Public Company Accounting Oversight Board; Notice of Filing of Proposed Rules on Amendments to QC 1000, A Firm's System of Quality Control, and Related Rule and Forms

Federal RegisterSep 18, 2026

Ask Donna

What actually matters in this document.

Text

SECURITIES AND EXCHANGE COMMISSION

[Release No. 34-106372; File No. PCAOB-2026-01]

Public Company Accounting Oversight Board; Notice of Filing of Proposed Rules on Amendments to QC 1000, A Firm's System of Quality Control, and Related Rule and Forms

September 15, 2026.

Pursuant to section 107(b) of the Sarbanes-Oxley Act of 2002 (the “Act”), notice is hereby given that on September 10, 2026, the Public Company Accounting Oversight Board (the “Board” or the “PCAOB”) filed with the Securities and Exchange Commission (the “Commission” or the “SEC”) the proposed rules described in items I and II below, which items have been prepared by the Board. On September 14, 2026, the Board filed with the Commission a technical correction to one of the proposed rules. The Commission is publishing this notice to solicit comments on the proposed rules from interested persons.

I. Board's Statement of the Terms of Substance of the Proposed Rules

On September 9, 2026, the Board adopted proposed rule amendments to QC 1000,

A Firm's System of Quality Control,

related amendments to PCAOB Rule 2203A, PCAOB forms, and technical amendments to AS 2101,

Audit Planning.

(collectively, the “proposed rules”). On September 11, 2026, the Board adopted a technical correction to the proposed rule amendments to QC 1000. The text of the proposed rules appears in Exhibit A to the SEC Filing Form 19b-4 and is available on the Board's website at

https://pcaobus.org/about/rules-rulemaking/rulemaking-dockets/docket-057.

II. Board's Statement of the Purpose of, and Statutory Basis for, the Proposed Rules

In its filing with the Commission, the Board included statements concerning the purpose of and basis for the proposed rules and discussed any comments it received on the proposed rules. The text of these statements may be examined at the places specified in Item IV below. The Board has prepared summaries, set forth in sections A, B, and C below, of the most significant aspects of such statements. In addition, to the extent necessary, the Board is requesting that the Commission approve the proposed rules pursuant to section 103(a)(3)(C) of the Act for application to audits of emerging growth companies (“EGCs”), as that term is defined in section 3(a)(80) of the Securities Exchange Act of 1934 (“Exchange Act”). The Board's request is set forth in section D.

A. Board's Statement of the Purpose of, and Statutory Basis for, the Proposed Rules

(a) Purpose

The Board adopted QC 1000,

A Firm's System of Quality Control

(“QC 1000”), on May 13, 2024,

to lead registered public accounting firms (“firms”) to significantly improve their quality control (“QC”) systems. The Board believes that, as firms prepare for the effective date of QC 1000, many such improvements have been and will continue to be implemented as firms develop more rigorous QC systems. The Board's experience during the implementation period led us, however, to consider whether the new standard imposes costs that may not be necessary for us to achieve the Board's regulatory goals and, relatedly, whether there were certain aspects of QC 1000 that could be brought into closer alignment with other audit firm quality management standards.

A Firm's System of Quality Control and Other Amendments to PCAOB Standards, Rules, and Forms, PCAOB Rel. No. 2024-005 (May 13, 2024) (“QC 1000 2024 adopting release”).

See International Standard on Quality Management (“ISQM”) 1, Quality Management for Firms that Perform Audits or Reviews of Financial Statements, or Other Assurance or Related Services Engagements (“ISQM 1”), issued by the International Auditing and Assurance Standards Board; Statement on Quality Management Standards (“SQMS”) No. 1, A Firm's System of Quality Management (“SQMS 1”), issued by the Auditing Standards Board of the American Institute of CPAs.

The Board adopted amendments to QC 1000 that it believes address concerns regarding the implementation challenges identified by firms and better align certain provisions with other quality management standards. These amendments are designed to reduce compliance costs while maintaining the investor protection benefits of QC 1000.

The principal amendments the Board adopted:

• Rescind the “design-only” requirement so that QC 1000 imposes requirements only on firms that are required to comply with applicable professional and legal requirements with respect to any “engagement” as defined in QC 1000 (QC 1000.06 and .07d);

• Provide increased flexibility in filling certain specified roles in the QC system by permitting roles to be assigned to non-firm personnel and divided among multiple individuals (QC 1000.12);

• Rescind the requirement to have an External QC Function (“EQCF”) (QC 1000.28);

• Narrow and simplify communication requirements relating to metrics that the firm communicates to external parties about its audit practice, firm personnel, or engagements (QC 1000.53e);

• With respect to identified engagement deficiencies, require evaluation of whether similar engagement deficiencies exist on other engagements only if the identified deficiency resulted or could result in (i) a failure to obtain sufficient appropriate evidence to support the conclusion reached on an engagement or (ii) an inappropriate overall conclusion on the subject matter of an engagement (QC 1000.68d);

• Revise the definition of QC deficiency to make clear that, when firms have implemented more than one quality response to address the same quality risk, they can take those other quality responses (

e.g.,

compensating responses) into account when determining whether a QC deficiency exists (QC 1000.A8);

• Allow firms to select the date as of which they annually evaluate the effectiveness of their QC system, rather than requiring firms to evaluate as of September 30 (QC 1000.77);

• Revise the QC system evaluation conclusions to align more closely with the conclusions in other quality management standards, while retaining a structured process, including specified factors for consideration, to guide the evaluation (QC 1000.77 and .78); and

• Simplify the requirements for retention of QC system documentation and abbreviate the retention period from seven to five years (QC 1000.84 and .86).

Additional amendments the Board adopted, including conforming amendments, are discussed below.

Several of the amendments the Board adopted bring QC 1000 into closer alignment with other quality management standards, both internationally and in the United States. However, differences remain in areas where the Board continues to believe that alternative or incremental provisions of QC 1000 better address its legal and regulatory environment, the needs and priorities of the Board's stakeholders, and the Board's statutory mandate of protecting investors and the public interest.

QC 1000 and the related amendments to PCAOB standards, rules, and forms adopted in 2024 will take effect on December 15, 2026. If approved by the

SEC, the amendments to QC 1000 that the Board adopted and the related amendments to a PCAOB rule and PCAOB forms will also take effect on December 15, 2026.

The proposed rules also include technical amendments to AS 2101,

Audit Planning,

to remove references to an auditing standard that was rescinded by another rulemaking.

The Board adopted these amendments as final due to their technical nature, and the Board did not seek public comment on these amendments. These amendments will be effective upon SEC approval.

See General Responsibilities of the Auditor in Conducting an Audit and Amendments to PCAOB Standards, PCAOB Rel. No. 2024-004 (May 13, 2024) (rescinding AS 1015, Due Professional Care in the Performance of Work).

(b) Statutory Basis

The statutory basis for the proposed rules is Title I of the Act.

B. Board's Statement on Burden on Competition

Not applicable. The Board's consideration of the economic impacts of the proposed rules is discussed in section D below.

C. Board's Statement on Comments on the Proposed Rule Change Received From Members, Participants, or Others

The Board released proposed rule amendments for public comment on June 9, 2026, in its release titled

Supplemental Request for Comment: Proposed Amendments to QC 1000, A Firm's System of Quality Control, and Related Rule and Forms,

PCAOB Release No. 2026-002. The Board received 25 comment letters in response to that supplemental request for comment.

See

Comment Letters for Docket 057,

https://pcaobus.org/about/rules-rulemaking/rulemaking-dockets/docket-057/comment-letters.

The Board also received 26 comment letters in response to a request for public comment on the PCAOB strategic priorities, identified at footnote 12 below, and 4 comment letters in response to a request for public comment on PCAOB standard setting, identified at footnote 289 below, and 1 comment letter in response to a request for public comment on the Draft 2026-2030 Strategic Plan Goals and Objective, identified at footnote 300 below, which all raised comments specifically to QC 1000, among other things.

See

Comment Letters on the PCAOB website available at

https://pcaobus.org/about/strategic-plan-budget/public-comments-on-pcaob-strategic-priorities, https://pcaobus.org/oversight/standards/standard-setting-research-projects/agenda-consultation--request-for-public-comment-on-pcaob-standard-setting,

and

https://pcaobus.org/about/strategic-plan-budget/public-comments-on-goals-and-objectives-for-pcaob-strategic-plan-2026-2030,

respectively. The Board has carefully considered all comments received. The Board's responses to the comments received, including revisions to the proposed rule amendments, are discussed below.

Background

This section presents background information on this rulemaking, including recent rulemaking history and staff implementation support efforts since SEC approval of QC 1000 in September 2024.

Recent Rulemaking History

On May 13, 2024, the Board adopted QC 1000 and related amendments. They were approved by the SEC on September 9, 2024, with an effective date of December 15, 2025.

For more details regarding the rulemaking history of QC 1000,

see

Rulemaking Docket No. 046 on the Board's website,

available at https://pcaobus.org/about/rules-rulemaking/rulemaking-dockets/docket-046-quality-control;

see also Public Company Accounting Oversight Board; Order Granting Approval of QC 1000, A Firm's System of Quality Control and Related Amendments to PCAOB Standards, Rules, and Forms,

SEC Rel. No. 34-100968 (Sept. 9, 2024).

On August 28, 2025, to provide firms with additional time for implementation, the Board proposed to delay the effective date of QC 1000 and the related amendments to December 15, 2026, and that postponement became immediately effective.

The SEC received 15 comment letters in response to its notice regarding the postponement.

Commenters generally supported providing additional implementation time but raised concerns regarding certain provisions of QC 1000 that they viewed as more prescriptive than other quality management standards and as creating unnecessary operational complexity and cost.

See Public Company Accounting Oversight Board; Notice of Filing and Immediate Effectiveness of Proposed Rule Change Postponing the Effective Date of Amendments to Board Standards, Rules, and Forms Adopted on May 13, 2024, SEC Rel. No. 34-103803 (Aug. 28, 2025).

The comment letters received are available on the SEC's web page,

available at https://www.sec.gov/comments/pcaob-2025-01/pcaob202501.htm.

On July 23, 2025, and March 20, 2026, the PCAOB received letters from a firm-related group regarding implementation of QC 1000 and related implementation challenges.

See

letter from the Center for Audit Quality dated July 23, 2025,

available at https://www.thecaq.org/comment-letter-pcaob-requesting-deferral-qc-1000;

and letter from the Center for Audit Quality dated March 20, 2026,

available at https://www.thecaq.org/letter-to-the-pcaob-on-qc1000-implementation-experience-and-costs.

On March 31, 2026, the Board issued a request for public comment on the PCAOB's strategic priorities, including future standard-setting activity.

Several commenters provided observations regarding QC 1000.

The comments relating to QC 1000 were generally consistent with themes raised in comment letters submitted to the PCAOB and SEC in connection with the extension of the effective date of QC 1000. Most commenters urged the Board to adopt or align more closely with ISQM 1, suggesting it may better support global implementation, while emphasizing that differences in structure, terminology, and prescriptive requirements in QC 1000 create operational challenges, limit firm judgment, and increase complexity for global firms.

See Request for Public Comment, PCAOB Strategic Priorities, PCAOB Rel. No. 2026-001 (Mar. 31, 2026).

The comment letters received are on the Board's website,

available at https://pcaobus.org/about/strategic-plan-budget/public-comments-on-pcaob-strategic-priorities.

After considering feedback and information obtained through implementation support efforts,

on June 9, 2026, the Board issued a supplemental request for comment on potential targeted amendments to certain provisions of QC 1000 and related amendments to the QC reporting rule and PCAOB forms.

The Board received 26 comment letters.

Commenters included firms and firm-related groups, investor-related groups, and others. Firms, firm-related groups, and most other commenters generally supported the Board's objective of making targeted amendments to QC 1000 and most of the proposed amendments, particularly those intended to increase flexibility, improve operability, reduce unnecessary compliance burdens, and better align QC 1000 with other quality management standards.

One investor-related group did not support the proposed amendments overall because of the proposed rescission of the EQCF requirement.

Other investor-related groups generally supported the proposed amendments that reduce compliance costs without reducing audit quality, but opposed the removal of the EQCF requirement, emphasizing the importance of independent oversight and investor protection, and other amendments they viewed as weakening investor-protection-focused provisions of QC 1000.

Many commenters, particularly firms and firm-related groups, also requested implementation guidance and clarification in certain areas discussed below.

See

discussion below regarding PCAOB staff's implementation support efforts, including implementation guidance, workshops, stakeholder outreach, and feedback received from firms and other stakeholders regarding QC 1000 implementation.

See Supplemental Request for Comment: Proposed Amendments to QC 1000, A Firm's System of Quality Control, and Related Rule and Forms, PCAOB Rel. No. 2026-002 (June 9, 2026) (proposing amendments to QC 1000, PCAOB Rule 2203A, and PCAOB Forms 1, 2, and QC).

See

comment letters on the

Supplemental Request for Comment

from the Auditing Standards Committee, Auditing Section—American Accounting Association (July 3, 2026) (“AAA”); Baker Tilly US, LLP (July 9, 2026) (“Baker Tilly”); BDO USA, P.C. (July 9, 2026) (“BDO”); CBIZ CPAs P.C. (July 9, 2026) (“CBIZ”); Center for Audit Quality (July 9, 2026) (“CAQ”); CFA Institute (Aug. 31, 2026) (“CFA”); Council of Institutional Investors (July 9, 2026) (“CII”); Crowe LLP (July 9, 2026) (“Crowe”); Deloitte & Touche LLP (July 9, 2026) (“Deloitte”); Ernst & Young LLP (July 9, 2026) (“EY”); Forvis Mazars, LLP (July 9, 2026) (“Forvis”); George R. Kramer (July 6, 2026) (“Kramer”); Grant Thornton LLP (July 9, 2026) (“GT”); International Corporate Governance Network (July 9, 2026) (“ICGN”); James Grosvenor (July 9, 2026) (“Grosvenor”); KPMG LLP (July 9, 2026) (“KPMG”); MaloneBailey, LLP (June 26, 2026) (“Malone Bailey”); Members of the Investor Advisory Group (July 9, 2026) (“MIAG”); Pennsylvania Institute of CPAs (July 9, 2026)

(“PICPA”); Plante & Moran, PLLC (July 10, 2026) (“Plante & Moran”); PricewaterhouseCoopers LLP (July 9, 2026) (“PwC”); RSM US LLP (July 9, 2026) (“RSM”); St. Charles Consulting Group (June 12, 2026) (“SCCG”); Thomas H. Spitters (July 6, 2026) (“Spitters”); and Virginia Society of CPAs (July 9, 2026) (“VSCPA”). One additional comment letter was withdrawn.

See, e.g.,

comment letters from AAA, Baker Tilly, BDO, CAQ, CBIZ, Crowe, Deloitte, EY, Forvis, Grosvenor, GT, KPMG, Kramer, Malone Bailey, PICPA, Plante & Moran, PwC, RSM, SCCG, Spitters, and VSCPA.

See

comment letter from CII.

See

comment letters from CFA, ICGN, and MIAG.

