On November 18, the Public Company Accounting Oversight Board proposed a new standard to strengthen and update the requirements for the quality control (QC) systems of public accounting firms registered with the Board. The Board also proposed changes to various other standards, rules, and forms, including the standard governing communications with audit committees (AS 1301) and the standard on the auditor’s responsibility to respond to audit deficiencies that come to the auditor’s attention after completion of the engagement (AS 2901). If adopted, the new QC standard, QC 1000, would supersede the Board’s existing quality control standards. These changes may be of interest to audit committees because of their potential to affect the auditor’s work. Several would also have an impact on the audit committee’s relationship with the auditor.
Elements of the QC Proposal
The release proposing the new quality control regime states that the Board is seeking to improve audit firm QC systems and to promote compliance with audit requirements. Themes of the proposal include:
Requiring a risk-based approach to quality control, including quality objectives and a systematic effort to identify and manage risks to achieving those objectives.
Emphasizing firm governance, including “tone at the top,” and individual accountability.
Providing more direction regarding QC monitoring and remediation of identified deficiencies “to encourage an ongoing feedback loop that drives continuous improvement.”
The Board also states that its proposals are intended to address “changes in the audit practice environment, including the increasing participation of other firms and other outside resources, the role of firm networks, the evolving use of technology and other resources, and the increasing importance of internal and external firm communications.”
The Board’s Fact Sheet on the proposals lists “key improvements” to the existing quality control standards that would result from adoption of the proposal:
Reporting on QC effectiveness. The proposal would require firm annual reporting on quality control system effectiveness to both the PCAOB and client audit committees. QC 1000 would require a registered firm to annually evaluate its quality control system and that evaluation would be the basis for the firm’s reporting. The audit committee communication aspect of this proposed requirement is discussed in more detail below.
Accuracy of performance metrics. The proposal seeks to ensure the accuracy of firm-level or engagement-level information that audit firms publish, such as performance metrics and financial data. The release notes that some firms publicly communicate such information by issuing transparency reports or through other vehicles. “Regardless of the form of communication and the type of information presented, we believe that firms’ QC systems should address the integrity of firms’ external communications about themselves. Such information can influence the views of relevant stakeholders, including audit committees determining whether to engage or retain an auditor and investors determining whether to ratify such an appointment.”
Independent voice in governance. Proposed QC 1000 would require the governance structure of accounting firms that annually issue more than 100 public company audit reports to maintain an oversight function for the audit practice that includes at least one independent person. That person could not be a firm partner, shareholder, member, other principal, or employee and could not have any commercial, familial, or other relationship with the firm “that would interfere with the exercise of independent judgment with regard to matters related to the QC system.”
Correction of audit deficiencies. The proposal would expand the responsibility of auditors to correct audit deficiencies identified after completion of an engagement. This aspect of the proposal is discussed in more detail below.
Integrity and ethics standard. The Board proposes to rescind its existing ethics and independence standard and replace it with a new standard, EI 1000, Integrity and Objectivity. Among other things, this new standard would address the situation in which a person associated with a registered accounting firm has a disagreement or dispute with his or her supervisor over professional and legal requirements or how to apply or comply with them. EI 1000 would provide that, if, in the view of the associated person, the firm does not take appropriate action, he or she should consider notifying third parties of the matter, including regulatory authorities and audit committees.
Use of technology. Proposed QC 1000 includes a technology risk factor “to prompt consideration of technology as part of the firm’s risk assessment process.” In order to be “more adaptable to future developments and less likely to discourage the use of emerging technologies,” the proposal does not however include any specific requirements related to how a firm should employ emerging technology in either its audit practice or QC system. The Board notes that it has an ongoing research project assessing the need for regulatory actions in light of the increased use of technology-based tools by auditors and preparers.
Audit Committee QC Communication
The aspect of QC 1000 that would most directly impact audit committees is the proposed requirement that firms report to client audit committees on the effectiveness of their system of quality control. As noted above, audit firms would be required to annually evaluate the effectiveness of their QC system. A firm would be required to conclude, as of November 30 of each year, that the system (1) is effective with no unremediated QC deficiencies; (2) is effective except for one or more unremediated quality control deficiencies that are not major quality control deficiencies; or (3) is not effective (i.e., one or more major quality control deficiencies exists). Firms would be required to file a report with the PCAOB stating their conclusion concerning QC system effectiveness and, where applicable, describing any deficiencies. This report would be nonpublic.
