# Public Company Accounting Oversight Board; Order Granting Approval of QC 1000, A Firm's System of Quality Control, and Related Amendments to PCAOB Standards, Rules, and Forms > Briefs, arguments, decisions, and more. URL: https://www.frixlaw.com/law-library/documents/fr%3A2024-20714 ## Record - **Collection:** Federal Register - **Document type:** Notice - **Published:** September 12, 2024 - **Citation:** 89 FR 74324 ## Text SECURITIES AND EXCHANGE COMMISSION [Release No. 34-100968; File No. PCAOB-2024-002] Public Company Accounting Oversight Board; Order Granting Approval of QC 1000, A Firm's System of Quality Control, and Related Amendments to PCAOB Standards, Rules, and Forms September 9, 2024. I. Introduction On May 24, 2024, the Public Company Accounting Oversight Board (the “Board” or the “PCAOB”) filed with the Securities and Exchange Commission (the “Commission”), pursuant to Section 107(b) 1 of the Sarbanes-Oxley Act of 2002 (“SOX”) and Section 19(b) 2 of the Securities Exchange Act of 1934 (the “Exchange Act”), a proposal to adopt Quality Control (“QC”) 1000, A Firm's System of Quality Control (“QC 1000”), and supersede existing PCAOB QC standards; adopt EI 1000, Integrity and Objectivity, and supersede existing ET 102, Integrity and Objectivity; and amend several other related existing auditing standards, rules, and forms (collectively, the “Amendments”). 3 1 15 U.S.C. 7217(b). 2 15 U.S.C. 78s(b). 3 See Public Company Accounting Oversight Board; Notice of Filing of Proposed Rules on A Firm's System of Quality Control and Related Amendments to PCAOB Standards, Release No. 34-100277 (June 5, 2024) [89 FR 49588 (June 11, 2024)] (“Notice of Filing of Proposed Rules”), available at https://www.sec.gov/files/rules/pcaob/2024/34-100277.pdf. The Amendments were published for comment in the Federal Register on June 11, 2024. 4 On July 1, 2024, the Commission extended the public comment period until July 16, 2024, and extended the date by which the Commission shall either approve or disapprove, or institute proceedings to determine whether to approve or disapprove, the Amendments to August 25, 2024. 5 On August 13, 2024, the Commission further extended the date by which the Commission shall either approve or disapprove, or institute proceedings to determine whether to approve or disapprove, the Amendments to September 9, 2024. 6 The Commission received over 20 comment letters from the public regarding the Amendments and one response to comments from the PCAOB (“PCAOB response letter”). 7 This order approves the Amendments, which we find to be consistent with the requirements of Title I of SOX and the rules and regulations issued thereunder and necessary or appropriate in the public interest or for the protection of investors. 8 The Amendments and the Commission's findings with respect thereto are discussed in further detail below. 4 Id. 5 See Public Company Accounting Oversight Board; Extension of Comment and Approval Periods for Proposed Rules on General Responsibilities of the Auditor in Conducting an Audit and Amendments to PCAOB Standards and A Firm's System of Quality Control and Related Amendments to PCAOB Standards, Release No. 34-100451 (July 1, 2024) [89 FR 55993 (July 8, 2024)], available at https://www.sec.gov/files/rules/pcaob/2024/34-100451.pdf. 6 See Public Company Accounting Oversight Board; Extension of Approval Periods for Proposed Rules on A Firm's System of Quality Control and Related Amendments to PCAOB Standards, Proposed Rules on Amendments Related to Aspects of Designing and Performing Audit Procedures that Involve Technology-Assisted Analysis of Information in Electronic Form, and Proposed Rules on Amendment to PCAOB Rule 3502 Governing Contributory Liability, Release No. 34-100724 (Aug. 13, 2024) [89 FR 67117 (Aug. 23, 2024)], available at https://www.sec.gov/files/rules/pcaob/2024/34-100724.pdf. 7 Copies of the comment letters received on the Commission notice of the Amendments are available on the Commission's website at https://www.sec.gov/comments/pcaob-2024-02/pcaob202402.htm. 8 See Section 107(b)(4)(A)-(B) of SOX, 15 U.S.C. 7217(b)(4)(A)-(B). II. Description of the Amendments On May 13, 2024, the Board adopted the Amendments. 9 The Amendments were preceded by a 2019 concept release, 10 a proposal in November 2022, 11 and other outreach engaged in by the PCAOB. 12 QC 1000 would replace current PCAOB QC standards that were developed decades ago by the American Institute of Certified Public Accountants (“AICPA”), before the PCAOB was established, and which were adopted by the Board on an interim, transitional basis in 2003. 13 9 See A Firm's System of Quality Control and Other Amendments to PCAOB Standards, Rules, and Forms, PCAOB Release No. 2024-005 (May 13, 2024) (“Adopting Release”), available at https://assets.pcaobus.org/pcaob-dev/docs/default-source/rulemaking/docket046/2024-005-qc1000.pdf?sfvrsn=355bf24_2. 10 See PCAOB, Concept Release: Potential Approach to Revisions to PCAOB Quality Control Standards (Dec. 17, 2019) (“Concept Release”), available at https://assets.pcaobus.org/pcaob-dev/docs/default-source/rulemaking/docket046/2019-003-quality-control-concept-release.pdf?sfvrsn=5856398d_0. 11 See Proposed Quality Control Standard—A Firm's System of Quality Control and Other Proposed Amendments to PCAOB Standards, Rules, and Forms, PCAOB Release No. 2022-006 (Nov. 18, 2022) (“Proposing Release”), available at https://assets.pcaobus.org/pcaob-dev/docs/default-source/rulemaking/docket046/2022-006-qc.pdf?sfvrsn=b89546e2_4. 12 See, e.g., Briefing Paper for the Standard Advisory Group (“SAG”), Quality Control: Governance and Leadership (Nov. 29, 2018). The materials for the November 29, 2018 SAG meeting are available at https://pcaobus.org/news-events/events/event-details/standing-advisory-group-meeting_1137. 13 See Establishment of Interim Professional Auditing Standards, PCAOB Release No. 2003-006 (Apr. 18, 2003), available at https://assets.pcaobus.org/pcaob-dev/docs/default-source/rulemaking/interim_standards/release2003-006.pdf?sfvrsn=2424c91_0; Order Regarding Section 103(A)(3)(B) of the Sarbanes-Oxley Act of 2002, Release No. 33-8222 (Apr. 25, 2003) [68 FR 23335 (May 1, 2003)] (Commission order approving PCAOB's interim standards). See infra note 32 for a discussion of the AICPA's new quality control standard, which will become effective on December 15, 2025. In the Notice of Filing of Proposed Rules, the PCAOB stated that it was proposing a new QC standard that it believes will lead registered public accounting firms to significantly improve their QC systems and thereby protect investors by facilitating the consistent preparation and issuance of informative, accurate, and independent audit reports. 14 As described by the Board, QC 1000 is an integrated, risk-based standard that mandates quality objectives and key processes for all firms' QC systems. 15 While QC 1000 requires all public accounting firms that are registered with the PCAOB to design a QC system that meets the requirements of QC 1000, firms are only required to implement and operate the QC system in compliance with QC 1000 when they lead an engagement under PCAOB standards, play a substantial role in the preparation or furnishing of an audit report (as defined in PCAOB rules), 16 or have current responsibilities under “applicable professional and legal requirements” 17 regarding any such engagement. 18 14 See Adopting Release, supra note 9, at 5. 15 Id. 16 See PCAOB Rule 1001(p)(ii) (defining the phrase “play a substantial role in the preparation or furnishing of an audit report”) and Rule 2100 (requiring each public accounting firm that (a) prepares or issues any audit report with respect to any issuer, broker, or dealer; or (b) plays a substantial role in the preparation or furnishing of an audit report with respect to any issuer, broker, or dealer to be registered with the Board). 17 QC 1000 defines “applicable professional and legal requirements” as “(1) Professional standards, as defined in PCAOB Rule 1001(p)(vi); (2) Rules of the PCAOB that are not professional standards; and (3) To the extent related to the obligations and responsibilities of accountants or auditors in the conduct of engagements or in relation to the QC system, rules of the SEC, other provisions of U.S. federal securities law, ethics laws and regulations, and other applicable statutory, regulatory, and other legal requirements.” See QC 1000, Appendix A, .A2. 18 Adopting Release, supra note 9, at 10. Circumstances where firms are only required to design a QC system that meets the requirements of QC 1000, but not implement or operate it, are sometimes referred to as being subject to the “design-only requirement” or “design-only firms.” According to the Board, QC 1000 provides a framework for a QC system that is grounded in the ongoing practice of proactively identifying and managing risks to audit quality, with a feedback loop from ongoing monitoring, an explicit focus on firm governance and leadership, firm culture, and individual accountability, and specific direction in a number of areas the current PCAOB standards do not address. 19 QC 1000 consists of two process components: (1) the firm's risk assessment process and (2) the monitoring and remediation process. 20 It also consists of six components that address aspects of the firm's organization and operations: (1) governance and leadership; (2) ethics and independence; (3) acceptance and continuation of engagements; (4) engagement performance; (5) resources; and (6) information and communication. 21 The risk assessment process applies to these six components, requiring firms to: (i) establish outcome-based “quality objectives,” including those specified throughout the standard ( i.e., the desired outcomes to be achieved by the firm with respect to that component); (ii) identify and assess “quality risks” to the quality objectives; (iii) design and implement “quality responses” ( i.e., policies and procedures to address the quality risks); and (iv) establish policies and procedures to monitor internal and external changes that may require modifications to the quality objectives, quality risks, or quality responses. 22 The monitoring and remediation process applies to all of the components of the QC system, including monitoring and remediation itself ( i.e., firms are required to identify and remediate deficiencies that are observed in their monitoring and remediation activities). 23 19 Id. at 8. 20 Id. 21 Id. 22 Id. at 40. 23 Id. QC 1000 also requires an annual evaluation of the effectiveness of the QC system and reporting to the PCAOB on the QC system evaluation by the registered public accounting firm for any period in which it is required to implement and operate a QC system. 24 The standard includes requirements regarding individual roles and responsibilities in the QC system and documentation requirements. 25 24 Id. 25 Id. at 8. As noted above, firms are required to design and implement quality responses as part of the risk assessment process. Although QC 1000 requires firms to design and implement their own quality responses to respond to their particular assessed quality risks, QC 1000 also includes some specified quality responses, which are mandatory for the firms to which they apply. 26 Some specified quality responses carry requirements from current PCAOB standards into QC 1000 or provide new requirements that the PCAOB stated were important to a firm's QC system. 27 26 Id. at 42 (stating that the “specified quality responses are not intended to be comprehensive” and “alone will not be sufficient to enable the firm to achieve all established quality objectives”). 27 Id. For example, with respect to the governance and leadership component, QC 1000 includes a specified quality response that requires firms with larger PCAOB audit practices (firms that issue audit reports for more than 100 issuers in the prior calendar year) to adopt and implement an external quality control function (“EQCF”) that is composed of one or more persons who are not principals or employees of the firm and do not otherwise have a relationship with the firm that would interfere with the exercise of independent judgment with regard to matters related to the QC system. 28 The EQCF is required to evaluate the significant judgments made and related conclusions reached by the firm when evaluating and reporting on the effectiveness of its QC system. Firms have flexibility in how the role is structured, depending on their governance structure or other factors. In addition, firms may, at their discretion, assign additional responsibilities to the EQCF and those could vary across firms. 29 As noted above, the EQCF requirement only applies to firms that issue audit reports for more than 100 issuers in the prior calendar year, which currently is 13 out of the approximately 1,600 PCAOB-registered firms. 30 A number of these firms have stated publicly that they have independent representation in their governance structure or plan to add such a role in the near term. 31 The EQCF role is discussed and analyzed in greater detail in Section III.B, below. 28 Id. at 10. 29 Id. 30 The PCAOB response letter states that, as of 2023, the EQCF requirement would apply to 14 firms. See PCAOB response letter (Aug. 16, 2024) at 3 & n.7. However, one of these 14 firms has since filed an application for withdrawal from registration with the PCAOB. See PCAOB, Registered Public Accounting Firms—Withdrawal Request Pending (Aug. 15, 2024), available at https://assets.pcaobus.org/pcaob-dev/docs/default-source/registration/firms/documents/withdrawal-requests.pdf?sfvrsn=d30aab29_459 (listing BF Borgers CPA PC among the firms that have filed a request for withdrawal from registration). 