2024-20714. Public Company Accounting Oversight Board; Order Granting Approval of QC 1000, A Firm's System of Quality Control, and Related Amendments to PCAOB Standards, Rules, and Forms
-
September 9, 2024.
I. Introduction
On May 24, 2024, the Public Company Accounting Oversight Board (the “Board” or the “PCAOB”) filed with the Securities and Exchange Commission (the “Commission”), pursuant to Section 107(b) [1] of the Sarbanes-Oxley Act of 2002 (“SOX”) and Section 19(b) [2] of the Securities Exchange Act of 1934 (the “Exchange Act”), a proposal to adopt Quality Control (“QC”) 1000, A Firm's System of Quality Control (“QC 1000”), and supersede existing PCAOB QC standards; adopt EI 1000, Integrity and Objectivity, and supersede existing ET 102, Integrity and Objectivity; and amend several other related existing auditing standards, rules, and forms (collectively, the “Amendments”).[3]
The Amendments were published for comment in the Federal Register on June 11, 2024.[4] On July 1, 2024, the Commission extended the public comment period until July 16, 2024, and extended the date by which the Commission shall either approve or disapprove, or institute proceedings to determine whether to approve or disapprove, the Amendments to August ( print page 74325) 25, 2024.[5] On August 13, 2024, the Commission further extended the date by which the Commission shall either approve or disapprove, or institute proceedings to determine whether to approve or disapprove, the Amendments to September 9, 2024.[6] The Commission received over 20 comment letters from the public regarding the Amendments and one response to comments from the PCAOB (“PCAOB response letter”).[7] This order approves the Amendments, which we find to be consistent with the requirements of Title I of SOX and the rules and regulations issued thereunder and necessary or appropriate in the public interest or for the protection of investors.[8] The Amendments and the Commission's findings with respect thereto are discussed in further detail below.
II. Description of the Amendments
On May 13, 2024, the Board adopted the Amendments.[9] The Amendments were preceded by a 2019 concept release,[10] a proposal in November 2022,[11] and other outreach engaged in by the PCAOB.[12] QC 1000 would replace current PCAOB QC standards that were developed decades ago by the American Institute of Certified Public Accountants (“AICPA”), before the PCAOB was established, and which were adopted by the Board on an interim, transitional basis in 2003.[13]
In the Notice of Filing of Proposed Rules, the PCAOB stated that it was proposing a new QC standard that it believes will lead registered public accounting firms to significantly improve their QC systems and thereby protect investors by facilitating the consistent preparation and issuance of informative, accurate, and independent audit reports.[14] As described by the Board, QC 1000 is an integrated, risk-based standard that mandates quality objectives and key processes for all firms' QC systems.[15] While QC 1000 requires all public accounting firms that are registered with the PCAOB to design a QC system that meets the requirements of QC 1000, firms are only required to implement and operate the QC system in compliance with QC 1000 when they lead an engagement under PCAOB standards, play a substantial role in the preparation or furnishing of an audit report (as defined in PCAOB rules),[16] or have current responsibilities under “applicable professional and legal requirements” [17] regarding any such engagement.[18]
According to the Board, QC 1000 provides a framework for a QC system that is grounded in the ongoing practice of proactively identifying and managing risks to audit quality, with a feedback loop from ongoing monitoring, an explicit focus on firm governance and leadership, firm culture, and individual accountability, and specific direction in a number of areas the current PCAOB standards do not address.[19] QC 1000 consists of two process components: (1) the firm's risk assessment process and (2) the monitoring and remediation process.[20] It also consists of six components that address aspects of the firm's organization and operations: (1) governance and leadership; (2) ethics and independence; (3) acceptance and continuation of engagements; (4) engagement performance; (5) resources; and (6) information and communication.[21] The risk assessment process applies to these six components, requiring firms to: (i) establish outcome-based “quality objectives,” including those specified throughout the standard ( i.e., the desired outcomes to be achieved by the firm with respect to that component); (ii) identify and assess “quality risks” to the quality objectives; (iii) design and implement “quality responses” ( i.e., policies and procedures to address the quality risks); and (iv) establish policies and procedures to monitor internal and external changes that may require modifications to the quality objectives, quality risks, or quality responses.[22] The monitoring and remediation process applies to all of the components of the QC system, including monitoring and remediation itself ( i.e., firms are required to identify and remediate deficiencies that are observed in their monitoring and remediation activities).[23]
( print page 74326)QC 1000 also requires an annual evaluation of the effectiveness of the QC system and reporting to the PCAOB on the QC system evaluation by the registered public accounting firm for any period in which it is required to implement and operate a QC system.[24] The standard includes requirements regarding individual roles and responsibilities in the QC system and documentation requirements.[25]
As noted above, firms are required to design and implement quality responses as part of the risk assessment process. Although QC 1000 requires firms to design and implement their own quality responses to respond to their particular assessed quality risks, QC 1000 also includes some specified quality responses, which are mandatory for the firms to which they apply.[26] Some specified quality responses carry requirements from current PCAOB standards into QC 1000 or provide new requirements that the PCAOB stated were important to a firm's QC system.[27]
For example, with respect to the governance and leadership component, QC 1000 includes a specified quality response that requires firms with larger PCAOB audit practices (firms that issue audit reports for more than 100 issuers in the prior calendar year) to adopt and implement an external quality control function (“EQCF”) that is composed of one or more persons who are not principals or employees of the firm and do not otherwise have a relationship with the firm that would interfere with the exercise of independent judgment with regard to matters related to the QC system.[28] The EQCF is required to evaluate the significant judgments made and related conclusions reached by the firm when evaluating and reporting on the effectiveness of its QC system. Firms have flexibility in how the role is structured, depending on their governance structure or other factors. In addition, firms may, at their discretion, assign additional responsibilities to the EQCF and those could vary across firms.[29] As noted above, the EQCF requirement only applies to firms that issue audit reports for more than 100 issuers in the prior calendar year, which currently is 13 out of the approximately 1,600 PCAOB-registered firms.[30] A number of these firms have stated publicly that they have independent representation in their governance structure or plan to add such a role in the near term.[31] The EQCF role is discussed and analyzed in greater detail in Section III.B, below.
The Board described the QC 1000 framework as having commonalities with other international and domestic standards for firm QC systems, though it goes beyond those requirements in some areas.[32] QC 1000, ISQM 1, and SQMS 1 (the latter two collectively, the “Other QC Standards”) [33] share the same basic framework, with the same eight components and risk-based approach to quality control.[34] Both QC 1000 and the Other QC Standards include requirements to design, implement, and operate specified quality objectives, risks, and responses on an annual basis; [35] and specify structures of governance, including requiring the assignment of individuals to the same specified roles.[36] A discussion of the similarities and differences between QC 1000 and the Other QC Standards is included below in Section III.
The Amendments also include expanding the auditor's responsibility to respond to deficiencies on completed engagements under an amended and retitled AS 2901, Responding to Engagement Deficiencies After Issuance of the Auditor's Report. These changes would extend the scope of AS 2901 to cover engagement deficiencies in audits ( print page 74327) of internal control over financial reporting, incorporate the concepts and terminology introduced in QC 1000, and bring the standard into alignment with the auditor's existing responsibility to obtain sufficient appropriate audit evidence to support the opinion.[37] The changes also include related amendments to AT No. 1, Examination Engagements Regarding Compliance Reports of Brokers and Dealers, and AT No. 2, Review Engagements Regarding Exemption Reports of Brokers and Dealers, which would prompt auditors of registered brokers-dealers to take appropriate action if they discover that the opinion or conclusion in a previously issued attestation report was not supported.[38] Finally, the Amendments replace existing standard ET 102, Integrity and Objectivity, with a new standard, EI 1000, Integrity and Objectivity, to better align PCAOB ethics requirements with the scope, approach, and terminology of QC 1000.[39]
The Amendments will be effective on December 15, 2025. The first annual evaluation period will cover the period beginning on the effective date of the standard ( i.e., December 15, 2025) and ending on September 30, 2026. Subsequent evaluation periods will cover the 12-month period ending on September 30. The PCAOB has proposed application of the Amendments to include audits of emerging growth companies (“EGCs”),[40] as discussed in Section IV below.
III. Discussion and Commission Findings
The Commission continues to observe concerning indications that registered firms' QC systems are inadequate to ensure the high level of audit quality necessary for investor protection. Recent PCAOB inspection reports indicate that inspection deficiency rates are continuing to rise, with 46% of the engagements reviewed in 2023 having at least one Part I.A deficiency,[41] compared to 40% in 2022 and 34% in 2021.[42] While PCAOB inspection deficiency rates are not the only measure of audit quality and cannot necessarily be generalized to all PCAOB audits, these high deficiency rates place investors in harm's way. Effective QC systems provide firms with reasonable assurance that their audit engagements will be performed in compliance with applicable legal and professional requirements. The continuing rise in deficiency rates supports the need for the Amendments as they would enhance registered audit firms' QC systems to help ensure firms are able to perform their gatekeeper function, which is critical to investor protection and the functioning of our capital markets.
As noted above, in response to the Notice of Filing of Proposed Rules, to date the Commission has received over 20 comment letters from the public and one response to comments from the PCAOB.[43] Several commenters expressed support for the Amendments, stating that they would improve upon existing standards and lead to better protection of investors.[44] For example, one commenter stated that the Amendments “would better protect the interests of investors, consistent with the mandate set forth in SOX.” [45] Similarly, another commenter stated that it expected the Amendments “will enhance the quality of audits, raising the level of trust and confidence investors can place in the accuracy and reliability of public company financial disclosures.” [46] This commenter also stated that “[c]urrent quality control systems at many firms are not achieving an even minimally acceptable level of audit quality, let alone the high level of audit quality that investors have a right to expect and on which the reliability of our financial reporting system depends.” [47] Another commenter stated that “the PCAOB has done a good job of articulating why the improvements to the Quality Control Standards are warranted.” [48] One commenter stated that it “strongly supported” the Amendments, highlighting requests by the investor community over the years to update “outdated quality control standards” that were written in a pre-SOX era when the profession was self-regulated.[49] This commenter stated that many areas of the PCAOB's existing QC standards have not been updated to reflect fundamental changes in the profession.[50] Some commenters who supported the proposal also stated that they did not believe the requirements in the Amendments went far enough.[51]
Other commenters stated that the Commission should not approve the Amendments.[52] While several ( print page 74328) commenters stated that they supported the Board's efforts and goal to modernize quality control standards, they did not support certain aspects of the Amendments.[53] For example, one commenter stated that it was concerned that the Amendments “could potentially have unintended negative consequences to the profession, including significant costs without notable improvement to audit quality.” [54] One commenter expressed its “overall support for the project and the large majority of the provisions of the standard” but stated that the Commission should not approve the standard in its final form because the EQCF function “raises significant concerns,” including being inconsistent with SOX, and because, in the commenter's view, the PCAOB did not adequately address concerns it and others raised regarding the ability for small firms to comply with QC 1000, in particular the design-only requirement.[55] Another commenter stated that “the SEC should reject the PCAOB's final QC 1000 standard because it contains fundamental failures and flaws.” [56] Commenters also provided feedback on specific aspects of the Amendments as described below, which informed their general views discussed above.
We have considered the information contained in the Notice of Filing of Proposed Rules and the PCAOB's response letter [57] as well as the comments received by the Commission. Having carefully weighed all of the information before us, we find that the Amendments are consistent with the requirements of Title I of SOX and the rules and regulations thereunder and are necessary or appropriate in the public interest or for the protection of investors. In particular, we believe the Amendments as a whole will further the Board's statutory mandate under SOX and enhance investor protection by creating an integrated, risk-based QC standard that can be applied by firms of varying sizes and complexities and is compatible with Other QC Standards that either have already been or are required to be implemented by the vast majority of registered public accounting firms. The Amendments will lead registered public accounting firms to significantly improve their quality control systems, thereby improving audit quality and investor protection. The existing interim QC standards—which were adopted on an interim basis in 2003 and were developed by the audit profession under an environment of self-regulation—do not adequately reflect the risks and requirements of the current auditing environment, overly focus on evaluating firms' compliance with their own internally-developed policies designed in a peer review environment, and do not require evaluation or reporting that ultimately enhances audit quality and investor protection.
The Amendments emphasize the importance of accountability and firm governance and a QC system that is proactive and responsive to risks. Replacing interim standards with permanent standards provides additional regulatory certainty that may have an incremental benefit of allowing audit firms to make long-term investments in their QC systems. Further, the Amendments will promote compliance by registered public accounting firms with applicable professional and legal requirements (including PCAOB auditing standards), which should help eliminate information asymmetries and expectation gaps for issuers, registered broker-dealers, and investors regarding whether audit firms are complying with such requirements. Improved compliance by registered public accounting firms with PCAOB auditing standards, among other professional and legal requirements, would result in improved financial reporting quality, which would further benefit investors.
In addition, the Amendments share a common framework with Other QC Standards that are widely implemented by auditing firms across the globe, with specific enhanced requirements for the U.S. regulatory environment, which allows firms to leverage costs already expended or that will be expended to comply with these standards. In addition to the overarching structure and the eight components being the same among QC 1000 and the Other Standards as noted above in Section II, the requirements within the components are also aligned. Specifically, the required quality objectives ( i.e., the outcomes specified by the standards that drive the firm's responses) generally are substantively similar [58] although some of QC 1000's quality objectives contain additional prescriptive requirements [59] that the Board considered to be relevant to the U.S. public company legal and regulatory environment as discussed in more detail below.[60] Both QC 1000 and the Other QC Standards provide firms with flexibility to design responses to achieve these quality objectives taking into account the particular risks and circumstances faced by the firm. Further, there is overlap in the limited number of specified quality responses ( i.e., individual responses required by QC 1000 and the Other QC Standards). In other words, the quality objectives that firms establish (and their resulting responses) under QC 1000 are expected to be sufficiently responsive to those of the Other QC Standards.[61]
QC 1000 does go beyond the Other QC Standards in that it contains relatively more prescriptive requirements than the Other QC Standards.[62] The Board ( print page 74329) considered these requirements to be relevant to the U.S. regulatory environment and investors.[63] Many of these additional requirements only apply to firms that issue audit reports for more than 100 issuers in the prior calendar year.[64] Because QC 1000 provides more precise and prescriptive requirements that drive accountability, it will enhance the Board's ability to perform its inspections and to enforce its standards, which will further incentivize firms to design, implement, and operate effective QC systems.[65] It is the Board's view that building on the well-understood basic framework of the Other QC Standards, appropriately tailored and strengthened to address the U.S. legal and regulatory environment and our investor protection mandate, will enable firms to implement and comply with QC 1000 more effectively.[66] In designing, implementing, and operating their QC systems, firms that are subject to both PCAOB standards and the Other QC Standards, which the Commission estimates to be 88% of registered firms that have performed engagements under PCAOB standards for an issuer or registered broker-dealer (“PCAOB engagements”) in the past year and 72% of registered firms that have not,[67] will be able to leverage the work they have already done and the investments they have already made to comply with such Other QC Standards.[68] In support of this conclusion, neither the Commission staff nor commenters have identified aspects of QC 1000 that are incompatible with the Other QC Standards.
A. Requirements Related to the Design of QC System
As discussed above, QC 1000 includes a design-only requirement. The PCAOB stated in the Adopting Release that the design-only requirement may facilitate timely implementation and operation of a compliant QC system.[69] The Board also stated that not requiring all registered public accounting firms to design their QC system would create a risk that firms could be unprepared to accept and perform such engagements in compliance with applicable professional and legal requirements.[70] Finally, the PCAOB stated that because registering with the PCAOB enables a firm to issue audit reports or play a substantial role on audits performed under PCAOB standards for issuers and registered broker-dealers, and because investors and companies considering engaging the firm could reasonably expect that any firm that could pursue such an engagement would already have a PCAOB-compliant QC system designed and ready for implementation and operation, it believes that imposing a design requirement on all registered firms promotes its mission of protecting investors and promoting the public interest.[71]
General
A number of commenters expressed concerns regarding the design-only requirement.[72] Commenters stated that this requirement will increase the barriers to entry for small firms to take on audits of small publicly-held companies, including EGCs, or registered broker-dealers and will incentivize firms to de-register.[73] A few commenters stated they agreed with concerns expressed by PCAOB Board Member Ho in her statement accompanying the adoption of QC 1000 indicating that the design-only requirement appears to be inconsistent with both the statutory text of SOX and a statement the PCAOB made to Congress in 2023, and that the requirement would impose undue burdens on competition.[74] The PCAOB response letter responds to commenter feedback on the design-only requirement, including addressing why applying such a requirement to firms that do not presently have obligations with respect to PCAOB engagements is consistent with the PCAOB's statutory mandate.[75]
While we acknowledge the concerns raised by commenters, we find that the design-only requirement is consistent with the requirements of Title I of SOX and the rules and regulations issued thereunder and is necessary or appropriate in the public interest or for the protection of investors. Allowing registered firms to design their QC system only upon entering into an audit engagement would create a risk that registered firms could be unprepared to accept and perform engagements in compliance with applicable professional and legal requirements, which in turn risks a reduction in audit quality to the detriment of investors. For example, one component of a well-designed QC system is policies and procedures around the acceptance of an engagement. Without having designed a QC system in advance, such firms would not be in a position to ensure that their QC system is effective in order to evaluate and take on a new PCAOB engagement.
Below we discuss the views of commenters with respect to specific aspects of QC 1000's design-only requirement, as well as the Commission's findings regarding those matters.
Statutory Authority
We have considered comments on the statutory authority questions raised in Board Member Ho's statement as well as the PCAOB's response letter and find that the Board has the authority to require that all registered firms design a QC system that complies with QC 1000. The Supreme Court has stated that, in cases of statutory construction, a court's analysis begins with “the language of the statute” and “where the statutory language provides a clear answer, it ends there as well.” [76] SOX Section 103(a)(2)(B) refers to quality control standards that the Board adopts with respect to the issuance of audit reports.[77] This section of SOX requires the PCAOB to include, in the quality control standards that it adopts with respect to the issuance of audit reports, seven requirements for every registered public accounting firm relating to: (i) monitoring of professional ethics and independence from issuers, brokers, and dealers on behalf of which the firm issues audit reports; (ii) consultation within such firm on accounting and auditing questions; (iii) supervision of audit work; (iv) hiring, professional development, and advancement of personnel; (v) the acceptance and continuation of engagements; (vi) ( print page 74330) internal inspections; and (vii) such other requirements as the Board may prescribe (subject to the general rulemaking authority provided to the PCAOB in SOX Section 103(a)(1)).[78] QC 1000 is a quality control standard with respect to the issuance of audit reports that includes each of these seven statutory requirements. Moreover, the fact that one of the statutory requirements relates to the acceptance of engagements implies that the PCAOB's QC standards must address firms that have not yet accepted engagements and not just firms that currently issue audit reports.