In addition to reporting to the PCAOB, firms would be required to report on their annual QC system evaluation to the audit committees of clients whose engagements are performed under PCAOB standards. Audit committee reports would include a brief overview of remedial actions for any quality control deficiencies that were unremediated at the time of the evaluation. Unlike reports to the PCAOB, reports to audit committees would not be required to include nonpublic inspection information. In the Board’s view:
“The proposed auditor communication requirement could enhance audit committee oversight by providing potentially valuable information about the firm and greater context and insight into the audit process. We believe that such information could be relevant to the audit committee’s responsibilities in connection with auditor appointment and retention. We also note that firms performing audits of New York Stock Exchange-listed companies already communicate information about their quality control to their client’s audit committees under applicable listing requirements. We believe that extending a similar requirement to all firms could promote beneficial dialogue between the auditor and the audit committee about QC matters.” (footnote omitted)
Audit Deficiencies
Another aspect of the QC proposal that could impact audit committees is the enhanced requirement concerning deficiencies in a completed engagement. Under AS 2901, the existing standard, when an auditor concludes, after issuing its report, that procedures necessary at the time of the audit were not performed, the auditor must “assess the importance of the omitted procedure to his present ability to support his previously expressed opinion on the financial statements taken as a whole.” If the auditor concludes that the omitted procedure “impairs his present ability to support the opinion” (and if the auditor believes the report is currently being relying on), the auditor must apply the omitted procedure or alternative procedures to provide a satisfactory basis for the opinion. On the other hand, if the auditor concludes that other procedures that were applied during the audit “tend to compensate” for the omitted procedure, or make its omission “less important,” or that subsequent audits provide support of the previous opinion, the auditor need not take further action. In short, the current standard affords the auditor considerable latitude in deciding whether action to correct a deficiency is necessary.
The PCAOB is proposing to create a straightforward requirement that omitted procedures must be performed: In cases where, because of engagement deficiencies, the auditor did not obtain sufficient appropriate audit evidence to support the opinion that was issued, “the auditor should either perform procedures to obtain additional evidence, to the extent necessary, such that the opinion is supported by sufficient appropriate evidence” or take action to prevent future reliance on the opinion.
The new requirement could have the effect of making the consequences of deficiencies uncovered in PCAOB inspections or firm internal reviews more visible to audit committees. In these situations, the proposal would generally require further audit work to be performed, regardless of whether the auditor believes that the original opinion is already supportable because of other procedures performed or subsequent audits. Performance of additional work may highlight for audit committees the nature of the deficiency and the extent of the effort necessary to correct it.
Comments: As the QC effectiveness reporting requirement and the enhanced deficiency correction standard illustrate, the PCAOB’s QC proposal, if adopted, would impact the auditor/audit committee relationship. More importantly, however, the proposal could have an impact on overall audit performance. The predicate of the proposal is that improving firm quality controls will strengthen audit quality. Audit committees should of course support that goal and, if the proposal is effective, should see the benefits of stronger firm QC in the performance of the company’s audit. At the same time, there will be costs associated with new QC requirements, and those costs will likely be reflected in audit fees. As the Board observes in its economic analysis:
“Audited companies may also incur indirect costs related to the proposed requirements. * * * Firms may pass on part of any increased costs they incur at the firm or engagement level by raising the fees they charge their clients. In addition, to the extent that the proposed requirements improve compliance with applicable professional and legal requirements, some audited companies could face additional costs to respond to their auditors’ requests for additional or more extensive audit evidence. Audited companies may incur other costs due to changes in audit firm QC policies and procedures. For example, if the proposed QC standard results in changes to firms’ client acceptance and continuance practices, firms may require greater fees or refuse to accept or retain high-risk clients.”
For these reasons, audit committees may want to follow the progress of the PCAOB’s QC proposal and may want to ask their auditor for its views on the specifics of the proposal and on whether and how it might impact the firm’s work. The deadline for public comments is February 1, 2023.