, as the note to paragraph .68d indicates understanding the circumstances that led to the engagement deficiency may assist the firm in identifying other engagements to evaluate for similar engagement deficiencies. A commenter stated that a deficiency found in one engagement should prompt the firm to ask whether the same problem exists in other engagements and why it occurred, with the answers feeding back into the firm’s risk assessment. 164 The Board agrees that an engagement deficiency identified in one engagement may provide information that is relevant to the firm’s broader monitoring and remediation and risk assessment processes. All engagement deficiencies are subject to action as required under paragraph .68a-c (in that particular engagement), and certain engagement deficiencies will require evaluation under paragraph .68d. Furthermore, all engagement deficiencies are treated as QC observations under paragraph .72 and must be evaluated to determine whether they are QC deficiencies. Additionally, under paragraph .20a(3), the firm obtains an understanding of information from the firm’s monitoring and remediation activities, including its identification of engagement deficiencies, in identifying and assessing quality risks. In this way, the evaluation of engagement deficiencies represents one part 163 See id. 164 See comment letter from CFA. of the broader monitoring and remediation feedback loop: information identified through that process informs the firm’s evaluation of QC observations and feeds back into the firm’s identification and assessment of quality risks. This commenter also stated that deficiency rates are not materially better than in the early years of the inspection program more than twenty years ago and suggested this is not the moment to narrow the lens through which firms look for systemic problems. 165 The Board believes that the amendments to paragraph .68d appropriately focus firms’ evaluations on engagement deficiencies related to obtaining sufficient appropriate evidence to support the conclusion reached on an engagement or the overall conclusion on the subject matter of an engagement that may indicate systemic issues on the firm’s engagements. A commenter suggested that the Board could further enhance the proposed amendment by aligning more closely with ISQM 1, which permits firms to use their judgment to determine the nature and extent of any investigation of identified engagement deficiencies and whether those deficiencies might indicate a deficiency in the system of quality management. 166 The Board believes the requirement in paragraph .68d is fundamental to achieving the objective of the QC system that each engagement report issued by the firm is in accordance with applicable professional and legal requirements. 167 165 See id. 166 See comment letter from PICPA. 167 See QC 1000.05. A commenter questioned why only items (1) and (2) from footnote 40A to proposed paragraph .68a were included in proposed paragraph .68d, while items (3) and (4) (the engagement report is not appropriate in the circumstances and the firm is not independent of its client, respectively) were not. 168 With regard to paragraph .68d, the amendment focuses on those types of engagement deficiencies that most directly affect the sufficiency and appropriateness of procedures performed on the engagement as well as the ultimate opinion expressed by the firm. 2. DEFINITION OF QC DEFICIENCY As originally adopted, the note to paragraph .A8(1) of the definition of QC deficiency states that the likelihood of not achieving the reasonable assurance objective or one or more quality objectives would be above an acceptably low level if, for example, a quality objective is not established, a quality risk is not properly identified or assessed, or a quality response is not properly designed or implemented or is not operating effectively. The Board proposed to amend this note to clarify that a failure of a quality response would be regarded as evidencing a QC deficiency only if other quality responses do not achieve the relevant objective(s). As stated in the QC 1000 2024 adopting release, the relationship across quality objectives, quality risks, and quality responses is generally not one-to-one. 169 Most quality objectives are likely to have multiple quality risks. Some quality risks may affect one or more quality objectives, 168 See comment letter from Grosvenor. 169 See PCAOB Rel. No. 2024-005, at 42. either within a single component or across several components, and may require multiple quality responses. Some quality responses may address multiple quality risks. Many commenters supported the proposed amendment to the definition of QC deficiency, 170 noting, for example, that allowing firms to take compensating quality responses into account when determining whether a QC deficiency exists better reflects how a risk-based system of quality control operates in practice and also aligns more closely with the principles-based framework of other quality management standards, such as ISQM 1. Two commenters suggested revisions to the proposed amendment. 171 One commenter stated that the rule text could clarify that multiple other quality responses are not necessarily required by adding the words “one or more” before “other quality responses” in the Note to paragraph .A8(1) for situations where there is just one other quality response. 