Furthermore, we find the use of the term “every” in Section 103(a)(2)(B) significant, because it is the only place in SOX that uses that term. In other sections of SOX, such as Sections 101, 104 and 106, Congress used narrower language when it wanted to apply a particular regulation to a smaller universe of public accounting firms or registered public accounting firms.[79] Further, requiring all registered public accounting firms to design a system of quality control that complies with QC 1000 is consistent with the Congressional directive in SOX Section 102, which requires applicant firms that want to register with the PCAOB to provide for review a description of “the quality control policies of the firm for its accounting and auditing practices.” [80] We therefore find the Amendments are within PCAOB's authority under Title I of SOX.
Barriers to Entry
As noted above, several commenters expressed concerns that the design-only requirement will increase the barriers to entry for small firms to take on audits of smaller issuers or registered broker-dealers and incentivize firms to de-register. Some commenters suggested the requirement be revised to require the system to address only elements of QC covered by the professional QC standards the firm is currently subject to for the type of engagements they currently perform ( e.g., the Other QC Standards).[81] Similarly, one commenter suggested the Commission defer the effective date of QC 1000 for inactive firms until they become active.[82] In the PCAOB response letter, the Board reiterated that the design-only requirement would benefit investors and explained why it believed the alternatives proposed by commenters would not achieve the same level of investor protection as QC 1000.[83] The Board further stated that the design-only requirement comports with its historical practice of requiring firms to provide a summary of the design of their QC system upon registration, regardless of whether such firms perform engagements under PCAOB standards.[84]
We acknowledge concerns that the design-only requirement could create barriers to entry or otherwise impact the decision to either register, or remain registered, with the PCAOB for firms that do not perform PCAOB engagements, and as discussed more fully in Section III.C below, we have considered the overall competitive effects of the Amendments on the market for audit services. These concerns must be weighed against the investor protection benefits of the design-only requirement. In particular, as the Board noted in the Adopting Release, if a registered firm that has not led an engagement or played a substantial role on an engagement in the past anticipates the possibility of transitioning to performing engagements, the design-only requirement may facilitate timely implementation and operation of their QC 1000 compliant QC system.[85] As would be the case in any profession or industry when quickly adopting business-wide quality control processes, allowing registered firms to design their QC system only upon entering into an audit engagement would create a risk that registered firms could be unprepared to accept and perform engagements in compliance with applicable professional and legal requirements, which in turn risks a reduction in audit quality.[86]
We further considered the alternatives raised by commenters, including allowing for compliance with Other QC Standards, or delaying the effective date until firms accept an engagement under PCAOB standards. However, we do not believe that either of these alternatives sufficiently addresses the risks to investors of a firm entering into audit engagements with an issuer or registered broker-dealer without a QC system in place that provides reasonable assurance the firm could conduct the engagement in accordance with applicable professional and legal requirements. An audit firm's failure to conduct an engagement in accordance with applicable professional and legal standards undermines audit quality, puts at risk capital formation, and places investors and issuers at risk.
Further, there are reasons to believe that the design-only requirement will not be a significant barrier to entry or cause for smaller firms to deregister, primarily due to the expected costs to the majority of registered firms being substantially mitigated by investments made by those firms to comply with the Other QC Standards, which have already been adopted by the IAASB and AICPA and will be effective at or before the effective date of QC 1000. In the Adopting Release, the PCAOB stated that QC 1000 shares a basic structure and approach with the Other QC Standards, so designing for the incremental features unique to QC 1000 is not expected to be unduly burdensome for firms that are subject to either or both of those Other QC standards.[87] The PCAOB also stated in the Adopting Release that it believes most audit firms will have either already implemented or be implementing one or both of the Other QC Standards when QC 1000 goes into effect on December 15, 2025.[88] The Commission staff compared the ( print page 74331) requirements of QC 1000 with the requirements of the Other QC Standards and similarly concluded that there is significant overlap and did not identify anything that is incompatible with those other requirements. Further, no commenters identified any aspects of QC 1000 that are incompatible with these other requirements. Many of the specified requirements in QC 1000 that are not in the Other QC Standards are applicable only to firms issuing audit reports for more than 100 issuers. Therefore, with respect to these incremental requirements, any firms required to design but not implement a QC system under QC 1000 would not be required to adopt those specified requirements. Further, any other incremental requirements over Other QC Standard requirements that are applicable to such firms are not expected to be burdensome to design, especially given the inherent scalability of QC 1000. The Commission staff also performed an analysis of registered firms and determined, consistent with the PCAOB's evaluation, that most registered firms will be subject to the Other QC Standards by the time QC 1000 is effective.[89] Based on the Commission staff's assessment, we believe that these existing standards are likely to mitigate compliance costs for a very substantial majority of registered firms.
Furthermore, other factors may serve to mitigate any adverse competitive effects from the design-only requirement for smaller firms. For example, some registered firms currently participate in PCAOB engagements at a level below that of a “substantial role,” with the level of involvement varying, with some of those firms participating at a level approaching a “substantial role.” [90] Larger firms could have a greater incentive to use the work of registered public accounting firms that are currently participating at a level below that of a “substantial role,” or that are not participating in PCAOB engagements at all, if the larger firms knew that such firms had already designed a QC system in accordance with QC 1000. Therefore, such smaller firms may have more opportunity to participate in audits pursuant to PCAOB standards in the future. Other firms that would have been subject to the design-only requirement may indeed choose to deregister. Such deregistration may, nevertheless, not have an adverse competitive effect if such firms were only intending to continue to compete for work that does not require PCAOB registration, such as participating in an audit pursuant to PCAOB standards at a level below that of a “substantial role,” as their registration status would not impact their eligibility for this work. Accordingly, for these reasons and the reasons discussed in Section III.C, the Commission does not believe this aspect of the Amendments is likely to have a significant negative impact on the market for audit services or the pool of registered audit firms.
B. EQCF Role
As described above, QC 1000 includes a requirement for the small number of firms that issue audit reports for more than 100 issuers during the prior calendar year to implement an EQCF. Composed of one or more persons who are not principals or employees of the firm and do not otherwise have a commercial, familial or other relationship with the firm that would interfere with the exercise of independent judgment with regard to the matters related to the QC system, the EQCF is required to evaluate the significant judgments made and related conclusions reached by the firm when the firm is evaluating and reporting on the effectiveness of its QC system.[91] The PCAOB stated in the Adopting Release that an external oversight function should enhance the discipline with which the firm carries out its own QC system evaluation.[92] The PCAOB also stated that, based on comments it received on the Concept Release and the Proposing Release and experience with inspections of firms' systems of quality control, it believes that investors, audit committees, and other stakeholders will benefit from the EQCF's evaluation.[93]
General
Some commenters stated that they specifically supported the EQCF role.[94] One commenter emphasized the importance of the EQCF role.[95] This commenter stated that it made sense to require firms that issue audit reports for more than 100 issuers per year to be subject to incremental requirements, such as the EQCF role, “given such firms' greater involvement in the U.S. capital markets and their impact on investors.” [96] This commenter further stated that it appreciated that the Amendments stressed “the independence of the external oversight function.” [97] Another commenter stated that the creation of the EQCF “is necessary in light of ongoing instances around the globe which suggest the firms suffer from a lack of ethics throughout the firms, including senior leadership.” [98]
On the other hand, several commenters stated that they do not support the requirement to incorporate an EQCF within the QC system.[99] Among other concerns, commenters asserted that the EQCF requirement included prescriptive elements that were not exposed for public comment; that the costs and benefits of the EQCF requirement had not been adequately considered; that the requirement could vitiate confidentiality protections under SOX; and that the requirement raised personal liability and other concerns that could render the requirement unworkable. Several commenters expressed the view that the requirement would necessitate disclosure of firm deficiency information included in Part II of PCAOB inspection reports to the person or persons serving in the EQCF role in conflict with SOX and PCAOB rules or Congressional intent.[100] More ( print page 74332) generally, commenters stated that it was unclear “how the EQCF would function within a firm's system of quality control” [101] and suggested that the standard the PCAOB adopted “expanded the professional obligations and responsibilities” of the EQCF role, which would impose additional liability costs for those professionals.[102] Another commenter stated that the EQCF requirement is “neither realistic nor needed” given that the QC systems of firms are complex and involve a multitude of judgments and conclusions and the PCAOB already inspects large firms annually.[103] One commenter stated that “[f]irms that are close to or just above the 100-issuer mark may feel compelled to consider reducing their issuer count below this threshold” as a result of the EQCF requirement.[104] One commenter raised concerns about the EQCF role in its initial comment letter to the Commission and stated, in a subsequent supplemental comment letter, that the PCAOB response letter “provides additional clarity on several of our questions,” including with regard to the EQCF role,[105] but stated the PCAOB response “did not address certain other key matters raised by commenters” [106] and that the letter “raises additional questions.” [107] Specifically, this commenter stated “it is not clear how to square the Board's stated belief that requiring the EQCF will `improve audit quality' and `drive improvement in a firm's QC system' with the view that EQCF members would only be considered `supervisory persons' if the EQCF had the `responsibility, ability, or authority to affect the conduct of . . . associated persons. . . .' ” [108]
While we acknowledge the concerns raised by commenters about the EQCF requirement, the Commission finds that the EQCF role is consistent with the requirements of Title I of SOX and the rules and regulations issued thereunder and is necessary or appropriate in the public interest or for the protection of investors. We believe that an independent oversight function for the small number of firms subject to the requirement will enhance the effectiveness of a registered firm's QC system, ultimately leading to improvements in audit quality. In support of the EQCF requirement, one commenter pointed to the importance of independence to “high quality corporate governance in the United States” and stated that “as independence has been implemented, enhanced and monitored, it has led to investors relying to a greater extent on corporate boards.” [109] We agree with this commenter's views on the benefits of independence to governance structures and concur with the PCAOB that adding an independent perspective to an annually inspected firm's QC system self-evaluation will promote a more rigorous evaluation process by those firms and drive improvements in audit quality.[110] In fact, the PCAOB stated that, in connection with its oversight, “certain firms have acknowledged the limitations of internal QC functions led by non-independent firm employees and have touted the benefits of independent review.” [111] The PCAOB further stated that some firms have already created leadership or advisory roles for independent third parties.[112] We find this evidence persuasive and therefore conclude that requiring an external quality control function for registered firms will serve the public interest and the protection of investors.
One commenter expressed doubts that the EQCF would improve audit quality or drive improvements in a firm's QC system given the PCAOB's view that the EQCF would only be considered a supervisory person if it had responsibility, ability, or authority to affect the conduct of associated persons.[113] We understand this commenter to be suggesting that the EQCF role will not result in improvements unless the EQCF has some control with respect to decision-making at the firm. To the extent the registered public accounting firms subject to the EQCF requirement share the concern raised by this commenter, the Amendments provide firms with flexibility to vest the EQCF with decision-making authority to the extent they see fit. However, even absent decision-making or other authority, we believe that the EQCF role will be able to drive improvements in audit quality and a firm's QC system. An independent perspective on the significant judgments made and conclusions reached by the firm during its annual evaluation will help firms identify areas of improvement in their QC systems that they can consider when operating their QC systems. It is not uncommon for businesses to seek external perspectives on a variety of topics or issues and the fact that the business is the ultimate decision-maker does not mean that the input provided is not valuable or beneficial to the process. In addition, as noted above, some audit firms have voluntarily added independent oversight to their governance structures, indicating that they see a benefit to having an independent perspective.
Relatedly, we do not believe that imposing an independent QC monitor or independent QC consultant for a prescribed period of time as remedial relief in a PCAOB enforcement action would serve as a viable substitute for the EQCF requirement for the small number of firms subject to the requirement, as suggested by one commenter.[114] Based on our experience with Commission enforcement actions, ( print page 74333) audit quality and investor protection benefits are greater with a prophylactic requirement aimed at preventing such violations from occurring in the first place—before investors are potentially placed at risk—than with only remedial relief in a handful of enforcement actions for limited periods of time.[115]
In addition to the overall benefits that an independent oversight function would provide, we find that the Board's approach to mandating this requirement in QC 1000 appropriately balances the need to enhance the effectiveness of registered firms' QC systems with an approach that provides flexibility in internal governance structures to minimize cost and disruption. As adopted by the Board, the EQCF requirement will provide significant flexibility for firms to design procedures that work best for their individual firm governance structure and requirements. QC 1000 does not specify where within the registered public accounting firm the EQCF must be housed or to whom the EQCF must report.[116] These determinations are left to the discretion of the firm. This flexibility will allow an independent EQCF [117] to also serve, for example, as an independent member of a firm's advisory committee or audit quality committee or governance body, including one that has a majority of non-independent members.[118] Furthermore, to the extent that firms have existing QC advisory committees, nothing in the rule would prevent those committees, or independent members of those committees, from serving as EQCF, provided they meet the rule's independence standard and can discharge the assigned duties.
The Amendments also do not prescribe specific procedures to be followed by the EQCF and require only one EQCF activity.[119] The EQCF must evaluate “the significant judgments made and the related conclusions reached by the firm when evaluating and reporting on the effectiveness of the QC system.” [120] Notably, the EQCF's responsibility does not extend to all of the firm's QC-related judgments and conclusions, but only to significant ones made in connection with the firm's annual QC-system evaluation and reporting.[121] Firms may, but are not required to, consider additional oversight functions for the EQCF, such as reviewing the firm's remediation actions and monitoring plan, or identifying and monitoring emerging risks or trends that could potentially affect the firm's QC system.[122] Similar to the flexibility provided to audit firms in determining how the EQCF will perform its responsibilities, audit firms would have flexibility to consider, based on their individual firm needs, what other functions, if any, would be beneficial. Along these lines, one commenter noted that the PCAOB has pointed out the flexibility of its approach and how a firm implementing it can apply that flexibility. The commenter further stated that, based on the commenter's experience with the auditing profession, the commenter believes that the PCAOB is correct and that the approach the PCAOB took with respect to the EQCF “should, and will ultimately, allay the concerns of audit firm commenters.” [123] Below we discuss the views of commenters with respect to specific aspects of QC 1000's EQCF requirement, as well as the Commission's findings regarding those matters.
Notice and Comment
Several commenters expressed the view that the EQCF requirement was not included in the Proposing Release and therefore was not properly exposed for public comment before being adopted by the Board.[124] One commenter stated that the change from requiring an “oversight function for the audit practice” in the Proposing Release to requiring an “oversight function for the QC system” in the Adopting Release represents a significant change that “effectively deprives us of an opportunity for public input into the revised requirement.” [125] Another commenter stated that the requirement for the EQCF to evaluate all “significant judgments” introduces “prescriptive elements not included in the original proposal.” [126] Conversely, one commenter stated that “[c]learly anyone who read and responded to the Concept Release and exposure draft were aware that the PCAOB was moving to adopt such a function in its final rule.” [127]
As a threshold matter, we find that the public had a meaningful opportunity to comment on the Amendments both as they were being developed by the PCAOB and after they were filed with the Commission for approval. The PCAOB received and considered comments in connection with both the 2019 Concept Release and 2022 Proposing Release. The comment period for the Proposing Release was open for 75 days, but the PCAOB continued to accept comments up until its adoption of the Amendments. The PCAOB considered all comments it received. After the Amendments were filed with the Commission for approval, the Commission published a notice to solicit comment on the Amendments with comments due 21 days after the Notice of Filing of Proposed Rules was published in the Federal Register . To provide additional time for consideration of the Amendments and the issues raised therein, the Commission twice extended the date by which it must act on the Amendments. During this time, the Commission received additional input from both the Board and public commenters. We have considered all of these comments in deciding to approve the Amendments.
The Commission finds that the Board's process for approving the Amendments complied with all applicable requirements. Although the Board is not “an agency or establishment of the United States Government,” [128] for statutory purposes and therefore is not subject to the requirements of the Administrative Procedure Act (“APA”),[129] the Board as ( print page 74334) a matter of policy has adopted a notice-and-comment process to inform its decision-making.[130] The Board followed that process here. The PCAOB response letter details the standard-setting history relating to the EQCF requirement, beginning with the 2008 recommendations from ACAP and including the Concept Release, Proposing Release, consideration of comments received to each, and Adopting Release.[131] The Board describes the outreach it performed and the input it received from a variety of stakeholders over the course of that multi-year process.[132] The Board's analysis demonstrates that the core tenets of “independent oversight over firm's QC systems” were introduced in the Concept Release,[133] and were refined through the Board's stakeholder engagement, including in response to comments received on their Concept Release and Proposing Release.[134] Accordingly, we find the Board's process for approving the Amendments reasonable and appropriate.
As proposed, consistent with the Concept Release,[135] the PCAOB contemplated an independent QC oversight function within the governance structure of an audit firm.[136] Specifically, the PCAOB proposed to require an “oversight function for the audit practice” writ large that included at least one individual who was not a principal or employee of the firm and who did not have a relationship with the firm “that would interfere with the exercise of independent judgment with regard to matters related to the QC system ” (emphasis added).[137] The PCAOB explained in the Proposing Release that the proposed requirements “would not specify how the firm would establish its governance structure or assign authority, other than having one person in an oversight role who would be in a position to exercise independent judgment with regard to QC matters ” (emphasis added).[138] The proposed oversight function, coupled with the general requirement relating to the “exercise of independent judgment with regard to matters related to the QC system,” reasonably could have been read to include, for example, oversight over all aspects of the QC system including design, sufficiency, judgment, and overall effectiveness.