See, e.g.,

comment letters from Baker Tilly, BDO, CAQ, CBIZ, Crowe, Deloitte, EY, Forvis, GT, KPMG, Kramer, Plante & Moran, RSM, SCCG, and VSCPA.

The Board considered all comments received on the supplemental request for comment. As discussed below, the Board is adopting the proposed amendments to QC 1000, with certain modifications.

Implementation Support Efforts

Since SEC approval of QC 1000, PCAOB staff have supported implementation through guidance, workshops, outreach activities, and engagement with stakeholders, which provided insight into implementation progress, challenges, and questions and informed the Board's consideration of the proposed amendments.

Additionally, as part of inspection outreach activities, the Board obtained feedback on the progress made by firms in implementing QC 1000 in their QC systems.

See

PCAOB,

Quality Control—Implementation Resources, available at

https://pcaobus.org/oversight/standards/implementation-resources-PCAOB-standards-rules/quality-control,

which includes staff guidance and other materials issued to support implementation of QC1000 and the related amendments.

See section titled “Need” under “Economic Considerations” below for additional information on data received through these inspection outreach activities.

As part of staff implementation support efforts, the PCAOB staff released

QC 1000 Questions and Answers

(“QC 1000 Q&As”) in August 2026.

The QC 1000 Q&As provide technical guidance on various aspects of QC 1000, including roles and responsibilities, evaluation and reporting, documentation, and other areas of designing, implementing, operating, and evaluating a firm's QC system. The QC 1000 Q&As were developed in response to questions and requests for clarification received from firms through staff implementation support efforts and are intended to reduce uncertainty and support firms' implementation of the standard.

See QC 1000 Questions and Answers, available at

https://pcaobus.org/oversight//setting-research-projects/quality-control/qc-1000-questions-and-answers.

The QC 1000 Q&As do not address the specific topics that are the subject of the amendments to QC 1000 that the Board adopted, but they do address some questions and clarification requests on other topics that were included in comment letters submitted in response to the supplemental request for comment. As implementation continues, additional guidance, including updates to the QC 1000 Q&As, may be issued to help address other areas identified by commenters or through staff implementation support efforts.

Amendments to QC 1000, PCAOB Rule 2203A, and PCAOB Form QC

This section describes the requirements of QC 1000, Rule 2203A, and Form QC that the Board amended.

Requirement To Design, Implement, and Operate a QC System

As originally adopted, QC 1000.06 requires all firms to design a QC system that complies with the standard, regardless of whether the firm is subject to applicable professional and legal requirements with respect to an engagement as defined in QC 1000. As explained in the supplemental request for comment, the Board understands that this “design-only” requirement would impose costs on firms that do not perform engagements requiring registration under the Sarbanes-Oxley Act of 2002 (“Sarbanes-Oxley”)

or PCAOB rules

without commensurate benefits for investors and the public. Therefore, the Board proposed to eliminate the requirement and sought comment on potential alternatives, as well as any circumstances that potentially could trigger a design requirement. As proposed in the supplemental request for comment, paragraphs .05 through .07 of QC 1000 would be revised to eliminate the separate obligation to design a QC system and would maintain unchanged the obligation to design, implement, and operate a QC system in compliance with QC 1000 when a firm is subject to applicable professional and legal requirements with respect to any of the firm's engagements.

See

section 102(a) of Sarbanes-Oxley, 15 U.S.C. 7212(a).

See PCAOB Rule 2100, Registration Requirements for Public Accounting Firms.

Many commenters supported the proposal to rescind the design-only requirement.

One commenter stated that they did not object to rescinding the design-only requirement when a firm neither performs nor intends to perform PCAOB engagements.

One of the commenters supporting rescission stated that it did not believe registered firms should be required to comply with PCAOB standards until the firm undertakes an engagement requiring compliance with those standards and that the design-only requirement was inconsistent with the text of Sarbanes-Oxley.

Commenters that addressed the question of whether the Board should adopt an alternative design-only requirement generally did not support such a requirement.

See

comment letters from AAA, Baker Tilly, BDO, CAQ, Crowe, Deloitte, GT, KPMG, Kramer, MIAG, PICPA, PwC, and RSM.

But see

comment letters from ICGN and Spitters. One commenter expressed support for eliminating the “design-only reporting requirement,” described as the “requirement for firms to report once a quality control system has merely been designed.”

See

comment letter from VSCPA.

See

comment letter from CFA.

See

comment letter from RSM.

See

comment letters from AAA, BDO, GT, KPMG, Kramer, and PICPA.

However, one commenter stated support for a QC design requirement that included effective operation of a system of quality management under relevant standards for the jurisdiction in which the firm operates, such as ISQM 1 or SQMS 1.

This commenter noted that, in practice, registered firms would already maintain some form of a system of quality management to support their

PCAOB registration.

The Board does not believe QC 1000 should explicitly require compliance with rules of local jurisdictions, as PCAOB standards generally do not impose such requirements. Another commenter noted that, although some registered firms do not conduct audits, that fact does not necessarily signify the need for an exemption from standard best practices or audit quality requirements; such firms should be subject to QC 1000 on the level of preparedness or some QC regime that parallels QC 1000 in its design, implementation, and operation.

The Board does not believe that the suggestion to base a design-only requirement on a level of preparedness or a system paralleling QC 1000 is workable because it is too vague as to the requirements that would apply to firms not performing PCAOB engagements.

See

comment letter from RSM.

See id.

See

comment letter from Spitters.

Commenters raised concerns over the costs of the design-only requirement in relation to the benefits.

One commenter stated that the requirement would have resulted in unnecessary costs of compliance without commensurate benefits.

Another commenter similarly stated that requiring firms not performing PCAOB engagements to comply with the design-only requirement did not provide a commensurate benefit to investor protection, as such firms do not present risk to U.S. capital markets.

Another commenter stated that requiring firms to build compliance infrastructure for work they may never undertake imposes cost without a corresponding investor benefit.

Another commenter observed that, because firms performing engagements would be fully subject to the requirement to design, implement, and operate a QC 1000-compliant system, rescinding the requirement for firms not performing such work would preserve the Board's objective of promoting high-quality audits, while reducing unnecessary burdens for those firms.

Another commenter stated that, while the value to the public of the design-only requirement was unclear, the costs would be real in the form of training costs, consulting costs, and professional time.

Other commenters noted the limited benefits of the requirement for investors, stating that rescission would not diminish investor protection

or introduce any risk to investors,

or that retaining the requirement would not help ensure improved audit quality.

See, e.g.,

comment letters from KPMG, PICPA, and PwC.

See

comment letter from PwC.

See

comment letter from KPMG.

See

comment letter from CFA.

See

comment letter from GT.

See

comment letter from PICPA.

See

comment letter from GT.

See

comment letter from Baker Tilly.

See

comment letter from PICPA.

Two commenters also raised concerns about requiring firms to address hypothetical situations. One of these commenters stated that it would be difficult for a firm not subject to applicable professional and legal requirements with respect to any engagement to design a QC system based on hypothetical circumstances.

The second commenter stated that such a firm's QC system “would be hypothetical at best and would likely become obsolete over time as practice conditions change, leading to the false pretense that [the firm is] in a position to immediately implement these standards.”

See

comment letter from AAA.

See

comment letter from PICPA.

The Board is rescinding the design-only requirement and adopting paragraphs .05 through .07 as proposed.

The Board believes rescinding the design-only requirement will reduce costs for firms without any significant detriment to audit quality.

As noted in the supplemental request for comment, the Board does not believe that this action would violate the mandate in section 103(a)(2)(B) of Sarbanes-Oxley, 15 U.S.C. 7213(a)(2)(B), to adopt requirements “for every registered public accounting firm” that address certain enumerated areas in “the quality control standards that [the PCAOB] adopts with respect to the issuance of audit reports.” Under the Board's approach, QC 1000 will apply to every firm with respect to the issuance of “audit reports” (which are limited under Sarbanes-Oxley to those relating to audits of issuers and broker-dealers).

As confirmed by commenter feedback, implementing the design-only requirement has proven more difficult and costly than originally anticipated. The requirement may compel some firms that have no intention of performing PCAOB engagements in the foreseeable future to design a QC 1000-compliant system, perhaps based on hypothetical circumstances. As described in the supplemental request for comment, the Board believes that the design-only requirement may have contributed to an increase in withdrawals from registration by firms that are not performing engagements. Although the impact of such activity on the marketplace (discussed below in the economic analysis) may be limited, the Board believes investors and the public interest are better served by incentivizing firms to register and consider seeking PCAOB engagements, thereby promoting competition.

As noted in the supplemental request for comment, some firms may register with the Board to perform activities not subject to the PCAOB's jurisdiction.

See, e.g.,

Guiding and Establishing National Innovation for U.S. Stablecoins Act, Pub. L. 119-27 (July 18, 2025), section 4(a)(3)(A), 12 U.S.C. 5903(a)(3)(A) (requiring month-end reports of permitted payment stablecoin issuers to be examined by a PCAOB-registered firm).

In the Board's view, rescission of the design-only requirement would entail foregoing the benefits associated with greater preparedness of firms to take on a PCAOB engagement for the first time. The Board believes this benefit to be modest, as any firm that actually takes on such an engagement will have become subject to the requirement to design, implement, and operate a QC 1000 system.

In any event, and as noted by one commenter, registered firms that do not perform PCAOB engagements are generally well-positioned to implement QC 1000 if or when required to do so.

This is so because most such firms, as some commenters observed, are generally either non-U.S. firms subject to international auditing standards or U.S.-based firms that conduct private company audits under the standards of the Auditing Standards Board of the American Institute of CPAs (“AICPA”); as such, those firms would be subject to ISQM 1 or SQMS 1, which both share a common basic structure with QC 1000.

Finally, as stated in the supplemental request for comment, the investor protection concerns encompassed by the Board's statutory mandate are reduced where a firm is not performing PCAOB engagements.

Firms could still choose to design (and for that matter, implement and operate) a QC system that complies with QC 1000. Firms may choose to do so if, for example, they are planning to bid for a PCAOB engagement, are taking on work on other firms' engagements that could potentially constitute a substantial role, or otherwise want to put themselves in a position to implement and operate a QC 1000-compliant system on short notice.

See

comment letter from KPMG.

See

comment letters from AAA, CAQ, KPMG, and PwC.

Based on the above considerations, the Board decided not to adopt any of the design-only alternatives discussed in the supplemental request for comment.

The Board also considered whether to include provisions in QC 1000 specifying an earlier trigger for the requirement to design, implement, and operate a QC 1000-compliant system under QC 1000.06-.07. In this regard, one commenter encouraged the Board to consider whether compliance with QC 1000 after its December 15, 2026 effective date could be tied to an

established evaluation period and measurement date rather than a specific triggering event.

The same commenter suggested that under such an approach, a firm would determine at the beginning of its selected evaluation cycle whether it is required to comply with QC 1000 during that period.

Another commenter stated that a firm must have “an appropriately designed and operational QC system before accepting or commencing PCAOB audit work.”

Another commenter suggested that “a QC system must be in place prior to a firm tendering an offer for a public company audit and/or getting registered.”

Another commenter requested that the Board specify an earlier trigger—for example, when a firm bids for or is appointed to issuer or broker-dealer work—by which time a compliant QC system must be designed and operating, well in advance of the firm commencing that work.

See

comment letter from BDO.

See id.

See

comment letter from MIAG.

See

comment letter from ICGN.

See

comment letter from CFA.

While an earlier trigger may promote readiness by firms to commence PCAOB engagements, the Board expects that the effort required to design, implement, and operate a QC 1000-compliant system may vary significantly across firms. That variation could arise from several different factors, including the status of their existing QC systems, the nature of their assurance practice (if any), the experience of their personnel, and the nature of their governance systems, operating processes, and technology, among other things. The Board also understands that some firms may pursue engagements for issuers and broker-dealers months, or even years, before these firms are awarded and commence such work. In light of these considerations, it may not be necessary in all circumstances for a firm to have a QC system that fully complies with QC 1000 before it pursues an issuer or broker-dealer engagement that might not be awarded to it or that might not commence for a significant period of time. Therefore, the Board believes that requiring firms to design, implement, and operate a QC 1000-compliant system when a firm becomes subject to applicable professional and legal requirements with respect to any engagement is appropriate, and an earlier trigger is not warranted.

Roles and Responsibilities

1. Assignment of Roles and Responsibilities

As originally adopted, QC 1000 requires that the operational roles and responsibilities specified in paragraph .12 be assigned only to “firm personnel.”

The note to paragraph .12 provides that responsibility for the roles in subparagraphs a-c cannot be shared and is required to be assigned to only one individual, to reinforce that the individual assigned to a specified role would be responsible and accountable for the role.

See

QC 1000.A5.

The Board proposed amendments to paragraph .12 to allow flexibility in assigning the specified roles and responsibilities to any individual (whether firm personnel or an “other participant”

), rather than limiting those roles and responsibilities to firm personnel. In connection with that change, the Board proposed a new footnote 5A to paragraph .12 to clarify that such individuals would be “associated persons” of the firm. As the Board explained in the supplemental request for comment, any individual who was not already an associated person would become an associated person by virtue of that assignment.

The proposed amendments would align with ISQM 1 and SQMS 1 by permitting any qualified individual to fill the specified QC system roles.

See

QC 1000.A7.

See

PCAOB Rule 1001(p)(i).

To preserve the accountability and responsibility objectives of paragraph .12, the Board also proposed an amendment to emphasize that the individuals assigned specific roles understand and be accountable for their roles and responsibilities. The Board also proposed an amendment to the note to paragraph .12 to allow firms to divide the responsibilities of a role specified in paragraph .12 among multiple individuals. The proposed amendments align with ISQM 1 and SQMS 1.

Commenters generally supported allowing the specified roles to be assigned to other participants and divided among multiple individuals.

Many commenters indicated the amendments would promote audit quality, for example, by enabling the firm to place the most experienced and qualified individuals in those roles.

Several commenters also supported allowing firms the flexibility to assign roles and responsibilities to multiple individuals based on their specialized expertise and capacity, including within their existing structures, while maintaining accountability.

Several commenters stated that the proposed amendments to paragraph .12 were sufficiently clear and appropriate.

See

comment letters from AAA, Baker Tilly, BDO, CAQ, CBIZ, Crowe, Deloitte, EY, Forvis, GT, ICGN, KPMG, Kramer, MIAG, PICPA, PwC, RSM, SCCG, and Spitters.

See

comment letters from CAQ, Deloitte, GT, KPMG, MIAG, PICPA, RSM, SCCG, and Spitters.

See

comment letters from AAA, Baker Tilly, CAQ, CFA, EY, GT, KPMG, and SCCG.

See

comment letters from GT, KPMG, MIAG, RSM, and Spitters.

A commenter stated that the proposed amendments would be especially helpful to firms that issued audit reports with respect to less than 100 issuers.

Another commenter supported the addition of footnote 5A, which clarifies that an individual assigned operational responsibility for any of the roles in paragraph .12 would become an associated person of the firm by virtue of that assignment.