172 The Board believes the rule text is sufficiently clear that the clause “and other quality responses do not achieve the relevant objective(s)” applies only if the firm has designed and implemented at least one other quality response relative to the objective(s). Another commenter suggested amending the definition as follows: “(other quality responses have been implemented to address the same risk, and) ‘other quality responses do not achieve the relevant objectives.’” 173 The Board does not believe it is necessary for the rule text to specify that “other quality responses” must have been 170 See comment letters from AAA, Baker Tilly, BDO, CAQ, Crowe, Deloitte, EY, GT, KPMG, Kramer, PICPA, Plante & Moran, PwC, RSM, and SCCG. 171 See comment letters from Kramer and Spitters. 172 See comment letter from Kramer. 173 See comment letter from Spitters. designed and implemented to address the particular quality risk. As stated in the supplemental request for comment and reiterated here, when firms have implemented more than one quality response to address the same quality risk, they can take those other quality responses into account when determining whether a QC deficiency exists. One commenter expressed concern that without a documented, inspectable basis for concluding that a “compensating response” actually operated effectively, this amendment risks becoming a way to explain away deficiencies rather than a genuine test of whether investors remain protected. 174 Another commenter expressed concern that the proposed amendment would give firms/networks additional temptation to identify compensating responses when the linkage is tenuous. 175 The Board believes the revised note makes clear that, when a quality response is not properly designed or implemented or is not operating effectively, the other quality responses would need to achieve the relevant objective(s), that is, they would need to be properly designed, implemented, tested, and found to operate effectively. And, as one commenter observed, paragraph .82 requires firms to document their evaluation of QC observations to determine whether QC deficiencies exist and the basis for each determination. 176 Another commenter stated that it is unclear how allowing the evaluation of compensating controls will work in practice. 177 For example, where a quality risk has a single response that fails, the commenter stated it was unclear whether firms may 174 See comment letter from CFA. 175 See comment letter from Grosvenor. 176 See comment letter from CFA. 177 See comment letter from RSM. consider other responses that mitigate other identified risks to support achievement of the overall objective. 178 This commenter suggested that there may be responses where a precision level is too high to singularly address a specific risk on their own, but when considered collectively, may reduce the risk of failing to achieve the objective to an acceptable level. 179 As explained in the QC 1000 2024 adopting release, the purpose of this note is to provide examples of circumstances where the likelihood of the firm not achieving the reasonable assurance objective or one or more quality objectives would not be reduced to an acceptably low level. 180 The amendments to this note further emphasize that, when a quality response is not properly designed or implemented or is not operating effectively and other quality responses do not achieve the relevant objective(s), the likelihood of the firm not achieving the reasonable assurance objective or one or more quality objectives has not been reduced to an acceptably low level. Under QC 1000, quality risks are defined as “[r]isks (whether or not related to intentional acts by firm personnel or other participants to deceive or to violate applicable professional and legal requirements) that, individually or in combination with other risks, have a reasonable possibility of occurring and, if they were to occur, a reasonable possibility of adversely affecting the firm’s achievement of one or more quality objectives.” The amendment clarifies that, when firms have implemented more than one quality response to address the same quality risk, they can take those other quality responses into account when determining whether a QC 178 See id. 179 See id. 180 See PCAOB Rel. No. 2024-005, at 231. deficiency exists; if the other quality responses were effective in achieving the relevant objective(s), no QC deficiency would exist. After consideration of the comments received, the Board is adopting the amendment to the definition of QC deficiency as proposed. EVALUATION OF AND REPORTING ON THE QC SYSTEM 1. ANNUAL EVALUATION OF THE QC SYSTEM i. Evaluation date As originally adopted, QC 1000 requires that the firm perform an evaluation of the effectiveness of its QC system annually as of September 30. The Board proposed to amend QC 1000 to permit firms to select their own annual evaluation date for their QC system by adding a new defined term, “evaluation date,” defined as the date selected by the firm as of which to evaluate its QC system under paragraph .77, and making conforming changes to paragraph .77. The Board also proposed to include language in a new footnote to guide the firm’s selection of its evaluation date by recognizing that the firm’s choice may be influenced by the nature and circumstances of the firm and its engagements, including, for example, the firm’s fiscal year-end or the timing of monitoring activities. All commenters who commented on this aspect of the proposed amendments expressed support. 