31 See EY, How Our Independent Audit Quality Committee Strengthens Our Focus on Audit Quality (Feb. 20, 2023) (stating that EY's Independent Audit Quality Committee consists of three external senior leaders and “provides independent advice to EY US senior leadership on all matters related to the Firm's system of quality control that affect audit quality, including its business, operations, culture, talent strategy, governance, and risk management”), available at https://www.ey.com/en_us/insights/assurance/independent-audit-quality-committee-strengthens-our-focus-on-audit-quality; KPMG LLP (US), KPMG U.S. Appoints Katrina Helmkamp and Harit Talwar to Serve on its U.S. Board (Jan. 8, 2024) (stating that it has three independent directors on its U.S. Board of Directors), available at https://kpmg.com/us/en/media/news/helmkamp-talwar-us-board-2024.html; KPMG US Announces Formation of Independent Audit Quality Advisory Committee to Build on the Success of Quality Initiatives (Aug. 28, 2024) (stating that the committee is responsible for advising KPMG on matters including “the firm's efforts to meet new quality standards from regulatory bodies and respond to PCAOB inspections, including root cause analysis, and the design, development, implementation and measurement of strategic audit quality initiatives”), available at https://kpmg.com/us/en/media/news/kpmg-announces-iaqac-2024.html; Chris Johnson, Deloitte follows PwC in search for independent board members, Riotact (Apr. 9, 2024) (stating that PWC Australia has announced plans to increase the number of independent directors to three on its nine-person board), available at https://the-riotact.com/deloitte-follows-pwc-in-search-for-independent-board-members/758971; Deloitte, Leadership and Governance (stating that the Deloitte Global Chair and Deputy Chair receive input from the Deloitte Global Independent Non-Executive (INE) Advisory Council, which provides advice and insights on a variety of matters, including strategy, planning, public policy, quality, risk and regulatory matters, and broader stakeholder engagement), available at https://www.deloitte.com/global/en/about/story/purpose-values/leadership-governance.html; Grant Thornton, Audit Quality & Transparency Report 2022 (stating that its audit quality advisory council includes two independent council members and its purpose is to advise the board regarding ways to maintain and improve the firm's system of quality control in accordance with applicable professional legal standards), available at https://www.grantthornton.com/content/dam/grantthornton/website/assets/content-page-files/audit/pdfs/2023/audit-quality-transparency-report-2022.pdf; and BDO USA P.C., 2023 Audit Quality Report (stating that it has an “Audit Quality Advisory Council” comprised of five (5) members that includes two (2) Independent Council Members), available at ASSR-BDO-2023-Audit-Quality-Report-web.pdf. See also infra note 112. The Board described the QC 1000 framework as having commonalities with other international and domestic standards for firm QC systems, though it goes beyond those requirements in some areas. 32 QC 1000, ISQM 1, and SQMS 1 (the latter two collectively, the “Other QC Standards”) 33 share the same basic framework, with the same eight components and risk-based approach to quality control. 34 Both QC 1000 and the Other QC Standards include requirements to design, implement, and operate specified quality objectives, risks, and responses on an annual basis; 35 and specify structures of governance, including requiring the assignment of individuals to the same specified roles. 36 A discussion of the similarities and differences between QC 1000 and the Other QC Standards is included below in Section III. 32 Adopting Release, supra note 9, at 7. The International Auditing and Assurance Standards Board (“IAASB”) released a suite of new quality management standards, including ISQM 1, which became effective on December 15, 2022. ISQM 1 is the international quality control standard and it applies to firms that perform audits of companies (non-SEC registrants) in jurisdictions that have adopted IAASB standards. See IAASB Fact Sheet, Introduction to ISQM 1, Quality Management for Firms that Perform Audits or Reviews of Financial Statements, or Other Assurance or Related Engagements (Dec. 2020) (“ISQM 1”), available at https://www.ifac.org/_flysystem/azure-private/publications/files/IAASB-ISQM-1-Fact-Sheet.pdf. In May 2022, the Auditing Standards Board of the AICPA adopted new quality management standards, including Statement of Quality Management Standards No. 1, A Firm's System of Quality Management (“SQMS 1”), which will become effective on December 15, 2025. SQMS 1 applies to accounting firms in the United States that perform audits under generally accepted auditing standards (“GAAS”) for non-issuers. See AICPA Statement on Quality Management Standards No. 1 (June 2022), available at https://www.aicpa-cima.com/resources/download/aicpa-statement-on-quality-management-standards-no-1. 33 ISQM 1 and SQMS 1 are substantially similar to each other. 34 See, e.g., QC 1000.02-03; ISQM 1.06; and SQMS 1.07. 35 Id. 36 See, e.g., QC 1000.12; SQMS 1.21; and ISQM 1.20. All three standards require assignment of individuals to three roles of operational responsibility that are substantively the same. QC 1000.12 requires assignment of operational responsibility for: (1) the QC system as a whole, (2) compliance with ethics and independence requirements, and (3) the monitoring and remediation process. SQMS 1.21 and ISQM 1.20 require assignment of operational responsibility for: (1) the system of quality management, (2) compliance with independence requirements, and (3) monitoring and remediation process. The Amendments also include expanding the auditor's responsibility to respond to deficiencies on completed engagements under an amended and retitled AS 2901, Responding to Engagement Deficiencies After Issuance of the Auditor's Report. These changes would extend the scope of AS 2901 to cover engagement deficiencies in audits of internal control over financial reporting, incorporate the concepts and terminology introduced in QC 1000, and bring the standard into alignment with the auditor's existing responsibility to obtain sufficient appropriate audit evidence to support the opinion. 37 The changes also include related amendments to AT No. 1, Examination Engagements Regarding Compliance Reports of Brokers and Dealers, and AT No. 2, Review Engagements Regarding Exemption Reports of Brokers and Dealers, which would prompt auditors of registered brokers-dealers to take appropriate action if they discover that the opinion or conclusion in a previously issued attestation report was not supported. 38 Finally, the Amendments replace existing standard ET 102, Integrity and Objectivity, with a new standard, EI 1000, Integrity and Objectivity, to better align PCAOB ethics requirements with the scope, approach, and terminology of QC 1000. 39 37 See AS 2901, as amended. 38 See AT No. 1 and AT No. 2, as amended. 39 See EI 1000. The Amendments will be effective on December 15, 2025. The first annual evaluation period will cover the period beginning on the effective date of the standard ( i.e., December 15, 2025) and ending on September 30, 2026. Subsequent evaluation periods will cover the 12-month period ending on September 30. The PCAOB has proposed application of the Amendments to include audits of emerging growth companies (“EGCs”), 40 as discussed in Section IV below. 40 The term “emerging growth company” is defined in Section 3(a)(80) of the Exchange Act (15 U.S.C. 78c(a)(80)). See also Inflation Adjustments under Titles I and III of the JOBS Act, Release No. 33-11098 (Sept. 9, 2022) [87 FR 57394 (Sept. 20, 2022)], available at https://www.sec.gov/files/rules/final/2022/33-11098.pdf. III. Discussion and Commission Findings The Commission continues to observe concerning indications that registered firms' QC systems are inadequate to ensure the high level of audit quality necessary for investor protection. Recent PCAOB inspection reports indicate that inspection deficiency rates are continuing to rise, with 46% of the engagements reviewed in 2023 having at least one Part I.A deficiency, 41 compared to 40% in 2022 and 34% in 2021. 42 While PCAOB inspection deficiency rates are not the only measure of audit quality and cannot necessarily be generalized to all PCAOB audits, these high deficiency rates place investors in harm's way. Effective QC systems provide firms with reasonable assurance that their audit engagements will be performed in compliance with applicable legal and professional requirements. The continuing rise in deficiency rates supports the need for the Amendments as they would enhance registered audit firms' QC systems to help ensure firms are able to perform their gatekeeper function, which is critical to investor protection and the functioning of our capital markets. 41 See PCAOB Posts 2023 Annual Inspection Reports Alongside Staff Observations and New Charts To Boost Transparency, available at https://pcaobus.org/news-events/news-releases/news-release-detail/pcaob-posts-2023-annual-inspection-reports-alongside-staff-observations-new-charts-to-boost-transparency. 42 See Spotlight Staff Update and Preview of 2022 Inspection Observations (July 2023), available at https://assets.pcaobus.org/pcaob-dev/docs/default-source/documents/spotlight-staff-preview-2022-inspection-observations.pdf ( pcaobus.org ). Figures exclude registered broker-dealer audits in all periods. As noted above, in response to the Notice of Filing of Proposed Rules, to date the Commission has received over 20 comment letters from the public and one response to comments from the PCAOB. 43 Several commenters expressed support for the Amendments, stating that they would improve upon existing standards and lead to better protection of investors. 44 For example, one commenter stated that the Amendments “would better protect the interests of investors, consistent with the mandate set forth in SOX.” 45 Similarly, another commenter stated that it expected the Amendments “will enhance the quality of audits, raising the level of trust and confidence investors can place in the accuracy and reliability of public company financial disclosures.” 46 This commenter also stated that “[c]urrent quality control systems at many firms are not achieving an even minimally acceptable level of audit quality, let alone the high level of audit quality that investors have a right to expect and on which the reliability of our financial reporting system depends.” 47 Another commenter stated that “the PCAOB has done a good job of articulating why the improvements to the Quality Control Standards are warranted.” 48 One commenter stated that it “strongly supported” the Amendments, highlighting requests by the investor community over the years to update “outdated quality control standards” that were written in a pre-SOX era when the profession was self-regulated. 49 This commenter stated that many areas of the PCAOB's existing QC standards have not been updated to reflect fundamental changes in the profession. 50 Some commenters who supported the proposal also stated that they did not believe the requirements in the Amendments went far enough. 51 43 See supra note 7. 44 See, e.g., letters from American Federation of Labor and Congress of Industrial Organizations (July 1, 2024) (“AFL-CIO”); Better Markets (July 2, 2024) (“Better Markets”); Sherrod Brown, Chairman, U.S. Senate Committee on Banking, Housing, and Urban Affairs (Aug. 15, 2024) (“S. Brown”); CFA Institute (July 1, 2024) (“CFA Institute”); Jack Ciesielski, CPA (July 2, 2024) (“J. Ciesielski”); Consumer Federation of America (July 1, 2024) (“Consumer Federation of America”); Robert A. Conway, CPA (June 26, 2024) (“R. Conway”); Council of Institutional Investors (June 27, 2024) (“CII”); Members of the Investor Advisory Group (June 28, 2024) (“Members of IAG”); and Lynn E. Turner (Aug. 20, 2024) (“L. Turner”) (discussing the history of quality control standards in the audit profession). 45 See letter from CII. See also letter from Members of IAG (“We believe the Amendments, if approved by the SEC, would provide enhanced protections for investors, consistent with the mandate set forth in SOX.”). 46 See letter from Consumer Federation of America. 47 Id. See also letters from AFL-CIO (“The need for enforceable quality control standards is demonstrated by the fact that approximately 40 percent of audits inspected by the PCAOB in 2022 contained deficiencies where the auditor failed to obtain sufficient appropriate audit evidence to support its opinion.”); Better Markets (stating that “the PCAOB's recent Staff Inspection Briefs indicate that significant improvements to firms' quality control systems are necessary and long overdue” and that “the deficiencies that inspection staff describe do not simply involve arcane, highly technical issues that could trip up even the most experienced, ethical auditor—they involve foundational issues of critical importance to high quality audit”). 48 See letter from R. Conway. 49 See letter from L. Turner. 50 Id. (listing fundamental changes such as the change from peer reviews by other audit firms to PCAOB inspections for audits of issuers, significant growth in the size of audit firms, expansion of consulting and other non-audit services, international expansion, increased efforts by partners and leadership to monetize their investment in an audit firm, and firms establishing external QC advisory committees). 51 See, e.g., letters from Better Markets (stating that although “it is pleased that the PCAOB has adopted improvements to auditing quality control standards” that it is “disappointed that the Proposal does not sufficiently ensure high-quality audits or adequate transparency and accountability”); Consumer Federation of America (stating “while these amendments do not go as far as we would have liked, we nonetheless expect that they will benefit investors”); and L. Turner (recommending that the PCAOB adopt an approach of requiring an independent board of directors for audit firms as proposed by the U.S. Treasury Advisory Committee on the Auditing Profession (“ACAP”) and used by the U.K. Financial Reporting Council (“FRC”) and the Japan Financial Services Agency). Other commenters stated that the Commission should not approve the Amendments. 52 While several commenters stated that they supported the Board's efforts and goal to modernize quality control standards, they did not support certain aspects of the Amendments. 53 For example, one commenter stated that it was concerned that the Amendments “could potentially have unintended negative consequences to the profession, including significant costs without notable improvement to audit quality.” 54 One commenter expressed its “overall support for the project and the large majority of the provisions of the standard” but stated that the Commission should not approve the standard in its final form because the EQCF function “raises significant concerns,” including being inconsistent with SOX, and because, in the commenter's view, the PCAOB did not adequately address concerns it and others raised regarding the ability for small firms to comply with QC 1000, in particular the design-only requirement. 55 Another commenter stated that “the SEC should reject the PCAOB's final QC 1000 standard because it contains fundamental failures and flaws.” 56 Commenters also provided feedback on specific aspects of the Amendments as described below, which informed their general views discussed above. 52 See, e.g., letters from BDO USA, P.C. (July 2, 2024) (“BDO”); Ernst & Young, LLP (Aug. 26, 2024) (“EY”); Forvis Mazars, LLP (July 2, 2024) (“Forvis Mazars”); Moss Adams, LLP (July 2, 2024) (“Moss Adams”); and Tom Quaadman, Executive Vice President, Center for Capital Markets Competitiveness, U.S. Chamber of Commerce (July 15, 2024) (“Chamber”). 