One commenter recommended retaining clear firm-level accountability and documentation requirements to avoid diffusion of responsibility.

Another commenter recommended the final standard require clear identification of those ultimately responsible for the QC system and key QC areas; this commenter further suggested that the PCAOB encourage firms to consider the firms' retirees for QC system roles, as such individuals would provide valuable experience.

See

comment letter from Kramer.

See

comment letter from PICPA.

See

comment letter from SCCG.

See

comment letter from MIAG.

One commenter did not support assigning roles to individuals outside the firm because individuals outside the firm may have conflicting interests, and they cannot provide the day-to-day ownership the roles require.

The same commenter stated that there remains a need for an ultimate point of accountability and there needs to be assurance that accountability is not diffused when responsibilities are divided.

Further, the commenter requested that whenever a QC role is divided among multiple individuals, the firm's reporting to the PCAOB identify (1) who holds ultimate responsibility and accountability for the QC system as a whole; (2) who is accountable for each function, such as ethics, independence, monitoring, and remediation; and (3) the scope of each individual's assigned responsibilities, so that no part of any role is left unassigned.

See

comment letter from CFA.

See id.

As to the question of whether the flexibility afforded by the proposed amendments should be available only

on a scaled basis to certain firms, many commenters generally favored applying the amendments to all firms.

Several of these commenters emphasized that the flexibility the proposed amendments would offer is important for firms of all sizes, although for reasons that may differ between larger and smaller firms.

One commenter said such flexibility appears appropriate regardless of firm size, while noting that larger firms may be better equipped to operate under a more restrictive and specialized set of requirements.

Another commenter stated they would not be opposed to a limited degree of scaling these requirements to address cost considerations for small and large firms.

See

comment letters from AAA, BDO, CAQ, CBIZ, GT, KPMG, PICPA, PwC, RSM, and Spitters.

See

comment letters from AAA, BDO, CAQ, CBIZ, GT, KPMG, PwC, and RSM.

See

comment letter from Kramer.

See

comment letter from ICGN.

After consideration of the comments received, the Board is adopting these amendments as proposed. The Board believes the flexibility afforded by the amendments should be available to all firms rather than on a scaled basis, because audit quality is enhanced when firms can assign the specified roles and responsibilities to the most qualified individuals, whether or not they are firm personnel. In the Board's view, the amendments will expand the pool of individuals with the requisite experience, competence, authority, and time to serve in specified roles. For example, a firm may improve its QC system and overall audit quality by assigning to one individual operational responsibility for ethics and to another individual operational responsibility for independence, where each individual has specific expertise in their respective area.

In response to commenters that recommended clear firm-level accountability and documentation when roles are divided, paragraph .27 requires a firm to establish and maintain clear lines of responsibility and supervision within the QC system, including defining authorities, responsibilities, accountabilities, and supervisory and reporting lines for roles within the firm up to and including the principal executive officer(s). Additionally, paragraph .82a requires the firm to document the lines of responsibility and supervision required by paragraph .27. In response to a commenter's call for specific reporting to the PCAOB about divided roles, the Board notes that Item 3.1 of Form QC requires firms to disclose (1) who holds ultimate responsibility and accountability for the QC system as a whole and (2) which individual or individuals have operational responsibility for ethics and independence and for monitoring and remediation. Although the specific scope of each individual's assigned responsibilities would not be reported, that information must be documented under paragraph .82a and would be available to the PCAOB in connection with its oversight activities, including inspections.

See

PCAOB Rule 4000(b),

General.

2. Responsibilities for Roles With Operational Responsibility

To align with the amendments to QC 1000.12, the Board proposed conforming amendments to paragraphs .15-.17 that would acknowledge the possibility that multiple individuals could share the specified roles and clarify that such individuals' obligations would be limited to the scope of their assigned responsibilities.

In addition, the Board proposed amendments to paragraph .17b(2) through (3) to delete the communication requirements related to major QC deficiencies to align with the amendments to the evaluation requirement in paragraph .77 discussed below.

Commenters who addressed these amendments supported the proposed changes to paragraphs .15-.17 and stated they are sufficiently clear.

Two commenters acknowledged that the conforming amendments are appropriately aligned with the revisions to paragraph .12.

One commenter stated the conforming amendments reinforce a more principles-based approach

and another commenter stated the conforming amendments increase flexibility.

After consideration of the comments received, the Board is adopting these conforming amendments as proposed.

See

comment letters from CAQ, GT, KPMG, PICPA, RSM, and Spitters.

See

comment letters from GT and RSM.

See

comment letter from GT.

See

comment letter from KPMG.

External QC Function

As originally adopted, paragraph .28 of QC 1000 includes a specified quality response that requires firms with a larger PCAOB audit practice

to incorporate into their governance structure an EQCF for the QC system composed of one or more persons who:

Firms with a larger PCAOB audit practice are considered those firms that issued audit reports for more than 100 issuers in the prior calendar year.

• Are not partners, shareholders, members, other principals, or employees of the firm;

• Do not otherwise have a commercial, familial, or other relationship with the firm that would interfere with the exercise of independent judgment with regard to matters related to the QC system; and

• Have the experience, competence, authority, and time necessary to enable them to carry out the responsibilities assigned to the EQCF by the firm.

The EQCF's responsibilities include, at a minimum, evaluating the significant judgments made and the related conclusions reached by the firm when evaluating and reporting on the effectiveness of its QC system.

The Board proposed rescinding the EQCF requirement based on information obtained in connection with staff implementation support efforts and outreach discussions, which revealed that implementing this requirement had proven more difficult and more costly than originally anticipated. The Board was concerned that the potential benefits may not justify the potential costs of the EQCF requirement, except potentially for the largest U.S. global network firms.

Many commenters expressed support for rescinding the EQCF requirement.

Some of these commenters said rescission would allow firms the flexibility to utilize existing external governance structures to promote audit quality in a manner tailored to their specific circumstances.

Some commenters stated that removing the EQCF requirement would not diminish the focus on quality because QC 1000 advances the objectives of strengthening trust in governance, reinforcing accountability, and supporting a commitment to quality through other provisions in the standard.

Other commenters offered support for the proposed rescission by asserting that existing governance structures, leadership accountability, monitoring activities, reporting processes, and PCAOB inspections already provide meaningful oversight or help promote the effective operation of the QC system.

See

comment letters from AAA (majority of AAA committee members), Baker Tilly, BDO, CAQ, CBIZ, Crowe, Deloitte, EY, Forvis, GT, KPMG, PICPA, Plante & Moran, PwC, RSM, and VSCPA.

See

comment letters from BDO, CBIZ, Deloitte, EY, GT, KPMG, Plante & Moran, PwC, RSM, and VSCPA.

See

comment letters from BDO, CBIZ, Crowe, KPMG, and PwC.

See

comment letters from CAQ, EY, PICPA, and VSCPA.

In addition, many commenters observed that the costs associated with

the EQCF requirement, as well as any incremental benefits to audit quality, remain uncertain.

Some commenters who supported removing the requirement cited significant implementation challenges and costs associated with identifying, recruiting, and onboarding individuals with the necessary expertise, independence, and availability to serve in the role.

Other commenters pointed to additional costs, including obtaining liability insurance and making governance-related structural changes, as further reasons to support the proposed rescission.

One commenter cautioned that rescission of the EQCF requirement would remove a level of assurance with respect to internal processes and audit quality in firms but described the requirement as expensive, redundant, overreaching, and unnecessary.

Two commenters acknowledged the narrow responsibilities of an individual serving in an EQCF role, but asserted that the Board may have overstated the potential costs of the EQCF requirement by using particular benchmarks involving compensation of non-employee company directors to estimate potential costs.

These commenters also suggested that the Board may have understated the potential benefits of the EQCF requirement by failing to consider the ongoing trend of private equity investing in accounting firms.

Another commenter stated that many of the firms most likely to be affected already use external advisers and that the incremental burden of establishing the mandated function may be less substantial than the proposal implies.

This commenter also stated that the Board did not have direct evidence on the cost of the EQCF to firms.

See

comment letters from CAQ, Deloitte, GT, KPMG, PICPA, Plante & Moran, and RSM.

See

comment letters from BDO, CAQ, Crowe, EY, GT, PICPA, and VSCPA.

See

comment letters from BDO, Deloitte, KPMG, PICPA, and RSM.

See

comment letter from Spitters.

See

comment letters from CII and MIAG.

See id.

See

comment letter from CFA.

See id.

One commenter raised concerns that the size and complexity of a large firm's QC system would create practical constraints on the depth of engagement individuals serving in the EQCF role can achieve, thereby limiting the EQCF's overall effectiveness and value beyond the oversight already available through existing channels.

Another commenter supported rescission of the EQCF requirement because its current form is not scalable for firms only moderately above the 100-issuer threshold.

See

comment letter from Deloitte.

See

comment letter from Baker Tilly.

Some commenters opposed the proposed rescission of the EQCF requirement.

Two commenters disagreed with the PCAOB's reasoning “that the benefits of the requirement may not justify the costs, except potentially for the largest U.S. global network firms.”

The same commenters, while acknowledging concerns related to potential costs, liability, and implementation, stated that some form of independent challenge remains a critical component of an effective QC system.

Another commenter viewed the EQCF as essential to audit quality.

One commenter expressed concern that rescinding the EQCF requirement would leave judgments about the firms' QC systems entirely to the firms themselves.

This commenter stated the EQCF is the clearest structural safeguard against the commercial and network pressures and interests that can affect a firm's judgments regarding its QC system.

This commenter further asserted that, as the PCAOB moves the focus of its audit inspections to the firm rather than the engagement level, and as private-equity ownership and other commercial pressures within the auditing profession continue to grow, retaining such a safeguard is particularly important.

See

comment letters from AAA (minority of AAA committee members), CFA, CII, ICGN, and MIAG.

See

comment letters from CII and MIAG.

See id.

See

comment letter from ICGN.

See

comment letter from CFA.

See id.

Two commenters also asserted that the requirement for larger PCAOB audit practices to have an EQCF would be applicable to only five firms.

However, absent rescission of the EQCF requirement, 13 firms, based on 2025 data, would become subject to that requirement.

See

comment letters from CII and MIAG.

See

footnote 401 for a list of the 13 firms.

In responding to the question regarding an alternative threshold for the EQCF requirement, many commenters stated it was not necessary to impose the EQCF requirement on any firm, regardless of size or number of issuers audited.

Some commenters did not support an alternative threshold (

e.g.,

restricting the requirement only to firms auditing more than 500 issuers) because retaining the requirement in any form would not resolve the underlying concerns about operability, costs, availability of qualified individuals, and uncertain incremental benefit.

Some commenters said that firms should have the flexibility to create governance structures that align with the nature and extent of their existing structure and risks of the firm.

See

comment letters from Baker Tilly, BDO, Crowe, GT, PICPA, PwC, and RSM.

See

comment letters from BDO, CAQ, GT, KPMG, PICPA, and RSM.

See

comment letters from BDO, CAQ, Crowe, and KPMG.

One commenter stated that if the Board concludes that some relief is necessary, it is better to retain the EQCF requirement as adopted for firms auditing more than 500 issuers because it would apply to the five firms where nearly all U.S. public market capitalization sits.

100

One commenter stated that if the current 100-issuer threshold were not retained, they would not oppose amending the threshold to firms that issued audit reports for more than 200 issuers during the prior calendar year, because they believe that the large revenue base received from those firms' issuer audit clients could support the incremental costs associated with the EQCF requirement.

101

One commenter suggested retaining the EQCF requirement for firms that have accepted any form of outside investment, other than traditional debt financing, and operate through an alternative practice structure.

102

In addition, one commenter who opposed removing the EQCF requirement expressed the view that smaller firms (under 100 audits per year) should not be exempted from robust and functioning alternative EQCF requirements if the PCAOB were to scale the provisions.

103

Another commenter noted that, given the unchanged effective date of QC 1000, adopting alternative oversight frameworks could present implementation challenges and leave firms with limited time to thoughtfully design and integrate new requirements into their governance structures.

104

100

See

comment letter from CFA.

101

See

comment letter from MIAG.

102

See

comment letter from AAA.

103

See

comment letter from ICGN.

104

See

comment letter from KPMG.

In the supplemental request for comment, the Board sought input on the alternative of reverting the requirement for an independent oversight function to that contained in the 2022 proposal. Several commenters did not support such an alternative.

105

One commenter stated that the 2022 proposed requirement lacked sufficient clarity

and could create uncertainty regarding whether existing firm governance and oversight arrangements would satisfy such a requirement.

106

Another commenter indicated that the effect or impact of adopting the requirement as initially proposed in 2022 could not be determined.

107

One commenter did not support reverting back to the 2022 proposed requirement because it carried no defined duty to evaluate the firm's QC conclusions—the very check the EQCF was adopted to provide.

108

105

See

comment letters from CAQ, CFA, GT, KPMG, PICPA, PwC, and RSM.

106

See

comment letter from KPMG.

107

See

comment letter from Spitters.

108

See

comment letter from CFA.

After consideration of the comments received, the Board is rescinding the EQCF requirement. Based on staff implementation support efforts, the Board understands that implementation of this requirement may have proven more difficult and costly than originally anticipated. The Board also acknowledges the concerns raised by commenters about the costs, operability, and potential limited benefit of the EQCF requirement, including the availability of qualified individuals to serve in an EQCF role, for firms of any size. In the Board's view, rescinding the EQCF requirement means giving up the benefits of an external second look. That external second look would have focused on the significant judgments made and related conclusions reached when evaluating and reporting on the effectiveness of firms' QC systems. The Board believes those incremental benefits are difficult to quantify and potentially limited. They would come from the fresh perspectives of an individual serving in an EQCF role, beyond the benefits already provided by other aspects of QC 1000. See below for further discussion on economic impacts.

The Board believes that the implementation concerns apply equally to all firms, including those operating under alternative practice structures or accepting private equity investments, regardless of the number of issuers they audit.

One commenter opposed the rescission, asserting that firm leadership should be held accountable through independent oversight.

109

Further, the commenter suggested that firms might lack the ability to “convince investors they can do the right thing when left to their own judgment.”

110

As designed, though, the EQCF lacks a mechanism or the authority to hold firm leadership accountable; the EQCF is not required to provide concurring approval of the firm's evaluation or reporting.

111

Nor would the EQCF supplant the firm's judgment.

109

See id.

110

See id.

111

See

PCAOB Rel. No. 2024-005, at 121.

Furthermore, the Board notes that the QC 1000 quality objectives for the governance and leadership component continue to call for (i) firm leadership to communicate and promote the firm's commitment to quality; (ii) the firm to clearly define leadership's responsibility for quality and hold them accountable; (iii) firm leadership to demonstrate a commitment to quality through actions and behaviors; (iv) the firm's strategic decisions and actions to be consistent with and support the firm's commitment to quality; and (v) resources to be obtained, developed, allocated, and assigned in a manner that enables an effective QC system and the performance of engagements in accordance with applicable professional and legal requirements.

