The Public Company Accounting Oversight Board has adopted a new standard, QC 1000, governing the quality control (QC) systems of public accounting firms. In her statement on QC 1000, PCAOB Chair Erica Williams said: “Because QC systems are fundamental to conducting quality audits, these new requirements directly align with our mission to protect investors and further the public interest in the preparation of informative, accurate, and independent audit reports.” The Board proposed the new QC standard in late 2022. See PCAOB QC Proposal Could Impact Auditor/Audit Committee Relationship, November-December 2022 Update. Subject to SEC approval, QC 1000, and related amendments to the PCAOB’s auditing standards, will take effect on December 15, 2025.
Most audit committees are unlikely to see specific changes in their auditor’s procedures due to QC 1000, although, to the extent that it improves compliance with professional standards, some companies could face requests for more extensive audit evidence. In addition, related changes to other auditing standards may afford audit committees greater visibility into the impact of inspection deficiencies. QC 1000 will involve internal implementation costs for audit firms, and audit committees may encounter audit fee increases as a result. QC 1000 could also cause some audit firms to drop their PCAOB registration, which would reduce competition in the audit market for smaller public companies.
Overview of the QC 1000
The press release announcing the adoption of QC 1000 states that the objective of the new standard is to “require all PCAOB registered firms to identify their specific risks and design a QC system that includes policies and procedures to guard against those risks.” The release adopting the new standard adds that it “mandates quality objectives and key processes for all firms’ QC systems, with a focus on accountability and continuous improvement” and “will lead firms to better serve investors by more consistently complying with the professional and legal requirements that apply to PCAOB engagements.”
Key features of the QC standard include:
QC system design and operation. QC systems must have two “process components” – risk assessment, and monitoring and remediation. In addition, QC systems must have components that address six aspects of the firm’s organization and operations -- Governance and leadership, Ethics and independence, Acceptance and continuance of engagements, Engagement performance, Resources, and Information and communication. QC 1000 also requires individual accountability. The firm's principal executive officer is ultimately responsible and accountable for the system, including its design, implementation, operation, and annual evaluation. In addition, specific individuals must have operational responsibility and accountability for the system and for the firm's compliance with particular system components.
Scalability/impact on inactive firms. All PCAOB-registered firms will be required to design a QC system that meets the requirements of QC 1000. However, firms that do not perform audits of public companies or SEC-registered broker-dealers will not be required to implement the system unless and until they lead an engagement under PCAOB standards, play a substantial role in the preparation or furnishing of an audit report under the PCAOB’s jurisdiction, or otherwise assume responsibilities regarding any such engagement. The release adopting QC 1000 states: “This approach reflects our view that all firms that register with the PCAOB should be appropriately prepared to perform a PCAOB engagement, regardless of whether they are currently subject to requirements with respect to one, while limiting the costs of compliance in circumstances where the risk to investor protection is minimal.”
Evaluation and reporting on QC effectiveness. Firms will be required to annually evaluate the effectiveness of their QC system and to determine, as of September 30 of each year, whether the system (1) is effective with no unremediated QC deficiencies; (2) is effective except for one or more unremediated quality control deficiencies that are not major quality control deficiencies; or (3) is not effective (i.e., one or more major quality control deficiencies exists). Firms will be required to file a report with the PCAOB by November 30 stating their QC system effectiveness conclusion and, where applicable, describing any deficiencies. This report will be nonpublic.
No mandatory audit committee reporting. In a significant change from the 2022 proposal, the final QC standard does not require firms to report the results of their annual evaluation of the firm’s QC system to client audit committees. The Board stated that it deleted the audit committee reporting requirement because “legal constraints” limit its ability to require public disclosures about the effectiveness of firms’ QC systems. This change reduces the risk that audit committees will need to make judgments about the significance of firm quality control deficiencies. Audit committees remain free to ask their audit firm questions about its system.
External quality control function (EQCF). Firms that annually issue more than 100 public company audit reports must establish an independent QC oversight function. The EQCF must be composed of one or more persons who are not principals or employees of the firm and do not have a relationship with the firm that would interfere with the exercise of independent judgment. The responsibilities of the EQCF must include evaluating the significant judgments made and the conclusions reached in the firm’s annual QC system effectiveness evaluation.
Other Auditing Standard Changes
In addition to adopting QC 1000, the PCAOB amended two other auditing standards related to audit quality control.
