[Federal Register Volume 89, Number 177 (Thursday, September 12, 2024)]
[Notices]
[Pages 74324-74347]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: 2024-20714]
-----------------------------------------------------------------------
SECURITIES AND EXCHANGE COMMISSION
[Release No. 34-100968; File No. PCAOB-2024-002]
Public Company Accounting Oversight Board; Order Granting
Approval of QC 1000, A Firm's System of Quality Control, and Related
Amendments to PCAOB Standards, Rules, and Forms
September 9, 2024.
I. Introduction
On May 24, 2024, the Public Company Accounting Oversight Board (the
``Board'' or the ``PCAOB'') filed with the Securities and Exchange
Commission (the ``Commission''), pursuant to Section 107(b) \1\ of the
Sarbanes-Oxley Act of 2002 (``SOX'') and Section 19(b) \2\ of the
Securities Exchange Act of 1934 (the ``Exchange Act''), a proposal to
adopt Quality Control (``QC'') 1000, A Firm's System of Quality Control
(``QC 1000''), and supersede existing PCAOB QC standards; adopt EI
1000, Integrity and Objectivity, and supersede existing ET 102,
Integrity and Objectivity; and amend several other related existing
auditing standards, rules, and forms (collectively, the
``Amendments'').\3\
---------------------------------------------------------------------------
\1\ 15 U.S.C. 7217(b).
\2\ 15 U.S.C. 78s(b).
\3\ See Public Company Accounting Oversight Board; Notice of
Filing of Proposed Rules on A Firm's System of Quality Control and
Related Amendments to PCAOB Standards, Release No. 34-100277 (June
5, 2024) [89 FR 49588 (June 11, 2024)] (``Notice of Filing of
Proposed Rules''), available at https://www.sec.gov/files/rules/pcaob/2024/34-100277.pdf.
---------------------------------------------------------------------------
The Amendments were published for comment in the Federal Register
on June 11, 2024.\4\ On July 1, 2024, the Commission extended the
public comment period until July 16, 2024, and extended the date by
which the Commission shall either approve or disapprove, or institute
proceedings to determine whether to approve or disapprove, the
Amendments to August
[[Page 74325]]
25, 2024.\5\ On August 13, 2024, the Commission further extended the
date by which the Commission shall either approve or disapprove, or
institute proceedings to determine whether to approve or disapprove,
the Amendments to September 9, 2024.\6\ The Commission received over 20
comment letters from the public regarding the Amendments and one
response to comments from the PCAOB (``PCAOB response letter'').\7\
This order approves the Amendments, which we find to be consistent with
the requirements of Title I of SOX and the rules and regulations issued
thereunder and necessary or appropriate in the public interest or for
the protection of investors.\8\ The Amendments and the Commission's
findings with respect thereto are discussed in further detail below.
---------------------------------------------------------------------------
\4\ Id.
\5\ See Public Company Accounting Oversight Board; Extension of
Comment and Approval Periods for Proposed Rules on General
Responsibilities of the Auditor in Conducting an Audit and
Amendments to PCAOB Standards and A Firm's System of Quality Control
and Related Amendments to PCAOB Standards, Release No. 34-100451
(July 1, 2024) [89 FR 55993 (July 8, 2024)], available at https://www.sec.gov/files/rules/pcaob/2024/34-100451.pdf.
\6\ See Public Company Accounting Oversight Board; Extension of
Approval Periods for Proposed Rules on A Firm's System of Quality
Control and Related Amendments to PCAOB Standards, Proposed Rules on
Amendments Related to Aspects of Designing and Performing Audit
Procedures that Involve Technology-Assisted Analysis of Information
in Electronic Form, and Proposed Rules on Amendment to PCAOB Rule
3502 Governing Contributory Liability, Release No. 34-100724 (Aug.
13, 2024) [89 FR 67117 (Aug. 23, 2024)], available at https://www.sec.gov/files/rules/pcaob/2024/34-100724.pdf.
\7\ Copies of the comment letters received on the Commission
notice of the Amendments are available on the Commission's website
at https://www.sec.gov/comments/pcaob-2024-02/pcaob202402.htm.