181 One commenter, who did not object to this aspect of the proposed amendments, expressed concern that timing should not become a tool for managing findings and a firm should not be able to use its initial selection, or a later change of date, 181 See comment letters from AAA, Baker Tilly, BDO, CAQ, CBIZ, Crowe, Deloitte, EY, Forvis, GT, ICGN, KPMG, MIAG, PICPA, Plante & Moran, PwC, RSM, and Spitters. to defer capturing known or anticipated inspection findings within an evaluation period. 182 This commenter, however, acknowledged that under the amendments, no period of time escapes evaluation altogether and any change of evaluation date must be reported to the Board together with the firm’s rationale for the change. 183 The Board agrees with the commenter that these are useful guardrails. 184 The choice of evaluation date is an aspect of QC system design and, as such, has to be made and documented by the time the firm becomes subject to the QC 1000.06 requirement to design, implement, and operate an effective QC system. The firm has to have the information needed to identify unremediated QC deficiencies and to reach a conclusion about the effectiveness of its QC system as of the evaluation date, and for the individuals with ultimate responsibility and accountability and operational responsibility and accountability for the QC system as a whole, acting with due professional care, to certify the firm’s report to the PCAOB on its annual evaluation of the QC system. This suggests that the evaluation date and the firm’s monitoring and remediation cycle ought to be coordinated so that sufficient, timely information is available when needed about the implementation and operation of the QC system (including the status of remediation efforts) and the compliance of the firm’s engagements with applicable professional and legal requirements. Because of the relationship between the evaluation date and the firm’s monitoring and remediation activities, The Board does not anticipate that firms will change their selected evaluation date without a specific reason (e.g., regulatory 182 See comment letter from CFA. 183 See id. 184 See id. requirements, business combination transactions, or changes in fiscal year or business cycles). The Board is adopting these amendments as proposed. The Board believes allowing each firm to select its evaluation date based on the firm’s particular facts and circumstances responds to the implementation challenges experienced by some firms and, in particular, could reduce the burden and costs of multiple annual evaluations that some firms could have experienced due to differences in required evaluation dates under QC 1000 versus other regulations to which they are subject. This change better aligns with the flexibility provided by other quality management standards, which permit firms to choose their own evaluation date. Additionally, the Board does not believe that allowing firms to select their own evaluation date impairs the Board’s ability to carry out its inspection program. ii. Five-month threshold for the initial evaluation of the firm’s QC system The Board proposed to add language to paragraph .77 that would require a minimum period of operation before a firm is first required to evaluate its QC system. Under the proposed amendment, a firm would be required to evaluate its QC system once the firm has been subject to the requirement to design, implement, and operate a QC system under paragraph .06 for at least five consecutive months (whether due to the effectiveness of QC 1000 on December 15, 2026, or to the firm’s later becoming subject to the requirements of QC 1000.06). Most commenters who commented on this topic supported the proposed amendment. 185 However, one commenter stated that the proposed approach may create practical challenges for firms seeking to align their QC 1000 evaluation process with evaluations performed under other quality management standards, which contemplate annual evaluation periods that generally do not exceed twelve months. 186 This commenter observed that a firm that has chosen, for example, March 31 as its evaluation date would likely be required to perform an evaluation under ISQM 1 or SQMS 1 as of March 31, 2027, while the corresponding QC 1000 evaluation would not occur until March 31, 2028, and would encompass a 15-month evaluation period. 187 This commenter suggested that the Board could permit firms to perform their initial evaluation of their QC system as of their selected evaluation date, consistent with their normal quality control processes, but require the first Form QC filing only for the first 12-month evaluation period ending after September 30, 2027. 188 This commenter believes that the Board could obtain information regarding that firm’s initial evaluation, implementation progress, significant findings, and remediation activities through its oversight activities (e.g., inspections, implementation outreach, annual data requests, and other regulatory interactions) prior to the firm’s first Form QC filing. 189 Another commenter stated that, combined with a free 185 See comment letters from Baker Tilly, CAQ, ICGN, KPMG, PICPA, RSM, and Spitters. 