112

To achieve these quality objectives, firms are required to design and implement quality responses that are based on the related quality risks and on the reasons for the assessments given to the quality risks and to reduce to an appropriately low level the risk that quality objectives will not be achieved. The Board has also observed that several firms already incorporate external advisors into their organizational and governance structures and they may continue to do so as part of their response to the quality risks associated with these quality objectives. The Board has long considered firm governance and leadership to be an important aspect of firms' QC systems that will continue to be subject to oversight by the PCAOB, including as part of PCAOB inspections.

112

See

QC 1000.25.

Information and Communication

QC 1000 requires a firm to establish a quality objective that, if the firm communicates firm-level or engagement-level information with respect to the firm's audit practice, firm personnel, or engagements, such as firm or engagement metrics, to external parties, such information is accurate and not misleading and, with respect to any such metrics that are communicated in writing, the communication explains in reasonable detail how the metrics were determined and, if applicable, how the method of determining them changed since the metrics were last communicated.

As discussed in the QC 1000 2024 adopting release, the information that this requirement applies to includes public communications about firm-level or engagement-level information, such as firm metrics and financial data.

113

For example, some firms publish transparency or audit quality reports, either voluntarily or in response to the requirements of other jurisdictions, that contain data such as:

113

See

PCAOB Rel. No. 2024-005, at 186.

• Revenue breakdown by service line, by year, or by geographic segment;

• Professional staff ratios;

• Staff turnover ratios;

• Average training hours per professional; and

• Partner workload.

Firms may also communicate such data via web pages or other media, such as promotional publications, social media, interviews, or presentations via webcast or video.

114

See

PCAOB Rel. No. 2024-005, at 186-187.

In the supplemental request for comment, the Board proposed to narrow the requirements of QC 1000.53e regarding the need for an explanation of written metrics to those metrics that the firm makes publicly available. This was consistent with the initial focus of the requirement on public communications.

115

The Board believes that recipients of nonpublic communications regarding metrics, such as regulators, company management, and audit committees, are generally in a position to request additional information about the metrics if they desire it. Further, some nonpublic metrics may already be calculated in accordance with a method prescribed by the recipient (for example, in response to a regulatory requirement or an audit committee request for proposal). In contrast, where metrics are publicly available, such as in firm transparency reports or promotional publications, these are usually one-way communications in which the external parties do not have the ability to ask questions or request clarification from the firm.

115

See id.

Several commenters supported the proposed amendments to paragraph .53e.

116

One commenter said they did not object to confining the explanation requirement to metrics the firm makes publicly available.

117

One of these commenters stated that the proposed amendments were generally clear and seem appropriate but suggested that the term “metric” be defined or explained in the rule text.

118

Another commenter stated that the PCAOB must clearly communicate to firms that the intent of the provision is that firms ensure that

the explanation remains accurate and publicly available.

119

Another commenter encouraged the Board to make explicit that simplification of communication requirements does not alter the firm's monitoring obligations.

120

One commenter stated that it would be helpful to further clarify whether the requirement applies only to those communications required under applicable professional and legal requirements or to all such metrics publicly disclosed.

121

The commenter further requested clarification of whether all changes to the calculation of disclosed metrics to which this requirement applies must be explained or whether this requirement applies only to material changes in the calculation of the disclosed metrics.

122

116

See

comment letters from AAA, BDO, CAQ, Deloitte, EY, GT, KPMG, Kramer, MIAG, PICPA, RSM, SCCG, and Spitters.

117

See

comment letter from CFA.

118

See

comment letter from Kramer.

119

See

comment letter from MIAG.

120

See

comment letter from SCCG.

121

See

comment letter from RSM.

122

See id.

One commenter stated that the operability of the requirement could be further enhanced by restructuring the requirement into two distinct quality objectives—one that addresses whether the information is accurate and not misleading, and a second, conditional objective requiring an explanation for publicly communicated metrics.

123

See

comment letter from KPMG.

The Board is adopting the proposed amendments to QC 1000.53e with modifications. Specifically, the Board is revising paragraph .53e by adding subparagraphs .e(1) and .e(2) to more clearly distinguish firm responsibilities when communicating firm-level or engagement-level information to external parties and in written public communications. The Board agrees with the commenter that this change will improve the operability of paragraph .53e without changing a firm's responsibilities. In addition, the Board believes that the change will help to address a commenter's concern regarding the clarity of the provision's intent with respect to metrics communicated in writing and made publicly available by the firm.

The requirement in paragraph .53e(2) applies to any metrics that are communicated in writing and made publicly available by the firm—it is not limited in application to metrics that are required to be communicated under applicable professional and legal requirements. Paragraph .53e(2) also requires a firm to communicate how the method of determining any metrics changed since previously communicated, if applicable, and that requirement applies to any such change in methodology, without regard to the firm's assessment of its materiality. The Board does not believe that it is necessary to define the term “metric” for purposes of applying paragraph .53e(2). The Board believes the term is reasonably understood in practice, and the Board previously clarified, in the supplemental request for comment, that the Board intends for the requirement to apply only to calculated measures, not to underlying data.

124

As illustrated in the supplemental request for comment, if a firm publicly discloses its auditor-employee headcount for a region or office, the firm will not need to describe how it counted the employees.

125

The requirement will apply, however, to any calculated figures derived using that data, such as the average years of experience for audit personnel (

i.e.,

total years of audit experience divided by auditor-employee headcount).

124

See

PCAOB Rel. No. 2026-002, at 25-26.

125

See id.

The Board also does not believe it is necessary to clarify that the proposed amendment would not alter a firm's monitoring obligations. As stated by the commenter who suggested doing so, the amendments simplify communication requirements but do not affect QC 1000 monitoring obligations.

The Board believes that the amendments will carry out its initial intent for public communications and avoid unnecessary costs associated with making additional disclosures to recipients who can request more information if they need it, while still ensuring that recipients of written public communications have access to an explanation of any metric provided.

In addition, the Board proposed adding a note to paragraph .53e stating that the explanation of the method for determining metrics can be provided either within the public written communication that includes the metrics or by referring in the communication to a publicly available explanation presented elsewhere, such as the firm's website.

Several commenters supported allowing firms to provide explanations of metrics in a publicly available location, such as the firm's website.

126

One commenter stated that they supported the proposed amendment provided that those explanations are clear, balanced, accessible, and sufficiently specific to help users of the metrics.

127

Another commenter stated that they favored public disclosures in one place for ease of use and that placement on the relevant website seems appropriate as long as there are clear instructions on how to access the explanation.

128

The commenter further stated that, while disclosures on websites are useful, investors would want to make sure that any restatements, changes in definitions, or metrics are clearly noted, communicated in writing, and updated on a timely basis.

129

While one commenter agreed that publishing an explanation of metrics on a website would not adversely affect the utility of metrics made public, this commenter questioned whether public information about firm metrics should be subject to certification or verification before publication.

130

Another commenter said that an explanation that was accurate on the day it was published is of little use to an investor comparing metrics two or three years later, and that simplification of the requirement should not come at the expense of transparency or comparability over time within a single firm.

131

This commenter requested that the Board require that any report containing a publicly disclosed metric include, in the report itself, a hyperlink to the explanation of how that metric is calculated, maintained on the firm's own website, and stated that the hyperlink must remain stable, archived, and year specific.

132

This commenter also said that when a metric or its methodology changes from one year to the next, the change must be prominently identified in the base report itself—not only in the linked explanation—together with a description of the change and a presentation of the comparable prior year metric.

133

126

See

comment letters from BDO, CFA, GT, KPMG, MIAG, PICPA, and RSM.

127

See

comment letter from CAQ.

128

See

comment letter from ICGN.

129

See id.

130

See

comment letter from Spitters.

131

See

comment letter from CFA.

132

See id.

133

See id.

After consideration of the comments received,

134

the Board is adopting the note to paragraph .53e as proposed but relocating it under new paragraph .53e(2).

134

One commenter stated that the PCAOB should use existing artificial intelligence technology to aggregate metrics and related information from firms' websites or other public sources and make that information available in a centralized location on the PCAOB's website.

See

comment letter from MIAG. This suggestion is beyond the scope of this rulemaking.

The Board believes that allowing firms to explain metrics either in the same communication as the metric itself or by reference to another publicly available explanation would streamline firms' communications about their audit practices without adversely affecting the quality of information received by

external parties. The Board does not believe that permitting firms this flexibility will create confusion for stakeholders. Given the volume of information that a firm might communicate about itself, and the possibility that the same information may be repeated through various communication platforms, the Board believes that permitting a firm to make reference to a single publicly available explanation could reduce unnecessary duplication of disclosures and provide additional clarity to stakeholders. Also for this reason, the Board believes it is not necessary to require a change made to a metric or its methodology be identified in the written communication. The Board is not requiring firms to provide hyperlinks for the metrics because the Board seeks to preserve the principles-based nature of the requirement and avoid prescribing a specific method that may become less effective as technology changes over time.

To satisfy paragraph .53e(2), any publicly available explanation, including one provided through a website, would need to be clear, accessible, and sufficiently specific to explain how the metric was determined and any changes in the method used to determine the metric since it was last communicated. In addition, the Board does not believe that requiring certification or verification of such explanations is necessary to achieve the objectives of paragraph .53e(2). Firms would need to ensure that their explanations remained specific as to the public metric to which they relate and are publicly available for as long as they continue to make available the written public communication that refers to the location of the metrics. Firms may update the publicly available explanation as necessary to maintain its accuracy; however, such updates do not require the issuance of a new written public communication identifying or describing those updates.

Monitoring and Remediation Process

1. Responding to Engagement Deficiencies

Engagement monitoring activities are designed to provide information on whether engagement or QC system-level areas may require additional attention. These activities may identify pervasive issues where a number of engagements have similar problems, possibly highlighting the need to revise methodologies, provide additional training, or take other actions at the QC-system level. QC 1000 requires monitoring activities to include determining, on a timely basis, whether engagement deficiencies exist and, if so, taking certain actions in response to the identified engagement deficiencies.

QC 1000 defines an engagement deficiency as an instance of noncompliance with applicable professional and legal requirements by the firm, firm personnel, or other participants with respect to an engagement of the firm, or by the firm or firm personnel with respect to an engagement of another firm. Under QC 1000.68, a firm is required to take certain action when an engagement deficiency exists, with the required action depending on circumstances such as whether the engagement is completed or still in-process or is related to work performed on other firms' engagements.

i. Engagement Deficiency Related to an In-Process Engagement (QC 1000.68a)

As originally adopted, QC 1000 requires firms, for engagement deficiencies relating to in-process engagements, to take action to address the deficiency in accordance with applicable professional and legal requirements (to the extent necessary, before the issuance of the engagement report(s)), such that the engagement report(s) are appropriate in the circumstances.

The Board proposed to amend paragraph .68a to (i) replace the language “the engagement report(s) are appropriate in the circumstances” with “the engagement is free of significant engagement deficiencies” and (ii) add a footnote describing what significant engagement deficiencies are. The concept of a significant engagement deficiency is derived from AS 1220, and the description used in the proposed footnote in paragraph .68a aligns with that in AS 1220. The footnote to QC 1000.68a also clarifies that the concept applies to all engagements as that term is defined in QC 1000 (which includes, for example, engagements performed pursuant to PCAOB interim attestation standards), not only those engagements described in AS 1220.

Many commenters supported the proposed amendments to paragraph .68a.

135

However, one commenter stated that the proposed threshold for a “significant engagement deficiency” remained overly broad and could be interpreted to encompass any instance in which an engagement team failed to perform a procedure required by PCAOB standards, regardless of whether the omission affected the sufficiency or appropriateness of audit evidence supporting a material assertion or the engagement conclusions.

136

This commenter suggested that the definition should incorporate the concepts of materiality, relevant assertions, and the significance of the deficiency to the overall audit.

137

135

See

comment letters from Baker Tilly, CAQ, Deloitte, GT, KPMG, Plante & Moran, and Spitters.

136

See

comment letter from PICPA.

137

See id.

The proposed description for when a significant engagement deficiency exists is consistent with concepts in AS 1220. Under AS 1220, an engagement quality reviewer (“EQR”) may provide concurring approval of issuance only if, after performing with due professional care the review required by the standard, the EQR is not aware of a significant engagement deficiency.

138

The description of significant engagement deficiency in the proposed amendments to paragraph .68a appropriately focuses firms on matters that must be corrected before an audit report is issued or before an engagement conclusion is communicated to the company.

139

Therefore, the Board does not agree that the description is overly broad; a significant engagement deficiency would not be any instance in which an engagement team failed to perform a procedure required by PCAOB standards but rather is specifically related to the circumstances described in footnote 40A. Further, the Board believes the concept is well understood by the profession and does not require any revision.

138

See

Notes to AS 1220.12, .17, .18B.

139

See Proposed Auditing Standard—Engagement Quality Review and Conforming Amendment to the Board's Interim Quality Control Standards, PCAOB Rel. No. 2008-002 (Feb. 26, 2008), at 16 (describing significant engagement deficiencies).

The Board is adopting the amendments to paragraph .68a as proposed.

ii. Evaluating Whether Similar Engagement Deficiencies Exist on Other Engagements (QC 1000.68d)

As originally adopted, QC 1000 requires that, when the firm determines that an engagement deficiency exists, the firm should evaluate whether similar engagement deficiencies exist in other in-process engagements, completed engagements (unless it is probable that the engagement report is not being relied upon), and work performed on other firms' engagements, and if so, take actions as required by paragraphs .68a-c, as applicable.

The Board proposed to limit the requirement to evaluate whether similar engagement deficiencies exist so it would apply only with respect to a

subset of engagement deficiencies, specifically those that resulted or could result (i) a failure to obtain sufficient appropriate evidence to support the conclusion reached on an engagement

140

or (ii) an inappropriate overall conclusion on the subject matter of an engagement.

140

Because QC 1000 covers not only audit engagements but also review engagements and attestation engagements, reference to “sufficient appropriate evidence” is necessary as this concept aligns with the audit, review, and attestation standards.

Most commenters generally supported the proposed amendments to paragraph .68d.

141

The Board is adopting the amendments to paragraph .68d as proposed, along with a new note discussed further below.

141

See

comment letters from Baker Tilly, BDO, CAQ, CBIZ, Deloitte, EY, GT, ICGN, KPMG, PICPA, Plante & Moran, RSM, SCCG, and Spitters.

The discussion below addresses specific commenter feedback related to the proposed amendments.

a. “Resulted or Could Result in”

Several commenters raised concern regarding the proposed language “resulted or could result in.”

142

Commenters stated that the language would introduce new complexity

143

and interpretation challenges,

144

or would involve substantial implementation effort with limited incremental investor protection.

145

One commenter stated that without further context, the term “could” effectively sets a threshold closer to a remote possibility, which, in practice, would require firms to evaluate an unbounded population of engagements.

146

This commenter suggested that the Board consider revising the language to specify that the requirement applies “where there is a reasonable possibility” that an engagement deficiency could result in either a failure to obtain sufficient appropriate audit evidence or an inappropriate overall conclusion, to distinguish from those that represent more remote possibilities.

147

Another commenter recommended changing the proposed language to “reasonably could result.”