\8\ See Section 107(b)(4)(A)-(B) of SOX, 15 U.S.C.
7217(b)(4)(A)-(B).
---------------------------------------------------------------------------
II. Description of the Amendments
On May 13, 2024, the Board adopted the Amendments.\9\ The
Amendments were preceded by a 2019 concept release,\10\ a proposal in
November 2022,\11\ and other outreach engaged in by the PCAOB.\12\ QC
1000 would replace current PCAOB QC standards that were developed
decades ago by the American Institute of Certified Public Accountants
(``AICPA''), before the PCAOB was established, and which were adopted
by the Board on an interim, transitional basis in 2003.\13\
---------------------------------------------------------------------------
\9\ See A Firm's System of Quality Control and Other Amendments
to PCAOB Standards, Rules, and Forms, PCAOB Release No. 2024-005
(May 13, 2024) (``Adopting Release''), available at https://assets.pcaobus.org/pcaob-dev/docs/default-source/rulemaking/docket046/2024-005-qc1000.pdf?sfvrsn=355bf24_2.
\10\ See PCAOB, Concept Release: Potential Approach to Revisions
to PCAOB Quality Control Standards (Dec. 17, 2019) (``Concept
Release''), available at https://assets.pcaobus.org/pcaob-dev/docs/default-source/rulemaking/docket046/2019-003-quality-control-concept-release.pdf?sfvrsn=5856398d_0.
\11\ See Proposed Quality Control Standard--A Firm's System of
Quality Control and Other Proposed Amendments to PCAOB Standards,
Rules, and Forms, PCAOB Release No. 2022-006 (Nov. 18, 2022)
(``Proposing Release''), available at https://assets.pcaobus.org/pcaob-dev/docs/default-source/rulemaking/docket046/2022-006-qc.pdf?sfvrsn=b89546e2_4.
\12\ See, e.g., Briefing Paper for the Standard Advisory Group
(``SAG''), Quality Control: Governance and Leadership (Nov. 29,
2018). The materials for the November 29, 2018 SAG meeting are
available at https://pcaobus.org/news-events/events/event-details/standing-advisory-group-meeting_1137.
\13\ See Establishment of Interim Professional Auditing
Standards, PCAOB Release No. 2003-006 (Apr. 18, 2003), available at
https://assets.pcaobus.org/pcaob-dev/docs/default-source/rulemaking/interim_standards/release2003-006.pdf?sfvrsn=2424c91_0; Order
Regarding Section 103(A)(3)(B) of the Sarbanes-Oxley Act of 2002,
Release No. 33-8222 (Apr. 25, 2003) [68 FR 23335 (May 1, 2003)]
(Commission order approving PCAOB's interim standards). See infra
note 32 for a discussion of the AICPA's new quality control
standard, which will become effective on December 15, 2025.
---------------------------------------------------------------------------
In the Notice of Filing of Proposed Rules, the PCAOB stated that it
was proposing a new QC standard that it believes will lead registered
public accounting firms to significantly improve their QC systems and
thereby protect investors by facilitating the consistent preparation
and issuance of informative, accurate, and independent audit
reports.\14\ As described by the Board, QC 1000 is an integrated, risk-
based standard that mandates quality objectives and key processes for
all firms' QC systems.\15\ While QC 1000 requires all public accounting
firms that are registered with the PCAOB to design a QC system that
meets the requirements of QC 1000, firms are only required to implement
and operate the QC system in compliance with QC 1000 when they lead an
engagement under PCAOB standards, play a substantial role in the
preparation or furnishing of an audit report (as defined in PCAOB
rules),\16\ or have current responsibilities under ``applicable
professional and legal requirements'' \17\ regarding any such
engagement.\18\
---------------------------------------------------------------------------
\14\ See Adopting Release, supra note 9, at 5.
\15\ Id.
\16\ See PCAOB Rule 1001(p)(ii) (defining the phrase ``play a
substantial role in the preparation or furnishing of an audit
report'') and Rule 2100 (requiring each public accounting firm that
(a) prepares or issues any audit report with respect to any issuer,
broker, or dealer; or (b) plays a substantial role in the
preparation or furnishing of an audit report with respect to any
issuer, broker, or dealer to be registered with the Board).