53 See, e.g., letters from BDO; EY; Forvis Mazars; Johnson Global Advisory (June 26, 2024) (“Johnson Global”); Moss Adams; Pennsylvania Institute of CPAs (June 24, 2024) (“PICPA”); PricewaterhouseCoopers LLP (July 1, 2024) (“PWC”); and RSM US LLP (July 16, 2024) (“RSM”). 54 See letter from Forvis Mazars. 55 See letter from PWC. 56 See letter from Chamber. We have considered the information contained in the Notice of Filing of Proposed Rules and the PCAOB's response letter 57 as well as the comments received by the Commission. Having carefully weighed all of the information before us, we find that the Amendments are consistent with the requirements of Title I of SOX and the rules and regulations thereunder and are necessary or appropriate in the public interest or for the protection of investors. In particular, we believe the Amendments as a whole will further the Board's statutory mandate under SOX and enhance investor protection by creating an integrated, risk-based QC standard that can be applied by firms of varying sizes and complexities and is compatible with Other QC Standards that either have already been or are required to be implemented by the vast majority of registered public accounting firms. The Amendments will lead registered public accounting firms to significantly improve their quality control systems, thereby improving audit quality and investor protection. The existing interim QC standards—which were adopted on an interim basis in 2003 and were developed by the audit profession under an environment of self-regulation—do not adequately reflect the risks and requirements of the current auditing environment, overly focus on evaluating firms' compliance with their own internally-developed policies designed in a peer review environment, and do not require evaluation or reporting that ultimately enhances audit quality and investor protection. 57 As discussed below, the Commission views the statements in the PCAOB response letter as being on par with statements made by the Board in the Adopting Release about the scope and application of the QC 1000 requirements. See Section III.G. The Amendments emphasize the importance of accountability and firm governance and a QC system that is proactive and responsive to risks. Replacing interim standards with permanent standards provides additional regulatory certainty that may have an incremental benefit of allowing audit firms to make long-term investments in their QC systems. Further, the Amendments will promote compliance by registered public accounting firms with applicable professional and legal requirements (including PCAOB auditing standards), which should help eliminate information asymmetries and expectation gaps for issuers, registered broker-dealers, and investors regarding whether audit firms are complying with such requirements. Improved compliance by registered public accounting firms with PCAOB auditing standards, among other professional and legal requirements, would result in improved financial reporting quality, which would further benefit investors. In addition, the Amendments share a common framework with Other QC Standards that are widely implemented by auditing firms across the globe, with specific enhanced requirements for the U.S. regulatory environment, which allows firms to leverage costs already expended or that will be expended to comply with these standards. In addition to the overarching structure and the eight components being the same among QC 1000 and the Other Standards as noted above in Section II, the requirements within the components are also aligned. Specifically, the required quality objectives ( i.e., the outcomes specified by the standards that drive the firm's responses) generally are substantively similar 58 although some of QC 1000's quality objectives contain additional prescriptive requirements 59 that the Board considered to be relevant to the U.S. public company legal and regulatory environment as discussed in more detail below. 60 Both QC 1000 and the Other QC Standards provide firms with flexibility to design responses to achieve these quality objectives taking into account the particular risks and circumstances faced by the firm. Further, there is overlap in the limited number of specified quality responses ( i.e., individual responses required by QC 1000 and the Other QC Standards). In other words, the quality objectives that firms establish (and their resulting responses) under QC 1000 are expected to be sufficiently responsive to those of the Other QC Standards. 61 58 We note that QC 1000's quality objectives may use different terminology from the Other QC standards to align with other PCAOB standards and requirements ( e.g., using the term “QC system” instead of “system of quality management”). 59 For example, in establishing quality objectives in the Governance and Leadership component, QC 1000.25.e requires firms to establish an objective that “The firm's organizational and governance structure and the assignment of roles, responsibilities, and authority enable the design, implementation, and operation of the firm's QC system and support performance of the firm's engagements in accordance with applicable professional and legal requirements” (emphasis added). ISQM 1.28 requires firms to establish an objective that “The organizational structure and assignment of roles, responsibilities and authority is appropriate to enable the design, implementation and operation of the firm's system of quality management.” These objectives are substantively the same, but QC 1000 places more emphasis on supporting the firm's engagements, which is inherent in the operation of the firm's QC system, and therefore implicitly included in both standards. The additional specificity in QC 1000 is not expected to result in substantively different responses ( i.e., policies and procedures) between the two standards. 60 See Adopting Release, supra note 9, at 38. Many of the prescriptive requirements in QC 1000 that are incremental to those that are in the Other QC Standards relate to existing PCAOB standards that the PCAOB determined were still relevant. See, e.g., QC 20.10, .13a, .13b, and .15a. 61 For example, the specified responses to determine the nature, timing, and extent of monitoring in the Monitoring and Remediation Processes (see QC 1000.64 and ISQM 1.37) are substantively similar, except QC 1000.64(d) and (f) specifically require firms to consider characteristics of particular engagements and partners. When a firm designs its monitoring process, as long as a firm considers the characteristics of particular engagements and partners, the same policies and procedures would likely be suitable for both QC 1000 and ISQM 1. QC 1000 does go beyond the Other QC Standards in that it contains relatively more prescriptive requirements than the Other QC Standards. 62 The Board considered these requirements to be relevant to the U.S. regulatory environment and investors. 63 Many of these additional requirements only apply to firms that issue audit reports for more than 100 issuers in the prior calendar year. 64 Because QC 1000 provides more precise and prescriptive requirements that drive accountability, it will enhance the Board's ability to perform its inspections and to enforce its standards, which will further incentivize firms to design, implement, and operate effective QC systems. 65 It is the Board's view that building on the well-understood basic framework of the Other QC Standards, appropriately tailored and strengthened to address the U.S. legal and regulatory environment and our investor protection mandate, will enable firms to implement and comply with QC 1000 more effectively. 66 In designing, implementing, and operating their QC systems, firms that are subject to both PCAOB standards and the Other QC Standards, which the Commission estimates to be 88% of registered firms that have performed engagements under PCAOB standards for an issuer or registered broker-dealer (“PCAOB engagements”) in the past year and 72% of registered firms that have not, 67 will be able to leverage the work they have already done and the investments they have already made to comply with such Other QC Standards. 68 In support of this conclusion, neither the Commission staff nor commenters have identified aspects of QC 1000 that are incompatible with the Other QC Standards. 62 For example, QC 1000.33.a and ISQM 1.34(a)(i) both require firms to establish policies and procedures to identify threats to independence; however, QC 1000.34 provides specific procedures the firm should establish in order to do so, including, for example, maintaining and making available the list of restricted entities. While maintaining a list of restricted entities is likely a common way of complying with ISQM 1.34(a)(i), it is not explicitly required. 63 See supra note 60. 64 See, e.g., QC 1000.28. 65 See, e.g., QC 1000.14(d) (requiring a firm's principal executive officer to certify the firm's report to the PCAOB on its annual evaluation of the QC system). 66 Adopting Release, supra note 9, at 7. 67 See details of Commission staff analysis in Section III.C. 68 See Adopting Release, supra note 9, at 7. A. Requirements Related to the Design of QC System As discussed above, QC 1000 includes a design-only requirement. The PCAOB stated in the Adopting Release that the design-only requirement may facilitate timely implementation and operation of a compliant QC system. 69 The Board also stated that not requiring all registered public accounting firms to design their QC system would create a risk that firms could be unprepared to accept and perform such engagements in compliance with applicable professional and legal requirements. 70 Finally, the PCAOB stated that because registering with the PCAOB enables a firm to issue audit reports or play a substantial role on audits performed under PCAOB standards for issuers and registered broker-dealers, and because investors and companies considering engaging the firm could reasonably expect that any firm that could pursue such an engagement would already have a PCAOB-compliant QC system designed and ready for implementation and operation, it believes that imposing a design requirement on all registered firms promotes its mission of protecting investors and promoting the public interest. 71 69 Id. at 60-61. 70 Id. at 368. 71 See PCAOB response letter at 25-26. General A number of commenters expressed concerns regarding the design-only requirement. 72 Commenters stated that this requirement will increase the barriers to entry for small firms to take on audits of small publicly-held companies, including EGCs, or registered broker-dealers and will incentivize firms to de-register. 73 A few commenters stated they agreed with concerns expressed by PCAOB Board Member Ho in her statement accompanying the adoption of QC 1000 indicating that the design-only requirement appears to be inconsistent with both the statutory text of SOX and a statement the PCAOB made to Congress in 2023, and that the requirement would impose undue burdens on competition. 74 The PCAOB response letter responds to commenter feedback on the design-only requirement, including addressing why applying such a requirement to firms that do not presently have obligations with respect to PCAOB engagements is consistent with the PCAOB's statutory mandate. 75 72 See, e.g., letters from BDO; Chamber; Forvis Mazars; PICPA; and PWC. 73 See, e.g., letters from BDO; Chamber; PICPA; and PWC. 74 See letters from BDO and PICPA (citing Board Member Ho, Statement on the QC 1000 Adoption—Demise to Audit Competition (May 13, 2024) (“C. Ho Statement”), available at https://pcaobus.org/news-events/speeches/speech-detail/statement-on-the-qc-1000-adoption---demise-to-audit-competition). See also letters from Chamber (“The Chamber urges the Commission to heed the serious concerns raised by Board Member Ho's statement.”) and RSM (same). 75 See PCAOB response letter at 25-27. While we acknowledge the concerns raised by commenters, we find that the design-only requirement is consistent with the requirements of Title I of SOX and the rules and regulations issued thereunder and is necessary or appropriate in the public interest or for the protection of investors. Allowing registered firms to design their QC system only upon entering into an audit engagement would create a risk that registered firms could be unprepared to accept and perform engagements in compliance with applicable professional and legal requirements, which in turn risks a reduction in audit quality to the detriment of investors. For example, one component of a well-designed QC system is policies and procedures around the acceptance of an engagement. Without having designed a QC system in advance, such firms would not be in a position to ensure that their QC system is effective in order to evaluate and take on a new PCAOB engagement. Below we discuss the views of commenters with respect to specific aspects of QC 1000's design-only requirement, as well as the Commission's findings regarding those matters. Statutory Authority We have considered comments on the statutory authority questions raised in Board Member Ho's statement as well as the PCAOB's response letter and find that the Board has the authority to require that all registered firms design a QC system that complies with QC 1000. The Supreme Court has stated that, in cases of statutory construction, a court's analysis begins with “the language of the statute” and “where the statutory language provides a clear answer, it ends there as well.” 76 SOX Section 103(a)(2)(B) refers to quality control standards that the Board adopts with respect to the issuance of audit reports. 77 This section of SOX requires the PCAOB to include, in the quality control standards that it adopts with respect to the issuance of audit reports, seven requirements for every registered public accounting firm relating to: (i) monitoring of professional ethics and independence from issuers, brokers, and dealers on behalf of which the firm issues audit reports; (ii) consultation within such firm on accounting and auditing questions; (iii) supervision of audit work; (iv) hiring, professional development, and advancement of personnel; (v) the acceptance and continuation of engagements; (vi) internal inspections; and (vii) such other requirements as the Board may prescribe (subject to the general rulemaking authority provided to the PCAOB in SOX Section 103(a)(1)). 78 QC 1000 is a quality control standard with respect to the issuance of audit reports that includes each of these seven statutory requirements. Moreover, the fact that one of the statutory requirements relates to the acceptance of engagements implies that the PCAOB's QC standards must address firms that have not yet accepted engagements and not just firms that currently issue audit reports. 76 See Hughes Aircraft Co. v. Jacobson, 525 U.S. 432, 438 (1999); see also Loper Bright Enter. v. Raimondo, 144 S. Ct. 2244 (June 28, 2024) (“Courts interpret statutes, no matter the context, based on the traditional tools of statutory construction, not individual policy preferences.”). 