148

Another commenter stated that it was not clear whether “could” should be assessed at the individual engagement level or at a broader thematic level, such as when a theme or trend of similar engagement deficiencies emerges.

149

Another commenter stated that a deficiency that appears immaterial on the engagement where it was first identified can still be a symptom of a firm-wide QC weakness and a narrower trigger reduces the number of opportunities a firm has to find that pattern before it results in an audit failure.

150

One commenter highlighted that the intended benefits of the proposed amendment could be offset by concerns regarding specific provisions (

i.e.,

the “could result in” language).

151

Another commenter stated that it was difficult to determine whether the proposed amendment will meaningfully reduce complexity, subjectivity, or implementation costs.

152

The Board is concerned that some commenters may have misinterpreted the intent of the phrase “could result in.” As adopted, QC 1000 requires the firm to evaluate all engagement deficiencies under paragraph .68d. The goal of the amendment is to narrow the types of engagement deficiencies subject to the evaluation to only those that relate to obtaining sufficient appropriate evidence or the overall conclusion of an engagement.

153

Other engagement deficiencies would not need to be evaluated under paragraph .68d, as amended. Such other engagement deficiencies include, for example, engagement deficiencies related to communications to the audit committee; the filing of Form AP,

Auditor Reporting of Certain Audit Participants;

or the registration status of an other auditor that performed substantial role work.

154

In other words, this “could result in” language is not intended to introduce an assessment of the likelihood that the engagement deficiency could result in, for example, a failure to obtain sufficient appropriate evidence to support the conclusion on another engagement. This language is instead intended to help firms assess whether a particular engagement deficiency falls within either of the two types of engagement deficiencies subject to the evaluation under the revised paragraph .68d.

142

See

comment letters from BDO, GT, KPMG, PICPA, and RSM.

143

See

comment letter from KPMG.

144

See

comment letters from GT and KPMG.

145

See

comment letter from PICPA.

146

See

comment letter from KPMG.

147

See id.

148

See

comment letter from BDO.

149

See

comment letter from RSM.

150

See

comment letter from CFA.

151

See

comment letter from KPMG.

152

See

comment letter from GT.

153

With respect to examples of the type of engagement deficiencies that relate to reaching an inappropriate overall conclusion on the subject matter of an engagement,

see

PCAOB Rel. No. 2008-002, at 16 n.29, which states that “[i]nappropriate conclusions on the subject matter of the engagement would include, for example, a failure to appropriately modify the engagement conclusion in response to: (1) a material departure from generally accepted accounting principles or (2) a material weakness in internal control over financial reporting.”

154

These types of engagement deficiencies would still be required to be addressed in accordance with paragraphs .68a-c and to be evaluated to determine whether QC deficiencies exist in accordance with paragraph .72.

For example, if the engagement deficiency related to not making a required communication to the audit committee, this type of engagement deficiency does not affect the auditor's ability to obtain sufficient appropriate audit evidence or reach the appropriate overall conclusion of the engagement and, therefore, would not be within the scope of the revised paragraph .68d. In contrast, if the engagement deficiency related to the auditor not making or observing a physical inventory count in accordance with AS 2510,

Auditing Inventories,

this type of an engagement deficiency would be within the scope of paragraph .68d, because it relates to obtaining sufficient appropriate evidence.

Some commenters requested clarification of an example the Board provided in the supplemental request for comment.

155

To clarify and illustrate the application of the “resulted or could result in” language in paragraph .68d, consider the following scenario: During internal monitoring activities for the current year, a firm selected one of its completed engagements for inspection and identified that the engagement team failed to evaluate cash confirmation exceptions pursuant to AS 2310.20. As a result, the engagement team violated PCAOB requirements (

i.e.,

applicable professional and legal requirements) and the firm determined that an engagement deficiency exists. Because noncompliance with the requirement of AS 2310.20 (that is, the failure to evaluate confirmation exceptions) relates to obtaining sufficient appropriate evidence (

i.e.,

it could result in a failure to obtain such evidence), this engagement deficiency meets the requirement for evaluation under the revised language of paragraph .68d.

156

155

See

comment letters from Baker Tilly, BDO, CAQ, Deloitte, EY, GT, PICPA, and RSM.

156

The Board has provided a continuation of this example below.

The Board believes that the amendment appropriately focuses a firm's attention and efforts on the types of engagement deficiencies that represent the greatest risk to audit quality. It also reduces compliance costs by narrowing the population of engagement deficiencies that a firm is required to evaluate.

b. “Evaluate Whether Similar Engagement Deficiencies Exist”

A commenter stated that the nature and extent of the procedures required to evaluate whether similar engagement

deficiencies exist should be more explicitly grounded in the root cause of the engagement deficiency identified and an assessment of whether that root cause suggests a potential QC deficiency.

157

This commenter suggested that an evaluation anchored to root cause would provide a more meaningful and risk-based framework for determining the scope of further procedures.

158

As it relates to the evaluation required under paragraph .68d, another commenter requested scenarios to help firms distinguish between engagement deficiencies and identified root causes that are (i) indicative of systemic issues and (ii) isolated incidents.

159

157

See

comment letter from Deloitte.

158

See id.

159

See

comment letter from GT.

As described in the QC 1000 2024 adopting release, understanding the nature of the engagement deficiency will assist the firm in determining the extent of the necessary evaluation.

160

The intent of the requirement to evaluate whether similar engagement deficiencies exist was not to require an unbounded look at every engagement the firm has. The Board believes understanding the circumstances that led to the engagement deficiency (

e.g.,

the underlying cause) would help the firm identify other engagements to evaluate for similar engagement deficiencies. The Board acknowledges, as commenters suggested, that this was not clear in the proposed amendments. Therefore, the Board is adding a new note to paragraph .68d to indicate that understanding the circumstances that led to the engagement deficiency may assist the firm in identifying other engagements (or work performed by the firm on other firms' engagements) to evaluate for similar engagement deficiencies.

160

See

PCAOB Rel. No. 2024-005, at 225.

The procedures performed can be scalable and practical in the circumstances and may be developed based on the nature of the engagement deficiency. However, it would not be appropriate for a firm's evaluation to be based on narrower criteria than those underlying the cause(s) for the engagement deficiency, nor would it be appropriate to include only a subset of the engagements that are identified based on the understanding of the circumstances that led to the engagement deficiency.

To continue with the example provided above regarding cash confirmations, the firm then gained an understanding of the circumstances that led to the engagement deficiency (

e.g.,

the underlying cause) to identify which other engagements to evaluate for similar engagement deficiencies. In this example, the firm might determine that the engagement deficiency was caused by an error in the firm's cash confirmations methodology, which is required to be used on all engagements that use cash confirmations. To identify whether other engagements used the same methodology (or, in the case of in-process engagements, are currently using the same methodology), the firm sends an inquiry email to each engagement partner. Based on the responses received to the emails and any follow-up with non-respondents, the firm identifies the engagements (and work performed on other firms' engagements) that followed the same methodology. It is these engagements and work performed on another firm's engagements that followed the same methodology that the firm will evaluate for similar engagement deficiencies.

If the firm identifies, for example, twenty engagements that followed the same cash confirmations methodology, the firm evaluates whether a similar engagement deficiency exists on each of the twenty engagements,

i.e.,

a failure to evaluate confirmation exceptions pursuant to AS 2310.20. Out of the twenty engagements, if the firm identifies four engagements in which the engagement team did not perform procedures to evaluate confirmation exceptions pursuant to AS 2310.20, then the firm would need to take appropriate actions pursuant to subparagraphs a-c of paragraph .68 on each of those four engagements.

Importantly, paragraph .68d does not prescribe the manner in which the firm would identify engagements to evaluate. In the above example, the firm decided to send an email to each engagement partner to identify engagements that followed the same methodology. However, the firm could use other approaches, such as a data analysis tool or performing a search of engagement files, to identify engagements that followed the same methodology. The evaluation approach a firm takes may differ depending on the nature of the engagement deficiency, the circumstances that led to the engagement deficiency, and a firm's specific facts and circumstances. As discussed above, once the firm identifies the population of engagements subject to the evaluation of whether similar engagement deficiencies exist, it would not be appropriate for a firm's evaluation to be based on narrower criteria nor would it be appropriate to evaluate only a subset of the engagements that were identified.

The following graphic illustrates the process for evaluating whether similar engagement deficiencies exist:

EN18SE26.007

c. Response to Other Commenter Feedback

One commenter did not support a requirement that would require the firm, after finding an engagement deficiency in one engagement, to evaluate whether similar deficiencies exist in all other completed engagements.

161

This commenter stated that the cost of the requirement could be extremely high and it is unclear whether the benefit would outweigh the cost.

162

This commenter suggested that the Board instead change the requirement so that examining a completed engagement would be required only when, based on the information available at the time, the firm believed that it was probable the financial statements were materially misstated and the likelihood was more than remote that the audit report was still being relied upon.

163

The Board does not agree with the commenter who stated that the amendment would require that the firm evaluate whether similar deficiencies exist in all other completed engagements, as the note to paragraph .68d indicates understanding the circumstances that led to the engagement deficiency may assist the firm in identifying other engagements to evaluate for similar engagement deficiencies.

161

See

comment letter from AAA.

162

See id.

163

See id.

A commenter stated that a deficiency found in one engagement should prompt the firm to ask whether the same problem exists in other engagements and why it occurred, with the answers feeding back into the firm's risk assessment.

164

The Board agrees that an engagement deficiency identified in one engagement may provide information that is relevant to the firm's broader monitoring and remediation and risk assessment processes. All engagement deficiencies are subject to action as required under paragraph .68a-c (in that particular engagement), and certain engagement deficiencies will require evaluation under paragraph .68d. Furthermore, all engagement deficiencies are treated as QC observations under paragraph .72 and must be evaluated to determine whether they are QC deficiencies. Additionally, under paragraph .20a(3), the firm obtains an understanding of information from the firm's monitoring and remediation activities, including its identification of engagement deficiencies, in identifying and assessing quality risks. In this way, the evaluation of engagement deficiencies represents one part of the broader monitoring and remediation feedback loop: information identified through that process informs the firm's evaluation of QC observations and feeds back into the firm's identification and assessment of quality risks.

164

See

comment letter from CFA.

This commenter also stated that deficiency rates are not materially better than in the early years of the inspection program more than twenty years ago and suggested this is not the moment to narrow the lens through which firms look for systemic problems.

165

The Board believes that the amendments to paragraph .68d appropriately focus firms' evaluations on engagement deficiencies related to obtaining sufficient appropriate evidence to

support the conclusion reached on an engagement or the overall conclusion on the subject matter of an engagement that may indicate systemic issues on the firm's engagements.

165

See id.

A commenter suggested that the Board could further enhance the proposed amendment by aligning more closely with ISQM 1, which permits firms to use their judgment to determine the nature and extent of any investigation of identified engagement deficiencies and whether those deficiencies might indicate a deficiency in the system of quality management.

166

The Board believes the requirement in paragraph .68d is fundamental to achieving the objective of the QC system that each engagement report issued by the firm is in accordance with applicable professional and legal requirements.

167

166

See

comment letter from PICPA.

167

See

QC 1000.05.

A commenter questioned why only items (1) and (2) from footnote 40A to proposed paragraph .68a were included in proposed paragraph .68d, while items (3) and (4) (the engagement report is not appropriate in the circumstances and the ﬁrm is not independent of its client, respectively) were not.

168

With regard to paragraph .68d, the amendment focuses on those types of engagement deficiencies that most directly affect the sufficiency and appropriateness of procedures performed on the engagement as well as the ultimate opinion expressed by the firm.

168

See

comment letter from Grosvenor.

2. Definition of QC Deficiency

As originally adopted, the note to paragraph .A8(1) of the definition of QC deficiency states that the likelihood of not achieving the reasonable assurance objective or one or more quality objectives would be above an acceptably low level if, for example, a quality objective is not established, a quality risk is not properly identified or assessed, or a quality response is not properly designed or implemented or is not operating effectively.

The Board proposed to amend this note to clarify that a failure of a quality response would be regarded as evidencing a QC deficiency only if other quality responses do not achieve the relevant objective(s). As stated in the QC 1000 2024 adopting release, the relationship across quality objectives, quality risks, and quality responses is generally not one-to-one.

169

Most quality objectives are likely to have multiple quality risks. Some quality risks may affect one or more quality objectives, either within a single component or across several components, and may require multiple quality responses. Some quality responses may address multiple quality risks.

169

See

PCAOB Rel. No. 2024-005, at 42.

Many commenters supported the proposed amendment to the definition of QC deficiency,

170

noting, for example, that allowing firms to take compensating quality responses into account when determining whether a QC deficiency exists better reflects how a risk-based system of quality control operates in practice and also aligns more closely with the principles-based framework of other quality management standards, such as ISQM 1.

170

See

comment letters from AAA, Baker Tilly, BDO, CAQ, Crowe, Deloitte, EY, GT, KPMG, Kramer, PICPA, Plante & Moran, PwC, RSM, and SCCG.

Two commenters suggested revisions to the proposed amendment.

171

One commenter stated that the rule text could clarify that multiple other quality responses are not necessarily required by adding the words “one or more” before “other quality responses” in the Note to paragraph .A8(1) for situations where there is just one other quality response.

172

The Board believes the rule text is sufficiently clear that the clause “and other quality responses do not achieve the relevant objective(s)” applies only if the firm has designed and implemented at least one other quality response relative to the objective(s). Another commenter suggested amending the definition as follows: “(other quality responses have been implemented to address the same risk, and) `other quality responses do not achieve the relevant objectives.' ”

173

The Board does not believe it is necessary for the rule text to specify that “other quality responses” must have been designed and implemented to address the particular quality risk. As stated in the supplemental request for comment and reiterated here, when firms have implemented more than one quality response to address the same quality risk, they can take those other quality responses into account when determining whether a QC deficiency exists.

171

See

comment letters from Kramer and Spitters.

172

See

comment letter from Kramer.

173

See

comment letter from Spitters.

One commenter expressed concern that without a documented, inspectable basis for concluding that a “compensating response” actually operated effectively, this amendment risks becoming a way to explain away deficiencies rather than a genuine test of whether investors remain protected.

174

Another commenter expressed concern that the proposed amendment would give firms/networks additional temptation to identify compensating responses when the linkage is tenuous.

175

The Board believes the revised note makes clear that, when a quality response is not properly designed or implemented or is not operating effectively, the other quality responses would need to achieve the relevant objective(s), that is, they would need to be properly designed, implemented, tested, and found to operate effectively. And, as one commenter observed, paragraph .82 requires firms to document their evaluation of QC observations to determine whether QC deficiencies exist and the basis for each determination.

176

174

See

comment letter from CFA.

175

See

comment letter from Grosvenor.

176

See

comment letter from CFA.

Another commenter stated that it is unclear how allowing the evaluation of compensating controls will work in practice.

177

For example, where a quality risk has a single response that fails, the commenter stated it was unclear whether firms may consider other responses that mitigate other identified risks to support achievement of the overall objective.