186 See comment letter from BDO. 187 See id. 188 See id. 189 See id. choice of evaluation date, the proposed five-month threshold could defer some firms’ first evaluation well into 2028. 190 This commenter stated that the Board should set an outer limit so that every firm completes its first evaluation within a reasonable period of becoming subject to the standard. 191 The Board acknowledges that, depending on the evaluation date chosen by the firm, the first evaluation period may encompass more than 12 months, but observes that subsequent periods would proceed on a 12-month cycle (absent a change of the evaluation date). The Board believes that this approach sets a reasonable outer limit for a firm’s first evaluation. The Board also believes that the five-month minimum duration of the initial evaluation period ensures that firms have sufficient information to evaluate the effectiveness of their QC system. A firm can elect to voluntarily perform its initial evaluation covering a less-than-five-month period, but that evaluation would not be a required evaluation under QC 1000. Consequently, under General Instruction 4(a) to Form QC, the firm’s first Form QC filing would be required to cover the period beginning on the date the firm first incurred an obligation to implement and operate a QC system under QC 1000.06 and ending on the firm’s evaluation date. Another commenter suggested that the five-month period should commence on the first day of the month immediately following the event that triggers the firm’s obligation to design, implement, and operate its QC system, which would allow firms a full five-month operating period on which to base their evaluation. 192 This commenter 190 See comment letter from CFA. 191 See id. 192 See comment letter from KPMG. also requested that the Board clarify that the five-month period applies solely to the initial operation of the broader QC system and does not establish a mandatory minimum operating period for concluding that a specific remedial action is effective. 193 To clarify, as noted above, a firm becomes subject to the requirements of QC 1000 on (1) December 15, 2026 (the effective date of QC 1000), or (2) the day the firm becomes subject to the requirement to design, implement, and operate a QC system under paragraph .06. Therefore, in all circumstances, a firm’s QC system will have operated for a full five months or longer before the firm is required to evaluate the effectiveness of its QC system. Additionally, because the five-month threshold refers to the evaluation of the effectiveness of the firm’s QC system as a whole, it does not impose any minimum time requirement for any other purpose other than for QC 1000.77. Another commenter also suggested that the Board clarify whether engagements should be included in a firm’s evaluation based on the financial statement year-end or the date the auditor’s report is issued. 194 This commenter encouraged the Board to clarify how firms should approach the initial evaluation when the completion of a firm’s engagements falls outside this five-month timeframe and when the initial evaluation has little or no engagement activity within the evaluation period. 195 QC 1000 requires that the firm design, implement, and operate a monitoring and remediation process to provide relevant, reliable, and timely information about the design, implementation, and operation of the QC system and to provide a reasonable 193 See id. 194 See comment letter from PICPA. 195 See id. basis for timely detection of engagement deficiencies and QC deficiencies. 196 Firms are required to monitor completed engagements. 197 A completed engagement is one for which the firm has issued an engagement report. Firms also are required, depending on the size of their PCAOB audit practice, to either perform in-process engagement monitoring 198 or consider doing so. 199 If the firm has no completed engagements during the firm’s initial evaluation of its QC system, in-process monitoring could provide relevant, reliable, and timely information about the performance of the firm’s engagements. Finally, one commenter questioned the rationale behind the Board’s decision to use five months as opposed to, for example, six months. 200 In developing the minimum time period for the initial QC system evaluation, the Board determined and continues to believe that the five-month threshold strikes the right balance such that the QC system has ample time to operate while also ensuring the PCAOB’s timely receipt of information related to firms’ QC systems. Accordingly, the Board is adopting this amendment as proposed. To illustrate how the five-month threshold for the initial evaluation of the firm’s QC system would operate, if a firm that is subject to the requirements of QC 1000.06 when the standard becomes effective (on December 15, 2026) selects June 30 as its 196 QC 1000.59a and b. 197 QC 1000.62a. 198 QC 1000.63a. 199 QC 1000.63b. 200 See comment letter from Spitters. evaluation date, the firm would first evaluate the effectiveness of its QC system in accordance with QC 1000 as of June 30, 2027, because the firm would have been required to operate a QC 1000-compliant system for at least five months (specifically, from December 15 to June 30) as of June 30, 2027. Alternatively, if such a firm selects March 31 as its