In response to the Proposing Release, commenters requested specificity regarding the function and scope of the responsibilities such an independent QC governance role would entail.[139] After taking such comments into consideration, the Board adopted an amended QC standard that clarified the EQCF's status and role. Specifically, the PCAOB narrowed the focus of the role from the proposal which, as explained above, would have required an “oversight function for the audit practice” to require an “oversight function for the QC system” and specified a single responsibility for the EQCF: “evaluating the significant judgments made and the related conclusions reached by the firm when evaluating and reporting on the effectiveness of the QC system.” [140]
One commenter specifically stated that the change from an “oversight function for the audit practice” to an “oversight function for the QC system” was a significant change that was not adequately explained or proposed for public comment.[141] We disagree with this commenter. The QC system is the process by which a firm manages and improves its audit practice and therefore is an integral and significant part of the audit practice, so that a role overseeing the audit practice would necessarily also oversee the QC system in addition to other aspects of a firm's audit operations. Therefore, an “oversight function for the QC system” is a subcomponent of an “oversight function for the audit practice” ( e.g., a narrower version of what was proposed). Moreover, the EQCF role was proposed in the context of the PCAOB's new quality control standard and both the PCAOB's proposed and adopted formulations of the oversight requirement required that the individual or individuals who fill the role not have any relationships with the firm “that could interfere with the exercise of independent judgment with regard to matters related to the QC system ” (emphasis added).[142] In our view, these explicit references to the individual's responsibilities as they relate to the “QC system” weigh against commenters' claims that the EQCF role could not have been anticipated from the proposal.[143]
Moreover, many aspects of the Amendments related to the EQCF role remain unchanged from the proposal. For example, the EQCF requirement only applies to firms that issue audit reports with respect to more than 100 issuers during the prior calendar year.[144] The requirement for independence remained the same with the exception of changing the terminology from the singular to plural form ( i.e., a grammatical change).[145] Although the Amendments describe the EQCF role as an “ external oversight function,” the PCAOB response letter explains that it used the phrase “external” to “underscore that the function is to be carried out by one or more persons who are independent and, necessarily, external to the firm” rather than imposing a separate requirement.[146] The proposal required the EQCF role to be composed of “at least one person” while the Amendments require the EQCF role to be composed of “one or more persons.” In either case, only one individual is required but a firm can choose to assign ( print page 74335) more than one individual to the role.[147] As discussed in greater detail below, the individual or individuals who fill the EQCF role will be “associated persons of a registered public accounting firm,” and the same would have been true under the proposal. Finally, the Amendments state that the “EQCF should have the experience, competence, authority, and time necessary to enable them to carry out the responsibilities assigned to the EQCF by the firm.” The PCAOB explained in the Adopting Release that this change was made to “conform[ ] the provision to the descriptions in QC 1000.12 of other specified QC system roles” that require the same qualifications to perform their responsibilities.[148]
Therefore, having considered the standard-setting process preceding the EQCF requirement, we find that the public had considerable opportunity to comment on the function and responsibilities of the EQCF role included in the Amendments as well as on the similar, but more broadly focused, independent oversight function in the Proposing Release, on which the EQCF is based. Moreover, we find the changes made to that role in the Adopting Release to be responsive to comments received by the PCAOB from a variety of stakeholders. We also agree with the Board that the only prescriptive requirement of the function—the requirement to evaluate the significant judgments made and the related conclusions reached by the firm when evaluating and reporting on the effectiveness of the firm's QC system [149] —is both responsive to requests for greater clarity and specificity and would benefit investors by enhancing the discipline with which a firm carries out its own QC system evaluation.[150] Overall, we believe the changes described above addressed feedback on the role that the Board received on the Concept Release and Proposing Release, including that the role did not go far enough; that the role's undefined authority made it likely to be ineffective; and that more specificity and prescription was needed to avoid overly broad interpretations of the requirements; while maintaining a principles-based approach to allow firms to design the EQCF as appropriate for their audit practice.
In addition, the public had the opportunity to provide comments to the Commission on the Amendments adopted by the PCAOB. One commenter stated that the “time-period for providing comments to the SEC” was “constrained.” [151] As discussed above, however, the Commission provided an initial comment period of 21 days, followed by an extension of 14 days. The Commission also extended its period to consider the Amendments two times, for a total of a 90-day period. Over the course of the 90 total days during which the Amendments were under consideration by the Commission, the public was able to continue to submit comment letters. The Commission received over 20 letters in total, several of which addressed the EQCF role in particular.[152] The Commission has considered the concerns raised by commenters and addresses them below.
Alternatives to the EQCF Role
One commenter stated that it was concerned that the EQCF may not achieve the effectiveness and accountability that is necessary because of the flexibility provided to firms, and questioned whether a single person would be able to fulfill the EQCF's responsibilities inside the largest accounting firms.[153] The commenter believed that a preferable approach would be to require the creation of an independent board as proposed by the ACAP and used by the FRC and the Japan Financial Services Agency.[154] As the PCAOB states in the Adopting Release, the EQCF role may be carried out by “one or more persons” and therefore larger firms will be able to determine whether it would be appropriate to assign more than one person to the role given their size and complexity.[155] We note that the firms that will be subject to the Amendments are of varying sizes and complexities and we therefore agree with the PCAOB that a “one size fits all” approach is unwarranted. Furthermore, we note that the PCAOB has stated that it intends to monitor the implementation of QC 1000 through its inspections program and outreach activities and “will remain vigilant” for any information regarding the standard's effectiveness or implementation challenges.[156] With respect to the commenter's preferred approach of creating an independent board, although we agree with the commenter that experience has indicated that independent boards of issuers can be very effective, such a requirement is not part of the Amendments and therefore it is beyond the scope of this Order. In addition, we believe that consideration would need to be given to how an independent board requirement would interact with any applicable corporate governance laws, particularly for those registered public accounting firms located outside of the United States.
Disclosure, Confidentiality and Liability
Several commenters stated that the EQCF requirement conflicts with SOX Sections 104(g)(2) or 105(b)(5)(A) [157] because it would compel audit firms to share non-public QC criticisms with the EQCF, who is external to the firm.[158] One commenter stated that the EQCF (or members of the EQCF) would not be an associated person, given the definition of associated persons in PCAOB Rule 1001(p)(i), and considering that the EQCF consists of one or more independent third-parties.[159] This commenter further stated that discussions in the Adopting Release “cloud this issue,” including the discussion of whether the EQCF would be subject to supervisory liability under SOX Section 105(c)(6).[160] One commenter responded to the PCAOB response letter stating that their “objection is in the PCAOB requiring disclosure to individuals a firm is not otherwise even required to employ or contract.” [161]
SOX Section 104(g)(2) provides that “no portions of [a PCAOB] inspection report that deal with criticisms of or potential defects in the quality control systems of the firm under inspection ( print page 74336) shall be made public if those criticisms or defects are addressed by the firm, to the satisfaction of the Board, not later than 12 months after the date of the inspection report.” [162] SOX Section 105(b)(5)(A) provides that, with certain exceptions, “all documents and information prepared or received by or specifically for the Board, and deliberations of the Board and its employees and agents, in connection with an inspection . . . or with an investigation . . . shall be confidential and privileged as an evidentiary matter . . . in any proceeding in any Federal or State court or administrative agency, and shall be exempt from disclosure . . . under the Freedom of Information Act . . . or otherwise.” [163]
The Commission finds that the disclosure of information to the EQCF would not be a public disclosure under Section 104(g)(2) or inconsistent with the confidentiality protections provided by Section 105(b)(5)(A) because those serving in the EQCF role would be associated persons and therefore subject to the same confidentiality requirements as the firm's partners, employees, and other associated persons.[164] Under SOX Section 2(a)(9), an “associated person of a public accounting firm” includes any “independent contractor” who, “in connection with the preparation or issuance of any audit report,” receives compensation from the firm or “participates as agent or otherwise on behalf of” the firm “in any activity of that firm.” [165] For reasons the PCAOB explained, because individuals serving in an EQCF role cannot be partners, shareholders, members, other principals, or employees of the firm, they are likely to be engaged as independent contractors.[166] And those independent contractors would meet the definition of an “associated person” under SOX Section 2(a)(9) because they are likely to be compensated for their work and, in any event, would participate in the firm's activities—at least the firm's evaluation and reporting process—on behalf of the firm.[167]
Like all associated persons, such independent contractors are part of the PCAOB inspection or investigation process, not strangers to it. They must cooperate with PCAOB inspections and investigations, comply with related PCAOB requests, and prepare inspection- or investigation-related documents for the PCAOB.[168] Accordingly, such independent contractors are not part of the public, and their involvement in Board inspections and investigations and awareness of information related thereto would not vitiate confidentiality protections.[169] Indeed, as the PCAOB observed, some firms currently share confidential information with external advisors, including those serving in audit quality advisory roles.[170]
QC 1000 does not specify what information affected firms must share with the EQCF, giving firms flexibility in determining the responsibilities of the EQCF and what information is needed for the EQCF to fulfill its role, as long as the EQCF complies with the minimum requirement to evaluate all significant judgments made by the firm with respect to its QC system. Also, firms may enter other types of independent-contractor arrangements, including with individuals at an affiliated firm within a global network or personnel at shared services centers outside of the firm.[171] A determination that the EQCF is not an associated person would have significant consequences for those arrangements. Finally, a firm would be free to impose confidentiality or non-disclosure requirements on the EQCF to the same extent a firm is able to impose such requirements on its other independent contractors.
Although their status as associated persons could result in potential personal liability for individuals that take on the EQCF role, we believe this is appropriate given that the EQCF, like any other associated person, should exercise due professional care when fulfilling their responsibilities—responsibilities that, as we have explained above, serve an important investor protection role. We note that the significant flexibility afforded to firms under the Amendments to design procedures for the EQCF that work best for their individual firm governance structure may help to mitigate concerns that the attendant personal liability could discourage qualified individuals from taking on such a role.
Commenters also raised concerns about the potential liability exposure of the EQCF if the individual serving in that role was considered not only an associated person of the firm, but also a supervisory person. Under SOX Section 105(c)(6), the Board may impose sanctions on a “supervisory person” who “fail[s] reasonably to supervise an associated person” and “such associated person commits a violation” of a relevant law, rule, or standard.[172] The Commission agrees with the PCAOB that the minimum requirements of the EQCF would not, on their own, make the individual or individuals “supervisory persons,” and that the assessment of whether any particular individual serving in the EQCF role is a supervisory person would need to consider any additional responsibilities or authorities the audit firm assigned to them.[173] Again, however, the flexibility ( print page 74337) afforded to firms under the Amendments to determine what additional functions, if any, would be performed by EQCF should serve to mitigate concerns.
Relatedly, several commenters raised concerns that potential liability under Section 105(c)(6) of SOX for the person or persons fulfilling the EQCF role could limit the pool of candidates for this role.[174] However, we do not believe that any potential liability will significantly impact the pool of candidates, given the flexibility afforded to firms in the structuring of the role and the impact of such flexibility on liability considerations, as well as the fact that the requirement only applies, as the PCAOB observed, to the small number of firms meeting the 100-issuer threshold [175] and that several of those firms already have independent members of their firm governance or audit quality structure whose responsibilities, in some cases, may already meet the requirements of the EQCF, or who otherwise may be willing to expand such responsibilities.
Other
One commenter stated that firms that are close to or just above the annual 100-issuer audit report threshold may feel compelled to consider reducing their issuer count below this threshold to avoid the EQCF requirement and that such exits would undermine competition.[176] However, we believe such an effect is unlikely to be significant given that, as the Board observed in the Adopting Release and in the PCAOB response letter, very few firms are close to the 100-issuer threshold. Specifically, PCAOB staff analysis of audit reports included in Commission filings during the 2022 calendar year indicated that two registered public accounting firms audited between 80 and 100 issuers and two registered public accounting firms audited between 100 and 120 issuers.[177] In addition, we expect that the minimum requirements for the EQCF role and the flexibility provided to firms to implement the role would reduce the likelihood that firms would be motivated to stay below the 100-issuer threshold to avoid the requirement. Furthermore, we agree that using the 100-issuer threshold is a reasonable approach because, as the PCAOB noted in the Adopting Release, firms are already familiar with this statutory threshold in the PCAOB inspection context and because we agree with the commenter who stated that the 100-issuer threshold was appropriate “given such firms' greater involvement in the U.S. capital markets and their impact on investors.” [178] SOX provides that firms that provide audit reports for more than 100 issuers are subject to annual inspection by the PCAOB and firms that provide audit reports for 100 issuers or fewer are subject to inspection triennially.[179] Therefore, not only are firms familiar with the threshold, we believe firms monitor the size of their issuer practice for purposes of monitoring their inspection requirements and using the same threshold would avoid requiring the small number of firms that are close to or above the 100-issuer threshold to track a different threshold for purposes of compliance with QC 1000.
Some commenters raised questions about the Board's analogy of the EQCF to the Engagement Quality Reviewer (“EQR”).[180] One commenter stated that the analogy the PCAOB made between the EQCF and the EQR was “not well analogized” because the EQR is required to perform a review under specific requirements that are the subject of an auditing standard while the PCAOB has not provided such specific requirements for the performance of the EQCF's evaluation.[181]
The analogy the PCAOB drew between the EQCF and the EQR in the Adopting Release noted certain similarities between the two roles, but also identified important differences between the requirements for the roles, including that the EQCF is not required to provide concurring approval, as is required of an EQR.[182] The EQR's concurrence instills responsibility and authority over the activities of the audit engagement team and places the EQR in a supervisory position in an audit engagement. On the other hand, as the PCAOB has made clear, the EQCF is not required to approve the firm's conclusions regarding its significant judgments for the firm to make a conclusion on the effectiveness of the QC system.[183] As explained above, the requirement to evaluate the significant judgments and conclusions reached does not, by itself, impose supervisory responsibilities on the EQCF nor is the EQCF's concurrence with the firm's conclusions required. The EQCF's evaluation is an input into the firm's assessment of its QC system and while it may inform the actions of individuals, it does not direct such actions.
Another commenter who addressed the PCAOB's comparison of the EQCF and EQR roles stated that, unlike the EQR who is governed by the requirements in the PCAOB's engagement quality review standard, the Amendments do not prescribe certain details regarding the EQCF's role and responsibilities.[184] Specifically, the commenter stated that the final standard does not, among other things: (1) specify the procedures the EQCF should perform to evaluate the significant judgments made and related conclusions reached; (2) address the nature, timing, and extent of the EQCF's review; or (3) address how differing judgments made by the EQCF and the firm should be resolved or documented.[185] This commenter stated that this creates uncertainty regarding the application of the responsibilities specified in the standard and raises questions about the potential liability of the EQCF.[186] We disagree with the views expressed by the commenters discussed above. The PCAOB adequately explained this comparison in the Adopting Release, noting ( print page 74338) similarities between the two roles, but also explaining important differences, which we have highlighted, above.[187] In our view, the referenced discussion sought to clarify aspects of the EQCF without imposing any new requirements on registered public accounting firms or changing the requirements for the EQCF as set forth in the Amendments.
With respect to the commenter's concerns about the lack of prescriptiveness of the EQCF requirement, the PCAOB explained its decision to provide firms with flexibility to design the EQCF role to fit their particular circumstances and firm governance structure in both the Adopting Release and the response letter.[188] As discussed above, we find that the Board's approach to the EQCF requirement in QC 1000 appropriately balances enhancing the effectiveness of audit firm QC systems with flexibility that allows for effective scaling and customization for firms of varying sizes, structures, and risk profiles, as well as minimizing cost and disruption. Regarding the question on resolution of differences, the Amendments provide audit firms with broad flexibility with respect to the implementation of the EQCF role, including applicable internal procedures. As the Amendments do not require that the EQCF have any specific decision-making responsibility or other authority, firms are generally free to determine an approach to any such differing judgments between the EQCF and the firm in the manner that they deem most appropriate for their firm.
To the extent that firms have questions about the implementation of the EQCF role, the PCAOB stated that it anticipates that, consistent with its historical practice, its staff will issue implementation guidance and will engage in other activities to support firms' implementation efforts.[189] We encourage the PCAOB to provide this implementation guidance and other support, which could be useful to firms, with respect to the Amendments generally and in particular for the EQCF role.
Two commenters suggested that the EQCF is unnecessary because a firm's annual self-evaluation of its QC system, coupled with the PCAOB's annual inspections of that QC system, should suffice.[190] We are persuaded, however, that the EQCF requirement will provide meaningful additional safeguards beyond those realized from self-evaluations and inspections. The EQCF's evaluation should provide the firm with real time, independent feedback, enabling the firm to enhance its quality control system on an ongoing basis whereas any response it receives from the PCAOB during its inspections process occurs at a later point in time. In this way, the EQCF role is consistent with the objective of a quality control standard that fosters continuous improvement—one of the PCAOB's express aims in adopting QC 1000.[191]
Some commenters stated the requirements for the EQCF are unclear ( e.g., requirements around documentation of EQCF's evaluation).[192] The PCAOB response letter addresses the documentation requirements as they relate to the EQCF.[193] The PCAOB response letter states that, under QC 1000, it is the firm that bears responsibility for complying with documentation requirements related to the EQCF role not the individual or individuals who comprise the EQCF.[194] Indeed, the EQCF could provide its evaluation orally because there is no requirement in QC 1000 that the EQCF must document or provide its evaluation in writing.[195] Further, QC 1000 does not prescribe to whom the EQCF must report, giving firms flexibility to develop the form of reporting and the line of reporting by the EQCF. We note, moreover, that it is typical for implementation questions to arise around new accounting or auditing requirements. To the extent additional clarity on specific requirements related to EQCF is necessary, we believe PCAOB staff implementation or other guidance would sufficiently assist firms with interpreting the requirement. As noted above, the PCAOB stated that it anticipates that, consistent with its historical practice, its staff will issue implementation guidance and will engage in other activities to support firms' implementation efforts.[196]
C. Economic Implications of the Amendments
Commenters expressed concerns that the costs arising from QC 1000 and certain of its requirements are not appropriately described and that a more rigorous economic analysis is necessary before the Amendments can be approved.[197] One commenter stated that the economic analysis conducted by the PCAOB in the Adopting Release was deficient because it did not discuss any plans for post-implementation review or details on how such a review will be conducted.[198] By contrast, another commenter observed that the PCAOB issued a staff white paper in November 2022 identifying research that suggests the PCAOB's proposed QC standard could lead to greater compliance with professional standards and improve financial reporting quality.[199] This commenter also stated that the “costs of deficient failed audits, can and have been significant and even catastrophic to investors, employees, and the U.S. economy.” [200]
The PCAOB response letter addresses commenter feedback on its economic analysis.[201] The Board stated that, where possible, quantitative data was used and that, when this data was not available, the Board used qualitative factors in its analysis.[202] The Board also stated that available data and methods do not permit them to fully quantify all of the benefits and costs of QC 1000 and that commenters on this topic did not provide studies or data that permitted complete quantification of the benefits or costs of QC 1000.[203] When commenters did suggest relevant data or research, the Board stated that it ( print page 74339) considered it and incorporated that data or research into its economic analysis as appropriate.[204]
As part of our assessment of the Amendments, we have considered the economic analysis conducted by the PCAOB in the Adopting Release as well as the comments received on this point and the additional information provided in the PCAOB response letter. Below we evaluate the PCAOB's analysis in order to reach our own conclusion about the economic implications of the Amendments. On many points, we find the PCAOB's analysis reasonable; however, where appropriate, we have expanded upon that analysis. Moreover, we have considered the specific concerns raised by commenters about the unintended consequences of the Amendments and, as discussed in more detail below, have concluded that the Amendments are unlikely to have a significant adverse effect on efficiency and competition within the market for audit services.[205]
The PCAOB's economic analysis addresses the benefits and costs associated with the Amendments, including, but not limited to, the design requirement, which applies to all registered firms, and the EQCF requirement, which applies to a small number of firms. The PCAOB's analysis explains the expected benefits to investors and other financial statement users that will be realized by improving compliance with applicable professional and legal requirements and thereby improving financial reporting quality.[206] In addition, the PCAOB's analysis addresses unintended consequences of the Amendments, such as potential effects on human capital, competition concerns, including the concern raised by some commenters that the requirements could diminish the availability of global network resources and that smaller firms around the world could decline to assist U.S. firms with global audits, and the potential negative consequences related to increased accountability or liability.[207] Finally, the Board stated in the PCAOB response letter that it intends to follow its normal practice under which staff in its Office of Economic and Risk Analysis will conduct an analysis and make a recommendation to the Board as to whether to conduct a post-implementation review of the Amendments.[208] We encourage the Board to conduct such a post-implementation review.