178

This commenter suggested that there may be responses where a precision level is too high to singularly address a specific risk on their own, but when considered collectively, may reduce the risk of failing to achieve the objective to an acceptable level.

179

177

See

comment letter from RSM.

178

See id.

179

See id.

As explained in the QC 1000 2024 adopting release, the purpose of this note is to provide examples of circumstances where the likelihood of the firm not achieving the reasonable assurance objective or one or more quality objectives would not be reduced to an acceptably low level.

180

The amendments to this note further emphasize that, when a quality response is not properly designed or implemented or is not operating effectively and other quality responses do not achieve the relevant objective(s), the likelihood of the firm not achieving the reasonable assurance objective or one or more quality objectives has not been reduced to an acceptably low level. Under QC 1000, quality risks are defined as “[r]isks (whether or not related to intentional acts by

firm personnel

other participants

to deceive or to violate

applicable professional and legal requirements

) that, individually or in combination

with other risks, have a reasonable possibility of occurring and, if they were to occur, a reasonable possibility of adversely affecting the firm's achievement of one or more

quality objectives.”

The amendment clarifies that, when firms have implemented more than one quality response to address the same quality risk, they can take those other quality responses into account when determining whether a QC deficiency exists; if the other quality responses were effective in achieving the relevant objective(s), no QC deficiency would exist.

180

See

PCAOB Rel. No. 2024-005, at 231.

After consideration of the comments received, the Board is adopting the amendment to the definition of QC deficiency as proposed.

Evaluation of and Reporting on the QC System

1. Annual Evaluation of the QC System

i. Evaluation Date

As originally adopted, QC 1000 requires that the firm perform an evaluation of the effectiveness of its QC system annually as of September 30.

The Board proposed to amend QC 1000 to permit firms to select their own annual evaluation date for their QC system by adding a new defined term, “evaluation date,” defined as the date selected by the firm as of which to evaluate its QC system under paragraph .77, and making conforming changes to paragraph .77.

The Board also proposed to include language in a new footnote to guide the firm's selection of its evaluation date by recognizing that the firm's choice may be influenced by the nature and circumstances of the firm and its engagements, including, for example, the firm's fiscal year-end or the timing of monitoring activities.

All commenters who commented on this aspect of the proposed amendments expressed support.

181

One commenter, who did not object to this aspect of the proposed amendments, expressed concern that timing should not become a tool for managing findings and a firm should not be able to use its initial selection, or a later change of date, to defer capturing known or anticipated inspection findings within an evaluation period.

182

This commenter, however, acknowledged that under the amendments, no period of time escapes evaluation altogether and any change of evaluation date must be reported to the Board together with the firm's rationale for the change.

183

The Board agrees with the commenter that these are useful guardrails.

184

181

See

comment letters from AAA, Baker Tilly, BDO, CAQ, CBIZ, Crowe, Deloitte, EY, Forvis, GT, ICGN, KPMG, MIAG, PICPA, Plante & Moran, PwC, RSM, and Spitters.

182

See

comment letter from CFA.

183

See id.

184

See id.

The choice of evaluation date is an aspect of QC system design and, as such, has to be made and documented by the time the firm becomes subject to the QC 1000.06 requirement to design, implement, and operate an effective QC system. The firm has to have the information needed to identify unremediated QC deficiencies and to reach a conclusion about the effectiveness of its QC system as of the evaluation date, and for the individuals with ultimate responsibility and accountability and operational responsibility and accountability for the QC system as a whole, acting with due professional care, to certify the firm's report to the PCAOB on its annual evaluation of the QC system. This suggests that the evaluation date and the firm's monitoring and remediation cycle ought to be coordinated so that sufficient, timely information is available when needed about the implementation and operation of the QC system (including the status of remediation efforts) and the compliance of the firm's engagements with applicable professional and legal requirements. Because of the relationship between the evaluation date and the firm's monitoring and remediation activities, The Board does not anticipate that firms will change their selected evaluation date without a specific reason (

e.g.,

regulatory requirements, business combination transactions, or changes in fiscal year or business cycles).

The Board is adopting these amendments as proposed.

The Board believes allowing each firm to select its evaluation date based on the firm's particular facts and circumstances responds to the implementation challenges experienced by some firms and, in particular, could reduce the burden and costs of multiple annual evaluations that some firms could have experienced due to differences in required evaluation dates under QC 1000 versus other regulations to which they are subject. This change better aligns with the flexibility provided by other quality management standards, which permit firms to choose their own evaluation date. Additionally, the Board does not believe that allowing firms to select their own evaluation date impairs the Board's ability to carry out its inspection program.

ii. Five-Month Threshold for the Initial Evaluation of the Firm's QC System

The Board proposed to add language to paragraph .77 that would require a minimum period of operation before a firm is first required to evaluate its QC system. Under the proposed amendment, a firm would be required to evaluate its QC system once the firm has been subject to the requirement to design, implement, and operate a QC system under paragraph .06 for at least five consecutive months (whether due to the effectiveness of QC 1000 on December 15, 2026, or to the firm's later becoming subject to the requirements of QC 1000.06).

Most commenters who commented on this topic supported the proposed amendment.

185

See

comment letters from Baker Tilly, CAQ, ICGN, KPMG, PICPA, RSM, and Spitters.

However, one commenter stated that the proposed approach may create practical challenges for firms seeking to align their QC 1000 evaluation process with evaluations performed under other quality management standards, which contemplate annual evaluation periods that generally do not exceed twelve months.

186

This commenter observed that a firm that has chosen, for example, March 31 as its evaluation date would likely be required to perform an evaluation under ISQM 1 or SQMS 1 as of March 31, 2027, while the corresponding QC 1000 evaluation would not occur until March 31, 2028, and would encompass a 15-month evaluation period.

187

This commenter suggested that the Board could permit firms to perform their initial evaluation of their QC system as of their selected evaluation date, consistent with their normal quality control processes, but require the first Form QC filing only for the first 12-month evaluation period ending after September 30, 2027.

188

This commenter believes that the Board could obtain information regarding that firm's initial evaluation, implementation progress, significant findings, and remediation activities through its oversight activities (

e.g.,

inspections, implementation outreach, annual data requests, and other regulatory interactions) prior to the firm's first Form QC filing.

189

Another commenter stated that, combined with a free choice of evaluation date, the proposed five-month threshold could defer some firms' first evaluation well into 2028.

190

This commenter stated

that the Board should set an outer limit so that every firm completes its first evaluation within a reasonable period of becoming subject to the standard.

191

186

See

comment letter from BDO.

187

See id.

188

See id.

189

See id.

190

See

comment letter from CFA.

191

See id.

The Board acknowledges that, depending on the evaluation date chosen by the firm, the first evaluation period may encompass more than 12 months, but observes that subsequent periods would proceed on a 12-month cycle (absent a change of the evaluation date). The Board believes that this approach sets a reasonable outer limit for a firm's first evaluation. The Board also believes that the five-month minimum duration of the initial evaluation period ensures that firms have sufficient information to evaluate the effectiveness of their QC system. A firm can elect to voluntarily perform its initial evaluation covering a less-than-five-month period, but that evaluation would not be a required evaluation under QC 1000. Consequently, under General Instruction 4(a) to Form QC, the firm's first Form QC filing would be required to cover the period beginning on the date the firm first incurred an obligation to implement and operate a QC system under QC 1000.06 and ending on the firm's evaluation date.

Another commenter suggested that the five-month period should commence on the first day of the month immediately following the event that triggers the firm's obligation to design, implement, and operate its QC system, which would allow firms a full five-month operating period on which to base their evaluation.

192

This commenter also requested that the Board clarify that the five-month period applies solely to the initial operation of the broader QC system and does not establish a mandatory minimum operating period for concluding that a specific remedial action is effective.

193

To clarify, as noted above, a firm becomes subject to the requirements of QC 1000 on (1) December 15, 2026 (the effective date of QC 1000), or (2) the day the firm becomes subject to the requirement to design, implement, and operate a QC system under paragraph .06. Therefore, in all circumstances, a firm's QC system will have operated for a full five months or longer before the firm is required to evaluate the effectiveness of its QC system. Additionally, because the five-month threshold refers to the evaluation of the effectiveness of the firm's QC system as a whole, it does not impose any minimum time requirement for any other purpose other than for QC 1000.77.

192

See

comment letter from KPMG.

193

See id.

Another commenter also suggested that the Board clarify whether engagements should be included in a firm's evaluation based on the financial statement year-end or the date the auditor's report is issued.

194

This commenter encouraged the Board to clarify how firms should approach the initial evaluation when the completion of a firm's engagements falls outside this five-month timeframe and when the initial evaluation has little or no engagement activity within the evaluation period.

195

194

See

comment letter from PICPA.

195

See id.

QC 1000 requires that the firm design, implement, and operate a monitoring and remediation process to provide relevant, reliable, and timely information about the design, implementation, and operation of the QC system and to provide a reasonable basis for timely detection of engagement deficiencies and QC deficiencies.

196

Firms are required to monitor completed engagements.

197

A completed engagement is one for which the firm has issued an engagement report. Firms also are required, depending on the size of their PCAOB audit practice, to either perform in-process engagement monitoring

198

or consider doing so.

199

If the firm has no completed engagements during the firm's initial evaluation of its QC system, in-process monitoring could provide relevant, reliable, and timely information about the performance of the firm's engagements.

196

QC 1000.59a and b.

197

QC 1000.62a.

198

QC 1000.63a.

199

QC 1000.63b.

Finally, one commenter questioned the rationale behind the Board's decision to use five months as opposed to, for example, six months.

200

In developing the minimum time period for the initial QC system evaluation, the Board determined and continues to believe that the five-month threshold strikes the right balance such that the QC system has ample time to operate while also ensuring the PCAOB's timely receipt of information related to firms' QC systems.

200

See

comment letter from Spitters.

Accordingly, the Board is adopting this amendment as proposed.

To illustrate how the five-month threshold for the initial evaluation of the firm's QC system would operate, if a firm that is subject to the requirements of QC 1000.06 when the standard becomes effective (on December 15, 2026) selects June 30 as its evaluation date, the firm would first evaluate the effectiveness of its QC system in accordance with QC 1000 as of June 30, 2027, because the firm would have been required to operate a QC 1000-compliant system for at least five months (specifically, from December 15 to June 30) as of June 30, 2027. Alternatively, if such a firm selects March 31 as its evaluation date, the firm would be required to first evaluate the effectiveness of its QC system as of March 31, 2028, because the firm would not have been required to operate a QC 1000-compliant system for at least five months as of March 31, 2027. As another example, if a firm first became subject to the requirements of QC 1000.06 on June 1, 2027 (because the firm became subject to applicable professional and legal requirements with respect to an engagement at that time), and the firm selects July 31 as its evaluation date, the firm would be required to first evaluate the effectiveness of its QC system as of July 31, 2028, because the firm would not have been required to operate a QC 1000-compliant system for at least five months as of July 31, 2027.

iii. Evaluation Conclusions

As originally adopted, QC 1000 requires the firm to evaluate its QC system annually and conclude that the QC system is effective, is effective except for one or more unremediated QC deficiencies that are not major QC deficiencies, or is not effective (

i.e.,

one or more major QC deficiencies exist).

The Board proposed to amend the above three conclusions to align QC 1000 more closely with other quality management frameworks. Under proposed paragraph .77, the firm would be required to conclude, as of the evaluation date, that its QC system:

• Is effective in achieving the reasonable assurance objective; or

• Is effective in achieving the reasonable assurance objective except for unremediated QC deficiencies that have a severe but not pervasive effect on the design, implementation, and operation of the QC system (and do not render the QC system not effective); or

• Is not effective in achieving the reasonable assurance objective.

To clarify when a firm may conclude that its QC system is effective in achieving the reasonable assurance objective under paragraph .77a, the Board proposed to include a note explaining that such a conclusion would be appropriate when, as of the evaluation date, there are no unremediated QC deficiencies other than those that, individually or in

combination, are not severe. This clarification was intended to emphasize that the presence of unremediated QC deficiencies did not, in all cases, preclude a conclusion under paragraph .77a that the QC system is effective. Rather, the determination would depend on the severity of those deficiencies and their effect on the firm's ability to achieve the reasonable assurance objective. Under the proposed approach, QC deficiencies that are not severe, whether considered individually or in combination, would not indicate that the QC system is failing to operate effectively, which would be consistent with the ISQM 1 evaluation framework and the reasonable assurance objective of QC 1000.

Under proposed paragraph .77b, a firm would conclude that its QC system was effective in achieving the reasonable assurance objective except for unremediated QC deficiencies that have a severe but not pervasive effect on the design, implementation, and operation of the QC system (and do not render the QC system not effective). To clarify, when evaluating the effect of unremediated QC deficiencies on the QC system, a firm would evaluate whether the QC deficiencies have a severe but not pervasive effect on each of the following: (1) the design of the QC system, (2) the implementation of the QC system, and (3) the operation of the QC system. Therefore, with respect to the conclusion under paragraph .77b, QC deficiencies may have a severe but not pervasive effect on the design, implementation, or operation of the QC system; they need not have such an effect on all three aspects of the QC system for a firm to reach the conclusion under proposed paragraph .77b. The parenthetical statement is intended to clarify that if QC deficiencies are so severe as to prevent the firm from achieving the reasonable assurance objective, the appropriate conclusion would be under proposed paragraph .77c. A firm would reach the conclusion set forth in paragraph .77c if its QC system was not effective in achieving the reasonable assurance objective.

QC 1000 specifies that an unremediated QC deficiency is one for which remedial actions that completely address the QC deficiency have not been fully implemented, tested, and found effective. The Board proposed to modify the existing note to paragraph .77 to explain that, while remedial actions must be fully implemented as of the evaluation date, they can be tested and found effective no later than the date Form QC is due under paragraph .79 (or, if earlier, the date Form QC is filed). The note distinguishes between the implementation of remedial actions and the demonstration of their effectiveness. For purposes of determining whether a QC deficiency is remediated, firms are expected to have fully implemented remedial actions as of the evaluation date, but the assessment of whether those actions are operating effectively may be supported by testing their operating effectiveness after the evaluation date but before the Form QC filing date.

Commenters supported the proposed amendments to the evaluation framework and evaluation conclusions, particularly the effort to align more closely with other quality management standards.

201

Several commenters noted that this alignment would reduce the complexity of managing evaluations under multiple frameworks and help avoid potential confusion among stakeholders.

202

Two commenters observed that the three-tiered conclusions framework better supports informed decision-making and meaningful communication with stakeholders, and reflects a more accurate representation of how QC systems operate in practice.

203

Two other commenters noted that the proposed evaluation framework would enhance transparency by allowing firms to distinguish among varying degrees of effectiveness, including through the use of the “except for” conclusion.

204

One commenter further stated that the proposed evaluation framework better aligns with the reasonable assurance objective because it clarifies that a QC system may provide reasonable assurance even when unremediated QC deficiencies exist.

205

In addition, some commenters indicated that the proposed conclusions in paragraph .77 were sufficiently clear and appropriate.