evaluation date, the firm would be required to first evaluate the effectiveness of its QC system as of March 31, 2028, because the firm would not have been required to operate a QC 1000-compliant system for at least five months as of March 31, 2027. As another example, if a firm first became subject to the requirements of QC 1000.06 on June 1, 2027 (because the firm became subject to applicable professional and legal requirements with respect to an engagement at that time), and the firm selects July 31 as its evaluation date, the firm would be required to first evaluate the effectiveness of its QC system as of July 31, 2028, because the firm would not have been required to operate a QC 1000-compliant system for at least five months as of July 31, 2027. iii. Evaluation conclusions As originally adopted, QC 1000 requires the firm to evaluate its QC system annually and conclude that the QC system is effective, is effective except for one or more unremediated QC deficiencies that are not major QC deficiencies, or is not effective (i.e., one or more major QC deficiencies exist). The Board proposed to amend the above three conclusions to align QC 1000 more closely with other quality management frameworks. Under proposed paragraph .77, the firm would be required to conclude, as of the evaluation date, that its QC system: • Is effective in achieving the reasonable assurance objective; or • Is effective in achieving the reasonable assurance objective except for unremediated QC deficiencies that have a severe but not pervasive effect on the design, implementation, and operation of the QC system (and do not render the QC system not effective); or • Is not effective in achieving the reasonable assurance objective. To clarify when a firm may conclude that its QC system is effective in achieving the reasonable assurance objective under paragraph .77a, the Board proposed to include a note explaining that such a conclusion would be appropriate when, as of the evaluation date, there are no unremediated QC deficiencies other than those that, individually or in combination, are not severe. This clarification was intended to emphasize that the presence of unremediated QC deficiencies did not, in all cases, preclude a conclusion under paragraph .77a that the QC system is effective. Rather, the determination would depend on the severity of those deficiencies and their effect on the firm’s ability to achieve the reasonable assurance objective. Under the proposed approach, QC deficiencies that are not severe, whether considered individually or in combination, would not indicate that the QC system is failing to operate effectively, which would be consistent with the ISQM 1 evaluation framework and the reasonable assurance objective of QC 1000. Under proposed paragraph .77b, a firm would conclude that its QC system was effective in achieving the reasonable assurance objective except for unremediated QC deficiencies that have a severe but not pervasive effect on the design, implementation, and operation of the QC system (and do not render the QC system not effective). To clarify, when evaluating the effect of unremediated QC deficiencies on the QC system, a firm would evaluate whether the QC deficiencies have a severe but not pervasive effect on each of the following: (1) the design of the QC system, (2) the implementation of the QC system, and (3) the operation of the QC system. Therefore, with respect to the conclusion under paragraph .77b, QC deficiencies may have a severe but not pervasive effect on the design, implementation, or operation of the QC system; they need not have such an effect on all three aspects of the QC system for a firm to reach the conclusion under proposed paragraph .77b. The parenthetical statement is intended to clarify that if QC deficiencies are so severe as to prevent the firm from achieving the reasonable assurance objective, the appropriate conclusion would be under proposed paragraph .77c. A firm would reach the conclusion set forth in paragraph .77c if its QC system was not effective in achieving the reasonable assurance objective. QC 1000 specifies that an unremediated QC deficiency is one for which remedial actions that completely address the QC deficiency have not been fully implemented, tested, and found effective. The Board proposed to modify the existing note to paragraph .77 to explain that, while remedial actions must be fully implemented as of the evaluation date, they can be tested and found effective no later than the date Form QC is due under paragraph .79 (or, if earlier, the date Form QC is filed). The note distinguishes between the implementation of remedial actions and the demonstration of their effectiveness. For purposes of determining whether a QC deficiency is remediated, firms are expected to have fully implemented remedial actions as of the evaluation date, but the assessment of whether those actions are operating effectively may be supported by testing their operating effectiveness after the evaluation date but before the Form QC filing date. Commenters supported the proposed amendments to the evaluation framework and evaluation conclusions, particularly the effort to align more closely with other quality management standards. 201 Several commenters noted that this alignment would reduce the complexity of managing evaluations under multiple frameworks and help avoid potential confusion among stakeholders. 