On September 9, 2024 the SEC adopted Public Company Accounting Oversight Board (PCAOB) rules that establish new quality control requirements for public companies accounting firms (PCAFs). The new standard, Quality Control (QC) 1000, A Firm’s System of Quality Control (QC 1000), was adopted by the PCAOB in May 2024 and supersedes the current PCAOB QC standards, which were adopted in the early 2000s. The PCAOB “believe[s] [the adoption of a new QC standard] will lead registered public accounting firms to significantly improve their QC systems… [which will] enhance the confidence of investors and other market participants in the information firms report on.”[1] QC 1000 subjects all PCAFs under its purview to significant procedural and compliance obligations. In addition to the requirements that apply to all subject PCAFs, QC 1000 imposes certain heightened requirements on firms with larger audit practices (firms that issue audit reports for more than 100 issuers per year). We discuss key features of the new rules below.
Framework
The PCAOB describes the QC 1000 framework as “grounded in an ongoing process of proactively identifying and managing risks to quality, with a feedback loop from ongoing monitoring and remediation that should drive continuous improvement…”[2] The QC 1000 framework consists of:
- Two process components: (1) risk assessment; and (2) monitoring and remediation.
- Six components that address organization and operations: (1) governance and leadership; (2) ethics and independence; (3) acceptance and continuance of engagements; (4) engagement performance; (5) resources; and (6) information and communication.
- Two principal requirements for evaluation of, and reporting on, the QC system: (1) annual evaluation of the effectiveness of the QC system to be completed by September 30 of each year; and (2) reporting to the PCAOB on the QC system evaluation by November 30 of each year. The Form QC may be voluntarily disclosed but firm reporting on Form QC will be nonpublic.
Roles and Responsibilities
QC 1000 establishes that the PCAF’s principal executive officer bears ultimate responsibility and accountability for the firm’s QC system as a whole. In addition, firms are required to designate separate individuals to have oversight of specified components of the QC processes, including: (1) operational responsibility and accountability for the QC system as a whole; (2) operational responsibility for the firm’s compliance with ethics and independence requirements; (3) operational responsibility for the monitoring and remediation process; and (4) under appropriate circumstances, operational responsibility for other components of the QC system. Each of the individual who bears ultimate responsibility for the firm’s QC system as a whole, and the individual who bears operational responsibility and accountability for the firm’s QC system as a whole, is required to certify the firm’s report to the PCAOB as to the annual evaluation of the QC system.
Risk Assessment
Under QC 1000 PCAFs must undertake an ongoing risk assessment through which to inform the design, implementation and operation of their QC systems. In the risk assessment process, firms must establish quality objectives, identify and assess quality risks to the achievement of the quality objectives, and design and implement quality responses to address the quality risks that meet the threshold requirement of having a “reasonable possibility of occurring.” On an annual basis, firms must assess quality risks to achieving each of the quality objectives established by such firm.
Monitoring and Remediation Process
Under QC 1000, PCAFs are required to design, implement, and operate a monitoring and remediation process to:
- Provide relevant, reliable, and timely information about the design, implementation, and operation of the QC system.
- Provide a reasonable basis for timely detection of engagement deficiencies and QC deficiencies.
- Remediate identified engagement deficiencies and QC deficiencies and take any other required actions in relation to such deficiencies in accordance with applicable professional and legal requirements on a timely basis.
Annual Evaluation and Reporting to the PCAOB
QC 1000 includes a new reporting form, Form QC, which PCAFs must file annually with the PCAOB. Among other things, firms must report in their Form QC the result of their annual evaluation of their QC system (as of September 30). This evaluation must conclude that: the firm’s QC system is effective with no unremediated QC deficiencies; is effective, except for one or more unremediated QC deficiencies that are not major QC deficiencies; or is not effective (one or more major QC deficiencies exist). If the firm identifies unremediated QC deficiencies, it must provide a description of each unremediated QC deficiency, including each major QC deficiency, as well as a summary of the remedial actions taken and planned to be taken to address each QC deficiency.
Requirements Applicable to Firms With Larger Audit Practices:
QC 1000 imposes heightened obligations on larger PCAFs (those that prepare audit reports for more than 100 issuers per year). These firms are required to:
- Establish an external oversight function for the QC system composed of one or more persons who can exercise independent judgment related to the QC system (EQCF). The responsibilities of the EQCF include, at a minimum, evaluating the significant judgments made and the related conclusions reached by the firm when evaluating and reporting on the effectiveness of its QC system.
- Implement a program for collecting and addressing complaints and allegations that includes confidentiality protections.
- Establish an automated system to track investments that may bear on independence.
- Monitor in-process engagements.
Timing of Implementation
The new quality control rules become effective on December 15, 2025. The first annual evaluation period will cover the period beginning on December 15, 2025 and ending on September 30, 2026. Subsequent evaluation periods will cover the 12-month period ending on September 30.
Final Thoughts
Implementation of QC 1000 may require PCAFs to significantly enhance their quality assurance procedures. Businesses that work with these firms, including public company audit clients, should anticipate the potential adoption of additional procedural and compliance processes as audit firms work toward implementation of these requirements and companies should seek to understand any impact on the engagement for the annual audit. Audit committees should consider inquiring about any deficiencies or other significant findings included in their PCAF’s Form QC. Companies should consider reviewing their audit committee charter to ensure that the scope of review of their PCAF includes consideration and discussion of these matters.
__________
[1] A Firm’s System of Quality Control and Other Amendments to PCAOB Standards, Rules, and Forms, PCAOB
Release No. 2024-005 (May 13, 2024), p. 5.
[2] Id, p. 8.