\17\ QC 1000 defines ``applicable professional and legal
requirements'' as ``(1) Professional standards, as defined in PCAOB
Rule 1001(p)(vi); (2) Rules of the PCAOB that are not professional
standards; and (3) To the extent related to the obligations and
responsibilities of accountants or auditors in the conduct of
engagements or in relation to the QC system, rules of the SEC, other
provisions of U.S. federal securities law, ethics laws and
regulations, and other applicable statutory, regulatory, and other
legal requirements.'' See QC 1000, Appendix A, .A2.
\18\ Adopting Release, supra note 9, at 10. Circumstances where
firms are only required to design a QC system that meets the
requirements of QC 1000, but not implement or operate it, are
sometimes referred to as being subject to the ``design-only
requirement'' or ``design-only firms.''
---------------------------------------------------------------------------
According to the Board, QC 1000 provides a framework for a QC
system that is grounded in the ongoing practice of proactively
identifying and managing risks to audit quality, with a feedback loop
from ongoing monitoring, an explicit focus on firm governance and
leadership, firm culture, and individual accountability, and specific
direction in a number of areas the current PCAOB standards do not
address.\19\ QC 1000 consists of two process components: (1) the firm's
risk assessment process and (2) the monitoring and remediation
process.\20\ It also consists of six components that address aspects of
the firm's organization and operations: (1) governance and leadership;
(2) ethics and independence; (3) acceptance and continuation of
engagements; (4) engagement performance; (5) resources; and (6)
information and communication.\21\ The risk assessment process applies
to these six components, requiring firms to: (i) establish outcome-
based ``quality objectives,'' including those specified throughout the
standard (i.e., the desired outcomes to be achieved by the firm with
respect to that component); (ii) identify and assess ``quality risks''
to the quality objectives; (iii) design and implement ``quality
responses'' (i.e., policies and procedures to address the quality
risks); and (iv) establish policies and procedures to monitor internal
and external changes that may require modifications to the quality
objectives, quality risks, or quality responses.\22\ The monitoring and
remediation process applies to all of the components of the QC system,
including monitoring and remediation itself (i.e., firms are required
to identify and remediate deficiencies that are observed in their
monitoring and remediation activities).\23\
---------------------------------------------------------------------------
\19\ Id. at 8.
\20\ Id.
\21\ Id.
\22\ Id. at 40.
\23\ Id.
---------------------------------------------------------------------------
[[Page 74326]]
QC 1000 also requires an annual evaluation of the effectiveness of
the QC system and reporting to the PCAOB on the QC system evaluation by
the registered public accounting firm for any period in which it is
required to implement and operate a QC system.\24\ The standard
includes requirements regarding individual roles and responsibilities
in the QC system and documentation requirements.\25\
---------------------------------------------------------------------------
\24\ Id.
\25\ Id. at 8.
---------------------------------------------------------------------------
As noted above, firms are required to design and implement quality
responses as part of the risk assessment process. Although QC 1000
requires firms to design and implement their own quality responses to
respond to their particular assessed quality risks, QC 1000 also
includes some specified quality responses, which are mandatory for the
firms to which they apply.\26\ Some specified quality responses carry
requirements from current PCAOB standards into QC 1000 or provide new
requirements that the PCAOB stated were important to a firm's QC
system.\27\
---------------------------------------------------------------------------
\26\ Id. at 42 (stating that the ``specified quality responses
are not intended to be comprehensive'' and ``alone will not be
sufficient to enable the firm to achieve all established quality
objectives'').
\27\ Id.