77 See 15 U.S.C. 7213(a)(2)(B). 78 See 15 U.S.C. 7213(a)(2)(B). Furthermore, we find the use of the term “every” in Section 103(a)(2)(B) significant, because it is the only place in SOX that uses that term. In other sections of SOX, such as Sections 101, 104 and 106, Congress used narrower language when it wanted to apply a particular regulation to a smaller universe of public accounting firms or registered public accounting firms. 79 Further, requiring all registered public accounting firms to design a system of quality control that complies with QC 1000 is consistent with the Congressional directive in SOX Section 102, which requires applicant firms that want to register with the PCAOB to provide for review a description of “the quality control policies of the firm for its accounting and auditing practices.” 80 We therefore find the Amendments are within PCAOB's authority under Title I of SOX. 79 See 15 U.S.C. 7211(c)(1) (“. . . register public accounting firms that prepare audit reports for issuers, in accordance with section 102. . . ”) (emphasis added); 15 U.S.C. 7214(a)(2)((A) (“The Board may, by rule, conduct and require a program of inspection in accordance with paragraph (1), on a basis to be determined by the Board, of registered public accounting firms that provide one or more audit reports for a broker or dealer.” ) (emphasis added); 15 U.S.C. 7216 (“ Any foreign public accounting firm that prepares or furnishes an audit report with respect to any issuer, broker, or dealer shall be subject to this Act . . .”) (emphasis added). 80 15 U.S.C. 7212. We also disagree that the design-only requirement is contrary to the statements in the PCAOB's February 2023 letter to Senators Warren and Wyden. See C. Ho Statement (citing https://www.warren.senate.gov/imo/media/doc/2023-02-08%20PCAOB%20Chair%20Erica%20Williams%20response%20letter%20to%20Senators%20Warren%20and%20Wyden.pdf ). The PCAOB's letter specifically addressed the PCAOB's statutory authority as it relates to the cryptocurrency industry and stated, among other things, that “[a]s a general matter, audit firms registered with the PCAOB must follow PCAOB standards and rules specifically in connection with their audits of SEC-registered issuers, brokers or dealers only.” The letter does not specifically address whether an accounting firm that does not perform audits for issuers, brokers, or dealers that chooses to register with the PCAOB must comply with statutory requirements related to systems of quality control. Barriers to Entry As noted above, several commenters expressed concerns that the design-only requirement will increase the barriers to entry for small firms to take on audits of smaller issuers or registered broker-dealers and incentivize firms to de-register. Some commenters suggested the requirement be revised to require the system to address only elements of QC covered by the professional QC standards the firm is currently subject to for the type of engagements they currently perform ( e.g., the Other QC Standards). 81 Similarly, one commenter suggested the Commission defer the effective date of QC 1000 for inactive firms until they become active. 82 In the PCAOB response letter, the Board reiterated that the design-only requirement would benefit investors and explained why it believed the alternatives proposed by commenters would not achieve the same level of investor protection as QC 1000. 83 The Board further stated that the design-only requirement comports with its historical practice of requiring firms to provide a summary of the design of their QC system upon registration, regardless of whether such firms perform engagements under PCAOB standards. 84 81 See letters from Chamber and Forvis Mazars. 82 See letter from PWC. See also letters from PICPA (recommending that an “inactive firm . . . not have to design its quality control system until after it decided to accept an engagement with a public company, broker, or dealer”); RSM (recommending that firms be required to design, implement, and test the effectiveness of their system of quality control in compliance with QC 1000 prior to being engaged to issue public company audit reports rather than upon registration). 83 See PCAOB response letter at 26-27. 84 Id. at 26. We acknowledge concerns that the design-only requirement could create barriers to entry or otherwise impact the decision to either register, or remain registered, with the PCAOB for firms that do not perform PCAOB engagements, and as discussed more fully in Section III.C below, we have considered the overall competitive effects of the Amendments on the market for audit services. These concerns must be weighed against the investor protection benefits of the design-only requirement. In particular, as the Board noted in the Adopting Release, if a registered firm that has not led an engagement or played a substantial role on an engagement in the past anticipates the possibility of transitioning to performing engagements, the design-only requirement may facilitate timely implementation and operation of their QC 1000 compliant QC system. 85 As would be the case in any profession or industry when quickly adopting business-wide quality control processes, allowing registered firms to design their QC system only upon entering into an audit engagement would create a risk that registered firms could be unprepared to accept and perform engagements in compliance with applicable professional and legal requirements, which in turn risks a reduction in audit quality. 86 85 See Adopting Release, supra note 9, at 60-61. 86 Id. at 368. We further considered the alternatives raised by commenters, including allowing for compliance with Other QC Standards, or delaying the effective date until firms accept an engagement under PCAOB standards. However, we do not believe that either of these alternatives sufficiently addresses the risks to investors of a firm entering into audit engagements with an issuer or registered broker-dealer without a QC system in place that provides reasonable assurance the firm could conduct the engagement in accordance with applicable professional and legal requirements. An audit firm's failure to conduct an engagement in accordance with applicable professional and legal standards undermines audit quality, puts at risk capital formation, and places investors and issuers at risk. Further, there are reasons to believe that the design-only requirement will not be a significant barrier to entry or cause for smaller firms to deregister, primarily due to the expected costs to the majority of registered firms being substantially mitigated by investments made by those firms to comply with the Other QC Standards, which have already been adopted by the IAASB and AICPA and will be effective at or before the effective date of QC 1000. In the Adopting Release, the PCAOB stated that QC 1000 shares a basic structure and approach with the Other QC Standards, so designing for the incremental features unique to QC 1000 is not expected to be unduly burdensome for firms that are subject to either or both of those Other QC standards. 87 The PCAOB also stated in the Adopting Release that it believes most audit firms will have either already implemented or be implementing one or both of the Other QC Standards when QC 1000 goes into effect on December 15, 2025. 88 The Commission staff compared the requirements of QC 1000 with the requirements of the Other QC Standards and similarly concluded that there is significant overlap and did not identify anything that is incompatible with those other requirements. Further, no commenters identified any aspects of QC 1000 that are incompatible with these other requirements. Many of the specified requirements in QC 1000 that are not in the Other QC Standards are applicable only to firms issuing audit reports for more than 100 issuers. Therefore, with respect to these incremental requirements, any firms required to design but not implement a QC system under QC 1000 would not be required to adopt those specified requirements. Further, any other incremental requirements over Other QC Standard requirements that are applicable to such firms are not expected to be burdensome to design, especially given the inherent scalability of QC 1000. The Commission staff also performed an analysis of registered firms and determined, consistent with the PCAOB's evaluation, that most registered firms will be subject to the Other QC Standards by the time QC 1000 is effective. 89 Based on the Commission staff's assessment, we believe that these existing standards are likely to mitigate compliance costs for a very substantial majority of registered firms. 87 Id. at 61. 88 See, e.g., id. at 330-31. 89 Commission staff estimate that approximately 77% of registered firms are subject to the requirements of one or both of the Other QC Standards. Details on this analysis can be found in Section III.C. Furthermore, other factors may serve to mitigate any adverse competitive effects from the design-only requirement for smaller firms. For example, some registered firms currently participate in PCAOB engagements at a level below that of a “substantial role,” with the level of involvement varying, with some of those firms participating at a level approaching a “substantial role.” 90 Larger firms could have a greater incentive to use the work of registered public accounting firms that are currently participating at a level below that of a “substantial role,” or that are not participating in PCAOB engagements at all, if the larger firms knew that such firms had already designed a QC system in accordance with QC 1000. Therefore, such smaller firms may have more opportunity to participate in audits pursuant to PCAOB standards in the future. Other firms that would have been subject to the design-only requirement may indeed choose to deregister. Such deregistration may, nevertheless, not have an adverse competitive effect if such firms were only intending to continue to compete for work that does not require PCAOB registration, such as participating in an audit pursuant to PCAOB standards at a level below that of a “substantial role,” as their registration status would not impact their eligibility for this work. Accordingly, for these reasons and the reasons discussed in Section III.C, the Commission does not believe this aspect of the Amendments is likely to have a significant negative impact on the market for audit services or the pool of registered audit firms. 90 Commission staff reviewed the publicly available PCAOB Form AP database, “FirmFilings,” and filtered for Forms AP with an “Audit Report Date” between April 1, 2022 to March 31, 2023 to identify “other participant” firms listed in column “Audit Not Divided Percent Information,” available at https://pcaobus.org/resources/auditorsearch. For purposes of this analysis, staff assumed that only “other participant” firms with a “Firm ID” in the database were registered. Staff then compared this information to the corresponding publicly available Form 2 data related to audit reports filed between April 1, 2022 to March 31, 2023 to identify firms that did not perform issuer audits, broker-dealer audits, or perform any substantial role work based on responses to questions in Part III, indicating that while not required to register, these firms are registered. Staff then filtered the Form AP data to isolate these firms, noting their roles are at less than a “substantial role” to varying degrees from 5-10% to 20-30% of total audit hours in many cases. B. EQCF Role As described above, QC 1000 includes a requirement for the small number of firms that issue audit reports for more than 100 issuers during the prior calendar year to implement an EQCF. Composed of one or more persons who are not principals or employees of the firm and do not otherwise have a commercial, familial or other relationship with the firm that would interfere with the exercise of independent judgment with regard to the matters related to the QC system, the EQCF is required to evaluate the significant judgments made and related conclusions reached by the firm when the firm is evaluating and reporting on the effectiveness of its QC system. 91 The PCAOB stated in the Adopting Release that an external oversight function should enhance the discipline with which the firm carries out its own QC system evaluation. 92 The PCAOB also stated that, based on comments it received on the Concept Release and the Proposing Release and experience with inspections of firms' systems of quality control, it believes that investors, audit committees, and other stakeholders will benefit from the EQCF's evaluation. 93 91 See Adopting Release, supra note 9, at 118. 92 Id. at 124. 93 Id. General Some commenters stated that they specifically supported the EQCF role. 94 One commenter emphasized the importance of the EQCF role. 95 This commenter stated that it made sense to require firms that issue audit reports for more than 100 issuers per year to be subject to incremental requirements, such as the EQCF role, “given such firms' greater involvement in the U.S. capital markets and their impact on investors.” 96 This commenter further stated that it appreciated that the Amendments stressed “the independence of the external oversight function.” 97 Another commenter stated that the creation of the EQCF “is necessary in light of ongoing instances around the globe which suggest the firms suffer from a lack of ethics throughout the firms, including senior leadership.” 98 94 See letters from Consumer Federation of America and L. Turner. 95 See letter from Consumer Federation of America. 96 Id. 97 Id. 98 See letter from L. Turner. On the other hand, several commenters stated that they do not support the requirement to incorporate an EQCF within the QC system. 99 Among other concerns, commenters asserted that the EQCF requirement included prescriptive elements that were not exposed for public comment; that the costs and benefits of the EQCF requirement had not been adequately considered; that the requirement could vitiate confidentiality protections under SOX; and that the requirement raised personal liability and other concerns that could render the requirement unworkable. Several commenters expressed the view that the requirement would necessitate disclosure of firm deficiency information included in Part II of PCAOB inspection reports to the person or persons serving in the EQCF role in conflict with SOX and PCAOB rules or Congressional intent. 100 More generally, commenters stated that it was unclear “how the EQCF would function within a firm's system of quality control” 101 and suggested that the standard the PCAOB adopted “expanded the professional obligations and responsibilities” of the EQCF role, which would impose additional liability costs for those professionals. 