Below we examine the individual elements of the Board's economic analysis, including its consideration of the effects on efficiency, competition, and capital formation.
Consistent with best practice when conducting an economic analysis,[209] the Board includes a baseline assessment of existing audit requirements and practices against which the potential effects of the Amendments can be considered. The Board presents analyses of quantitative proxies for the level of compliance with existing professional standards, including information on Part I.A deficiencies, QC deficiencies related to audit performance, and broker-dealer engagement deficiencies, from the audits or engagements inspected by the PCAOB. Overall, these analyses suggest that some firms' QC systems may not be providing the required reasonable assurance. The Board's analysis indicates that broker-dealer engagements and issuer audits performed by firms other than the U.S. global network firms (“GNFs”) [210] appear to have more room for improvement on average based on the period examined. The Board also presents research that it conducted on existing policies and procedures at U.S GNFs. This research finds that U.S. GNFs are already devoting extensive resources to the design, implementation, and operation of QC policies and procedures related to the ISQM 1 requirements.[211] Further, the Board observes that commenters on the Proposing Release indicated that non-GNFs have been devoting resources to the design, implementation, and operation of QC policies and procedures related to ISQM 1 and/or SQMS 1 requirements, though some of these firms may have more narrowly focused their resources on the design component and may not yet be spending resources to operate QC policies in line with SQMS 1. Lastly, the Board's baseline assessment provides information on the evolution of firms' QC policies and procedures and discusses academic research on behaviors that suggest certain weaknesses in QC systems in practice.
Several commenters on the Proposing Release suggested that some firms have already designed and implemented, or are in the process of designing and implementing, QC policies and procedures consistent with the requirements of Other QC Standards.[212] The Board supported that view, but many commenters on the Proposing Release disagreed with this characterization of the baseline and stated that QC 1000 will impose significant costs.[213] The Commission staff independently examined the number of PCAOB-registered audit firms that will be affected by QC 1000, including the extent to which they may be affected.
There are 1554 audit firms registered with the PCAOB as of August 2024. [214] ( print page 74340) Among these, 659 firms performed an engagement under PCAOB standards for an issuer or registered broker-dealer. These firms will have to fully implement QC 1000. Out of these 659 firms, 323 are U.S. firms that issued opinions under AICPA standards and, should they continue to do so, will have to implement SQMS 1; 199 are non-U.S. firms that are GNFs and are therefore likely to implement ISQM 1; and another 60 are non-U.S. firms that have an audit-related membership, affiliation, or similar arrangement. We believe that non-U.S. firms that have an audit-related membership, affiliation, or similar arrangement, especially GNFs, are likely to have implemented ISQM 1 due either to their own issuance of audit reports under International Auditing Standards, or as a recommendation or requirement due to its audit-related membership, affiliation, or similar arrangement.[215] Hence, in total, we believe that 582 of the 659 firms ( i.e., 88%), by the effective date of QC 1000, will already be subject to quality control requirements that share a basic structure with the requirements in QC 1000. This overlap significantly reduces the cost and benefits of the Amendments, to the extent that these firms in fact comply with the Other QC Standards. Recognizing that the Amendments are likely to increase compliance with these shared quality control requirements ( i.e., as a result of PCAOB inspections and enforcement of QC 1000), firms may incur costs relative to the baseline, and there may be corresponding benefits to investors stemming from audit quality improvement.
Another 845 firms of the 1,554 firms registered with the PCAOB have not performed an engagement under PCAOB standards for an issuer or registered broker-dealer within the past year and thus would only be subject to the design-only requirement.[216] Out of these 845 firms, 259 are U.S. firms that issued opinions under AICPA standards and, should they continue to do so, will have to implement SQMS 1; 98 are non-U.S. firms that are GNFs and are therefore likely to implement ISQM 1; and another 255 are non-U.S. firms that have an audit-related membership, affiliation, or similar arrangement. As discussed above, we believe having an audit-related membership, affiliation, or similar arrangement indicates these firms will likely have implemented ISQM 1. Hence, in total, we believe that 612 of the 845 firms that have not performed an engagement under PCAOB standards for an issuer or registered broker-dealer within the past year ( i.e., 72%), by the effective date of QC 1000, will already be subject to quality control requirements that share a basic structure with the design-only requirements in QC 1000. This significantly reduces both the costs and benefits of the Amendments to these firms, as discussed above. Taken together, 1,194 of the 1,554 ( i.e., 77%) firms registered with the PCAOB are unlikely to incur significant incremental costs under QC 1000.
One commenter stated that the Board did not adequately consider the extent to which the Amendments could impact entities other than issuers and registered broker-dealers in its assessment of the Amendments' economic effects.[217] We agree that QC 1000 will indirectly affect parties other than issuers and registered broker-dealers, as the Commission has promulgated rules requiring the use of PCAOB-registered or PCAOB-registered and inspected audit firms by other entities, including, but not limited to, certain investment advisers, pooled investment vehicles, security-based swap data repositories, and clearing agencies.[218] For example, Rule 206(4)-2 under the Investment Advisers Act of 1940 requires that (1) advisers using a related person as custodian must obtain their surprise examination and internal control report from a PCAOB-registered and inspected auditor, and (2) advisers relying on the audit exception from the surprise examination requirement with respect to a pooled investment vehicle must have the pooled investment vehicle audited by a PCAOB-registered and inspected auditor.[219] Below we discuss some of the potential effects of the Amendments on these other regulated entities.
One commenter on the Proposing Release asserted that audit firms' financial incentives to operate too lean undermine audit quality.[220] The Board agreed and, more generally, identified market failures and thus a need for regulatory action. As a general matter, the Board explained that there are information asymmetries between auditors and investors and other financial statement users regarding the services performed by auditors.[221] Also there are positive externalities in the audit market. Specifically, while the services of an auditor provide benefits to a variety of investors and financial statement users, auditors do not bargain with all of these parties, but, rather, are appointed, compensated, and retained by the audit committee.[222] The Board stated that some beneficiaries of the auditor's work ( e.g., the investing public generally, who benefit from overall confidence in the quality of financial information provided to the market) may have no influence on the auditor at all.[223]
We agree that the information submitted by the PCAOB demonstrates that these market failures exist in the market for audit services. Information asymmetries could create a risk that auditors may under-perform and gather insufficient audit evidence to support their opinion or may otherwise depart from applicable requirements unbeknownst to market participants who rely on financial statements. This risk could be exacerbated as auditors directly contract with issuers (through the audit committee), not investors and financial statement users. The principal-agent relationship between audit firms and issuers could exacerbate the risk that auditors may not be incentivized to gather sufficient audit evidence to support their opinion or otherwise depart from applicable requirements, potentially harming financial statement users or market participants generally. ( print page 74341) As a result, we agree with the Board that the audit market may not provide sufficient economic incentives for all firms to design, implement, and operate QC systems that provide reasonable assurance. Additionally, the Board explains that current PCAOB QC standards do not directly address recent QC developments, so that the current regulatory baseline is not rigorous enough to sufficiently support the Board's ability to address audit performance deficiencies through PCAOB inspection and enforcement activities related to firms' QC systems.[224]
Having established the regulatory baseline and need for regulatory action, the PCAOB's analysis then discusses the anticipated economic benefits of the Amendments. With respect to benefits, the Board states that the QC 1000 requirements provide substantial additional direction to firms regarding the design, implementation, and operation of their QC systems. The Board identifies three overarching beneficial features of these requirements. The first feature pertains to the mandate for a more integrated, proactive, and risk-based QC system. The second pertains to the enhancements to accountability within the firm to achieve the reasonable assurance objective. The third pertains to more precise language and more prescriptive requirements in several key areas.[225]
We agree with the Board that the QC 1000 requirements will benefit investors and other financial statement users by improving compliance, including through PCAOB inspections and enforcement, with applicable professional and legal requirements via a more risk-based, accountable, and detailed QC standard.[226] Such a QC standard will help improve audit quality resulting in more accurate and more reliable financial statements regarding the financial position and operating results of companies.[227] Investors may, in turn, use this information to improve the efficiency of their capital allocation decisions ( e.g., investors may more accurately identify companies with the strongest prospects for generating future risk-adjusted returns and allocate their capital accordingly), thereby also improving market efficiency.[228] Investors may also perceive reduced risk in capital markets generally, promoting capital formation.[229] The magnitude of these effects will depend on the degree to which auditors improve their QC systems and the degree to which the incremental improvements lead to higher audit quality.
The PCAOB's analysis also discusses the anticipated economic costs of the Amendments. The Board stated that it expects the QC 1000 requirements will result in direct and indirect costs to auditors and, potentially, indirect costs to the companies that they audit. The Board also noted that the extent of these costs will depend on the degree to which firms otherwise have QC systems in place designed to comply with Other QC Standards and the specific policies and procedures adopted by the firm. We agree that audit firms will incur compliance costs, both one-time implementation costs and ongoing operating costs (at the firm level and at the engagement level), associated with the QC 1000 requirements. To the extent that audit firms pass on these cost increases to their clients, these clients would incur indirect costs such as in the form of higher audit fees.
As the Adopting Release acknowledges, the Board received a number of comments stating there will be costs and challenges to implement and operate features of QC 1000 that are incremental to the systems firms have established to comply with Other QC Standards.[230] Several commenters also asserted that firms that audit between 100 and 500 issuers will be significantly impacted by costs associated with some or all of QC 1000's incremental requirements for firms that issue audit reports for more than 100 issuers, and some of the commenters noted resource differences between GNFs and annually-inspected NAFs.[231] Other commenters stated that smaller firms may be especially affected by the new QC requirements, including requirements incremental or alternative to ISQM 1 and SQMS 1 standards.[232]
Similarly, the Commission received a number of comments about the potential costs of the Amendments.[233] One commenter stated that the requirements mean that PCAOB-registered, but not inspected, audit firms must comply with the design-only requirement, although these firms do not render audit reports on issuer or broker-dealer engagements or play a substantial role in such engagements.[234] The same commenter stated that firms that are registered, but not inspected, are smaller audit firms that serve market segments for entities that become smaller issuers and broker-dealers, including emerging growth companies. Another commenter similarly stated the adopting release's design-only requirement for firms that do not issue audit reports for issuers imposes undue burdens on competition that will hurt smaller issuers (including emerging growth companies), investors, and the competitiveness of the audit marketplace.[235] One commenter expressed concerns over the significant costs of designing a system of QC in accordance with QC 1000 on a hypothetical basis, also stating that even for firms that are performing a small number of engagements under PCAOB standards, the requirement to comply with two standards ( i.e., either ISQM 1 or SQMS 1 and QC 1000) with two different sets of deficiency definitions and conclusion frameworks could present similar cost constraints.[236] The same commenter requested that the effective date of QC 1000 implementation for these firms be deferred until such time as they determine they intend to perform engagements in accordance with PCAOB standards and consider whether explicit guidance could be developed that would explain that a registered accounting firm is essentially prohibited from undertaking PCAOB engagements until a system of QC that complies with QC 1000 is in place.
We agree with the Board's assessment that there are costs to designing and implementing a QC system. As discussed above, as of August 2024, 845 firms of the 1,554 firms ( i.e., 54%) registered with the PCAOB have not performed an engagement under PCAOB standards for an issuer or registered broker-dealer within the past year and would therefore not bear the costs to implement and operate the QC system.[237] QC systems are resource- ( print page 74342) intensive, and audit firms could incur significant costs to respond to certain provisions in QC 1000 or to otherwise adapt the QC system to the auditing environment for issuers and registered broker-dealers. Furthermore, as noted above, these costs would extend to PCAOB-registered firms providing audits to entities other than issuers and broker-dealers pursuant to SEC rules (including, but not limited to, certain investment advisers, pooled investment vehicles, security-based swap data repositories, and clearing agencies), which may have an indirect impact on such other entities.[238]
The Board also acknowledges that the Amendments could disproportionately affect smaller firms and cause some firms to exit the public company audit market or deter other firms from future entry. Entry deterrence could be exacerbated by the fact that being registered with the PCAOB will subject firms to certain QC requirements even if they do not perform engagements. Nevertheless, the Board states that it does not expect the effects on smaller firms to be significant.[239] The Board expressed the view that QC 1000 shares a basic structure and approach with ISQM 1 and SQMS 1,[240] so designing for the incremental features unique to QC 1000 should not be unduly burdensome for firms that are subject to either or both of those Other QC standards.
We agree that implementation costs could be disproportionately greater for smaller audit firms than for larger audit firms. The cost of implementing QC 1000 depends in significant part on the degree to which auditors' existing QC systems already comply with QC 1000 requirements. PCAOB-registered, but not inspected, audit firms that decide to comply with the design portions of QC 1000 will incur the design costs. This could, as discussed above in Section III.A, place these firms in a better position to compete for work participating in audits of issuers or registered broker-dealers at a level below that of a “substantial role.” This could also position these firms to expand their business into audits of SEC-registered issuers and broker-dealers, but these firms would incur additional implementation and operation costs to do so. Alternatively, these firms could choose to avoid the design costs by withdrawing from PCAOB registration given that they are not required to be registered with the PCAOB; however, we note that this withdrawal would not impact these firms' eligibility to compete for work participating in audits of issuers or registered broker-dealers at a level below that of a “substantial role.” The impact of QC 1000 implementation and operation costs on an audit firm will also depend on the audit firm's ability to absorb those costs or pass them onto their clients ( i.e., higher audit fees). Smaller audit firms may be disproportionally vulnerable to implementation costs, because smaller firms will distribute their fixed implementation costs over a smaller number of engagements, thus resulting in a higher average implementation cost per engagement. By contrast, larger PCAOB audit firms, especially those that already have extensive QC systems in place, may benefit from economies of scale or scope when incorporating the new requirements into their existing systems, which would in turn reduce their cost of implementing and operating QC 1000 per engagement. Conversely, larger audit firms are likely to have more complex clients and more diverse client portfolios, which could require higher implementation costs for an effective QC system.
The Commission also received several comments expressing concern that the EQCF requirement, in particular, would be costly or difficult to fulfill, especially for firms that audit between 100 and 500 issuers.[241] One commenter stated that the proposed EQCF role is “vastly different” from the role that the PCAOB proposed in 2022 and asserted that the economic analysis in the Adopting Release “does not provide substantive analysis to justify the costs, benefits and unintended consequences.” [242] Another commenter stated the EQCF requirement would involve “significant additional internal and external costs arising from (1) entering into a new arrangements [sic] with the same or other individuals who are determined to have sufficient competence for the specific role and who satisfy the rule as adopted, (2) sufficiently compensating individuals fulfilling the EQCF role for their time and potential liability, and (3) the additional resources needed for the firm to enable the EQCF to perform the required duties.” [243] This commenter added that these costs would be passed on to issuers (and ultimately investors).
The PCAOB's economic analysis considered the economic implications of the EQCF requirement. The Board states that all U.S. GNFs indicate, as of the 2020 inspection cycle, they already have a governance structure that includes a non-employee, suggesting that, in contrast to commenters' assertions, the costs (as well as the benefits) of this requirement could be attenuated.[244] In addition, in response to comments critiquing the Board's analysis of the EQCF requirement, the Board provided in the PCAOB response letter additional data from the U.K., as the independent non-executive (“INE”) role for audit firms in the U.K. is partially analogous to the EQCF. The Board reports that, according to transparency reports from six large U.K. audit firms, total per firm compensation for individual INEs ranged from roughly $80,000 to $400,000 in 2023.[245]
The Board has scaled the EQCF requirement to apply to only 13 of the PCAOB-registered firms, namely those that issued audit reports for more than 100 issuers as of 2023.[246] Scaling the EQCF requirement in this way, while reducing the benefits, significantly mitigates concerns regarding competition in the audit market. Further, the incremental demand for qualified individuals would be relatively small compared to the available supply, further limiting potential costs to compensate individuals performing the EQCF role.
In addition, as discussed in Section III.B above, the Amendments provide firms with significant flexibility to implement the EQCF requirement in a manner that suits their particular needs and circumstances. For example, the Amendments do not prescribe specific qualifications for the EQCF. Aside from the responsibility of evaluating the significant judgments made and the related conclusions reached by the firm on the effectiveness of its QC system, firms can determine the appropriate scope, responsibilities, and qualifications for the EQCF based on their existing governance structures and the complexity of their QC systems. This flexibility will allow firms to integrate the EQCF into their current practices without the need for significant restructuring or additional resources, thereby minimizing the financial and operational burden of compliance. In addition, the flexibility of the QC 1000 standard will allow firms to focus on addressing their ( print page 74343) unique risks and challenges, reducing the potential for duplicative efforts or unnecessary expenditures.
Relatedly, some commenters noted that, because certain provisions of the Amendments, such as the EQCF requirement, have a 100-issuer threshold, this threshold could deter triennially inspected firms from accepting new public company audit engagements or cause firms to feel compelled to consider reducing their issuer count to avoid crossing the 100-issuer threshold.[247] We acknowledge this possibility, but for the reasons discussed below, we believe its economic effect is likely modest, as there is a limited number of firms near the 100-issuer threshold. PCAOB staff analysis of audit reports included in SEC filings identified that, during the 2022 calendar year, only two NAFs audited between 80 and 100 issuers and only two NAFs audited between 100 and 120 issuers. In addition, as discussed above, the Amendments provide firms with significant flexibility to implement the EQCF requirement, which should help to mitigate costs associated with this requirement and thus any potential incentives for firms near the 100-issuer threshold to alter their audit engagement practices.
Several commenters on the Proposing Release expressed the concern that competition in the audit market will be adversely impacted by the requirements.[248] One commenter stated that the incremental requirements of QC 1000 relative to Other QC Standards could lead smaller high-quality firms to exit the market. One commenter said that the certification requirement would be an especially significant driver of exit, particularly for smaller firms. Some commenters suggested that the design-only requirement could lead those firms to deregister with the PCAOB or create a barrier to entry. One commenter added that the design-only requirement could impact audit markets beyond the United States by creating a disincentive for foreign firms to serve specific audit markets. One commenter also noted that QC 1000 requirements may serve as an impediment to audit firm mergers and acquisitions and otherwise perturb market activity.
We agree that the compliance costs associated with the QC 1000 requirements could lead some firms to exit the public company audit market, thereby lessening competition in that market. However, as discussed above, many firms already are, or will be, subject to comparable standards and are unlikely to incur costs so substantial that they exit the public company audit market. Moreover, as also described above, the Amendments are targeted so that the largest firms, which would be less likely to exit the market, are the ones likely to incur the most significant costs. These factors considerably lessen the potential adverse impact on competition in the audit market.