---------------------------------------------------------------------------
For example, with respect to the governance and leadership
component, QC 1000 includes a specified quality response that requires
firms with larger PCAOB audit practices (firms that issue audit reports
for more than 100 issuers in the prior calendar year) to adopt and
implement an external quality control function (``EQCF'') that is
composed of one or more persons who are not principals or employees of
the firm and do not otherwise have a relationship with the firm that
would interfere with the exercise of independent judgment with regard
to matters related to the QC system.\28\ The EQCF is required to
evaluate the significant judgments made and related conclusions reached
by the firm when evaluating and reporting on the effectiveness of its
QC system. Firms have flexibility in how the role is structured,
depending on their governance structure or other factors. In addition,
firms may, at their discretion, assign additional responsibilities to
the EQCF and those could vary across firms.\29\ As noted above, the
EQCF requirement only applies to firms that issue audit reports for
more than 100 issuers in the prior calendar year, which currently is 13
out of the approximately 1,600 PCAOB-registered firms.\30\ A number of
these firms have stated publicly that they have independent
representation in their governance structure or plan to add such a role
in the near term.\31\ The EQCF role is discussed and analyzed in
greater detail in Section III.B, below.
---------------------------------------------------------------------------
\28\ Id. at 10.
\29\ Id.
\30\ The PCAOB response letter states that, as of 2023, the EQCF
requirement would apply to 14 firms. See PCAOB response letter (Aug.
16, 2024) at 3 & n.7. However, one of these 14 firms has since filed
an application for withdrawal from registration with the PCAOB. See
PCAOB, Registered Public Accounting Firms--Withdrawal Request
Pending (Aug. 15, 2024), available at https://assets.pcaobus.org/pcaob-dev/docs/default-source/registration/firms/documents/withdrawal-requests.pdf?sfvrsn=d30aab29_459 (listing BF Borgers CPA
PC among the firms that have filed a request for withdrawal from
registration).
\31\ See EY, How Our Independent Audit Quality Committee
Strengthens Our Focus on Audit Quality (Feb. 20, 2023) (stating that
EY's Independent Audit Quality Committee consists of three external
senior leaders and ``provides independent advice to EY US senior
leadership on all matters related to the Firm's system of quality
control that affect audit quality, including its business,
operations, culture, talent strategy, governance, and risk
management''), available at https://www.ey.com/en_us/insights/assurance/independent-audit-quality-committee-strengthens-our-focus-on-audit-quality; KPMG LLP (US), KPMG U.S. Appoints Katrina Helmkamp
and Harit Talwar to Serve on its U.S. Board (Jan. 8, 2024) (stating
that it has three independent directors on its U.S. Board of
Directors), available at https://kpmg.com/us/en/media/news/helmkamp-talwar-us-board-2024.html; KPMG US Announces Formation of
Independent Audit Quality Advisory Committee to Build on the Success
of Quality Initiatives (Aug. 28, 2024) (stating that the committee
is responsible for advising KPMG on matters including ``the firm's
efforts to meet new quality standards from regulatory bodies and
respond to PCAOB inspections, including root cause analysis, and the
design, development, implementation and measurement of strategic
audit quality initiatives''), available at https://kpmg.com/us/en/media/news/kpmg-announces-iaqac-2024.html; Chris Johnson, Deloitte
follows PwC in search for independent board members, Riotact (Apr.
9, 2024) (stating that PWC Australia has announced plans to increase
the number of independent directors to three on its nine-person
board), available at https://the-riotact.com/deloitte-follows-pwc-in-search-for-independent-board-members/758971; Deloitte, Leadership
and Governance (stating that the Deloitte Global Chair and Deputy
Chair receive input from the Deloitte Global Independent Non-
Executive (INE) Advisory Council, which provides advice and insights
on a variety of matters, including strategy, planning, public
policy, quality, risk and regulatory matters, and broader
stakeholder engagement), available at https://www.deloitte.com/global/en/about/story/purpose-values/leadership-governance.html;
Grant Thornton, Audit Quality & Transparency Report 2022 (stating
that its audit quality advisory council includes two independent
council members and its purpose is to advise the board regarding
ways to maintain and improve the firm's system of quality control in
accordance with applicable professional legal standards), available
at https://www.grantthornton.com/content/dam/grantthornton/website/assets/content-page-files/audit/pdfs/2023/audit-quality-transparency-report-2022.pdf; and BDO USA P.C., 2023 Audit Quality
Report (stating that it has an ``Audit Quality Advisory Council''
comprised of five (5) members that includes two (2) Independent
Council Members), available at ASSR-BDO-2023-Audit-Quality-Report-
web.pdf. See also infra note 112.