102 Another commenter stated that the EQCF requirement is “neither realistic nor needed” given that the QC systems of firms are complex and involve a multitude of judgments and conclusions and the PCAOB already inspects large firms annually. 103 One commenter stated that “[f]irms that are close to or just above the 100-issuer mark may feel compelled to consider reducing their issuer count below this threshold” as a result of the EQCF requirement. 104 One commenter raised concerns about the EQCF role in its initial comment letter to the Commission and stated, in a subsequent supplemental comment letter, that the PCAOB response letter “provides additional clarity on several of our questions,” including with regard to the EQCF role, 105 but stated the PCAOB response “did not address certain other key matters raised by commenters” 106 and that the letter “raises additional questions.” 107 Specifically, this commenter stated “it is not clear how to square the Board's stated belief that requiring the EQCF will `improve audit quality' and `drive improvement in a firm's QC system' with the view that EQCF members would only be considered `supervisory persons' if the EQCF had the `responsibility, ability, or authority to affect the conduct of . . . associated persons. . . .' ” 108 99 See, e.g., letters from BDO; CAQ; Chamber; EY; Forvis Mazars; Moss Adams; PICPA; and PWC. 100 See, e.g., letters from BDO; CAQ; Chamber; Forvis Mazars; and PWC. See also letter from the Center for Audit Quality (Aug. 29, 2024) (“CAQ Supplemental Letter”) (stating that the PCAOB response letter did not address “certain other key matters” raised by commenters, such as “the PCAOB's authority to compel disclosure of information afforded confidential and privileged by The Sarbanes-Oxley Act ( e.g., Part II of PCAOB Inspection Reports)”); letter from PICPA (expressing the view that the EQCF “presents concerns regarding the confidentiality of PCAOB Part II inspection findings”); letter from RSM (“The SEC should consider whether SOX restrictions on public disclosure of Part II inspection findings and confidentiality of communications with inspection teams create complexities for effectuating the PCAOB's intention with respect to the EQCF's role.”). 101 See letter from Forvis Mazars. 102 See letter from BDO. 103 See letter from Chamber. See also letter from PWC (stating “[w]e do not believe that firms should be viewed as incapable of performing their own evaluations and conclusions on their QC systems with full transparency to the PCAOB through its inspections process but without third-party involvement”). 104 See letter from Moss Adams. 105 This commenter stated that, for example, the PCAOB comment letter clarified the Board's belief that those serving in an EQCF role would meet the definition of an “associated person.” See CAQ Supplemental Letter. 106 This commenter stated that, for example, the PCAOB response letter did not address the point raised in several comment letters that the Amendments would require firms to disclose confidential and privileged information to “individuals a firm is not otherwise even required to employ or contract.” Id. In addition, the commenter stated that the Board “does not address concerns raised by commenters about the new EQCF requirements being stated by the Board to be analogous in some ways to an Engagement Quality Reviewer.” Id. 107 Id. The commenter asked the Commission to clarify whether the PCAOB response letter “can be viewed as equally authoritative as the Final Standard and Adopting Release.” We respond to this comment in Section III.G below. 108 Id. While we acknowledge the concerns raised by commenters about the EQCF requirement, the Commission finds that the EQCF role is consistent with the requirements of Title I of SOX and the rules and regulations issued thereunder and is necessary or appropriate in the public interest or for the protection of investors. We believe that an independent oversight function for the small number of firms subject to the requirement will enhance the effectiveness of a registered firm's QC system, ultimately leading to improvements in audit quality. In support of the EQCF requirement, one commenter pointed to the importance of independence to “high quality corporate governance in the United States” and stated that “as independence has been implemented, enhanced and monitored, it has led to investors relying to a greater extent on corporate boards.” 109 We agree with this commenter's views on the benefits of independence to governance structures and concur with the PCAOB that adding an independent perspective to an annually inspected firm's QC system self-evaluation will promote a more rigorous evaluation process by those firms and drive improvements in audit quality. 110 In fact, the PCAOB stated that, in connection with its oversight, “certain firms have acknowledged the limitations of internal QC functions led by non-independent firm employees and have touted the benefits of independent review.” 111 The PCAOB further stated that some firms have already created leadership or advisory roles for independent third parties. 112 We find this evidence persuasive and therefore conclude that requiring an external quality control function for registered firms will serve the public interest and the protection of investors. 109 See letter from L. Turner. 110 See PCAOB response letter at 3, 9. In 2008, one of ACAP's recommendations was to urge the PCAOB and the SEC, in consultation with others, to “analyze, explore, and enable, as appropriate, the possibility and feasibility of firms appointing independent members with full voting power to firm boards and/or advisory boards with meaningful governance responsibilities to improve governance and transparency of audit firms.” See letter from L. Turner (citing and quoting from ACAP recommendations). 111 See PCAOB response letter at 3. 112 Id. (including, for example, one firm that disclosed it had “robust discussions” regarding its initial QC system evaluation under ISQM 1 with its external quality advisors and another firm that indicated its audit advisory council, which includes two independent members, addresses matters related to the QC system, including inspection results and remediation efforts). See also PWC, 2023 Audit Quality Report, at 31 (describing its “independent Assurance Quality Advisory Committee” as providing advice “on aspects of the business, operations, culture, governance, and risk management approach that are reasonably expected to impact audit and assurance quality” and stating that such committee “made us the first firm with both a Board that includes external members and an independent advisory committee focused on quality”), available at https://www.pwc.com/us/en/services/audit-assurance/library/audit-quality-report.html. One commenter expressed doubts that the EQCF would improve audit quality or drive improvements in a firm's QC system given the PCAOB's view that the EQCF would only be considered a supervisory person if it had responsibility, ability, or authority to affect the conduct of associated persons. 113 We understand this commenter to be suggesting that the EQCF role will not result in improvements unless the EQCF has some control with respect to decision-making at the firm. To the extent the registered public accounting firms subject to the EQCF requirement share the concern raised by this commenter, the Amendments provide firms with flexibility to vest the EQCF with decision-making authority to the extent they see fit. However, even absent decision-making or other authority, we believe that the EQCF role will be able to drive improvements in audit quality and a firm's QC system. An independent perspective on the significant judgments made and conclusions reached by the firm during its annual evaluation will help firms identify areas of improvement in their QC systems that they can consider when operating their QC systems. It is not uncommon for businesses to seek external perspectives on a variety of topics or issues and the fact that the business is the ultimate decision-maker does not mean that the input provided is not valuable or beneficial to the process. In addition, as noted above, some audit firms have voluntarily added independent oversight to their governance structures, indicating that they see a benefit to having an independent perspective. 113 See CAQ Supplemental Letter. Relatedly, we do not believe that imposing an independent QC monitor or independent QC consultant for a prescribed period of time as remedial relief in a PCAOB enforcement action would serve as a viable substitute for the EQCF requirement for the small number of firms subject to the requirement, as suggested by one commenter. 114 Based on our experience with Commission enforcement actions, audit quality and investor protection benefits are greater with a prophylactic requirement aimed at preventing such violations from occurring in the first place—before investors are potentially placed at risk—than with only remedial relief in a handful of enforcement actions for limited periods of time. 115 114 See letter from PWC. 115 See PCAOB response letter at 10. In addition to the overall benefits that an independent oversight function would provide, we find that the Board's approach to mandating this requirement in QC 1000 appropriately balances the need to enhance the effectiveness of registered firms' QC systems with an approach that provides flexibility in internal governance structures to minimize cost and disruption. As adopted by the Board, the EQCF requirement will provide significant flexibility for firms to design procedures that work best for their individual firm governance structure and requirements. QC 1000 does not specify where within the registered public accounting firm the EQCF must be housed or to whom the EQCF must report. 116 These determinations are left to the discretion of the firm. This flexibility will allow an independent EQCF 117 to also serve, for example, as an independent member of a firm's advisory committee or audit quality committee or governance body, including one that has a majority of non-independent members. 118 Furthermore, to the extent that firms have existing QC advisory committees, nothing in the rule would prevent those committees, or independent members of those committees, from serving as EQCF, provided they meet the rule's independence standard and can discharge the assigned duties. 116 See QC 1000.28. 117 The EQCF must be independent in accordance with the requirements in QC 1000.28. See Adopting Release, supra note 9, at 122 (stressing the importance of the independence requirement but otherwise providing firms with discretion to determine the specific credentials the EQCF must have as long as they have the experience, competence, authority, and time necessary to carry out their assigned responsibilities); PCAOB response letter at 8 (“As long as the firm incorporates into its governance structure an EQCF that can appropriately discharge its single prescribed responsibility (and any additional responsibilities the firm might voluntarily assign to it) in accordance with the QC 1000 standard, the firm would have wide latitude to decide—in its discretion and based on its particular circumstances—how best to design its EQCF.”). 118 A number of the audit firms that would be subject to the EQCF requirement have stated publicly that they have independent representation in their governance structure or plan to add such a role in the near-term. See supra notes 31 and 112. The Amendments also do not prescribe specific procedures to be followed by the EQCF and require only one EQCF activity. 119 The EQCF must evaluate “the significant judgments made and the related conclusions reached by the firm when evaluating and reporting on the effectiveness of the QC system.” 120 Notably, the EQCF's responsibility does not extend to all of the firm's QC-related judgments and conclusions, but only to significant ones made in connection with the firm's annual QC-system evaluation and reporting. 121 Firms may, but are not required to, consider additional oversight functions for the EQCF, such as reviewing the firm's remediation actions and monitoring plan, or identifying and monitoring emerging risks or trends that could potentially affect the firm's QC system. 122 Similar to the flexibility provided to audit firms in determining how the EQCF will perform its responsibilities, audit firms would have flexibility to consider, based on their individual firm needs, what other functions, if any, would be beneficial. Along these lines, one commenter noted that the PCAOB has pointed out the flexibility of its approach and how a firm implementing it can apply that flexibility. The commenter further stated that, based on the commenter's experience with the auditing profession, the commenter believes that the PCAOB is correct and that the approach the PCAOB took with respect to the EQCF “should, and will ultimately, allay the concerns of audit firm commenters.” 123 Below we discuss the views of commenters with respect to specific aspects of QC 1000's EQCF requirement, as well as the Commission's findings regarding those matters. 119 See QC 1000.28. 120 Id. 121 See PCAOB response letter at 7. 122 See Adopting Release, supra note 9, at 119-24. 123 See letter from L. Turner. Notice and Comment Several commenters expressed the view that the EQCF requirement was not included in the Proposing Release and therefore was not properly exposed for public comment before being adopted by the Board. 124 One commenter stated that the change from requiring an “oversight function for the audit practice” in the Proposing Release to requiring an “oversight function for the QC system” in the Adopting Release represents a significant change that “effectively deprives us of an opportunity for public input into the revised requirement.” 125 Another commenter stated that the requirement for the EQCF to evaluate all “significant judgments” introduces “prescriptive elements not included in the original proposal.” 126 Conversely, one commenter stated that “[c]learly anyone who read and responded to the Concept Release and exposure draft were aware that the PCAOB was moving to adopt such a function in its final rule.” 127 124 See, e.g., letters from CAQ; Chamber; EY; Forvis Mazars; Moss Adams; and PWC. 125 See letter from PWC. 126 See letter from Grant Thornton LLP (July 16, 2024) (“GT”) (explaining that although the firm has an Audit Quality Advisory Counsel, it does not meet the EQCF requirements in QC 1000, particularly regarding the necessary authority and review of all “significant judgments”). 