D. Form QC Confidentiality
QC 1000 provides that a firm must report annually to the PCAOB on nonpublic Form QC, in accordance with the instructions to that form, the results of the evaluation of its QC system.[249] The PCAOB explained in the Adopting Release that, although it recognized the desire of investors and other stakeholders for information related to audit quality and the effectiveness of QC systems, the Board's ability to require firms to publicly disclose their QC deficiencies is subject to certain legal constraints imposed by SOX as discussed in greater detail below.[250]
One commenter stated that they are concerned that the confidentiality protections of Section 105(b)(5)(A) of SOX related to information provided to the PCAOB through inspection does not appear to apply to information reported through Form QC and stated that the PCAOB's response to this issue in the Adopting Release appears to acknowledge that it cannot guarantee the confidentiality it promised under the proposed rule.[251] This commenter also suggested that any information required by QC 1000 should be submitted by firms to the PCAOB only through the inspections process to ensure that it would receive confidential treatment under SOX Section 105(b)(5)(A).[252]
We believe these concerns are largely misplaced. Certain information contained within a Form QC may be subject to the protections of SOX Section 105(b)(5)(A), which addresses documents and information prepared or received by or specifically for the Board in connection with an inspection or investigation. Furthermore, in certain circumstances, remedial actions reported in Form QC may be subject to laws relating to the confidentiality of proprietary, personal, or other information, and in such a scenario, the Board, in accordance with SOX Section 102(e) would need to honor a firm's properly substantiated request for confidential treatment of such information.[253] The PCAOB also adopted Rule 2203A(c), which provides that Form QC will be non-public, in light of the confidentiality provision that applies to quality control criticisms and potential defects identified during a PCAOB inspection in SOX Section 104(g)(2).[254] To the extent that certain information contained within a Form QC meets the requirements of the statutory confidentiality protections described above, such protections would apply to that information to the same extent as any other information submitted to the PCAOB. We find such an approach to be appropriate in that it aligns the extent of the confidentiality of information in Form QC with the broader statutory framework created by Congress in SOX.
In response to this commenter's suggestion that any information required by QC 1000 should be submitted by firms to the PCAOB only through the inspections process, we believe that the information provided by Form QC, which in some cases would be provided more frequently than firms are inspected, would provide important information that could inform improvements in the PCAOB's standard-setting, economic and risk analysis, and registration program—separate and apart from the benefits of the PCAOB's inspection program which is focused on audit engagements.[255] These improvements, in our view, would have concomitant benefits to audit quality and investors.
E. Evaluation Date
The Amendments require firms to evaluate their QC system annually as of September 30 and conclude whether any unremediated QC deficiencies exist as of that date.[256] The PCAOB stated it believed an evaluation date of September 30 would provide firms with enough time to identify and potentially remediate any QC deficiencies identified from the most recent calendar year-end engagements, which might not be possible if an earlier date were selected.[257] In addition, the PCAOB adjusted the specified evaluation date from the initially proposed date of November 30th to September 30th to address commenter concerns that the November 30th date would have caused ( print page 74344) potential resource limitations during the traditional busy period for many firms.[258]
Commenters raised concerns with the specified quality control evaluation date of September 30th, citing concerns including that a fixed evaluation date may misalign the assessment of quality with employee or partner compensation to the extent firms have established compensation cycles that do not align with the September 30th date, as well as concerns regarding the timing of the inspection cycle potentially limiting the firms' ability to fully assess the impact of inspections in their QC evaluation.[259] One commenter additionally raised a concern that a firm that already chose its evaluation date under ISQM 1 would be required to either change its ISQM 1 evaluation date or perform two QC system evaluations per year.[260]
We agree with the PCAOB's conclusion that an evaluation date of September 30th would provide the audit firm with sufficient time to identify and potentially remediate QC deficiencies identified from the most recent calendar year-end engagements before the evaluation date. Given the ongoing nature of audits, which are driven by issuers' fiscal year-ends, firms' inspections cycles, and remediation activities, any fixed evaluation date will necessarily result in certain activities being split between QC evaluation years. The PCAOB's selected evaluation date of September 30 addressed the comments the PCAOB received on the proposal, as noted above, and we believe should provide time for a majority of inspections to be completed and considered in the same QC evaluation year. Moreover, including a specified evaluation date across firms provides for consistency and comparability of the firms' quality control reporting, which enhances the PCAOB's ability to assess and respond to firms' QC evaluations and thereby increases investor protection. We do not believe that firms that have already selected an evaluation date under Other QC standards would be required to perform two evaluations. First, QC 1000 allows firms to build on work already done, to the extent applicable, for the purpose of complying with the requirements of Other QC Standards. Second, firms are permitted to change their evaluation date under Other QC Standards so that the evaluation dates coincide.
F. Effective Date
As stated in the PCAOB's Adopting Release, QC 1000 and related amendments to auditing standards, rules, and forms will take effect on December 15, 2025.[261] The PCAOB stated that it believes an effective date of December 15, 2025 strikes an appropriate balance between the benefits to investors of having QC 1000 take effect as promptly as practicable, and allowing sufficient time for firms to design and implement robust, QC 1000-compliant QC systems.[262]
General
Commenters expressed concerns that the effective date would not provide firms with sufficient time to implement the new standard,[263] with one commenter suggesting the Commission require the PCAOB to extend the implementation deadline.[264] Another commenter stated that the PCAOB should have reopened the comment period for the Amendments to allow for additional comments on a reasonable effective date in light of the PCAOB's other recently proposed or adopted standards and rules.[265]
The PCAOB response letter reaffirms the Board's view stated above that the effective date of December 31, 2025 strikes a reasonable balance between providing firms with sufficient time and promptly delivering the benefits to investors.[266] The PCAOB acknowledged that, subject to adoption by the PCAOB and approval by the Commission, several PCAOB standards and rules could come into effect over the next few years, and that the relevant audit labor market may be relatively inelastic in the short run. However, the PCAOB explained that implementing multiple PCAOB standards and rules in quick succession could potentially reduce the incremental costs attributable to each change in requirements, if, for example, firms were able to more efficiently implement certain systems or training on an integrated basis, addressing multiple new requirements simultaneously.[267] We understand that the PCAOB took into consideration its full standard-setting and rulemaking agenda when selecting the effective date.[268]
In our view, December 15, 2025, is a reasonable effective date for the Amendments. Commenters on the Proposing Release, which specified an effective date of December 31, 2024, suggested a variety of alternatives, including several that suggested December 31, 2025 or 12 to 18 months after SEC approval. The PCAOB took this feedback into consideration when it revised the effective date to December 15, 2025. Significantly, this date aligns with the implementation date of the AICPA's SQMS 1 QC standard, which will be required for all U.S. audit firms that issue reports under AICPA standards, and which shares a basic structure with QC 1000. As a consequence, aligning the effective date of QC 1000 with SQMS 1 may reduce implementation costs for U.S. firms that are required to implement both. With respect to the commenter's concerns about the effective date as it relates to the EQCF requirement, we note that the PCAOB considered the implementation requirements of the EQCF in determining the appropriate effective date for QC 1000.[269] Finally, with respect to the commenter's concerns about sufficient time being provided for the general implementation of other recently proposed and effective PCAOB standards, we acknowledge there are instances where more than one standard becomes effective within a six-month period; however, we think the effective dates are sufficiently staggered such that audit firms will have either already implemented, or largely implemented, some of the standards referenced by the commenter or will have sufficient time to do so before compliance with the Amendments is required.[270]
( print page 74345)EQCF Considerations
One commenter raised concerns with the effective date specific to the EQCF requirement, stating that the approximately 18-month time period would not provide sufficient time to identify, vet, contract and onboard an EQCF.[271]
The external oversight requirement was included in the standard that the PCAOB proposed for comment. While the PCAOB made some changes to the proposed requirement in response to commenters, such as providing additional specificity and clarity about the role, the changes made did not impact many of the fundamental requirements for the role such as the requirement for the individual or individuals filling the role to be able to exercise independent judgment with regard to matters related to the QC system, the requirement for one or more individuals to fill the role, and the significant flexibility provided to audit firms to design procedures that work best for their individual firm governance structure and requirements. We believe such changes should not have a significant impact on the timeline for firms to complete the hiring process for an EQCF, such that an extended effective date would be necessary (nor does the commenter explain why this would be so). We thus conclude the effective date as adopted is appropriate.
G. Other Comments
One commenter stated that the PCAOB's comment period for the Amendments was inadequate, or should have been reopened, in light of other Board proposals.[272] A few commenters stated that if the Amendments are approved, PCAOB engagement with firms during the implementation period is necessary.[273] Several commenters encouraged the PCAOB to undertake a post-implementation review of the Amendments [274] or provide implementation guidance.[275]
We acknowledge the importance of monitoring the implementation of the Amendments, prior and subsequent to their effective date. The PCAOB response letter states that the Board anticipates its staff will issue implementation guidance and will engage in other activities to support firms' implementation efforts.[276] Further, the Commission staff works closely with the PCAOB as part of our general oversight mandate. As part of that oversight, Commission staff will keep apprised of the PCAOB's activities for monitoring the implementation of the Amendments, prior and subsequent to the effective date, and update the Commission, as necessary and appropriate. Finally, as discussed above regarding notice and comment considerations around the EQCF requirement, we believe 75 days was an appropriate period for commenters to provide feedback on the Proposing Release and note that, consistent with typical practice, the Board did not limit its consideration of comments to those received during its designated comment period but effectively provided for a longer comment period by considering all comments it received prior to the date of adoption.[277]
Some commenters reiterated comments made on the Concept Release and Proposing Release, including: concerns regarding the requirement that only one person be assigned operational responsibility for the firm's compliance with ethics and independence requirements; [278] a belief that the Amendments are too prescriptive, especially in regards to the specified quality responses; [279] disagreement that all engagement deficiencies require remediation; [280] concerns that the Amendments differ from Other QC Standards and will require firms to have multiple QC systems; [281] and a request that smaller firms ( e.g., triennially inspected firms that issue 100 or fewer issuer audit reports) be provided with the option to comply with ISQM 1 or SQMS 1 as an acceptable alternative to QC 1000.[282]
We acknowledge commenters concerns with these specific aspects of the Amendments and note that the PCAOB considered and addressed all of these matters in the Adopting Release.[283] On balance, we find that the Amendments strike an appropriate balance between specified mandates to enhance the effectiveness of its QC systems and to ensure they are designed and operated with an appropriate level of rigor, and providing appropriate flexibility to tailor such systems to the specific risks associated with the firm's practice or organizational structure. Further, we do not believe that the Amendments will require firms to maintain multiple systems of quality control. We find that QC 1000 shares the same basic structure as and is consistent with Other QC Standards and firms are able to build upon the work performed for Other QC Standards to implement incremental requirements from QC 1000. Neither we nor any commenters identified anything in QC 1000 that is incompatible with ISQM 1 or SQMS1. At least one registered public accounting firm has recently noted that the evolution of its system of quality management and its implementation of ISQM 1 has positioned the firm well to adapt to future regulatory developments, such as the quality control standard proposed by the PCAOB in November 2022.[284]
One commenter stated that the PCAOB response letter “addresses and provides additional clarity” on several of the questions it raised in the comment letter it submitted to the Commission, and the commenter asked the Commission to clarify whether the PCAOB response letter “can be viewed as equally authoritative as the Final Standard and Adopting Release.” [285] We view the statements in the PCAOB response letter as being on par with statements made by the Board in the Adopting Release about the scope and application of the QC 1000 requirements.
Additionally, there were requests for clarification regarding the definitions of “applicable professional and legal requirements,” [286] “other participants,” [287] “QC deficiency,” [288] and “firm personnel” [289] and how various requirements of the Amendments apply to non-employee professionals and organizations.[290] These definitions and the question about non-employee professionals and organizations were addressed in the ( print page 74346) Adopting Release,[291] and to the extent additional clarity is needed, we note that the Board stated in the PCAOB response letter that it anticipates that its staff will issue implementation guidance and will engage in other activities to support firms' implementation efforts.[292]
IV. Effect on Emerging Growth Companies
In the Notice of Filing of Proposed Rules, the Board recommended that the Commission determine that the Amendments apply to audits of EGCs.[293] Section 103(a)(3)(C) of SOX requires that any rules of the Board requiring mandatory audit firm rotation or a supplement to the auditor's report in which the auditor would be required to provide additional information about the audit and the financial statements of the issuer (auditor discussion and analysis) shall not apply to an audit of an EGC.[294] The provisions of the Amendments do not fall into these categories.
Section 103(a)(3)(C) further provides that “[a]ny additional rules” adopted by the PCAOB after April 5, 2012 do not apply to audits of EGCs “unless the Commission determines that the application of such additional requirements is necessary or appropriate in the public interest, after considering the protection of investors and whether the action will promote efficiency, competition, and capital formation.” [295] The Amendments fall within this category. Having considered those statutory factors, we find that applying the Amendments to the audits of EGCs is necessary or appropriate in the public interest.
With respect to the Commission's determination of whether the Amendments will apply to audits of EGCs, the PCAOB provided data and analysis of EGCs identified by the Board's staff from public sources that sets forth its views as to why the Amendments should apply to audits of EGCs.[296]
The Board states that the discussion of economic impacts of the QC 1000 requirements is generally applicable to the audits of EGCs. The benefits to financial reporting quality, including improved efficiency of capital allocation, lower cost of capital, and enhanced capital formation, are also pertinent to EGCs. The Board states that EGCs tend to be smaller and have a shorter SEC financial reporting history than the broader population of issuers. The Board cites to academic research that suggests that, for several reasons, smaller issuers tend to exhibit greater information asymmetry between management and investors. Also, PCAOB staff gathered information on Part I.A deficiencies for the audits of EGCs between 2013 and 2022, and these data suggest that Part I.A deficiencies are more common among audits of EGCs, raising questions about whether QC systems of firms that audit EGCs are effective in preventing audit deficiencies for these types of audit engagements. We agree that the benefits of the QC 1000 requirements are also relevant to EGCs.
The Board acknowledges that to the extent the compliance costs associated with the QC 1000 requirements lead some smaller audit firms, such as some NAFs, to exit the public company audit market, then EGCs could be adversely impacted. PCAOB staff analysis indicates that, compared to exchange-listed non-EGCs, exchange-listed EGCs are approximately 2.6 times as likely to be audited by an NAF.
The Board presents evidence that a large number of audit firms, including smaller audit firms, serve EGCs. PCAOB staff analysis indicates that, as of November 15, 2022, there were 3,031 companies that self-identified as EGCs and filed audited financial statements with the Commission between May 16, 2021, and November 15, 2022. Of the 263 registered firms that audited EGCs, 227 firms (or 86%) performed audits for both EGC and non-EGC issuers. Approximately 98% of EGCs were audited by these 227 firms. These data suggest that the impact on EGCs of any exit by some smaller audit firms, as a result of the requirements, would likely be limited. For this reason, we expect that any potential adverse impact on EGCs and their ability to be competitive in their product markets will be modest.
In addition, the Board sought public input on the application of the Amendments to the audits of EGCs. Those commenters that responded to the Board agreed the Amendments should apply to the audits of EGCs.[297] In the Adopting Release, the Board explained that, in general, any new PCAOB standards and amendments to existing standards determined not to apply to the audits of EGCs would require auditors to address differing requirements within their methodologies or policies and procedures with respect to audits of EGCs and non-EGCs, which would create the potential for confusion.[298] The Board further stated this may not be practical in the context of the QC standards because while some components of the QC system (such as engagement monitoring) may enable different approaches for audits of EGCs compared to audits of other companies, other elements (for example, resources and governance and leadership) are necessarily firm-wide and cannot easily be differentiated for different types of audits.[299] The Board further stated that even where differentiation is possible, maintaining separate components for EGC and non-EGC audits may add cost or lead to confusion, and could run counter to the objective of integrating QC practices into a single continuous cycle of risk assessment, monitoring, and remediation.[300]
In addition, the Board stated that the benefits of the higher audit quality resulting from the Amendments may be more pertinent for EGCs than for non-EGCs, including improved efficiency of market capital allocation, lower cost of capital, and enhanced capital formation.[301] The Amendments are expected to enhance audit quality and contribute to an increase in the credibility of financial reporting by EGCs, which are newer to the capital markets than typical non-EGCs.[302]
We agree with the Board's analysis and further emphasize the benefits discussed by the PCAOB, including higher audit quality leading to improved efficiency of capital allocation, lower cost of capital, and enhanced capital formation with respect to EGCs. As noted above, these improvements in the quality of the audit may be more pronounced on the audits of EGCs. While improvements in audit quality benefit all investors, such improvements may particularly benefit investors in ( print page 74347) EGCs by increasing the credibility of their financial reporting given that they are typically newer to the capital markets and feature a higher degree of information asymmetry between management and investors. Improvements in audit quality provide investors with more accurate information, which helps them make more informed investment decisions. More accurate information in financial statements may also increase investors' confidence and, in turn, facilitate capital formation.
To the extent that an EGC's auditor's existing quality control standards do not meet the requirements under QC 1000 and the changes that auditors make to their quality control system impact the performance of audit engagements, this could lead to a spillover externality effect whereby EGCs themselves may have to incur additional costs. For example, an EGC could have to allocate more resources to its own internal control systems or to additional requests for more extensive or additional evidence from audit firms.[303] While this could be costly to the EGC, enhanced internal control over financial reporting at the EGC and audits that are performed in compliance with applicable professional standards are expected to also benefit investors. Audit firms may also raise audit fees for EGCs as a result of implementing QC 1000. Higher audit-related costs, in the form of EGCs' costs to support the audit and/or in fees paid to auditors, would in turn raise EGCs' overall costs and possibly adversely impact their ability to be competitive in the product markets that they operate. These potential costs to EGCs will be reduced to the extent EGC auditors will already be required to comply with the Other QC Standards or may choose not to pass on their incremental costs arising from the QC 1000 requirements in the form of higher audit fees. As discussed above, Commission analysis shows that approximately 88% of registered firms performing PCAOB engagements will, by the effective date of QC 1000, already be subject to quality control requirements that share a basic structure with the requirements in QC 1000. PCAOB staff analysis also shows that approximately 98% of EGCs were audited by firms that performed audits for both EGC and non-EGC issuers.[304] Therefore, for 98% of EGCs being audited, there likely would be minimal incremental costs for QC 1000 to apply to EGCs, either due to their auditor implementing QC 1000, as required to audit its other issuers, or implementing the Other QC Standards.
Accordingly, after considering the protection of investors and whether the action will promote efficiency, competition, and capital formation, we believe there is a sufficient basis to determine that applying the Amendments to the audits of EGCs is necessary or appropriate in the public interest.[305]
V. Conclusion
The Commission has reviewed and considered the Amendments, the information submitted therewith by the PCAOB, the comment letters received, and the recommendation of the Commission's staff. The Commission concludes that the determinations made by the PCAOB as described in the Adopting Release are reasonable. Generally, the Amendments establish an integrated, risk-based quality control standard that can be applied by firms of varying sizes and complexities and that will lead registered public accounting firms to significantly improve their quality control systems, thereby improving audit quality and investor protection. Specifically, the Amendments make the following important changes, among others, to the existing quality control standards, which will advance the Board's investor protection mandate under SOX:
- Replace the current standards, which: (i) were developed by the AICPA, a professional organization for certified public accountants; (ii) were last updated in 1997; (iii) focus on evaluating firms' compliance with their own policies; (iv) do not require evaluation or reporting; and (v) do not contain express obligations for firms to perform any specific monitoring;
- Incorporate a risk-based approach to quality control, driving firms to proactively identify and manage the specific risks associated with their practices, along with a set of mandates, tailored to the size of the audit practice, which should assure that the quality control system is designed, implemented, and operated with an appropriate level of rigor;
- Emphasize the importance of accountability and firm governance through requirements around roles and responsibilities, assigning operational responsibility to individuals for particular aspects of the QC system, and the introduction of a certification by certain responsible individuals; and
- Create a framework for evaluation and reporting to the PCOAB which will be consistently applied across all firms operating a QC system under QC 1000.