Response to audit engagement deficiencies. The Board amended AS 2901, Consideration of Omitted Procedures After the Report Date, to require auditors to address all engagement deficiencies that come to their attention after the completion of an audit. An engagement deficiency is “an instance of noncompliance with applicable professional or legal requirements.” (PCAOB inspection findings are an example of engagement deficiencies.) The current standard affords the auditor latitude in deciding whether any action is necessary in response to an engagement deficiency. Under revised AS 2901, in cases where, because of the deficiency, the auditor did not obtain sufficient appropriate audit evidence to support the opinion, the auditor must either perform procedures to obtain additional evidence or prevent future reliance on the opinion. For engagement deficiencies that do not affect the sufficiency of the audit evidence, the auditor must either correct the deficiency or take action to prevent a recurrence.
Integrity and ethics standard. The Board rescinded its existing ethics and independence standard and replaced it with a new standard, EI 1000, Integrity and Objectivity. Among other things, this new standard would address the situation in which a person associated with a registered accounting firm has a disagreement with his or her supervisor over compliance with professional or legal requirements. EI 1000 provides that, if, in the view of the associated person, the firm does not take appropriate action, he or she should consider notifying third parties of the matter, including regulatory authorities and audit committees.
Impact on Competition: Commissioner Ho’s Dissent
The Board adopted the new QC standard by a 4-1 vote. In her statement, dissenting Board member Christina Ho focused on the burdens that QC 1000 imposes on accounting firms that do not currently audit public companies or broker-dealers. About half of the PCAOB-registered firm population does not engage in PCAOB-regulated activity. As explained above, the standard requires these firms to design a system that complies with QC 1000 but does not require the firm to implement the system unless it becomes involved in an engagement subject to the PCAOB’s jurisdiction. Board Member Ho stated:
“I believe that the adopting release’s design-only requirement for firms that do not issue public company audit reports: (1) appears inconsistent with the statutory text of the Sarbanes-Oxley Act of 2002 (SOX); (2) appears inconsistent with what the PCAOB told Congress in 2023; and (3) imposes undue burdens on competition that will hurt smaller public companies (including emerging growth companies), investors, and the competitiveness of audit marketplace.
. . .
“I want to encourage competition in the audit marketplace and induce inactive firms not to deregister but rather to become active, because competition will result in lower audit fees which will allow smaller issuers and emerging growth companies to dedicate more of their scarce capital to research and development and job creation. Our capital markets depend on a robust and resilient public company auditing profession, and this proposal seeks to dismantle the profession by creating unnecessary, inappropriate, and I believe unlawful barriers to entry, which I predict will adversely affect competition in the audit marketplace.”
Comments:
Strong quality controls are a key component of a firm’s ability to deliver a quality audit. Audit committees should of course support that goal. If QC 1000 is effective, audit committees should see the benefits of stronger firm QC in the performance of the company’s audit.
At the same time, audit firms will incur costs in complying with the complex requirements of QC 1000, and those costs will likely be reflected in higher audit fees. Audit clients may be affected in other ways as well. The economic analysis in the release adopting QC 1000 repeats the same observation regarding costs that appeared in the 2022 proposing release: “Firms may pass on part of any increased costs they incur at the firm or engagement level by raising the fees they charge their clients. In addition, to the extent that the requirements improve compliance with applicable professional and legal requirements, some audited companies could face additional costs to respond to their auditors’ requests for additional or more extensive audit evidence. Audited companies may incur other costs due to changes in audit firm QC policies and procedures. For example, if QC 1000 results in changes to firms’ client acceptance and continuance practices, firms may require greater fees or refuse to accept or retain high-risk clients.”
Board Member Ho raises serious concerns about the impact of the new QC standard on smaller firms. Further, this standard is only one of a series of new standards the Board is considering that may make public company auditing less attractive for firms that do not have a large public company clientele. Some of these firms may decide to de-register and concentrate on private company auditing. The result, Ms. Ho fears, might be that smaller public companies and their audit committees will have fewer auditor choices. Reduced auditor competition is likely to lead to higher audit fees for small public companies.
The new AS 2901 requirement that firms take action to address all engagement deficiencies could have the effect of making the consequences of deficiencies uncovered in PCAOB inspections or firm internal reviews more visible to audit committees. The new version of this standard will require the auditor to perform further audit work, regardless of whether the deficiency has any impact on the original audit opinion. The need to perform additional work may highlight for audit committees the nature of the deficiency and the extent of the effort necessary to correct it.
The deletion of the requirement to report the results of the auditor’s annual QC evaluation to the audit committee is a positive development for audit committees since spares them from mandatory receipt of information about a topic that may be hard to evaluate. At the same time, audit committees will be free to ask their auditor for information about its QC system. In this regard, the Board stated in its release, “such inquiries could include requesting the firm to keep the audit committee apprised of the status of the quality control remediation process (including whether the firm made a submission to the Board responding to inspection report quality control criticisms by the 12-month deadline) and whether the Board has made a final remediation determination (including a negative determination that has not yet become public).”
Commentaires