202 Two commenters observed that the threetiered conclusions framework better supports informed decision-making and meaningful communication with stakeholders, and reflects a more accurate representation of how QC systems operate in practice. 203 Two other commenters noted that the proposed evaluation framework would enhance transparency by allowing firms to distinguish among varying degrees of effectiveness, including through the use of the “except for” conclusion. 204 One commenter further stated that the proposed evaluation framework better aligns with the reasonable assurance objective because it clarifies that a QC system may provide reasonable assurance even when unremediated QC deficiencies exist. 205 In addition, some commenters indicated that the proposed conclusions in paragraph .77 were sufficiently clear and appropriate. 206 One commenter stated the evaluation framework in proposed paragraphs .77-.78 is generally clear but requested clarification on the latitude of firms to 201 See comment letters from AAA, Baker Tilly, BDO, CAQ, CBIZ, Deloitte, EY, Forvis, GT, ICGN, KPMG, PICPA, Plante & Moran, PwC, and RSM. 202 See comment letters from Baker Tilly, Deloitte, EY, Forvis, and KPMG. 203 See comment letters from BDO and CBIZ. 204 See comment letters from Baker Tilly and GT. 205 See comment letter from KPMG. 206 See comment letters from GT, KPMG, and Spitters. change their conclusions as of the evaluation date if, before the date that Form QC is filed, a firm identifies shortcomings when further testing its remedial actions. 207 While commenters generally supported the proposed framework, one commenter recommended expanding the “except for” category to include both “severe but not pervasive” and “pervasive but not severe” unremediated QC deficiencies to minimize potential blurring among the conclusion categories. 208 This commenter expressed concern that a conclusion under paragraph .77a could be confusing because a firm may arrive at a favorable conclusion despite having experienced significant quality control issues during the evaluation period that were subsequently remediated. 209 The same commenter also noted that deficiencies may take time to become apparent and suggested requiring statements or certifications indicating that firms considered previously unidentified deficiencies relating to prior years in their evaluations. 210 Another commenter urged the Board to retain the “effective, with no unremediated QC deficiencies” conclusion as originally adopted. 211 The commenter expressed concern that allowing firms to reach an unqualified “effective” conclusion despite the existence of unremediated QC deficiencies would broaden the circumstances in which firms may reach a favorable conclusion. 212 207 See comment letter from Kramer. 208 See comment letter from Grosvenor. 209 See id. 210 See id. 211 See comment letter from CFA. 212 See id. One commenter supported the proposed modification to the existing note to paragraph .77 because it provides helpful guidance and better reflects how remediation occurs in practice. 213 Another commenter questioned whether the phrase “completely address” in the first sentence of the note, which is not part of the proposed modification, establishes an unnecessarily stringent standard and suggested replacing it with “sufficiently address.” 214 Another commenter requested clarification on the description in the release for determining whether a QC deficiency is remediated, specifically whether the phrase “may be supported by evidence obtained from testing after the evaluation date” refers to testing of instances that occurred before the evaluation date or the related response activities after the evaluation date. 215 One commenter requested clarification on how firms should assess the effect of remediation efforts when frequency constraints preclude testing enough instances of the remedial actions in evaluating remaining QC deficiencies. 216 In developing the proposed amendments to paragraph .77, the Board also considered an alternative evaluation framework under which a firm would be required to reach a binary conclusion (i.e., that its QC system is either effective or not effective in achieving the reasonable assurance objective). One commenter stated that a binary conclusion may be particularly appropriate for many triennial firms and suggested that a binary framework would simplify the 213 See comment letter from KPMG. 214 See comment letter from Grosvenor. 215 See comment letter from RSM. 216 See comment letter from CBIZ. evaluation process. 217 Another commenter stated that whether the alternative evaluation framework with a binary conclusion is more appropriate is undefined, and it would be appropriate and constructive to retain the factors included in paragraph .78 (which are discussed further below) under this alternative framework. 218 Many commenters did not support the binary approach for the evaluation framework. 219 Some commenters were concerned that it would limit firms’ ability to communicate the nature and severity of identified deficiencies and would de [Text truncated at 120,000 characters. The full text is on the page linked above.] --- Source: Frix Law Library, https://www.frixlaw.com/law-library/documents/agency%3Asec%3A653d433b5d9d9c06. Public record. Not legal advice.