Therefore, in connection with the PCAOB's filing and the Commission's review,
A. The Commission finds that the Amendments are consistent with the requirements of Title I of SOX and the rules and regulations thereunder and are necessary or appropriate in the public interest or for the protection of investors; and
B. Separately, the Commission finds that the application of the Amendments to the audits of EGCs is necessary or appropriate in the public interest, after considering the protection of investors and whether the action will promote efficiency, competition, and capital formation.
It is therefore ordered, pursuant to section 107 of SOX and section 19(b)(2) of the Exchange Act, that the Amendments (File No. PCAOB-2024-02) be and hereby are approved.
By the Commission.
Vanessa A. Countryman,
Secretary.
Footnotes
3. See Public Company Accounting Oversight Board; Notice of Filing of Proposed Rules on A Firm's System of Quality Control and Related Amendments to PCAOB Standards, Release No. 34-100277 (June 5, 2024) [89 FR 49588 (June 11, 2024)] (“Notice of Filing of Proposed Rules”), available at https://www.sec.gov/files/rules/pcaob/2024/34-100277.pdf.
Back to Citation4. Id.
Back to Citation5. See Public Company Accounting Oversight Board; Extension of Comment and Approval Periods for Proposed Rules on General Responsibilities of the Auditor in Conducting an Audit and Amendments to PCAOB Standards and A Firm's System of Quality Control and Related Amendments to PCAOB Standards, Release No. 34-100451 (July 1, 2024) [89 FR 55993 (July 8, 2024)], available at https://www.sec.gov/files/rules/pcaob/2024/34-100451.pdf.
Back to Citation6. See Public Company Accounting Oversight Board; Extension of Approval Periods for Proposed Rules on A Firm's System of Quality Control and Related Amendments to PCAOB Standards, Proposed Rules on Amendments Related to Aspects of Designing and Performing Audit Procedures that Involve Technology-Assisted Analysis of Information in Electronic Form, and Proposed Rules on Amendment to PCAOB Rule 3502 Governing Contributory Liability, Release No. 34-100724 (Aug. 13, 2024) [89 FR 67117 (Aug. 23, 2024)], available at https://www.sec.gov/files/rules/pcaob/2024/34-100724.pdf.
Back to Citation7. Copies of the comment letters received on the Commission notice of the Amendments are available on the Commission's website at https://www.sec.gov/comments/pcaob-2024-02/pcaob202402.htm.
Back to Citation8. See Section 107(b)(4)(A)-(B) of SOX, 15 U.S.C. 7217(b)(4)(A)-(B).
Back to Citation9. See A Firm's System of Quality Control and Other Amendments to PCAOB Standards, Rules, and Forms, PCAOB Release No. 2024-005 (May 13, 2024) (“Adopting Release”), available at https://assets.pcaobus.org/pcaob-dev/docs/default-source/rulemaking/docket046/2024-005-qc1000.pdf?sfvrsn=355bf24_2.
Back to Citation10. See PCAOB, Concept Release: Potential Approach to Revisions to PCAOB Quality Control Standards (Dec. 17, 2019) (“Concept Release”), available at https://assets.pcaobus.org/pcaob-dev/docs/default-source/rulemaking/docket046/2019-003-quality-control-concept-release.pdf?sfvrsn=5856398d_0.
Back to Citation11. See Proposed Quality Control Standard—A Firm's System of Quality Control and Other Proposed Amendments to PCAOB Standards, Rules, and Forms, PCAOB Release No. 2022-006 (Nov. 18, 2022) (“Proposing Release”), available at https://assets.pcaobus.org/pcaob-dev/docs/default-source/rulemaking/docket046/2022-006-qc.pdf?sfvrsn=b89546e2_4.
Back to Citation12. See, e.g., Briefing Paper for the Standard Advisory Group (“SAG”), Quality Control: Governance and Leadership (Nov. 29, 2018). The materials for the November 29, 2018 SAG meeting are available at https://pcaobus.org/news-events/events/event-details/standing-advisory-group-meeting_1137.
Back to Citation13. See Establishment of Interim Professional Auditing Standards, PCAOB Release No. 2003-006 (Apr. 18, 2003), available at https://assets.pcaobus.org/pcaob-dev/docs/default-source/rulemaking/interim_standards/release2003-006.pdf?sfvrsn=2424c91_0; Order Regarding Section 103(A)(3)(B) of the Sarbanes-Oxley Act of 2002, Release No. 33-8222 (Apr. 25, 2003) [68 FR 23335 (May 1, 2003)] (Commission order approving PCAOB's interim standards). See infra note 32 for a discussion of the AICPA's new quality control standard, which will become effective on December 15, 2025.
Back to Citation14. See Adopting Release, supra note 9, at 5.
Back to Citation15. Id.
Back to Citation16. See PCAOB Rule 1001(p)(ii) (defining the phrase “play a substantial role in the preparation or furnishing of an audit report”) and Rule 2100 (requiring each public accounting firm that (a) prepares or issues any audit report with respect to any issuer, broker, or dealer; or (b) plays a substantial role in the preparation or furnishing of an audit report with respect to any issuer, broker, or dealer to be registered with the Board).
Back to Citation17. QC 1000 defines “applicable professional and legal requirements” as “(1) Professional standards, as defined in PCAOB Rule 1001(p)(vi); (2) Rules of the PCAOB that are not professional standards; and (3) To the extent related to the obligations and responsibilities of accountants or auditors in the conduct of engagements or in relation to the QC system, rules of the SEC, other provisions of U.S. federal securities law, ethics laws and regulations, and other applicable statutory, regulatory, and other legal requirements.” See QC 1000, Appendix A, .A2.
Back to Citation18. Adopting Release, supra note 9, at 10. Circumstances where firms are only required to design a QC system that meets the requirements of QC 1000, but not implement or operate it, are sometimes referred to as being subject to the “design-only requirement” or “design-only firms.”
Back to Citation19. Id. at 8.
Back to Citation20. Id.
Back to Citation21. Id.
Back to Citation22. Id. at 40.
Back to Citation23. Id.
Back to Citation24. Id.
Back to Citation25. Id. at 8.
Back to Citation26. Id. at 42 (stating that the “specified quality responses are not intended to be comprehensive” and “alone will not be sufficient to enable the firm to achieve all established quality objectives”).
Back to Citation27. Id.
Back to Citation28. Id. at 10.
Back to Citation29. Id.
Back to Citation30. The PCAOB response letter states that, as of 2023, the EQCF requirement would apply to 14 firms. See PCAOB response letter (Aug. 16, 2024) at 3 & n.7. However, one of these 14 firms has since filed an application for withdrawal from registration with the PCAOB. See PCAOB, Registered Public Accounting Firms—Withdrawal Request Pending (Aug. 15, 2024), available at https://assets.pcaobus.org/pcaob-dev/docs/default-source/registration/firms/documents/withdrawal-requests.pdf?sfvrsn=d30aab29_459 (listing BF Borgers CPA PC among the firms that have filed a request for withdrawal from registration).
Back to Citation31. See EY, How Our Independent Audit Quality Committee Strengthens Our Focus on Audit Quality (Feb. 20, 2023) (stating that EY's Independent Audit Quality Committee consists of three external senior leaders and “provides independent advice to EY US senior leadership on all matters related to the Firm's system of quality control that affect audit quality, including its business, operations, culture, talent strategy, governance, and risk management”), available at https://www.ey.com/en_us/insights/assurance/independent-audit-quality-committee-strengthens-our-focus-on-audit-quality; KPMG LLP (US), KPMG U.S. Appoints Katrina Helmkamp and Harit Talwar to Serve on its U.S. Board (Jan. 8, 2024) (stating that it has three independent directors on its U.S. Board of Directors), available at https://kpmg.com/us/en/media/news/helmkamp-talwar-us-board-2024.html; KPMG US Announces Formation of Independent Audit Quality Advisory Committee to Build on the Success of Quality Initiatives (Aug. 28, 2024) (stating that the committee is responsible for advising KPMG on matters including “the firm's efforts to meet new quality standards from regulatory bodies and respond to PCAOB inspections, including root cause analysis, and the design, development, implementation and measurement of strategic audit quality initiatives”), available at https://kpmg.com/us/en/media/news/kpmg-announces-iaqac-2024.html; Chris Johnson, Deloitte follows PwC in search for independent board members, Riotact (Apr. 9, 2024) (stating that PWC Australia has announced plans to increase the number of independent directors to three on its nine-person board), available at https://the-riotact.com/deloitte-follows-pwc-in-search-for-independent-board-members/758971; Deloitte, Leadership and Governance (stating that the Deloitte Global Chair and Deputy Chair receive input from the Deloitte Global Independent Non-Executive (INE) Advisory Council, which provides advice and insights on a variety of matters, including strategy, planning, public policy, quality, risk and regulatory matters, and broader stakeholder engagement), available at https://www.deloitte.com/global/en/about/story/purpose-values/leadership-governance.html; Grant Thornton, Audit Quality & Transparency Report 2022 (stating that its audit quality advisory council includes two independent council members and its purpose is to advise the board regarding ways to maintain and improve the firm's system of quality control in accordance with applicable professional legal standards), available at https://www.grantthornton.com/content/dam/grantthornton/website/assets/content-page-files/audit/pdfs/2023/audit-quality-transparency-report-2022.pdf; and BDO USA P.C., 2023 Audit Quality Report (stating that it has an “Audit Quality Advisory Council” comprised of five (5) members that includes two (2) Independent Council Members), available at ASSR-BDO-2023-Audit-Quality-Report-web.pdf. See also infra note 112.
Back to Citation32. Adopting Release, supra note 9, at 7. The International Auditing and Assurance Standards Board (“IAASB”) released a suite of new quality management standards, including ISQM 1, which became effective on December 15, 2022. ISQM 1 is the international quality control standard and it applies to firms that perform audits of companies (non-SEC registrants) in jurisdictions that have adopted IAASB standards. See IAASB Fact Sheet, Introduction to ISQM 1, Quality Management for Firms that Perform Audits or Reviews of Financial Statements, or Other Assurance or Related Engagements (Dec. 2020) (“ISQM 1”), available at https://www.ifac.org/_flysystem/azure-private/publications/files/IAASB-ISQM-1-Fact-Sheet.pdf. In May 2022, the Auditing Standards Board of the AICPA adopted new quality management standards, including Statement of Quality Management Standards No. 1, A Firm's System of Quality Management (“SQMS 1”), which will become effective on December 15, 2025. SQMS 1 applies to accounting firms in the United States that perform audits under generally accepted auditing standards (“GAAS”) for non-issuers. See AICPA Statement on Quality Management Standards No. 1 (June 2022), available at https://www.aicpa-cima.com/resources/download/aicpa-statement-on-quality-management-standards-no-1.
Back to Citation33. ISQM 1 and SQMS 1 are substantially similar to each other.
Back to Citation34. See, e.g., QC 1000.02-03; ISQM 1.06; and SQMS 1.07.
Back to Citation35. Id.
Back to Citation36. See, e.g., QC 1000.12; SQMS 1.21; and ISQM 1.20. All three standards require assignment of individuals to three roles of operational responsibility that are substantively the same. QC 1000.12 requires assignment of operational responsibility for: (1) the QC system as a whole, (2) compliance with ethics and independence requirements, and (3) the monitoring and remediation process. SQMS 1.21 and ISQM 1.20 require assignment of operational responsibility for: (1) the system of quality management, (2) compliance with independence requirements, and (3) monitoring and remediation process.
Back to Citation37. See AS 2901, as amended.
Back to Citation38. See AT No. 1 and AT No. 2, as amended.
Back to Citation39. See EI 1000.
Back to Citation40. The term “emerging growth company” is defined in Section 3(a)(80) of the Exchange Act (15 U.S.C. 78c(a)(80)). See also Inflation Adjustments under Titles I and III of the JOBS Act, Release No. 33-11098 (Sept. 9, 2022) [87 FR 57394 (Sept. 20, 2022)], available at https://www.sec.gov/files/rules/final/2022/33-11098.pdf.
Back to Citation41. See PCAOB Posts 2023 Annual Inspection Reports Alongside Staff Observations and New Charts To Boost Transparency, available at https://pcaobus.org/news-events/news-releases/news-release-detail/pcaob-posts-2023-annual-inspection-reports-alongside-staff-observations-new-charts-to-boost-transparency.
Back to Citation42. See Spotlight Staff Update and Preview of 2022 Inspection Observations (July 2023), available at https://assets.pcaobus.org/pcaob-dev/docs/default-source/documents/spotlight-staff-preview-2022-inspection-observations.pdf ( pcaobus.org). Figures exclude registered broker-dealer audits in all periods.
Back to Citation43. See supra note 7.
Back to Citation44. See, e.g., letters from American Federation of Labor and Congress of Industrial Organizations (July 1, 2024) (“AFL-CIO”); Better Markets (July 2, 2024) (“Better Markets”); Sherrod Brown, Chairman, U.S. Senate Committee on Banking, Housing, and Urban Affairs (Aug. 15, 2024) (“S. Brown”); CFA Institute (July 1, 2024) (“CFA Institute”); Jack Ciesielski, CPA (July 2, 2024) (“J. Ciesielski”); Consumer Federation of America (July 1, 2024) (“Consumer Federation of America”); Robert A. Conway, CPA (June 26, 2024) (“R. Conway”); Council of Institutional Investors (June 27, 2024) (“CII”); Members of the Investor Advisory Group (June 28, 2024) (“Members of IAG”); and Lynn E. Turner (Aug. 20, 2024) (“L. Turner”) (discussing the history of quality control standards in the audit profession).
Back to Citation45. See letter from CII. See also letter from Members of IAG (“We believe the Amendments, if approved by the SEC, would provide enhanced protections for investors, consistent with the mandate set forth in SOX.”).
Back to Citation46. See letter from Consumer Federation of America.
Back to Citation47. Id. See also letters from AFL-CIO (“The need for enforceable quality control standards is demonstrated by the fact that approximately 40 percent of audits inspected by the PCAOB in 2022 contained deficiencies where the auditor failed to obtain sufficient appropriate audit evidence to support its opinion.”); Better Markets (stating that “the PCAOB's recent Staff Inspection Briefs indicate that significant improvements to firms' quality control systems are necessary and long overdue” and that “the deficiencies that inspection staff describe do not simply involve arcane, highly technical issues that could trip up even the most experienced, ethical auditor—they involve foundational issues of critical importance to high quality audit”).
Back to Citation48. See letter from R. Conway.
Back to Citation49. See letter from L. Turner.
Back to Citation50. Id. (listing fundamental changes such as the change from peer reviews by other audit firms to PCAOB inspections for audits of issuers, significant growth in the size of audit firms, expansion of consulting and other non-audit services, international expansion, increased efforts by partners and leadership to monetize their investment in an audit firm, and firms establishing external QC advisory committees).
Back to Citation51. See, e.g., letters from Better Markets (stating that although “it is pleased that the PCAOB has adopted improvements to auditing quality control standards” that it is “disappointed that the Proposal does not sufficiently ensure high-quality audits or adequate transparency and accountability”); Consumer Federation of America (stating “while these amendments do not go as far as we would have liked, we nonetheless expect that they will benefit investors”); and L. Turner (recommending that the PCAOB adopt an approach of requiring an independent board of directors for audit firms as proposed by the U.S. Treasury Advisory Committee on the Auditing Profession (“ACAP”) and used by the U.K. Financial Reporting Council (“FRC”) and the Japan Financial Services Agency).
Back to Citation52. See, e.g., letters from BDO USA, P.C. (July 2, 2024) (“BDO”); Ernst & Young, LLP (Aug. 26, 2024) (“EY”); Forvis Mazars, LLP (July 2, 2024) (“Forvis Mazars”); Moss Adams, LLP (July 2, 2024) (“Moss Adams”); and Tom Quaadman, Executive Vice President, Center for Capital Markets Competitiveness, U.S. Chamber of Commerce (July 15, 2024) (“Chamber”).
Back to Citation53. See, e.g., letters from BDO; EY; Forvis Mazars; Johnson Global Advisory (June 26, 2024) (“Johnson Global”); Moss Adams; Pennsylvania Institute of CPAs (June 24, 2024) (“PICPA”); PricewaterhouseCoopers LLP (July 1, 2024) (“PWC”); and RSM US LLP (July 16, 2024) (“RSM”).
Back to Citation54. See letter from Forvis Mazars.
Back to Citation55. See letter from PWC.
Back to Citation56. See letter from Chamber.
Back to Citation57. As discussed below, the Commission views the statements in the PCAOB response letter as being on par with statements made by the Board in the Adopting Release about the scope and application of the QC 1000 requirements. See Section III.G.
Back to Citation58. We note that QC 1000's quality objectives may use different terminology from the Other QC standards to align with other PCAOB standards and requirements ( e.g., using the term “QC system” instead of “system of quality management”).
Back to Citation59. For example, in establishing quality objectives in the Governance and Leadership component, QC 1000.25.e requires firms to establish an objective that “The firm's organizational and governance structure and the assignment of roles, responsibilities, and authority enable the design, implementation, and operation of the firm's QC system and support performance of the firm's engagements in accordance with applicable professional and legal requirements” (emphasis added). ISQM 1.28 requires firms to establish an objective that “The organizational structure and assignment of roles, responsibilities and authority is appropriate to enable the design, implementation and operation of the firm's system of quality management.” These objectives are substantively the same, but QC 1000 places more emphasis on supporting the firm's engagements, which is inherent in the operation of the firm's QC system, and therefore implicitly included in both standards. The additional specificity in QC 1000 is not expected to result in substantively different responses ( i.e., policies and procedures) between the two standards.
Back to Citation60. See Adopting Release, supra note 9, at 38. Many of the prescriptive requirements in QC 1000 that are incremental to those that are in the Other QC Standards relate to existing PCAOB standards that the PCAOB determined were still relevant. See, e.g., QC 20.10, .13a, .13b, and .15a.
Back to Citation61. For example, the specified responses to determine the nature, timing, and extent of monitoring in the Monitoring and Remediation Processes (see QC 1000.64 and ISQM 1.37) are substantively similar, except QC 1000.64(d) and (f) specifically require firms to consider characteristics of particular engagements and partners. When a firm designs its monitoring process, as long as a firm considers the characteristics of particular engagements and partners, the same policies and procedures would likely be suitable for both QC 1000 and ISQM 1.