127 See letter from L. Turner (discussing the relevant history of the proposed QC standard, including the 2008 ACAP recommendation, 2019 Concept Release, and 2022 Proposing Release, and stating that the PCAOB has gone through an “extensive process of outreach” to both its Investor Advisory Groups and Standards Advisory Groups with respect to quality control standards and noting that members of the Standards Advisory Groups include members of the “Big Four” as well as smaller firms). As a threshold matter, we find that the public had a meaningful opportunity to comment on the Amendments both as they were being developed by the PCAOB and after they were filed with the Commission for approval. The PCAOB received and considered comments in connection with both the 2019 Concept Release and 2022 Proposing Release. The comment period for the Proposing Release was open for 75 days, but the PCAOB continued to accept comments up until its adoption of the Amendments. The PCAOB considered all comments it received. After the Amendments were filed with the Commission for approval, the Commission published a notice to solicit comment on the Amendments with comments due 21 days after the Notice of Filing of Proposed Rules was published in the Federal Register . To provide additional time for consideration of the Amendments and the issues raised therein, the Commission twice extended the date by which it must act on the Amendments. During this time, the Commission received additional input from both the Board and public commenters. We have considered all of these comments in deciding to approve the Amendments. The Commission finds that the Board's process for approving the Amendments complied with all applicable requirements. Although the Board is not “an agency or establishment of the United States Government,” 128 for statutory purposes and therefore is not subject to the requirements of the Administrative Procedure Act (“APA”), 129 the Board as a matter of policy has adopted a notice-and-comment process to inform its decision-making. 130 The Board followed that process here. The PCAOB response letter details the standard-setting history relating to the EQCF requirement, beginning with the 2008 recommendations from ACAP and including the Concept Release, Proposing Release, consideration of comments received to each, and Adopting Release. 131 The Board describes the outreach it performed and the input it received from a variety of stakeholders over the course of that multi-year process. 132 The Board's analysis demonstrates that the core tenets of “independent oversight over firm's QC systems” were introduced in the Concept Release, 133 and were refined through the Board's stakeholder engagement, including in response to comments received on their Concept Release and Proposing Release. 134 Accordingly, we find the Board's process for approving the Amendments reasonable and appropriate. 128 15 U.S.C. 7211(b). 129 See 5 U.S.C. 551(1) (defining an “agency” as “each authority of the Government of the United States”); id. § 551(5) (defining “rule making” as “agency process for formulating, amending, or repealing a rule”); id. § 553 (setting forth the requirements for agency rule making). 130 See PCAOB Staff Guidance on Economic Analysis in PCAOB Standard Setting (2014), available at https://pcaobus.org/oversight/standards/economic-analysis/05152014_guidance. 131 See PCAOB response letter at 3-5. 132 Id. 133 Id. (noting that the Concept Release included a request for comment asking, “Should a future PCAOB QC standard incorporate mechanisms for independent oversight over firms' QC systems ( e.g., boards with independent directors or equivalent)?”). 134 Id. (stating that in response to the Proposing Release “[m]any commenters called for more clarity and specificity about the role of the oversight function”). As proposed, consistent with the Concept Release, 135 the PCAOB contemplated an independent QC oversight function within the governance structure of an audit firm. 136 Specifically, the PCAOB proposed to require an “oversight function for the audit practice” writ large that included at least one individual who was not a principal or employee of the firm and who did not have a relationship with the firm “that would interfere with the exercise of independent judgment with regard to matters related to the QC system ” (emphasis added). 137 The PCAOB explained in the Proposing Release that the proposed requirements “would not specify how the firm would establish its governance structure or assign authority, other than having one person in an oversight role who would be in a position to exercise independent judgment with regard to QC matters ” (emphasis added). 138 The proposed oversight function, coupled with the general requirement relating to the “exercise of independent judgment with regard to matters related to the QC system,” reasonably could have been read to include, for example, oversight over all aspects of the QC system including design, sufficiency, judgment, and overall effectiveness. 135 See Concept Release, supra note 10 (“We are considering whether a future PCAOB QC standard should address mechanisms for independent oversight over firms' QC systems .”) (emphasis added). 136 See Proposing Release, supra note 11, at 97 (“[T]he firm's governance structure should incorporate an oversight function for the audit practice that includes at least one person who is not a partner, shareholder, member, other principal, or employee of the firm and does not otherwise have a commercial, familial, or other relationship with the firm that would interfere with the exercise of independent judgment with regard to matters related to the QC system.”). 137 Id. at 97 (“If the firm issued audit reports with respect to more than 100 issuers during the prior calendar year, the firm's governance structure should incorporate an oversight function for the audit practice that includes at least one person who is not a partner, shareholder, member, other principal, or employee of the firm and does not otherwise have a commercial, familial, or other relationship with the firm that would interfere with the exercise of independent judgment with regard to matters related to the QC system.”). 138 Id. In response to the Proposing Release, commenters requested specificity regarding the function and scope of the responsibilities such an independent QC governance role would entail. 139 After taking such comments into consideration, the Board adopted an amended QC standard that clarified the EQCF's status and role. Specifically, the PCAOB narrowed the focus of the role from the proposal which, as explained above, would have required an “oversight function for the audit practice” to require an “oversight function for the QC system” and specified a single responsibility for the EQCF: “evaluating the significant judgments made and the related conclusions reached by the firm when evaluating and reporting on the effectiveness of the QC system.” 140 139 See Adopting Release, supra note 9, at 119-20 (citing relevant commenter feedback on the Proposing Release). 140 Id. at 118. One commenter specifically stated that the change from an “oversight function for the audit practice” to an “oversight function for the QC system” was a significant change that was not adequately explained or proposed for public comment. 141 We disagree with this commenter. The QC system is the process by which a firm manages and improves its audit practice and therefore is an integral and significant part of the audit practice, so that a role overseeing the audit practice would necessarily also oversee the QC system in addition to other aspects of a firm's audit operations. Therefore, an “oversight function for the QC system” is a subcomponent of an “oversight function for the audit practice” ( e.g., a narrower version of what was proposed). Moreover, the EQCF role was proposed in the context of the PCAOB's new quality control standard and both the PCAOB's proposed and adopted formulations of the oversight requirement required that the individual or individuals who fill the role not have any relationships with the firm “that could interfere with the exercise of independent judgment with regard to matters related to the QC system ” (emphasis added). 142 In our view, these explicit references to the individual's responsibilities as they relate to the “QC system” weigh against commenters' claims that the EQCF role could not have been anticipated from the proposal. 143 141 See letter from PWC. 142 See Proposing Release, supra note 11, at 97. 143 See letters from CAQ and Chamber. Moreover, many aspects of the Amendments related to the EQCF role remain unchanged from the proposal. For example, the EQCF requirement only applies to firms that issue audit reports with respect to more than 100 issuers during the prior calendar year. 144 The requirement for independence remained the same with the exception of changing the terminology from the singular to plural form ( i.e., a grammatical change). 145 Although the Amendments describe the EQCF role as an “ external oversight function,” the PCAOB response letter explains that it used the phrase “external” to “underscore that the function is to be carried out by one or more persons who are independent and, necessarily, external to the firm” rather than imposing a separate requirement. 146 The proposal required the EQCF role to be composed of “at least one person” while the Amendments require the EQCF role to be composed of “one or more persons.” In either case, only one individual is required but a firm can choose to assign more than one individual to the role. 147 As discussed in greater detail below, the individual or individuals who fill the EQCF role will be “associated persons of a registered public accounting firm,” and the same would have been true under the proposal. Finally, the Amendments state that the “EQCF should have the experience, competence, authority, and time necessary to enable them to carry out the responsibilities assigned to the EQCF by the firm.” The PCAOB explained in the Adopting Release that this change was made to “conform[ ] the provision to the descriptions in QC 1000.12 of other specified QC system roles” that require the same qualifications to perform their responsibilities. 148 144 See Adopting Release, supra note 9, at 118-20. 145 Compare Proposing Release, supra note 11, at 97 (“. . . includes at least one person who is not a partner, shareholder, member, other principal, or employee of the firm and does not otherwise have a commercial, familial, or other relationship with the firm. . .”) and Adopting Release, supra note 9, at 118 (“. . .composed of one or more persons who are not partners, shareholders, members, other principals, or employees of the firm and do not otherwise have a commercial, familial, or other relationship with the firm. . .”). 146 See PCAOB response letter at 6. 147 See Adopting Release, supra note 9, at 118-20. 148 Id. at 120. Both the PCAOB's proposed and adopted versions of QC 1000.12 stated, “[t]he firm must assign other roles and responsibilities with respect to the QC system to firm personnel who have the experience, competence, authority, and time to enable them to carry out their responsibilities.” See Proposing Release, supra note 11, at 68; Adopting Release, supra note 9, at 82. The EQCF is a role with respect to the QC system, which is further clarified through the conforming change described above. Therefore, having considered the standard-setting process preceding the EQCF requirement, we find that the public had considerable opportunity to comment on the function and responsibilities of the EQCF role included in the Amendments as well as on the similar, but more broadly focused, independent oversight function in the Proposing Release, on which the EQCF is based. Moreover, we find the changes made to that role in the Adopting Release to be responsive to comments received by the PCAOB from a variety of stakeholders. We also agree with the Board that the only prescriptive requirement of the function—the requirement to evaluate the significant judgments made and the related conclusions reached by the firm when evaluating and reporting on the effectiveness of the firm's QC system 149 —is both responsive to requests for greater clarity and specificity and would benefit investors by enhancing the discipline with which a firm carries out its own QC system evaluation. 150 Overall, we believe the changes described above addressed feedback on the role that the Board received on the Concept Release and Proposing Release, including that the role did not go far enough; that the role's undefined authority made it likely to be ineffective; and that more specificity and prescription was needed to avoid overly broad interpretations of the requirements; while maintaining a principles-based approach to allow firms to design the EQCF as appropriate for their audit practice. 149 QC 1000.28 (“Responsibilities of the EQCF should include, at a minimum, evaluating the significant judgments made and the related conclusions reached by the firm when evaluating and reporting on the effectiveness of the firm's QC system.”). 150 See PCAOB response letter at 6. In addition, the public had the opportunity to provide comments to the Commission on the Amendments adopted by the PCAOB. One commenter stated that the “time-period for providing comments to the SEC” was “constrained.” 151 As discussed above, however, the Commission provided an initial comment period of 21 days, followed by an extension of 14 days. The Commission also extended its period to consider the Amendments two times, for a total of a 90-day period. Over the course of the 90 total days during which the Amendments were under consideration by the Commission, the public was able to continue to submit comment letters. The Commission received over 20 letters in total, several of which addressed the EQCF role in particular. 152 The Commission has considered the concerns raised by commenters and addresses them below. 151 See Chamber letter. 152 See, e.g., letters from BDO; CAQ; Consumer Federation of America; Chamber; EY; Forvis Mazars; Moss Adams; PICPA; PWC; and L. Turner. Alternatives to the EQCF Role One commenter stated that it was concerned that the EQCF may not achieve the effectiveness and accountability that is necessary because of the flexibility provided to firms, and questioned whether a single person would be able to fulfill the EQCF's responsibilities inside the largest accounting firms. 153 The commenter believed that a preferable approach would be to require the creation of an independent board as proposed by the ACAP and used by the FRC and the Japan Financial Services Agency. 154 As the PCAOB states in the Adopting Release, the EQCF role may be carried out by “one or more persons” and therefore larger firms will be able to determine whether it would be appropriate to assign more than one person to the role given their size and complexity. 