206

One commenter stated the evaluation framework in proposed paragraphs .77-.78 is generally clear but requested clarification on the latitude of firms to change their conclusions as of the evaluation date if, before the date that Form QC is filed, a firm identifies shortcomings when further testing its remedial actions.

207

201

See

comment letters from AAA, Baker Tilly, BDO, CAQ, CBIZ, Deloitte, EY, Forvis, GT, ICGN, KPMG, PICPA, Plante & Moran, PwC, and RSM.

202

See

comment letters from Baker Tilly, Deloitte, EY, Forvis, and KPMG.

203

See

comment letters from BDO and CBIZ.

204

See

comment letters from Baker Tilly and GT.

205

See

comment letter from KPMG.

206

See

comment letters from GT, KPMG, and Spitters.

207

See

comment letter from Kramer.

While commenters generally supported the proposed framework, one commenter recommended expanding the “except for” category to include both “severe but not pervasive” and “pervasive but not severe” unremediated QC deficiencies to minimize potential blurring among the conclusion categories.

208

This commenter expressed concern that a conclusion under paragraph .77a could be confusing because a firm may arrive at a favorable conclusion despite having experienced significant quality control issues during the evaluation period that were subsequently remediated.

209

The same commenter also noted that deficiencies may take time to become apparent and suggested requiring statements or certifications indicating that firms considered previously unidentified deficiencies relating to prior years in their evaluations.

210

Another commenter urged the Board to retain the “effective, with no unremediated QC deficiencies” conclusion as originally adopted.

211

The commenter expressed concern that allowing firms to reach an unqualified “effective” conclusion despite the existence of unremediated QC deficiencies would broaden the circumstances in which firms may reach a favorable conclusion.

212

208

See

comment letter from Grosvenor.

209

See id.

210

See id.

211

See

comment letter from CFA.

212

See id.

One commenter supported the proposed modification to the existing note to paragraph .77 because it provides helpful guidance and better reflects how remediation occurs in practice.

213

Another commenter questioned whether the phrase “completely address” in the first sentence of the note, which is not part of the proposed modification, establishes an unnecessarily stringent standard and suggested replacing it with “sufficiently address.”

214

Another commenter requested clarification on the description in the release for determining whether a QC deficiency is remediated, specifically whether the phrase “may be supported by evidence obtained from testing after the evaluation date” refers to testing of instances that occurred before the evaluation date or the related response activities after the evaluation date.

215

One commenter requested clarification on how firms should assess the effect of remediation efforts when frequency constraints preclude testing enough instances of the remedial actions in

evaluating remaining QC deficiencies.

216

213

See

comment letter from KPMG.

214

See

comment letter from Grosvenor.

215

See

comment letter from RSM.

216

See

comment letter from CBIZ.

In developing the proposed amendments to paragraph .77, the Board also considered an alternative evaluation framework under which a firm would be required to reach a binary conclusion (

i.e.,

that its QC system is either effective or not effective in achieving the reasonable assurance objective).

One commenter stated that a binary conclusion may be particularly appropriate for many triennial firms and suggested that a binary framework would simplify the evaluation process.

217

Another commenter stated that whether the alternative evaluation framework with a binary conclusion is more appropriate is undefined, and it would be appropriate and constructive to retain the factors included in paragraph .78 (which are discussed further below) under this alternative framework.

218

217

See

comment letter from Kramer.

218

See

comment letter from Spitters.

Many commenters did not support the binary approach for the evaluation framework.

219

Some commenters were concerned that it would limit firms' ability to communicate the nature and severity of identified deficiencies and would decrease alignment with other quality management frameworks.

220

In addition, some commenters stated that a binary framework could provide insufficient information regarding significant deficiencies that are not pervasive enough to warrant a conclusion that the QC system is ineffective.

221

Two commenters noted that a binary framework would be less informative.

222

Another commenter expressed concern that the binary approach could reduce the rigor of the evaluation process.

223

Another commenter stated that the existing three-tiered conclusion structure provides more meaningful information by distinguishing QC systems with severe but not yet pervasive QC deficiencies and serves as an important early-warning mechanism.

224

This commenter also stated that the middle category allows severe but not yet pervasive unremediated QC deficiencies to be identified, escalated, and remediated before the QC system fails.

225

219

See

comment letters from AAA, Baker Tilly, BDO, CAQ, CBIZ, CFA, GT, ICGN, KPMG, MIAG, PICPA, PwC, and RSM.

220

See

comment letters from BDO, CBIZ, and GT.

221

See

comment letters from CAQ, KPMG, and PICPA.

222

See

comment letters from AAA and MIAG.

223

See

comment letter from MIAG.

224

See

comment letter from CFA.

225

See id.

After considering the comments received, the Board is adopting the amendments to paragraph .77 as proposed.

The Board believes that unremediated QC deficiencies that are pervasive but not severe may nevertheless allow the QC system to achieve its reasonable assurance objective and therefore support a conclusion under paragraph .77a. The Board also believes the evaluation framework appropriately focuses on the condition of the QC system as of the evaluation date and provides firms with the incentive to timely and effectively remediate identified QC deficiencies as of the evaluation date to reach a conclusion under paragraph .77a.

The Board notes that, despite increased alignment between the evaluation conclusions under QC 1000 and other quality management standards, the possibility remains that firms may reach different conclusions regarding the effectiveness of their QC systems under QC 1000 and ISQM 1 or SQMS 1. For example, there are differences in the professional and legal requirements that apply to a firm's audit practice under PCAOB standards compared to other standards, including variations between applicable auditing standards and independence requirements. The relevant populations of engagements are different. There could also be differences relating to the individuals who perform such engagements or perform activities within the QC system, including with regard to training and supervision. In addition, QC 1000 would continue to require a more structured approach to the evaluation process than other standards, including through the application of specific defined terms and factors that are required to be considered. The Board believes this more structured approach is important both in supporting consistent and appropriate evaluation of the QC system by firms and in providing a foundation for PCAOB oversight in the future.

The Board does not believe that an additional certification requirement, as suggested by one commenter, is necessary because QC 1000 already requires firms to consider the results of prior monitoring activities and remedial actions when determining the nature, timing, and extent of the firm's monitoring activities. The Board is also retaining the phrase “completely address” in the first sentence of the note to paragraph .77 describing the meaning of an unremediated QC deficiency. The commenter's suggested phrase “sufficiently address” could introduce subjectivity regarding whether a QC deficiency has been adequately remediated. The Board believes the phrase “completely address” conveys the expected level of remediation necessary before concluding that a QC deficiency is fully remediated.

With respect to requests for clarifications of (i) the phrase “may be supported by evidence obtained from testing after the evaluation date” and (ii) frequency constraints on testing remedial actions, the note to paragraph .77 distinguishes between the implementation of remedial actions and the demonstration of their effectiveness. For purposes of determining whether a QC deficiency is remediated, firms are expected to have fully implemented remedial actions as of the evaluation date, but the assessment of whether those actions are operating effectively may be supported by testing their operating effectiveness after the evaluation date but before the Form QC filing date. For example, when a remedial action has been implemented prior to the evaluation date but evidence from multiple instances of operation is needed to conclude that the remediation is effective, the firm may test one or more instances of operation of the remedial action that took place after the evaluation date but before the filing of Form QC to demonstrate effectiveness of the remedial action. However, if multiple instances of operation are needed to conclude that a remedial action is effective and, due to frequency constraints, only one instance of operation can be tested before the filing of Form QC, then the QC deficiency would be considered an unremediated QC deficiency.

Regarding the requested clarification of a firm's ability to change its conclusion on QC effectiveness between the evaluation date and the date Form QC is filed, the Board notes that the firm's final conclusion about the effectiveness of its QC system is the conclusion reported on Form QC. When additional information related to the QC system as of the evaluation date becomes available before Form QC is filed, the firm is expected to evaluate that information and make appropriate determinations regarding the information in a timely manner and report any relevant conclusions it reaches.

iv. Evaluating the Severity and Pervasiveness of Unremediated QC Deficiencies

As originally adopted, QC 1000.78 includes the concept of a “major QC deficiency” and provides presumptions and factors to determine whether a major QC deficiency exists and, therefore, the QC system is not effective. The Board proposed to eliminate the concept of a “major QC deficiency,” including the associated presumptions. The Board proposed to retain, in modified form, the factors to consider in evaluating the severity and pervasiveness of unremediated QC deficiencies.

Specifically, the Board proposed to amend paragraph .78 to require firms to evaluate the severity and pervasiveness of unremediated QC deficiencies in reaching the evaluation conclusion under paragraph .77. Proposed paragraph .78 clarifies that the firm's evaluation would consider all unremediated QC deficiencies individually and in combination, considering both quantitative and qualitative implications. The proposed paragraph .78 also describes severity and pervasiveness for purposes of this evaluation. Severity reflects the seriousness of a QC deficiency or combination of QC deficiencies, including the potential impact on the firm's ability to achieve the reasonable assurance objective. Pervasiveness reflects the breadth of impact of the QC deficiency or combination of QC deficiencies on the QC system or across the firm's portfolio of engagements.

Commenters generally supported removing the concept of a “major QC deficiency” from QC 1000.

226

Some commenters noted that the concept constituted a fundamental departure from other quality management standards and reduced consistency across quality management frameworks.

227

One commenter stated that the removal of the major QC deficiency concept and related presumptions could reduce the information value of the evaluation conclusions and lessen the prominence with which serious QC issues are escalated and communicated.

228

The commenter urged the Board to preserve escalation presumptions in some form and clarify how serious QC issues that fall short of overall ineffectiveness will be escalated and communicated if the “major QC deficiency” concept is removed.

229

226

See

comment letters from BDO, CAQ, GT, KPMG, PICPA, RSM, and Spitters.

227

See

comment letters from GT, KPMG, PICPA, and RSM.

228

See

comment letter from CFA.

229

See id.

Some commenters supported the factors used to evaluate the severity and pervasiveness of unremediated QC deficiencies, stating that the factors promote consistency and rigor in the evaluation process.

230

One commenter stated that the factors in proposed paragraph .78 appropriately address QC deficiencies individually and collectively and account for both qualitative and quantitative considerations.

231

230

See

comment letters from BDO, CAQ, GT, and KPMG.

231

See

comment letter from Spitters.

One commenter stated that considering deficiencies “in combination” when assessing severity may blur the distinction between the concepts of severity and pervasiveness.

232

The same commenter also indicated that this distinction may be further blurred because the same factors are used to evaluate both severity and pervasiveness.

233

Another commenter supported the objective of providing a structured framework for evaluating the severity and pervasiveness of unremediated QC deficiencies but viewed proposed paragraph .78 as overly complex and prescriptive.

234

The same commenter suggested an alternative model for paragraph .78, incorporating concepts from the AICPA Peer Review Program guidance for evaluating deficiencies, that would focus on the nature, cause, and effect of the deficiency, including: (1) whether the deficiency is an isolated event or a systemic weakness; (2) the significance of the deficiency to the firm's practice, including the likelihood to affect other engagements or components of the QC system; (3) the effect of the deficiency on the firm's ability to achieve the reasonable assurance objective; and (4) the extent to which remedial actions have been implemented and demonstrated to be effective.

235

232

See

comment letter from Grosvenor.

233

See id.

234

See

comment letter from PICPA.

235

See id.

The Board does not believe that removing the major QC deficiency concept removes the framework's ability to identify and appropriately distinguish particularly severe QC deficiencies. Under the amended evaluation framework, firms would still be required to evaluate the severity and pervasiveness of all unremediated QC deficiencies, individually and in combination, and report information regarding unremediated QC deficiencies in Form QC regardless of the evaluation conclusion reached. The evaluation conclusions in paragraph .77 and the factors in paragraph .78 would provide a structured framework for identifying and assessing unremediated QC deficiencies and for communicating unremediated QC deficiencies to the PCAOB. Further, the conclusion under paragraph .77b can only be selected when unremediated QC deficiencies have a severe but not pervasive effect on the QC system and also do not render the QC system not effective. As reflected in the parenthetical statement in paragraph .77b, if unremediated QC deficiencies are so severe as to prevent the firm from achieving the reasonable assurance objective, the firm would be required to conclude under paragraph .77c that its QC system is not effective in achieving the reasonable assurance objective.

The Board believes it is important to consider unremediated QC deficiencies both individually and in combination because doing so may reveal patterns of similar findings or indicate a broader issue that may not be evident from evaluating each deficiency in isolation. The Board also believes that allowing the same factors to inform assessments of both severity and pervasiveness provides firms with relevant information for their evaluations. In many cases, it may not be practicable to categorize a factor as relating exclusively to either severity or pervasiveness. Additionally, the Board believes the alternative factors for evaluating deficiencies, suggested by one commenter, are already reflected in paragraph .78 as proposed. The factors in paragraph .78 are intended to assist firms in performing the internal evaluation required to reach a conclusion under paragraph .77. The Board believes the approach in paragraph .78 provides clear direction to firms in evaluating the severity and pervasiveness of unremediated QC deficiencies.

One commenter noted that the term “component” in proposed paragraph .78a is undefined and could be unclear and recommended that the standard more explicitly link the term to the eight integrated components of a firm's QC system described in QC 1000.03, either through a cross-reference or by using consistent terminology.

236

To clarify the intended meaning of the term “component” in proposed paragraph .78a, the Board is revising the paragraph to refer to the “components of the firm's QC system.”

236

See

comment letter from Kramer.

Another commenter questioned if the factor of persistence in paragraph .78d affects the evaluation of severity and pervasiveness and provided an example of an issue that persists unchanged for three years.

237

The Board continues to believe that the persistence of a deficiency may provide useful information in assessing its severity and pervasiveness. However, persistence alone may not determine the severity or pervasiveness of a QC deficiency, and those assessments depend on the particular facts and circumstances as well as other factors in paragraph .78.

237

See

comment letter from Grosvenor.

Another commenter stated that the proposed amendments to paragraphs .78e-f introduce the phrase “or could result in” and expressed concern that the use of “could” may imply an evaluation threshold approaching absolute assurance because it encompasses even remote possibilities.

238

This commenter suggested revising the language to refer instead to circumstances “where there is a reasonable possibility.”

239

The factors to consider in evaluating the severity and pervasiveness of unremediated deficiencies do not relate to providing any level of assurance. They are intended to help the firm evaluate how severe or pervasive unremediated QC deficiencies are in performing the evaluation and reaching a conclusion regarding the effectiveness of the firm's QC system. The use of “could” in these factors is intended for the firm to evaluate whether the unremediated QC deficiencies remaining as of the evaluation date have the potential to cause significant engagement deficiencies or revisions of engagement reports, or to be associated with financial statement restatements or reissuances of management reports on internal control over financial reporting or broker-dealer compliance or exemption reports that are the subject of the firm's audit or attestation engagements.

238

See

comment letter from KPMG.

239

See id.

One commenter expressed concern that the wording regarding the significance to the firm's portfolio of engagements in paragraph .78g could unintentionally imply that some engagements are less important than others.