Back to Citation62. For example, QC 1000.33.a and ISQM 1.34(a)(i) both require firms to establish policies and procedures to identify threats to independence; however, QC 1000.34 provides specific procedures the firm should establish in order to do so, including, for example, maintaining and making available the list of restricted entities. While maintaining a list of restricted entities is likely a common way of complying with ISQM 1.34(a)(i), it is not explicitly required.
Back to Citation63. See supra note 60.
Back to Citation64. See, e.g., QC 1000.28.
Back to Citation65. See, e.g., QC 1000.14(d) (requiring a firm's principal executive officer to certify the firm's report to the PCAOB on its annual evaluation of the QC system).
Back to Citation66. Adopting Release, supra note 9, at 7.
Back to Citation67. See details of Commission staff analysis in Section III.C.
Back to Citation68. See Adopting Release, supra note 9, at 7.
Back to Citation69. Id. at 60-61.
Back to Citation70. Id. at 368.
Back to Citation71. See PCAOB response letter at 25-26.
Back to Citation72. See, e.g., letters from BDO; Chamber; Forvis Mazars; PICPA; and PWC.
Back to Citation73. See, e.g., letters from BDO; Chamber; PICPA; and PWC.
Back to Citation74. See letters from BDO and PICPA (citing Board Member Ho, Statement on the QC 1000 Adoption—Demise to Audit Competition (May 13, 2024) (“C. Ho Statement”), available at https://pcaobus.org/news-events/speeches/speech-detail/statement-on-the-qc-1000-adoption---demise-to-audit-competition). See also letters from Chamber (“The Chamber urges the Commission to heed the serious concerns raised by Board Member Ho's statement.”) and RSM (same).
Back to Citation75. See PCAOB response letter at 25-27.
Back to Citation76. See Hughes Aircraft Co. v. Jacobson, 525 U.S. 432, 438 (1999); see also Loper Bright Enter. v. Raimondo, 144 S. Ct. 2244 (June 28, 2024) (“Courts interpret statutes, no matter the context, based on the traditional tools of statutory construction, not individual policy preferences.”).
Back to Citation79. See15 U.S.C. 7211(c)(1) (“. . . register public accounting firms that prepare audit reports for issuers, in accordance with section 102. . . ”) (emphasis added); 15 U.S.C. 7214(a)(2)((A) (“The Board may, by rule, conduct and require a program of inspection in accordance with paragraph (1), on a basis to be determined by the Board, of registered public accounting firms that provide one or more audit reports for a broker or dealer.”) (emphasis added); 15 U.S.C. 7216 (“ Any foreign public accounting firm that prepares or furnishes an audit report with respect to any issuer, broker, or dealer shall be subject to this Act . . .”) (emphasis added).
Back to Citation80. 15 U.S.C. 7212. We also disagree that the design-only requirement is contrary to the statements in the PCAOB's February 2023 letter to Senators Warren and Wyden. See C. Ho Statement (citing https://www.warren.senate.gov/imo/media/doc/2023-02-08%20PCAOB%20Chair%20Erica%20Williams%20response%20letter%20to%20Senators%20Warren%20and%20Wyden.pdf). The PCAOB's letter specifically addressed the PCAOB's statutory authority as it relates to the cryptocurrency industry and stated, among other things, that “[a]s a general matter, audit firms registered with the PCAOB must follow PCAOB standards and rules specifically in connection with their audits of SEC-registered issuers, brokers or dealers only.” The letter does not specifically address whether an accounting firm that does not perform audits for issuers, brokers, or dealers that chooses to register with the PCAOB must comply with statutory requirements related to systems of quality control.
Back to Citation81. See letters from Chamber and Forvis Mazars.
Back to Citation82. See letter from PWC. See also letters from PICPA (recommending that an “inactive firm . . . not have to design its quality control system until after it decided to accept an engagement with a public company, broker, or dealer”); RSM (recommending that firms be required to design, implement, and test the effectiveness of their system of quality control in compliance with QC 1000 prior to being engaged to issue public company audit reports rather than upon registration).
Back to Citation83. See PCAOB response letter at 26-27.
Back to Citation84. Id. at 26.
Back to Citation85. See Adopting Release, supra note 9, at 60-61.
Back to Citation86. Id. at 368.
Back to Citation87. Id. at 61.
Back to Citation88. See, e.g., id. at 330-31.
Back to Citation89. Commission staff estimate that approximately 77% of registered firms are subject to the requirements of one or both of the Other QC Standards. Details on this analysis can be found in Section III.C.
Back to Citation90. Commission staff reviewed the publicly available PCAOB Form AP database, “FirmFilings,” and filtered for Forms AP with an “Audit Report Date” between April 1, 2022 to March 31, 2023 to identify “other participant” firms listed in column “Audit Not Divided Percent Information,” available at https://pcaobus.org/resources/auditorsearch. For purposes of this analysis, staff assumed that only “other participant” firms with a “Firm ID” in the database were registered. Staff then compared this information to the corresponding publicly available Form 2 data related to audit reports filed between April 1, 2022 to March 31, 2023 to identify firms that did not perform issuer audits, broker-dealer audits, or perform any substantial role work based on responses to questions in Part III, indicating that while not required to register, these firms are registered. Staff then filtered the Form AP data to isolate these firms, noting their roles are at less than a “substantial role” to varying degrees from 5-10% to 20-30% of total audit hours in many cases.
Back to Citation91. See Adopting Release, supra note 9, at 118.
Back to Citation92. Id. at 124.
Back to Citation93. Id.
Back to Citation94. See letters from Consumer Federation of America and L. Turner.
Back to Citation95. See letter from Consumer Federation of America.
Back to Citation96. Id.
Back to Citation97. Id.
Back to Citation98. See letter from L. Turner.
Back to Citation99. See, e.g., letters from BDO; CAQ; Chamber; EY; Forvis Mazars; Moss Adams; PICPA; and PWC.
Back to Citation100. See, e.g., letters from BDO; CAQ; Chamber; Forvis Mazars; and PWC. See also letter from the Center for Audit Quality (Aug. 29, 2024) (“CAQ Supplemental Letter”) (stating that the PCAOB response letter did not address “certain other key matters” raised by commenters, such as “the PCAOB's authority to compel disclosure of information afforded confidential and privileged by The Sarbanes-Oxley Act ( e.g., Part II of PCAOB Inspection Reports)”); letter from PICPA (expressing the view that the EQCF “presents concerns regarding the confidentiality of PCAOB Part II inspection findings”); letter from RSM (“The SEC should consider whether SOX restrictions on public disclosure of Part II inspection findings and confidentiality of communications with inspection teams create complexities for effectuating the PCAOB's intention with respect to the EQCF's role.”).
Back to Citation101. See letter from Forvis Mazars.
Back to Citation102. See letter from BDO.
Back to Citation103. See letter from Chamber. See also letter from PWC (stating “[w]e do not believe that firms should be viewed as incapable of performing their own evaluations and conclusions on their QC systems with full transparency to the PCAOB through its inspections process but without third-party involvement”).
Back to Citation104. See letter from Moss Adams.
Back to Citation105. This commenter stated that, for example, the PCAOB comment letter clarified the Board's belief that those serving in an EQCF role would meet the definition of an “associated person.” See CAQ Supplemental Letter.
Back to Citation106. This commenter stated that, for example, the PCAOB response letter did not address the point raised in several comment letters that the Amendments would require firms to disclose confidential and privileged information to “individuals a firm is not otherwise even required to employ or contract.” Id. In addition, the commenter stated that the Board “does not address concerns raised by commenters about the new EQCF requirements being stated by the Board to be analogous in some ways to an Engagement Quality Reviewer.” Id.
Back to Citation107. Id. The commenter asked the Commission to clarify whether the PCAOB response letter “can be viewed as equally authoritative as the Final Standard and Adopting Release.” We respond to this comment in Section III.G below.
Back to Citation108. Id.
Back to Citation109. See letter from L. Turner.
Back to Citation110. See PCAOB response letter at 3, 9. In 2008, one of ACAP's recommendations was to urge the PCAOB and the SEC, in consultation with others, to “analyze, explore, and enable, as appropriate, the possibility and feasibility of firms appointing independent members with full voting power to firm boards and/or advisory boards with meaningful governance responsibilities to improve governance and transparency of audit firms.” See letter from L. Turner (citing and quoting from ACAP recommendations).
Back to Citation111. See PCAOB response letter at 3.
Back to Citation112. Id. (including, for example, one firm that disclosed it had “robust discussions” regarding its initial QC system evaluation under ISQM 1 with its external quality advisors and another firm that indicated its audit advisory council, which includes two independent members, addresses matters related to the QC system, including inspection results and remediation efforts). See also PWC, 2023 Audit Quality Report, at 31 (describing its “independent Assurance Quality Advisory Committee” as providing advice “on aspects of the business, operations, culture, governance, and risk management approach that are reasonably expected to impact audit and assurance quality” and stating that such committee “made us the first firm with both a Board that includes external members and an independent advisory committee focused on quality”), available at https://www.pwc.com/us/en/services/audit-assurance/library/audit-quality-report.html.
Back to Citation113. See CAQ Supplemental Letter.
Back to Citation114. See letter from PWC.
Back to Citation115. See PCAOB response letter at 10.
Back to Citation116. See QC 1000.28.
Back to Citation117. The EQCF must be independent in accordance with the requirements in QC 1000.28. See Adopting Release, supra note 9, at 122 (stressing the importance of the independence requirement but otherwise providing firms with discretion to determine the specific credentials the EQCF must have as long as they have the experience, competence, authority, and time necessary to carry out their assigned responsibilities); PCAOB response letter at 8 (“As long as the firm incorporates into its governance structure an EQCF that can appropriately discharge its single prescribed responsibility (and any additional responsibilities the firm might voluntarily assign to it) in accordance with the QC 1000 standard, the firm would have wide latitude to decide—in its discretion and based on its particular circumstances—how best to design its EQCF.”).
Back to Citation118. A number of the audit firms that would be subject to the EQCF requirement have stated publicly that they have independent representation in their governance structure or plan to add such a role in the near-term. See supra notes 31 and 112.
Back to Citation119. See QC 1000.28.
Back to Citation120. Id.
Back to Citation121. See PCAOB response letter at 7.
Back to Citation122. See Adopting Release, supra note 9, at 119-24.
Back to Citation123. See letter from L. Turner.
Back to Citation124. See, e.g., letters from CAQ; Chamber; EY; Forvis Mazars; Moss Adams; and PWC.
Back to Citation125. See letter from PWC.
Back to Citation126. See letter from Grant Thornton LLP (July 16, 2024) (“GT”) (explaining that although the firm has an Audit Quality Advisory Counsel, it does not meet the EQCF requirements in QC 1000, particularly regarding the necessary authority and review of all “significant judgments”).
Back to Citation127. See letter from L. Turner (discussing the relevant history of the proposed QC standard, including the 2008 ACAP recommendation, 2019 Concept Release, and 2022 Proposing Release, and stating that the PCAOB has gone through an “extensive process of outreach” to both its Investor Advisory Groups and Standards Advisory Groups with respect to quality control standards and noting that members of the Standards Advisory Groups include members of the “Big Four” as well as smaller firms).
Back to Citation129. See5 U.S.C. 551(1) (defining an “agency” as “each authority of the Government of the United States”); id. § 551(5) (defining “rule making” as “agency process for formulating, amending, or repealing a rule”); id. § 553 (setting forth the requirements for agency rule making).
Back to Citation130. See PCAOB Staff Guidance on Economic Analysis in PCAOB Standard Setting (2014), available at https://pcaobus.org/oversight/standards/economic-analysis/05152014_guidance.
Back to Citation131. See PCAOB response letter at 3-5.
Back to Citation132. Id.
Back to Citation133. Id. (noting that the Concept Release included a request for comment asking, “Should a future PCAOB QC standard incorporate mechanisms for independent oversight over firms' QC systems ( e.g., boards with independent directors or equivalent)?”).
Back to Citation134. Id. (stating that in response to the Proposing Release “[m]any commenters called for more clarity and specificity about the role of the oversight function”).
Back to Citation135. See Concept Release, supra note 10 (“We are considering whether a future PCAOB QC standard should address mechanisms for independent oversight over firms' QC systems.”) (emphasis added).
Back to Citation136. See Proposing Release, supra note 11, at 97 (“[T]he firm's governance structure should incorporate an oversight function for the audit practice that includes at least one person who is not a partner, shareholder, member, other principal, or employee of the firm and does not otherwise have a commercial, familial, or other relationship with the firm that would interfere with the exercise of independent judgment with regard to matters related to the QC system.”).
Back to Citation137. Id. at 97 (“If the firm issued audit reports with respect to more than 100 issuers during the prior calendar year, the firm's governance structure should incorporate an oversight function for the audit practice that includes at least one person who is not a partner, shareholder, member, other principal, or employee of the firm and does not otherwise have a commercial, familial, or other relationship with the firm that would interfere with the exercise of independent judgment with regard to matters related to the QC system.”).
Back to Citation138. Id.
Back to Citation139. See Adopting Release, supra note 9, at 119-20 (citing relevant commenter feedback on the Proposing Release).
Back to Citation140. Id. at 118.
Back to Citation141. See letter from PWC.
Back to Citation142. See Proposing Release, supra note 11, at 97.
Back to Citation143. See letters from CAQ and Chamber.
Back to Citation144. See Adopting Release, supra note 9, at 118-20.
Back to Citation145. Compare Proposing Release, supra note 11, at 97 (“. . . includes at least one person who is not a partner, shareholder, member, other principal, or employee of the firm and does not otherwise have a commercial, familial, or other relationship with the firm. . .”) and Adopting Release, supra note 9, at 118 (“. . .composed of one or more persons who are not partners, shareholders, members, other principals, or employees of the firm and do not otherwise have a commercial, familial, or other relationship with the firm. . .”).
Back to Citation146. See PCAOB response letter at 6.
Back to Citation147. See Adopting Release, supra note 9, at 118-20.
Back to Citation148. Id. at 120. Both the PCAOB's proposed and adopted versions of QC 1000.12 stated, “[t]he firm must assign other roles and responsibilities with respect to the QC system to firm personnel who have the experience, competence, authority, and time to enable them to carry out their responsibilities.” See Proposing Release, supra note 11, at 68; Adopting Release, supra note 9, at 82. The EQCF is a role with respect to the QC system, which is further clarified through the conforming change described above.
Back to Citation149. QC 1000.28 (“Responsibilities of the EQCF should include, at a minimum, evaluating the significant judgments made and the related conclusions reached by the firm when evaluating and reporting on the effectiveness of the firm's QC system.”).
Back to Citation150. See PCAOB response letter at 6.
Back to Citation151. See Chamber letter.
Back to Citation152. See, e.g., letters from BDO; CAQ; Consumer Federation of America; Chamber; EY; Forvis Mazars; Moss Adams; PICPA; PWC; and L. Turner.
Back to Citation153. See letter from L. Turner.
Back to Citation154. Id.
Back to Citation155. See Adopting Release, supra note 9, at 121.
Back to Citation156. See PCAOB response letter at 24-25.
Back to Citation158. See, e.g., letters from BDO; CAQ; Chamber; Forvis Mazars; PICPA; and PWC.
Back to Citation159. See letter from Chamber. The CAQ Supplemental Letter stated that the PCAOB response letter provided clarity on whether the EQCF would be considered an associated person.
Back to Citation160. Id. See also letter from PWC (stating that the “adopting release raises the possibility that individuals filling this role could be subject to liability under Section 105(c)(6) of SOX”).
Back to Citation161. See CAQ Supplemental Letter.
Back to Citation164. We note that the external oversight role as described in the Proposing Release similarly would have met the definition of associated person of a public accounting firm.
Back to Citation165. 15 U.S.C. 7201(a)(9). PCAOB Rule 1001(p)(i) provides a substantially similar definition of “person associated with a public accounting firm.”
Back to Citation166. PCAOB response letter at 10.
Back to Citation167. One commenter suggested that its concerns about the disclosure of confidential and privileged information to the EQCF stem from the fact the PCAOB is “requiring disclosure to individuals a firm is not otherwise even required to employ or contract.” See CAQ Supplemental Letter. However, the Amendments require the largest firms to establish and maintain an EQCF. As explained above, we believe that such individual or individuals serving in the EQCF would be associated persons—likely independent contractors—and therefore, we expect that firms will enter into contracts to set forth the terms and conditions of the role, including non-disclosure agreements, just as with their other independent contractors.
Back to Citation169. See PCAOB response letter at 13 n.55 (citing In re Bieter Co., 16 F.3d 929, 940 (8th Cir. 1994) (addressing the waiver of attorney-client privilege in the context of disclosure to an independent contractor); In re Flonase Antitrust Litig., 879 F. Supp. 2d 454, 459 (E.D. Pa. 2012) (same); In re Copper Mkt. Antitrust Litig., 200 FRD. 213, 219 (S.D.N.Y. 2001) (same); Am. S.S. Owners Mut. Protection & Indem. Ass'n v. Alcoa S.S. Co., 232 FRD. 191, 198 (S.D.N.Y. 2005) (addressing the waiver of attorney-client privilege in the context of disclosure to corporate directors); Strougo v. BEA Assocs., 199 FRD. 515, 525 (S.D.N.Y. 2001) (same, with respect to outside directors)); see also letter from L. Turner (stating that the legislative history of the SOX Section 104(g)(2) indicates that it was intended to prohibit the PCAOB from disclosing information it obtained regarding quality control deficiencies but that the firms could disclose that information to their audit committee if they chose to).
Back to Citation170. See PCAOB response letter at 12 (citing the 2023 Audit Quality Report of BDO, which states that its audit advisory council addresses matters related to its QC system, including inspection results and remediation efforts, and the 2022 Audit Quality and Transparency Report of Grant Thornton, which states that it grants its audit quality advisory council full access to firm information to help them fully understand the system of quality control). We note that BDO states in its 2023 Audit Quality Report that two members of its audit advisory council are independent and Grant Thornton states in its 2022 Audit Quality and Transparency Report that two members of its audit quality advisory council are independent.
Back to Citation171. See PCAOB response letter at 13-14.