155 We note that the firms that will be subject to the Amendments are of varying sizes and complexities and we therefore agree with the PCAOB that a “one size fits all” approach is unwarranted. Furthermore, we note that the PCAOB has stated that it intends to monitor the implementation of QC 1000 through its inspections program and outreach activities and “will remain vigilant” for any information regarding the standard's effectiveness or implementation challenges. 156 With respect to the commenter's preferred approach of creating an independent board, although we agree with the commenter that experience has indicated that independent boards of issuers can be very effective, such a requirement is not part of the Amendments and therefore it is beyond the scope of this Order. In addition, we believe that consideration would need to be given to how an independent board requirement would interact with any applicable corporate governance laws, particularly for those registered public accounting firms located outside of the United States. 153 See letter from L. Turner. 154 Id. 155 See Adopting Release, supra note 9, at 121. 156 See PCAOB response letter at 24-25. Disclosure, Confidentiality and Liability Several commenters stated that the EQCF requirement conflicts with SOX Sections 104(g)(2) or 105(b)(5)(A) 157 because it would compel audit firms to share non-public QC criticisms with the EQCF, who is external to the firm. 158 One commenter stated that the EQCF (or members of the EQCF) would not be an associated person, given the definition of associated persons in PCAOB Rule 1001(p)(i), and considering that the EQCF consists of one or more independent third-parties. 159 This commenter further stated that discussions in the Adopting Release “cloud this issue,” including the discussion of whether the EQCF would be subject to supervisory liability under SOX Section 105(c)(6). 160 One commenter responded to the PCAOB response letter stating that their “objection is in the PCAOB requiring disclosure to individuals a firm is not otherwise even required to employ or contract.” 161 157 See 15 U.S.C. 7214(g)(2); 15 U.S.C. 7215(b)(5)(A). 158 See, e.g., letters from BDO; CAQ; Chamber; Forvis Mazars; PICPA; and PWC. 159 See letter from Chamber. The CAQ Supplemental Letter stated that the PCAOB response letter provided clarity on whether the EQCF would be considered an associated person. 160 Id. See also letter from PWC (stating that the “adopting release raises the possibility that individuals filling this role could be subject to liability under Section 105(c)(6) of SOX”). 161 See CAQ Supplemental Letter. SOX Section 104(g)(2) provides that “no portions of [a PCAOB] inspection report that deal with criticisms of or potential defects in the quality control systems of the firm under inspection shall be made public if those criticisms or defects are addressed by the firm, to the satisfaction of the Board, not later than 12 months after the date of the inspection report.” 162 SOX Section 105(b)(5)(A) provides that, with certain exceptions, “all documents and information prepared or received by or specifically for the Board, and deliberations of the Board and its employees and agents, in connection with an inspection . . . or with an investigation . . . shall be confidential and privileged as an evidentiary matter . . . in any proceeding in any Federal or State court or administrative agency, and shall be exempt from disclosure . . . under the Freedom of Information Act . . . or otherwise.” 163 162 15 U.S.C. 7214(g)(2). 163 15 U.S.C. 7215(b)(5)(A). The Commission finds that the disclosure of information to the EQCF would not be a public disclosure under Section 104(g)(2) or inconsistent with the confidentiality protections provided by Section 105(b)(5)(A) because those serving in the EQCF role would be associated persons and therefore subject to the same confidentiality requirements as the firm's partners, employees, and other associated persons. 164 Under SOX Section 2(a)(9), an “associated person of a public accounting firm” includes any “independent contractor” who, “in connection with the preparation or issuance of any audit report,” receives compensation from the firm or “participates as agent or otherwise on behalf of” the firm “in any activity of that firm.” 165 For reasons the PCAOB explained, because individuals serving in an EQCF role cannot be partners, shareholders, members, other principals, or employees of the firm, they are likely to be engaged as independent contractors. 166 And those independent contractors would meet the definition of an “associated person” under SOX Section 2(a)(9) because they are likely to be compensated for their work and, in any event, would participate in the firm's activities—at least the firm's evaluation and reporting process—on behalf of the firm. 167 164 We note that the external oversight role as described in the Proposing Release similarly would have met the definition of associated person of a public accounting firm. 165 15 U.S.C. 7201(a)(9). PCAOB Rule 1001(p)(i) provides a substantially similar definition of “person associated with a public accounting firm.” 166 PCAOB response letter at 10. 167 One commenter suggested that its concerns about the disclosure of confidential and privileged information to the EQCF stem from the fact the PCAOB is “requiring disclosure to individuals a firm is not otherwise even required to employ or contract.” See CAQ Supplemental Letter. However, the Amendments require the largest firms to establish and maintain an EQCF. As explained above, we believe that such individual or individuals serving in the EQCF would be associated persons—likely independent contractors—and therefore, we expect that firms will enter into contracts to set forth the terms and conditions of the role, including non-disclosure agreements, just as with their other independent contractors. Like all associated persons, such independent contractors are part of the PCAOB inspection or investigation process, not strangers to it. They must cooperate with PCAOB inspections and investigations, comply with related PCAOB requests, and prepare inspection- or investigation-related documents for the PCAOB. 168 Accordingly, such independent contractors are not part of the public, and their involvement in Board inspections and investigations and awareness of information related thereto would not vitiate confidentiality protections. 169 Indeed, as the PCAOB observed, some firms currently share confidential information with external advisors, including those serving in audit quality advisory roles. 170 168 15 U.S.C. 7212(b)(3); 15 U.S.C. 7215(b)(5)(A). 169 See PCAOB response letter at 13 n.55 (citing In re Bieter Co., 16 F.3d 929, 940 (8th Cir. 1994) (addressing the waiver of attorney-client privilege in the context of disclosure to an independent contractor); In re Flonase Antitrust Litig., 879 F. Supp. 2d 454, 459 (E.D. Pa. 2012) (same); In re Copper Mkt. Antitrust Litig., 200 FRD. 213, 219 (S.D.N.Y. 2001) (same); Am. S.S. Owners Mut. Protection & Indem. Ass'n v. Alcoa S.S. Co., 232 FRD. 191, 198 (S.D.N.Y. 2005) (addressing the waiver of attorney-client privilege in the context of disclosure to corporate directors); Strougo v. BEA Assocs., 199 FRD. 515, 525 (S.D.N.Y. 2001) (same, with respect to outside directors)); see also letter from L. Turner (stating that the legislative history of the SOX Section 104(g)(2) indicates that it was intended to prohibit the PCAOB from disclosing information it obtained regarding quality control deficiencies but that the firms could disclose that information to their audit committee if they chose to). 170 See PCAOB response letter at 12 (citing the 2023 Audit Quality Report of BDO, which states that its audit advisory council addresses matters related to its QC system, including inspection results and remediation efforts, and the 2022 Audit Quality and Transparency Report of Grant Thornton, which states that it grants its audit quality advisory council full access to firm information to help them fully understand the system of quality control). We note that BDO states in its 2023 Audit Quality Report that two members of its audit advisory council are independent and Grant Thornton states in its 2022 Audit Quality and Transparency Report that two members of its audit quality advisory council are independent. QC 1000 does not specify what information affected firms must share with the EQCF, giving firms flexibility in determining the responsibilities of the EQCF and what information is needed for the EQCF to fulfill its role, as long as the EQCF complies with the minimum requirement to evaluate all significant judgments made by the firm with respect to its QC system. Also, firms may enter other types of independent-contractor arrangements, including with individuals at an affiliated firm within a global network or personnel at shared services centers outside of the firm. 171 A determination that the EQCF is not an associated person would have significant consequences for those arrangements. Finally, a firm would be free to impose confidentiality or non-disclosure requirements on the EQCF to the same extent a firm is able to impose such requirements on its other independent contractors. 171 See PCAOB response letter at 13-14. Although their status as associated persons could result in potential personal liability for individuals that take on the EQCF role, we believe this is appropriate given that the EQCF, like any other associated person, should exercise due professional care when fulfilling their responsibilities—responsibilities that, as we have explained above, serve an important investor protection role. We note that the significant flexibility afforded to firms under the Amendments to design procedures for the EQCF that work best for their individual firm governance structure may help to mitigate concerns that the attendant personal liability could discourage qualified individuals from taking on such a role. Commenters also raised concerns about the potential liability exposure of the EQCF if the individual serving in that role was considered not only an associated person of the firm, but also a supervisory person. Under SOX Section 105(c)(6), the Board may impose sanctions on a “supervisory person” who “fail[s] reasonably to supervise an associated person” and “such associated person commits a violation” of a relevant law, rule, or standard. 172 The Commission agrees with the PCAOB that the minimum requirements of the EQCF would not, on their own, make the individual or individuals “supervisory persons,” and that the assessment of whether any particular individual serving in the EQCF role is a supervisory person would need to consider any additional responsibilities or authorities the audit firm assigned to them. 173 Again, however, the flexibility afforded to firms under the Amendments to determine what additional functions, if any, would be performed by EQCF should serve to mitigate concerns. 172 15 U.S.C. 7215(c)(6). 173 Section 105(c)(6) addresses supervision in terms that are “similar to those that apply to broker-dealers under section 15(b)(4) of the Securities Exchange Act of 1934.” S. Rep. No. 107-205 at 11, 49. Exchange Act Sections 15(b)(4)(E) and 15(b)(6) provide a theory of liability for broker-dealers and their associated persons that have failed reasonably to supervise, with a view to preventing violations of the federal securities laws and the rules thereunder, another person who commits such a violation, if such other person is subject to the broker-dealer or associated person's supervision. 15 U.S.C. 78o(b)(4)(E) and (b)(6). In that context, the Commission has explained that “determining if a particular person is a `supervisor' depends on whether, under the facts and circumstances of a particular case, that person has a requisite degree of responsibility, ability or authority to affect the conduct of the employee whose behavior is at issue.” John H. Gutfreund, Rel. No. 34-31554, 51 SEC 93, 113 (Dec. 3, 1992) (settled order and Exchange Act 21(a) Report). See also, e.g., SEC v. Yu, 231 F.Supp.2d 16 (D.D.C. 2002) (court found individual violated supervisory bar by retaining involvement in hiring and firing, and supervising compliance staff); Steven E. Muth, Rel. No. 34-52551, 2005 WL 2428336 (Oct. 3, 2005) (Commission opinion) (individual had requisite degree of control where he participated in decision to hire and later to suspend registered representative). Relatedly, several commenters raised concerns that potential liability under Section 105(c)(6) of SOX for the person or persons fulfilling the EQCF role could limit the pool of candidates for this role. 174 However, we do not believe that any potential liability will significantly impact the pool of candidates, given the flexibility afforded to firms in the structuring of the role and the impact of such flexibility on liability considerations, as well as the fact that the requirement only applies, as the PCAOB observed, to the small number of firms meeting the 100-issuer threshold 175 and that several of those firms already have independent members of their firm governance or audit quality structure whose responsibilities, in some cases, may already meet the requirements of the EQCF, or who otherwise may be willing to expand such responsibilities. 174 See, e.g., letters from BDO; CAQ; and PWC. 175 See PCAOB response letter at 17-21. See also supra note 30 (only 14 of the approximately 1,600 PCAOB-registered firms issued audit reports to more than 100 issuers as of 2023 but one of those firms has since filed an application for withdrawal from registration). Other One commenter stated that firms that are close to or just above the annual 100-issuer audit report threshold may feel compelled to consider reducing their issuer count below this threshold to avoid the EQCF requirement and that such exits would undermine competition. 176 However, we believe such an effect is unlikely to be significant given that, as the Board observed in the Adopting Release and in the PCAOB response letter, very few firms are close to the 100-issuer threshold. Specifically, PCAOB staff analysis of audit reports included in Commission filings during the 2022 calendar year indicated that two registered public accounting firms audited between 80 and 100 issuers and two registered public accounting firms audited between 100 and 120 issuers. 177 In addition, we expect that the minimum requirements for the EQCF role and the flexibility provided to firms to implement the role would reduce the likelihood that firms would be motivated to stay below the 100-issuer threshold to avoid the requirement. Furthermore, we agree that using the 100-issuer threshold is a reasonable approach because, as the PCAOB noted in the Adopting Release, firms are already familiar with this statutory threshold in the PCAOB inspection context and because we agree with the commenter who stated that the 100-issuer threshold was appropriate “given such firms' greater involvement in the U.S. capital markets and their impact on investors.” 