240

While all unremediated QC deficiencies are required to be evaluated for severity and pervasiveness, the Board recognizes that there may be certain engagements where unremediated QC deficiencies are more likely to affect the firm's overall practice under PCAOB standards due to the engagement's significance to the firm's portfolio. For example, if an unremediated QC deficiency is likely to result in engagement deficiencies that occur across the primary industry that represents a substantial portion of the firm's PCAOB engagements, the unremediated QC deficiency could be severe or pervasive because of its significance to the firm's engagement portfolio.

240

See

comment letter from PICPA.

Another commenter supported the factors if they continue to include consideration of whether remedial actions have been implemented, tested, and determined to be effective, consistent with paragraph .78h.

241

See

comment letter from ICGN.

The Board is adopting the factors in paragraph .78 as proposed with the revision made to paragraph .78a discussed above. The Board believes these factors promote consistency by identifying circumstances that are particularly relevant in assessing the severity and pervasiveness of unremediated QC deficiencies. The final factors with general descriptions are:

The number and nature of components of the firm's QC system or quality objectives directly or indirectly affected.

This factor focuses on how many components of the firm's QC system or quality objectives are affected, what they are, and whether the impact is direct or spread through other components or quality objectives.

The extent to which the unremediated QC deficiency or combination of unremediated QC deficiencies relates to a component, quality objective, or quality response that affects the design or operation of other aspects of the QC system.

This factor focuses on how widespread the impact of the unremediated QC deficiency or combination of unremediated QC deficiencies is throughout the QC system.

The number and pervasiveness of root causes.

The factor focuses on what the firm's root cause analysis reveals about why the QC deficiency occurred and how significantly or broadly it affects the QC system.

The persistence of the unremediated QC deficiency or combination of unremediated QC deficiencies over time.

This factor focuses on the existence of a QC deficiency or combination of QC deficiencies that recurs or continues unremediated year over year.

Whether the unremediated QC deficiency or combination of unremediated QC deficiencies has resulted or could result in significant engagement deficiencies.

This factor focuses on whether the unremediated QC deficiency or combination of unremediated QC deficiencies is leading to or likely to lead to significant engagement deficiencies.

Whether the unremediated QC deficiency or combination of unremediated QC deficiencies has resulted or could result in the need for revisions to engagement reports, or is or could be associated with restatements of financial statements or reissuances of company-prepared reports that are the subject of audit or attestation engagements.

242

Company-prepared reports subject to audit or attestation engagements include the report on internal control over financial reporting and broker-dealer compliance and exemption reports.

This factor focuses on whether the unremediated QC deficiency or combination of unremediated QC deficiencies has already led or could lead to revisions of engagement reports, or is or could be associated with financial statement restatements or reissuances of management reports on internal control over financial reporting or broker-dealer compliance or exemption reports.

With respect to the factors in subparagraphs d-f, the number and significance (to the firm's portfolio of engagements) of engagements that are affected by the unremediated QC deficiency or combination of unremediated QC deficiencies or are likely to be affected in the future in the absence of remediation, and the nature of the effect.

This factor focuses on how important the affected engagements are compared to the firm's overall practice under PCAOB standards. The number and significance of affected engagements to the firm's portfolio of engagements depends on, for example, firm personnel affected or likely to be affected, the associated revenue or profit, the associated risks, and the relevant industry.

The effects of any remedial actions that have been implemented, tested, and found to be effective.

Before the annual evaluation date, a firm may implement remedial actions that may reduce the severity or pervasiveness of an unremediated QC deficiency while not completely addressing it. For a firm to take credit for the effects of these remedial actions, they would need to be implemented as

of the evaluation date, and they would need to be tested and found to be effective before Form QC is due and filed. For example, in response to a QC deficiency related to a problem identified with a firm's audit software, the firm designs and implements five remedial actions as of the evaluation date. Of those five remedial actions, two remedial actions have been tested and found to be effective before Form QC is due and filed. When determining the severity and pervasiveness of the unremediated QC deficiency, the firm can consider the effects of the two remedial actions that have been tested and found to be effective.

The process flow that follows illustrates how to apply the above considerations in reaching one of the three evaluation conclusions in paragraph .77.

BILLING CODE 8011-01-P

EN18SE26.008

BILLING CODE 8011-01-C

2. Reporting to the PCAOB

i. Reporting on the Annual Evaluation of the Effectiveness of the QC System

As originally adopted, QC 1000 provides that firms have until November 30 each year to report to the PCAOB on Form QC the outcomes of their QC system evaluations, based on a fixed evaluation date of September 30. This provides firms with 61 days after the evaluation date of September 30 to file Form QC. Based on the proposed amendment to permit firms to select their own evaluation dates, the Board proposed to amend the due date of Form QC in paragraph .79 to 60 days after the firm's chosen evaluation date. The Board also proposed to amend the Form QC reporting rule, PCAOB Rule 2203A,

Report on the Evaluation of the Firm's System of Quality Control,

and General Instruction 3 to Form QC to reflect this proposed amendment (see below).

Commenters generally supported the proposed amendments to paragraph .79, Rule 2203A, and Form QC.

243

See

comment letters from BDO, CFA, Crowe, EY, GT, KPMG, Spitters, and VSCPA.

One commenter expressed concern related to the 60-day reporting deadline for Form QC, stating that, for many smaller firms, completing the annual evaluation of the system of quality control, hiring and coordinating external resources, obtaining the necessary internal reviews and approvals, and preparing the required report within 60 days may not be practicable.

244

This commenter recommended that the Board adopt a more scalable approach, for example, by permitting firms below an appropriate threshold to file Form QC within 180 days of their evaluation date.

245

In allowing firms to select their own evaluation date, the Board believes it is appropriately providing firms with the ability to select a date that works best for their business cycles; however, the Board also believes that timely receipt by the PCAOB of information contained in Form QC to support the Board's oversight activities requires a shorter timeline than this commenter suggested. The Board continues to believe that the 60-day filing requirement provides firms with sufficient time from the evaluation date to the reporting date to complete their evaluation and report to the PCAOB.

244

See

comment letter from PICPA.

245

See id.

The Board also proposed an amendment to General Instruction 4 to Form QC to clarify the reporting period covered by the firm's evaluation. As proposed, the reporting period would be the period beginning the day after the most recent previous evaluation date and ending on the evaluation date, with the following exceptions as to the beginning of the reporting period:

• If a firm has not previously been required to evaluate its QC system under QC 1000, the reporting period is the period beginning on the date the firm first incurred an obligation to design, implement, and operate a QC system under QC 1000.06.

• If a firm was previously required to evaluate its QC system under QC 1000, but such obligation lapsed because the firm ceased having any obligations under applicable professional and legal requirements with respect to one or more engagements, the reporting period is the period beginning when the firm subsequently incurred an obligation to design, implement, and operate a QC system under QC 1000.06.

Under this proposed amendment, the reporting period would generally be twelve months long, but it would be longer or shorter if the obligation to design, implement, and operate the QC system arises mid-period (whether by virtue of the effective date of QC 1000 or the firm's otherwise becoming subject to the requirement to design, implement, and operate a QC system). For example, for a firm that selects March 31 as its evaluation date, upon the effective date of QC 1000 the firm's first evaluation would cover the reporting period from December 15, 2026, to March 31, 2028, resulting in a greater-than-15-month reporting period, with the first Form QC due to be filed no later than 60 days following March 31, 2028. This is because as of March 31, 2027, the firm would not have been subject to the requirement to design, implement, and operate a QC system for at least five consecutive months (under the five-month threshold in paragraph .77 discussed above). By contrast, for a firm that selects May 31 as its evaluation date and is subject to QC 1000 on the standard's effective date, this firm's first evaluation would cover approximately five and a half months beginning on December 15, 2026, and ending on May 31, 2027, with the first Form QC due to be filed no later than 60 days following May 31, 2027.

The proposed amendment to General Instruction 4 did not draw comment.

The Board is adopting as proposed the amendments to paragraph .79, PCAOB Rule 2203A, and Form QC described above.

One commenter stated that two important elements of Form QC reporting would be lost with the removal of the “major QC deficiency” concept: (1) the requirement to flag whether each unremediated deficiency is major, and (2) the narrative required where a major deficiency is presumed but determined not to exist.

246

This commenter requested that the Board preserve equivalent signals under the proposed evaluation framework and require that firms (1) indicate, for each unremediated QC deficiency, whether the firm assessed it as severe, and (2) explain the basis for any determination that severe deficiencies do not, individually or in combination, render the QC system not effective.

247

QC 1000 continues to require that firms report all unremediated QC deficiencies as of the evaluation date on Form QC, regardless of the conclusion reported under paragraph .80a. Accordingly, a firm's Form QC reporting must include any unremediated QC deficiencies identified as of the evaluation date, including QC deficiencies that were determined not to be severe or pervasive. The Board continues to believe that reporting of all unremediated QC deficiencies will inform various aspects of the Board's oversight activities. Upon receipt of a Form QC, the PCAOB will have the ability to perform further inquiries of a firm regarding any of the information provided. Additionally, the firm is required to document under paragraph .82d the basis for the conclusion reached under paragraph .77, which would include the firm's evaluation of the severity and pervasiveness of unremediated QC deficiencies, and this information would be available to the PCAOB in connection with its oversight activities, including inspections.

248

246

See

comment letter from CFA.

247

See id.

248

See

PCAOB Rule 4000(b),

General.

Based on the amendments described above, the Board is adopting additional conforming amendments to paragraph .80 and Form QC, substantially as proposed.

249

The Board is also adopting amendments to paragraph .80 and Form QC to replace the language “the issuance of unsupported opinions” with “significant engagement deficiencies,” consistent with the amendments to QC 1000.68a described above, as proposed.

249

Note 1 to Item 3.2 within Form QC is amended to include a reference to the evaluation date. Also, language related to Exhibit 3.2.b in Part VII of Form QC is amended to refer to individuals “assigned” operational responsibility and accountability for the firm's QC system as a whole.

ii. Reporting Changes to the Firm's Evaluation Date

Under the amendments to QC 1000.77, as discussed above, each firm selects its own evaluation date. The Board proposed that any change in the

evaluation date, together with a brief statement of the firm's rationale for making the change, be reported on Form QC within 30 days after the firm's decision. The Board believes this information would inform the timing of the Board's oversight efforts.

To codify this requirement, the Board proposed to recaption Rule 2203A as “

Reporting on the Evaluation of the Firm's System of Quality Control,”

amend paragraph (a) of Rule 2203A to require notification of a change in the evaluation date on Form QC, and amend paragraph (b) of Rule 2203A to require such notification to be filed no later than 30 days after the firm's decision to change the evaluation date.

Relatedly, the Board proposed to amend Form QC to add a new Item 1.2,

Change to the Evaluation Date,

for providing notice of a change to the evaluation date, including the new evaluation date and a brief statement of the rationale for making the change. Additional language was also proposed to be added to General Instruction 3 to explain that Form QC is required to be filed no later than 30 days after the firm's decision to change the evaluation date and that a notification of change in the evaluation date need only include a completed Part I and the signed certification in Part V of Form QC.

Several commenters expressed support for the proposed reporting changes regarding the firm's evaluation date.

250

Some commenters requested additional clarifications regarding (1) whether the firm should use business days or calendar days when calculating the deadline for submitting Form QC to notify the Board of a new evaluation date, (2) changes in the firm's evaluation date (for example, due to mergers or acquisitions), and (3) changing an evaluation date after the first year of implementation.

251

Because the deadline for submitting Form QC is greater than seven days, the 30-day submission deadline when providing notice of a new evaluation date is based on calendar days, taking into account the exception that applies if the last day of the 30-day period is a Saturday, Sunday, or Federal legal holiday.

252

Additionally, the standard does not limit when a firm can change its evaluation date, but a change to a firm's evaluation date would likely involve significant changes to many aspects of the firm's QC processes, so a firm will need to consider the implications to its QC system of making such a change. As noted above, if the firm decides to change its evaluation date, the change must be reported on Form QC within 30 days after the firm's decision, together with a brief statement of the firm's rationale for the change.

250

See

comment letters from CFA, GT, and KPMG.

251

See

comment letters from Baker Tilly, BDO, CAQ, and Plante & Moran.

252

See

PCAOB Rule 1002,

Time Computation; see also

PCAOB Rule 2203A, which states that pursuant to Rule 1002, in any year in which the filing deadline falls on a Saturday, Sunday, or Federal legal holiday, the deadline for filing Form QC shall be the next day that is not a Saturday, Sunday, or Federal legal holiday.

The Board is adopting these amendments as proposed.

Documentation

As originally adopted, QC 1000 provides firms until December 14 following the firm's annual evaluation to assemble for retention a complete and final set of QC documentation.

The Board proposed amendments to QC 1000.84 to clarify that the QC documentation should be completed and retained “in a manner that permits timely retrieval,” rather than “assembled for retention,” by the QC documentation completion date. Documentation is considered timely retrievable when it is made available in a manner that does not hinder an experienced auditor's ability to understand the design, implementation, and operation of the QC system during a particular evaluation period in accordance with QC 1000.83b and the accompanying note. In addition, in conjunction with the amendments to paragraphs .77 and .79 of QC 1000, which permit firms to select their own evaluation date and require them to report on that evaluation no later than 60 days after that date, the Board proposed to amend the QC documentation completion date to be 14 days after Form QC is filed (or due to be filed, if earlier).

Many commenters supported the proposed amendments to paragraph .84

253

but some stated they continue to have concerns regarding the scope of the documentation requirements, particularly the extent of documentation required to be retained.

254

One of these commenters raised concerns regarding the clarity and practical application of “timely retrieval of documentation” that is not maintained in the quality monitoring tool and stated that firms would otherwise need to identify, monitor, and retain documentation across a broad range of decentralized locations.

255

One commenter stated that, while they did not object to the proposed amendments, the proposed amendments did not address a key issue related to real-time systems, namely, that such systems may not allow for the reconstruction of information back to a specific point in time unless versions are archived or captured otherwise.

256

Another commenter did not object to the proposed amendments allowing firms to retain QC documentation within their original systems of record, provided it remains promptly retrievable.

257

253

See

comment letters from AAA, Baker Tilly, BDO, Forvis, GT, KPMG, MIAG, PICPA, PwC, and Spitters.

254

See

comment letters from Baker Tilly, GT, PICPA, and PwC.

255

See

comment letter from GT.

256

See

comment letter from RSM.

257

See

comment letter from CFA.

Two commenters expressed uncertainty as to the nature of the documentation required to be retained, for example, emails or other documentation that relate to QC processes.

258

One of these commenters requested clarification that other evidence of the underlying documentation, such as system-generated reports or other reproducible outputs, would meet the documentation requirements.

259

This commenter stated that the release text in the supplemental request for comment indicated that firms were expected to retrieve documentation from live systems “as it existed at the time that it was considered complete,” which might not be feasible with continuously updating systems and would appear to reintroduce the same operational challenges the proposed amendment was intended to alleviate.

260

The other commenter stated that it was unclear as to how to address documentation residing in systems or applications that have been replaced during the evaluation period.

This text is long and has been trimmed here. Open the source document for the complete record.

This is a copy of a public record, reproduced as it was published. It is not legal advice, and it may not be the version a court would rely on. Check the official source before you cite it.