---------------------------------------------------------------------------
The Board described the QC 1000 framework as having commonalities
with other international and domestic standards for firm QC systems,
though it goes beyond those requirements in some areas.\32\ QC 1000,
ISQM 1, and SQMS 1 (the latter two collectively, the ``Other QC
Standards'') \33\ share the same basic framework, with the same eight
components and risk-based approach to quality control.\34\ Both QC 1000
and the Other QC Standards include requirements to design, implement,
and operate specified quality objectives, risks, and responses on an
annual basis; \35\ and specify structures of governance, including
requiring the assignment of individuals to the same specified
roles.\36\ A discussion of the similarities and differences between QC
1000 and the Other QC Standards is included below in Section III.
---------------------------------------------------------------------------
\32\ Adopting Release, supra note 9, at 7. The International
Auditing and Assurance Standards Board (``IAASB'') released a suite
of new quality management standards, including ISQM 1, which became
effective on December 15, 2022. ISQM 1 is the international quality
control standard and it applies to firms that perform audits of
companies (non-SEC registrants) in jurisdictions that have adopted
IAASB standards. See IAASB Fact Sheet, Introduction to ISQM 1,
Quality Management for Firms that Perform Audits or Reviews of
Financial Statements, or Other Assurance or Related Engagements
(Dec. 2020) (``ISQM 1''), available at https://www.ifac.org/_flysystem/azure-private/publications/files/IAASB-ISQM-1-Fact-Sheet.pdf. In May 2022, the Auditing Standards Board of the AICPA
adopted new quality management standards, including Statement of
Quality Management Standards No. 1, A Firm's System of Quality
Management (``SQMS 1''), which will become effective on December 15,
2025. SQMS 1 applies to accounting firms in the United States that
perform audits under generally accepted auditing standards
(``GAAS'') for non-issuers. See AICPA Statement on Quality
Management Standards No. 1 (June 2022), available at https://www.aicpa-cima.com/resources/download/aicpa-statement-on-quality-management-standards-no-1.
\33\ ISQM 1 and SQMS 1 are substantially similar to each other.
\34\ See, e.g., QC 1000.02-03; ISQM 1.06; and SQMS 1.07.
\35\ Id.
\36\ See, e.g., QC 1000.12; SQMS 1.21; and ISQM 1.20. All three
standards require assignment of individuals to three roles of
operational responsibility that are substantively the same. QC
1000.12 requires assignment of operational responsibility for: (1)
the QC system as a whole, (2) compliance with ethics and
independence requirements, and (3) the monitoring and remediation
process. SQMS 1.21 and ISQM 1.20 require assignment of operational
responsibility for: (1) the system of quality management, (2)
compliance with independence requirements, and (3) monitoring and
remediation process.
---------------------------------------------------------------------------
The Amendments also include expanding the auditor's responsibility
to respond to deficiencies on completed engagements under an amended
and retitled AS 2901, Responding to Engagement Deficiencies After
Issuance of the Auditor's Report. These changes would extend the scope
of AS 2901 to cover engagement deficiencies in audits
[[Page 74327]]
of internal control over financial reporting, incorporate the concepts
and terminology introduced in QC 1000, and bring the standard into
alignment with the auditor's existing responsibility to obtain
sufficient appropriate audit evidence to support the opinion.\37\ The
changes also include related amendments to AT No. 1, Examination
Engagements Regarding Compliance Reports of Brokers and Dealers, and AT
No. 2, Review Engagements Regarding Exemption Reports of Brokers and
Dealers, which would prompt auditors of registered brokers-dealers to
take appropriate action if they discover that the opinion or conclusion
in a previously issued attestation report was not supported.\38\
Finally, the Amendments replace existing standard ET 102, Integrity and
Objectivity, with a new standard, EI 1000, Integrity and Objectivity,
to better align PCAOB ethics requirements with the scope, approach, and
terminology of QC 1000.\39\
---------------------------------------------------------------------------
\37\ See AS 2901, as amended.
\38\ See AT No. 1 and AT No. 2, as amended.
\39\ See EI 1000.