178 SOX provides that firms that provide audit reports for more than 100 issuers are subject to annual inspection by the PCAOB and firms that provide audit reports for 100 issuers or fewer are subject to inspection triennially. 179 Therefore, not only are firms familiar with the threshold, we believe firms monitor the size of their issuer practice for purposes of monitoring their inspection requirements and using the same threshold would avoid requiring the small number of firms that are close to or above the 100-issuer threshold to track a different threshold for purposes of compliance with QC 1000. 176 See letter from Moss Adams (stating “[f]rom the standpoint of a firm that is subject to annual inspection and marginally exceeds the 100-issuer threshold, the disparity in scale, operational scope, and complexity when compared to other firms under similar scrutiny is substantial. Thus, we encourage the Board conduct a more in-depth economic analysis of the EQCF role, along with qualitative analysis of the proposed impact to audit quality and the interplay with the PCAOB's annual inspection of firms' systems of quality.”). 177 See Adopting Release, supra note 9, at 362; PCAOB response letter at 17 n. 72. 178 See Adopting Release, supra note 9, at 67; letter from Consumer Federation of America. See also, 15 U.S.C. 7214(b)(1)(A). 179 See 15 U.S.C. 7214(b)(1)(A). Some commenters raised questions about the Board's analogy of the EQCF to the Engagement Quality Reviewer (“EQR”). 180 One commenter stated that the analogy the PCAOB made between the EQCF and the EQR was “not well analogized” because the EQR is required to perform a review under specific requirements that are the subject of an auditing standard while the PCAOB has not provided such specific requirements for the performance of the EQCF's evaluation. 181 180 See, e.g., letters from EY; CAQ Supplemental Letter; and PWC. 181 See letter from PWC. The analogy the PCAOB drew between the EQCF and the EQR in the Adopting Release noted certain similarities between the two roles, but also identified important differences between the requirements for the roles, including that the EQCF is not required to provide concurring approval, as is required of an EQR. 182 The EQR's concurrence instills responsibility and authority over the activities of the audit engagement team and places the EQR in a supervisory position in an audit engagement. On the other hand, as the PCAOB has made clear, the EQCF is not required to approve the firm's conclusions regarding its significant judgments for the firm to make a conclusion on the effectiveness of the QC system. 183 As explained above, the requirement to evaluate the significant judgments and conclusions reached does not, by itself, impose supervisory responsibilities on the EQCF nor is the EQCF's concurrence with the firm's conclusions required. The EQCF's evaluation is an input into the firm's assessment of its QC system and while it may inform the actions of individuals, it does not direct such actions. 182 See Adopting Release, supra note 9, at 121. 183 Id.; PCAOB response letter at 7. Another commenter who addressed the PCAOB's comparison of the EQCF and EQR roles stated that, unlike the EQR who is governed by the requirements in the PCAOB's engagement quality review standard, the Amendments do not prescribe certain details regarding the EQCF's role and responsibilities. 184 Specifically, the commenter stated that the final standard does not, among other things: (1) specify the procedures the EQCF should perform to evaluate the significant judgments made and related conclusions reached; (2) address the nature, timing, and extent of the EQCF's review; or (3) address how differing judgments made by the EQCF and the firm should be resolved or documented. 185 This commenter stated that this creates uncertainty regarding the application of the responsibilities specified in the standard and raises questions about the potential liability of the EQCF. 186 We disagree with the views expressed by the commenters discussed above. The PCAOB adequately explained this comparison in the Adopting Release, noting similarities between the two roles, but also explaining important differences, which we have highlighted, above. 187 In our view, the referenced discussion sought to clarify aspects of the EQCF without imposing any new requirements on registered public accounting firms or changing the requirements for the EQCF as set forth in the Amendments. 184 See letter from EY. 185 Id. 186 Id. We addressed the liability concerns related to the EQCF role earlier in this Order. 187 See Adopting Release, supra note 9, at 121. With respect to the commenter's concerns about the lack of prescriptiveness of the EQCF requirement, the PCAOB explained its decision to provide firms with flexibility to design the EQCF role to fit their particular circumstances and firm governance structure in both the Adopting Release and the response letter. 188 As discussed above, we find that the Board's approach to the EQCF requirement in QC 1000 appropriately balances enhancing the effectiveness of audit firm QC systems with flexibility that allows for effective scaling and customization for firms of varying sizes, structures, and risk profiles, as well as minimizing cost and disruption. Regarding the question on resolution of differences, the Amendments provide audit firms with broad flexibility with respect to the implementation of the EQCF role, including applicable internal procedures. As the Amendments do not require that the EQCF have any specific decision-making responsibility or other authority, firms are generally free to determine an approach to any such differing judgments between the EQCF and the firm in the manner that they deem most appropriate for their firm. 188 Id. at 122; PCAOB response letter at 7. To the extent that firms have questions about the implementation of the EQCF role, the PCAOB stated that it anticipates that, consistent with its historical practice, its staff will issue implementation guidance and will engage in other activities to support firms' implementation efforts. 189 We encourage the PCAOB to provide this implementation guidance and other support, which could be useful to firms, with respect to the Amendments generally and in particular for the EQCF role. 189 PCAOB response letter at 28. Two commenters suggested that the EQCF is unnecessary because a firm's annual self-evaluation of its QC system, coupled with the PCAOB's annual inspections of that QC system, should suffice. 190 We are persuaded, however, that the EQCF requirement will provide meaningful additional safeguards beyond those realized from self-evaluations and inspections. The EQCF's evaluation should provide the firm with real time, independent feedback, enabling the firm to enhance its quality control system on an ongoing basis whereas any response it receives from the PCAOB during its inspections process occurs at a later point in time. In this way, the EQCF role is consistent with the objective of a quality control standard that fosters continuous improvement—one of the PCAOB's express aims in adopting QC 1000. 191 190 See letters from PWC and Chamber. 191 See Adopting Release, supra note 9, at 5 (“We are adopting an integrated, risk-based standard, QC 1000, A Firm's System of Quality Control, that mandates quality objectives and key processes for all firms' QC systems, with a focus on accountability and continuous improvement.). Some commenters stated the requirements for the EQCF are unclear ( e.g., requirements around documentation of EQCF's evaluation). 192 The PCAOB response letter addresses the documentation requirements as they relate to the EQCF. 193 The PCAOB response letter states that, under QC 1000, it is the firm that bears responsibility for complying with documentation requirements related to the EQCF role not the individual or individuals who comprise the EQCF. 194 Indeed, the EQCF could provide its evaluation orally because there is no requirement in QC 1000 that the EQCF must document or provide its evaluation in writing. 195 Further, QC 1000 does not prescribe to whom the EQCF must report, giving firms flexibility to develop the form of reporting and the line of reporting by the EQCF. We note, moreover, that it is typical for implementation questions to arise around new accounting or auditing requirements. To the extent additional clarity on specific requirements related to EQCF is necessary, we believe PCAOB staff implementation or other guidance would sufficiently assist firms with interpreting the requirement. As noted above, the PCAOB stated that it anticipates that, consistent with its historical practice, its staff will issue implementation guidance and will engage in other activities to support firms' implementation efforts. 196 192 See, e.g., letters from CAQ; Forvis Mazars; and GT. See also letter from EY (stating “it is unclear how firms will understand and document the EQCF's identification of and conclusion about the firm's significant judgments”). 193 See PCAOB response letter at 14-15. 194 Id. at 14. 195 Id. at 15 (stating “QC 1000 imposes a documentation requirement regarding the EQCF's operation on the firm, not on the individuals who comprise the EQCF—though the firm's EQCF policies could provide guidance to those individuals about what they should or should not do to facilitate the firm's retention of appropriate documentation about the EQCF's operation” (emphasis added)) and 14 (stating that all of the firm's documentation under QC 1000 must be documented “in sufficient detail to enable an experienced auditor who understands QC systems but has no experience with the firm's QC system to understand how the EQCF is designed”). 196 Id. at 28. One commenter stated that subsequent PCAOB staff guidance is an insufficient alternative to or remedy for the lack of notice and comment for the EQCF requirement. See letter from Chamber. However, as explained above, the Board followed its own notice-and-comment process and the EQCF requirement included in the Amendments was the result of changes made in light of commenter feedback on the PCAOB's proposed external oversight function. C. Economic Implications of the Amendments Commenters expressed concerns that the costs arising from QC 1000 and certain of its requirements are not appropriately described and that a more rigorous economic analysis is necessary before the Amendments can be approved. 197 One commenter stated that the economic analysis conducted by the PCAOB in the Adopting Release was deficient because it did not discuss any plans for post-implementation review or details on how such a review will be conducted. 198 By contrast, another commenter observed that the PCAOB issued a staff white paper in November 2022 identifying research that suggests the PCAOB's proposed QC standard could lead to greater compliance with professional standards and improve financial reporting quality. 199 This commenter also stated that the “costs of deficient failed audits, can and have been significant and even catastrophic to investors, employees, and the U.S. economy.” 200 197 See, e.g., letters from BDO; Chamber; PICPA; and PWC. 198 See letter from Chamber. 199 See letter from L. Turner (citing Public Company Accounting Oversight Board, Staff White Paper, The Impact of Quality Control System Remediation on Audit Performance and Financial Reporting Quality (Nov. 2022), available at https://assets.pcaobus.org/pcaob-dev/docs/default-source/rulemaking/docket046/qc-staff-white-paper-november-2022.pdf?sfvrsn=ddb22504_4 ). 200 Id. The PCAOB response letter addresses commenter feedback on its economic analysis. 201 The Board stated that, where possible, quantitative data was used and that, when this data was not available, the Board used qualitative factors in its analysis. 202 The Board also stated that available data and methods do not permit them to fully quantify all of the benefits and costs of QC 1000 and that commenters on this topic did not provide studies or data that permitted complete quantification of the benefits or costs of QC 1000. 203 When commenters did suggest relevant data or research, the Board stated that it considered it and incorporated that data or research into its economic analysis as appropriate. 204 201 See PCAOB response letter at 21-22. 202 Id. 203 Id. 204 Id. As part of our assessment of the Amendments, we have considered the economic analysis conducted by the PCAOB in the Adopting Release as well as the comments received on this point and the additional information provided in the PCAOB response letter. Below we evaluate the PCAOB's analysis in order to reach our own conclusion about the economic implications of the Amendments. On many points, we find the PCAOB's analysis reasonable; however, where appropriate, we have expanded upon that analysis. Moreover, we have considered the specific concerns raised by commenters about the unintended consequences of the Amendments and, as discussed in more detail below, have concluded that the Amendments are unlikely to have a significant adverse effect on efficiency and competition within the market for audit services. 205 205 One commenter stated that Exchange Act Section 3(f), 15 U.S.C. 78c(f), requires the Commission to consider the economic implications of the Amendments before approving or disapproving them. See letter from Chamber. Regardless of whether Section 3(f) applies in Commission review of PCAOB rules, because the PCAOB addressed the economic implications of the Amendments and commenters have raised concerns about that analysis, the Commission has likewise considered the economic implications of the Amendments and addresses those implications here. See Bloomberg, L.P. v. SEC, 45 F.4th 462, 476 (D.C. Cir. 2022) (APA requires the Commission to “respond adequately” to “relevant concerns about the direct and indirect costs of” a proposal raised by commenters, regardless of what Section 3(f) requires). The PCAOB's economic analysis addresses the benefits and costs associated with the Amendments, including, but not limited to, the design requirement, which applies to all registered firms, and the EQCF requirement, which applies to a small number of firms. The PCAOB's analysis explains the expected benefits to investors and other financial statement users that will be realized by improving compliance with applicable professional and legal requirements and thereby improving financial reporting quality. 206 In addition, the PCAOB's analysis addresses unintended consequences of the Amendments, such as potential effects on human capital, competition con [Text truncated at 120,000 characters. The full text is on the page linked above.] --- Source: Frix Law Library, https://www.frixlaw.com/law-library/documents/fr%3A2024-20714. Public record. Not legal advice.