Back to Citation173. Section 105(c)(6) addresses supervision in terms that are “similar to those that apply to broker-dealers under section 15(b)(4) of the Securities Exchange Act of 1934.” S. Rep. No. 107-205 at 11, 49. Exchange Act Sections 15(b)(4)(E) and 15(b)(6) provide a theory of liability for broker-dealers and their associated persons that have failed reasonably to supervise, with a view to preventing violations of the federal securities laws and the rules thereunder, another person who commits such a violation, if such other person is subject to the broker-dealer or associated person's supervision. 15 U.S.C. 78o(b)(4)(E) and (b)(6). In that context, the Commission has explained that “determining if a particular person is a `supervisor' depends on whether, under the facts and circumstances of a particular case, that person has a requisite degree of responsibility, ability or authority to affect the conduct of the employee whose behavior is at issue.” John H. Gutfreund, Rel. No. 34-31554, 51 SEC 93, 113 (Dec. 3, 1992) (settled order and Exchange Act 21(a) Report). See also, e.g., SEC v. Yu, 231 F.Supp.2d 16 (D.D.C. 2002) (court found individual violated supervisory bar by retaining involvement in hiring and firing, and supervising compliance staff); Steven E. Muth, Rel. No. 34-52551, 2005 WL 2428336 (Oct. 3, 2005) (Commission opinion) (individual had requisite degree of control where he participated in decision to hire and later to suspend registered representative).
Back to Citation174. See, e.g., letters from BDO; CAQ; and PWC.
Back to Citation175. See PCAOB response letter at 17-21. See also supra note 30 (only 14 of the approximately 1,600 PCAOB-registered firms issued audit reports to more than 100 issuers as of 2023 but one of those firms has since filed an application for withdrawal from registration).
Back to Citation176. See letter from Moss Adams (stating “[f]rom the standpoint of a firm that is subject to annual inspection and marginally exceeds the 100-issuer threshold, the disparity in scale, operational scope, and complexity when compared to other firms under similar scrutiny is substantial. Thus, we encourage the Board conduct a more in-depth economic analysis of the EQCF role, along with qualitative analysis of the proposed impact to audit quality and the interplay with the PCAOB's annual inspection of firms' systems of quality.”).
Back to Citation177. See Adopting Release, supra note 9, at 362; PCAOB response letter at 17 n. 72.
Back to Citation178. See Adopting Release, supra note 9, at 67; letter from Consumer Federation of America. See also,15 U.S.C. 7214(b)(1)(A).
Back to Citation179. See15 U.S.C. 7214(b)(1)(A).
Back to Citation180. See, e.g., letters from EY; CAQ Supplemental Letter; and PWC.
Back to Citation181. See letter from PWC.
Back to Citation182. See Adopting Release, supra note 9, at 121.
Back to Citation183. Id.; PCAOB response letter at 7.
Back to Citation184. See letter from EY.
Back to Citation185. Id.
Back to Citation186. Id. We addressed the liability concerns related to the EQCF role earlier in this Order.
Back to Citation187. See Adopting Release, supra note 9, at 121.
Back to Citation188. Id. at 122; PCAOB response letter at 7.
Back to Citation189. PCAOB response letter at 28.
Back to Citation190. See letters from PWC and Chamber.
Back to Citation191. See Adopting Release, supra note 9, at 5 (“We are adopting an integrated, risk-based standard, QC 1000, A Firm's System of Quality Control, that mandates quality objectives and key processes for all firms' QC systems, with a focus on accountability and continuous improvement.).
Back to Citation192. See, e.g., letters from CAQ; Forvis Mazars; and GT. See also letter from EY (stating “it is unclear how firms will understand and document the EQCF's identification of and conclusion about the firm's significant judgments”).
Back to Citation193. See PCAOB response letter at 14-15.
Back to Citation194. Id. at 14.
Back to Citation195. Id. at 15 (stating “QC 1000 imposes a documentation requirement regarding the EQCF's operation on the firm, not on the individuals who comprise the EQCF—though the firm's EQCF policies could provide guidance to those individuals about what they should or should not do to facilitate the firm's retention of appropriate documentation about the EQCF's operation” (emphasis added)) and 14 (stating that all of the firm's documentation under QC 1000 must be documented “in sufficient detail to enable an experienced auditor who understands QC systems but has no experience with the firm's QC system to understand how the EQCF is designed”).
Back to Citation196. Id. at 28. One commenter stated that subsequent PCAOB staff guidance is an insufficient alternative to or remedy for the lack of notice and comment for the EQCF requirement. See letter from Chamber. However, as explained above, the Board followed its own notice-and-comment process and the EQCF requirement included in the Amendments was the result of changes made in light of commenter feedback on the PCAOB's proposed external oversight function.
Back to Citation197. See, e.g., letters from BDO; Chamber; PICPA; and PWC.
Back to Citation198. See letter from Chamber.
Back to Citation199. See letter from L. Turner (citing Public Company Accounting Oversight Board, Staff White Paper, The Impact of Quality Control System Remediation on Audit Performance and Financial Reporting Quality (Nov. 2022), available at https://assets.pcaobus.org/pcaob-dev/docs/default-source/rulemaking/docket046/qc-staff-white-paper-november-2022.pdf?sfvrsn=ddb22504_4).
Back to Citation200. Id.
Back to Citation201. See PCAOB response letter at 21-22.
Back to Citation202. Id.
Back to Citation203. Id.
Back to Citation204. Id.
Back to Citation205. One commenter stated that Exchange Act Section 3(f), 15 U.S.C. 78c(f), requires the Commission to consider the economic implications of the Amendments before approving or disapproving them. See letter from Chamber. Regardless of whether Section 3(f) applies in Commission review of PCAOB rules, because the PCAOB addressed the economic implications of the Amendments and commenters have raised concerns about that analysis, the Commission has likewise considered the economic implications of the Amendments and addresses those implications here. See Bloomberg, L.P. v. SEC, 45 F.4th 462, 476 (D.C. Cir. 2022) (APA requires the Commission to “respond adequately” to “relevant concerns about the direct and indirect costs of” a proposal raised by commenters, regardless of what Section 3(f) requires).
Back to Citation206. See Adopting Release, supra note 9, at 341-43.
Back to Citation207. Id. at 358-66; see also letter from BDO (“There should be further consideration of the potential impacts of this standard on the competitive landscape of firms outside the U.S. where possible.”).
Back to Citation208. See PCAOB response letter at 24.
Back to Citation209. See SEC Staff, Current Guidance on Economic Analysis in SEC Rulemaking (Mar. 16, 2012), available at https://www.sec.gov/divisions/riskfin/rsfi_guidance_econ_analy_secrulemaking.pdf; PCAOB Staff, Staff Guidance on Economic Analysis in PCAOB Standard-Setting (Feb. 14, 2014), available at https://pcaobus.org/oversight/standards/economic-analysis/05152014_guidance.
Back to Citation210. See Adopting Release, supra note 9, at 54. The six global networks that contain the largest number of registered, non-U.S. firms as reported on Form 2s filed in 2023 are: BDO International Limited, Deloitte Touche Tohmatsu Limited, Ernst & Young Global Limited, Grant Thornton International Limited, KPMG International Cooperative, and PricewaterhouseCoopers International Limited (the member firms of these networks are collectively referred to herein as “GNFs”). The non-affiliated firms (“NAFs”) include registered public accounting firms that are not members of global network firms.
Back to Citation211. See Adopting Release, supra note 9, at 318-23.
Back to Citation212. Id. at 331.
Back to Citation213. Id. at 351-60.
Back to Citation214. Based on Commission staff analysis. Data on firms registered with the PCAOB come from the PCAOB's website: Registered Firms, PCAOB, https://pcaobus.org/oversight/registration/registered-firms. We identify whether an audit firm has performed an engagement under PCAOB standards for an issuer or registered broker-dealer using the “Audit Report Activity” filter. Staff identified U.S. and non-U.S. firms by using the country variable in the PCAOB data. U.S. firms include those in the United States and Puerto Rico. To identify firms that participate in the AICPA peer review program, staff extracted a list of participating firms from the following website: Public File Search, AICPA Peer Review Web Program, https://peerreview.aicpa.org/public_file_search.html. Staff manually matched those firms by auditor name and, if necessary, city and state to the PCAOB data. Staff identified non-U.S. firms that were part of the GNF by collecting data listed at Global Network Firms, PCAOB, https://pcaobus.org/oversight/registration/global-network-firms, and matching it to the PCAOB data by auditor name, city, state, and manually reviewing the firm summaries to compare Firm IDs. Finally, for non- US firms that were non-GNF, staff determined whether they were members of or affiliated with some other network, arrangement, alliance, partnership, or association using Form 2 ( i.e., any audit firm that answered “Yes” for either Item 5.2a.1 or Item 5.2a.2 has an “audit-related membership, affiliation, or similar arrangement”).
Back to Citation215. For example, each of the following transparency reports state that global network policies require compliance with ISQM 1. See, e.g., EY Global Audit Quality Report (June 2024), available at https://www.ey.com/content/dam/ey-unified-site/ey-com/en-gl/insights/assurance/documents/ey-global-audit-quality-report-06-2024.pdf; BDO Transparency Report (June 2023), available at https://www.bdo.global/en-gb/about/global-network/transparency-report-2023; Crowe Global Transparency Report (2024), available at https://www.crowe.com/global/-/media/crowe/international/files/about-us/crowe_global_transparency_report.pdf?rev=015641ea64c9491983ed47106226ddcf&hash=492F11006140712E365E07C80FF9CD5E.
Back to Citation216. Lastly, 50 of the 1554 firms have not yet filed a Form 2; thus, staff could not determine which of these firms had an audit report or played a substantial role for the audit of at least one issuer or registered broker-dealer. Staff were also unable to determine how many of these 50 firms will already be subject to quality control requirements that share a basic structure with the requirements in QC 1000.
Back to Citation217. See letter from Chamber.
Back to Citation218. See, e.g.,17 CFR 275.206(4)-2 (custody of funds or securities of clients by investment advisers); 17 CFR 240.13n-11 (chief compliance officer of security-based swap data repository; compliance reports and financial reports); 17 CFR 240.17ad-22 (standards for clearing agencies); 17 CFR 240.15c3-1g (conditions for ultimate holding companies of certain brokers or dealers, Appendix G to 17 CFR 240.15c3-1); and 17 CFR 240.18a-1 (net capital requirements for security-based swap dealers for which there is not a prudential regulator).
Back to Citation219. See17 CFR 275.206(4)-2.
Back to Citation220. See Adopting Release, supra note 9, at 335.
Back to Citation221. Id. at 333.
Back to Citation222. Id.
Back to Citation223. Id. at 334.
Back to Citation224. Id. at 336-37.
Back to Citation225. Id. at 338.
Back to Citation226. Id. at 341-43.
Back to Citation227. See id. at 343.
Back to Citation228. See id. at 343-45.
Back to Citation229. See id. at 344.
Back to Citation230. See id. at 44.
Back to Citation231. See id. at 66.
Back to Citation232. See id. at 58.
Back to Citation233. See, e.g., letters from BDO; Chamber; PIPCA; and PWC.
Back to Citation234. See letter from Chamber.
Back to Citation235. See letter from PICPA. See also, e.g., letters from BDO and Chamber.
Back to Citation236. See letter from PWC.
Back to Citation237. This count does not account for the 50 firms out of 1,554 that have not yet filed a Form 2, as Commission staff could not determine which of these 50 firms issued an audit report or played a substantial role for the audit of at least one issuer or registered broker-dealer. See supra note 216. The PCAOB made similar findings in 2023. See Adopting Release, supra note 9, at 345 (stating that, based on Form 2 reporting as of June 30, 2023, approximately 60% of registered firms reported that they had not issued an audit report for an audit of an issuer or broker-dealer or played a substantial role in such an engagement during the preceding 12 months).
Back to Citation238. See supra note 218.
Back to Citation239. See Adopting Release, supra note 9, at 354; see also PCAOB response letter at 23.
Back to Citation240. As discussed in Section III above, Commission staff compared QC 1000 with the requirements of ISQM 1 and SQMS 1 and similarly concluded that there is significant overlap.
Back to Citation241. See, e.g., letters from BDO; Chamber; PICPA; and PWC.
Back to Citation242. See letter from BDO.
Back to Citation243. See letter from PWC; see also, e.g., letters from BDO and PICPA.
Back to Citation244. See Adopting Release, supra note 9, at 356-57.
Back to Citation245. See PCAOB response letter at 19-20.
Back to Citation246. See supra note 30.
Back to Citation247. See, e.g., letter from Moss Adams.
Back to Citation248. See Adopting Release, supra note 9, at 361-62.
Back to Citation249. Id. at 258.
Back to Citation250. Id.
Back to Citation251. See letter from BDO.
Back to Citation252. Id.
Back to Citation253. See15 U.S.C. 7212(e); PCAOB Rule 2300(b). We understand that firms are accustomed to requesting and receiving confidential treatment from the Board.
Back to Citation254. See PCAOB Rule 2203A(c) as adopted.
Back to Citation255. See Adopting Release, supra note 9, at 263-64.
Back to Citation256. Id. at 245.
Back to Citation257. Id. at 246.
Back to Citation258. Id.
Back to Citation259. See, e.g., letters from BDO; Forvis Mazars; GT; Moss Adams; PICPA; and RSM.
Back to Citation260. See letter from BDO.
Back to Citation261. See Adopting Release, supra note 9, at 378.
Back to Citation262. Id.
Back to Citation263. See, e.g., letters from Forvis Mazars; Johnson Global; Moss Adams; and PICPA.
Back to Citation264. See letter from Moss Adams.
Back to Citation265. See letter from Chamber.
Back to Citation266. See PCAOB response letter at 21-22.
Back to Citation267. Id. at 27-28.
Back to Citation268. See PCAOB response letter at 27-28.
Back to Citation269. See Adopting Release, supra note 9, at 378.
Back to Citation270. For example, implementation efforts are expected to be largely completed for recently adopted PCAOB standards relating to the Supervision of Audits Involving Other Auditors and Dividing Responsibility for the Audit with Another Accounting Firm (effective for audits of financial statements for fiscal years ending on or after December 15, 2024), available at https://www.sec.gov/files/rules/pcaob/2022/34-95488.pdf and Auditor's Use of Confirmation (effective for audits of financial statements for fiscal years ending on or after June 15, 2025), available at https://www.sec.gov/files/rules/pcaob/2023/34-99060.pdf, as the fiscal years for which the standards apply have already begun. Certain other recently adopted rules and standards, for example Auditing Standard 1000, General Responsibilities of the Auditor in Conducting an Audit, available at https://www.sec.gov/files/rules/pcaob/2024/34-100773.pdf and Amendment to PCAOB Rule 3502 Governing Contributory Liability, available at https://www.sec.gov/files/rules/pcaob/2024/34-100772.pdf, are not expected to require significant implementation efforts due to minimal changes to performance requirements.
Back to Citation271. See letter from Moss Adams.
Back to Citation272. See letter from Chamber.
Back to Citation273. See, e.g., letters from CAQ and PWC.
Back to Citation274. See, e.g., letters from CII; Consumer Federation of America; L. Turner (stating that the SEC should instruct the PCAOB to conduct a post-implementation review); and Members of the IAG.
Back to Citation275. See letters from GT and RSM.
Back to Citation276. See PCAOB response letter at 28.
Back to Citation277. The Proposing Release was issued on November 18, 2022, and it requested comments by February 1, 2023. See supra note 11. The comment file includes comments that were submitted through March 6, 2023, and the PCAOB stated in the Adopting Release that it considered all forty-two (42) comments it received. See Adopting Release, supra note 9, at 35.
Back to Citation278. See letter from BDO.
Back to Citation279. See letter from PICPA (recommending that the standard instead include more specified quality objectives, which would reduce barriers to entry by promoting scalability).
Back to Citation280. See letter from Forvis Mazars.
Back to Citation281. See letters from Johnson Global and PICPA.
Back to Citation282. See letter from Johnson Global.
Back to Citation283. See, e.g., Adopting Release, supra note 9, at 83, 42, 63-64, 246, 295, 60, and A1-43.
Back to Citation284. See PWC, 2023 Audit Quality Report at 49, available at https://www.pwc.com/us/en/services/trust-solutions/library/pdfs/pwc-2023-audit-quality-report.pdf.
Back to Citation285. See CAQ Supplemental Letter.
Back to Citation286. See letter from PICPA.
Back to Citation287. See letter from Johnson Global.
Back to Citation288. See letter from PICPA (stating that it disagrees that all engagement deficiencies are QC deficiencies and that a root cause analysis is required for a firm to assess whether a simple mistake is in fact a quality control deficiency).
Back to Citation289. See letter from Forvis Mazars.
Back to Citation290. Id.
Back to Citation291. See, e.g., Adopting Release, supra note 9, at A1-43, A1-42, A1-43, A1-42, and 47-48.
Back to Citation292. See PCAOB response letter at 28.
Back to Citation293. See Notice of Filing of Proposed Rules, supra note 3.
Back to Citation295. Id.
Back to Citation296. See Adopting Release, supra note 9, at 374-77.
Back to Citation297. See, e.g., letter received by the PCAOB on the Proposing Release from Ernst and Young, LLP (Feb. 1, 2023) (stating “[w]e believe the proposal should apply to the audits of both emerging growth companies (EGCs) and non-EGC issuers.”), available at https://assets.pcaobus.org/pcaob-dev/docs/default-source/rulemaking/docket046/30_ey.pdf?sfvrsn=34762808_4.
Back to Citation298. See Adopting Release, supra note 9, at 376.
Back to Citation299. Id.
Back to Citation300. Id.
Back to Citation301. Id. at 376-77. Also, PCAOB staff gathered information on Part I.A deficiencies for the audits of EGCs between 2013 and 2022, analyzing the percentage of inspected EGC and non-EGC issuer audits having at least one Part I.A deficiency. These data suggest that Part I.A deficiencies are even more common among audits of EGCs, raising questions about whether QC systems of firms that audit EGCs are effective in preventing audit deficiencies for these types of audit engagements. Id. at 375.
Back to Citation302. Id. at 377.
Back to Citation303. See Alexander, C, S. Bauguess, G. Bernile, Y. A. Lee, and J. Marietta-Westberg (2013) “Economic Effect of SOX Section 404 Compliance: A Corporate Insider Perspective,” Journal of Accounting and Economics, at 56, 267-290. Based on a survey data, this paper shows the compliance costs of SOX 404 weigh disproportionately on smaller firms.
Back to Citation304. See Adopting Release, supra note 9, at 375.
Back to Citation305. As noted above, during the Commission's comment period, two commenters raised concerns that the design-only requirement would burden smaller firms, which could impact smaller issuers and broker-dealers, including emerging growth companies. See letters from Chamber and PICPA. Although these commenters mentioned EGCs in the context of commenting on the design-only requirement, neither suggested that firms should be required to apply different quality control standards to the audits of EGCs versus non-EGCs. For the reasons stated above, we agree with the Board that QC 1000 should apply to all registered public accounting firms, including with respect to the audits of EGCs, because of the firm-wide nature of QC systems.
Back to Citation[FR Doc. 2024-20714 Filed 9-11-24; 8:45 am]
BILLING CODE 8011-01-P
Document Information
- Published:
- 09/12/2024
- Department:
- Securities and Exchange Commission
- Entry Type:
- Notice
- Document Number:
- 2024-20714
- Pages:
- 74324-74347 (24 pages)
- Docket Numbers:
- Release No. 34-100968, File No. PCAOB-2024-002
- PDF File:
- 2024-20714.pdf