PCAOB Replaces Old Quality Control Rules With a New Standard

The Public Company Accounting Oversight Board (PCAOB) has overhauled its decades-old quality control requirements for audit firms by adopting a new standard on May 13 designed to put the onus squarely on auditors and executives.

The new standard, which the board approved by a 4-1 vote on Monday, would require all PCAOB-registered accounting firms to identify their specific risks that would inhibit audit quality—like the use of technology-based auditing tools that could create new risks if they don’t work as intended or are used incorrectly—and design a quality control system that includes policies and procedures to guard against those risks.

The audit regulator’s current quality control standards were developed and issued by the AICPA before the PCAOB was established in 2002. Given the significant changes in the auditing environment since that time, quality control has been a top modernization priority for the PCAOB.

“The auditing environment has changed significantly since that time, including evolving and greater use of technology, and increasing auditor use of outside resources, such as other accounting firms and providers of support services. Firms themselves have also changed significantly, as has the role of firm networks. And advances in internal control, quality management, and enterprise risk management suggest that factors such as active involvement of leadership, focus on risk, clearly defined objectives, objective-oriented processes, monitoring, and remediation of identified issues can contribute to more effective QC,” the PCAOB said in introducing the new standard, QC 1000, A Firm’s System of Quality Control. “These developments have, in part, led to our advisory groups’ general support for strengthening the QC standards, including through risk-based elements and enhanced requirements for firm governance and leadership.”

The PCAOB noted that firm quality control systems often fall short during its inspections of public company audits. For example, PCAOB inspectors observed that approximately 40% of the issuer audits they reviewed in 2022 had one or more deficiencies where the auditor failed to obtain sufficient appropriate audit evidence to support its opinion, an increase of six percentage points over the deficiency rate in 2021 and 11 percentage points over the rate in 2020.

In all those cases, auditors issued audit opinions without completing the audit work that PCAOB standards require for them to obtain reasonable assurance about whether the financial statements were free of material misstatement and/or whether the issuers maintained, in all material respects, effective internal control over financial reporting, the regulator said.

PCAOB officials say improving quality control rules will lead firms to improve their quality control systems, resulting in more consistent compliance with applicable requirements, which ultimately better serves investors.

“When quality control systems operate effectively, quality audits follow, and investors are better protected,” PCAOB Chair Erica Williams said in a statement.

Key provisions of the new standard include:

• The new standard strikes a balance between a risk-based approach to quality control, which the PCAOB said should drive firms to proactively identify and manage the specific risks associated with their practice, and a set of mandates, which should assure that the quality control system is designed, implemented, and operated with an appropriate level of rigor.
• All PCAOB-registered firms would be required to design a quality control system that complies with the new standard. Firms that perform audits of public companies or Securities and Exchange Commission (SEC)-registered brokers and dealers would be required to implement and operate the quality control system they design, monitor the system, and take remedial actions where policies and procedures are not operating effectively—creating a continuous feedback loop for improvement.
• Those firms would be required to annually evaluate their quality control system and report the results of their evaluation to the PCAOB on new Form QC, which would be certified by key firm personnel to reinforce individual accountability.
• Firms that audit more than 100 issuers annually would be required to establish an external oversight function, or EQCF, for the quality control system composed of one or more professionals. The EQCF’s responsibilities should include, at a minimum, evaluating the significant judgments made and the related conclusions reached by the firm when evaluating and reporting on the effectiveness of its quality control system.

“Simply designing elaborate processes on paper won’t be enough,” Williams said. “Firm leadership will have a personal stake in delivering results and additional incentives to fix problems quickly.”

Board member Christina Ho was the only one to vote against the standard, even though she supported a more modernized quality control standard when it was proposed in November 2022.

“We must do it right and not rush to replace an outdated standard with one harmful to audit quality by increasing burdens without credible benefits that will likely reduce competition,” she said in a statement. “Rather than potentially dismantling the audit profession and simultaneously setting copious standards that ironically make this profession exceptionally unappealing to future accountants and auditors, we as a regulator should thoughtfully balance the scale, using evidence-based quantitative and qualitative analysis to justify the need for our standards. In other words, requirements should promote a commensurate balance between benefits and the associated direct implementation costs to audit firms, that by extension are passed on to issuers and broker-dealers, and then indirectly reduce returns on investments.”

The new standard, pending approval by the SEC, would go into effect on Dec. 15, 2025.