---------------------------------------------------------------------------
The Amendments will be effective on December 15, 2025. The first
annual evaluation period will cover the period beginning on the
effective date of the standard (i.e., December 15, 2025) and ending on
September 30, 2026. Subsequent evaluation periods will cover the 12-
month period ending on September 30. The PCAOB has proposed application
of the Amendments to include audits of emerging growth companies
(``EGCs''),\40\ as discussed in Section IV below.
---------------------------------------------------------------------------
\40\ The term ``emerging growth company'' is defined in Section
3(a)(80) of the Exchange Act (15 U.S.C. 78c(a)(80)). See also
Inflation Adjustments under Titles I and III of the JOBS Act,
Release No. 33-11098 (Sept. 9, 2022) [87 FR 57394 (Sept. 20, 2022)],
available at https://www.sec.gov/files/rules/final/2022/33-11098.pdf.
---------------------------------------------------------------------------
III. Discussion and Commission Findings
The Commission continues to observe concerning indications that
registered firms' QC systems are inadequate to ensure the high level of
audit quality necessary for investor protection. Recent PCAOB
inspection reports indicate that inspection deficiency rates are
continuing to rise, with 46% of the engagements reviewed in 2023 having
at least one Part I.A deficiency,\41\ compared to 40% in 2022 and 34%
in 2021.\42\ While PCAOB inspection deficiency rates are not the only
measure of audit quality and cannot necessarily be generalized to all
PCAOB audits, these high deficiency rates place investors in harm's
way. Effective QC systems provide firms with reasonable assurance that
their audit engagements will be performed in compliance with applicable
legal and professional requirements. The continuing rise in deficiency
rates supports the need for the Amendments as they would enhance
registered audit firms' QC systems to help ensure firms are able to
perform their gatekeeper function, which is critical to investor
protection and the functioning of our capital markets.
---------------------------------------------------------------------------
\41\ See PCAOB Posts 2023 Annual Inspection Reports Alongside
Staff Observations and New Charts To Boost Transparency, available
at https://pcaobus.org/news-events/news-releases/news-release-detail/pcaob-posts-2023-annual-inspection-reports-alongside-staff-observations-new-charts-to-boost-transparency.
\42\ See Spotlight Staff Update and Preview of 2022 Inspection
Observations (July 2023), available at https://assets.pcaobus.org/pcaob-dev/docs/default-source/documents/spotlight-staff-preview-2022-inspection-observations.pdf (pcaobus.org). Figures exclude
registered broker-dealer audits in all periods.
---------------------------------------------------------------------------
As noted above, in response to the Notice of Filing of Proposed
Rules, to date the Commission has received over 20 comment letters from
the public and one response to comments from the PCAOB.\43\ Several
commenters expressed support for the Amendments, stating that they
would improve upon existing standards and lead to better protection of
investors.\44\ For example, one commenter stated that the Amendments
``would better protect the interests of investors, consistent with the
mandate set forth in SOX.'' \45\ Similarly, another commenter stated
that it expected the Amendments ``will enhance the quality of audits,
raising the level of trust and confidence investors can place in the
accuracy and reliability of public company financial disclosures.''
\46\ This commenter also stated that ``[c]urrent quality control
systems at many firms are not achieving an even minimally acceptable
level of audit quality, let alone the high level of audit quality that
investors have a right to expect and on which the reliability of our
financial reporting system depends.'' \47\ Another commenter stated
that ``the PCAOB has done a good job of articulating why the
improvements to the Quality Control Standards are warranted.'' \48\ One
commenter stated that it ``strongly supported'' the Amendments,
highlighting requests by the investor community over the years to
update ``outdated quality control standards'' that were written in a
pre-SOX era when the profession was self-regulated.\49\ This commenter
stated that many areas of the PCAOB's existing QC standards have not
been updated to reflect fundamental changes in the profession.\50\ Some
commenters who supported the proposal also stated that they did not
believe the requirements in the Amendments went far enough.\51\
---------------------------------------------------------------------------
\43\ See supra note 7.
\44\ See, e.g., letters from American Federation of Labor and
Congress of Industrial Organizations (July 1, 2024) (``AFL-CIO'');
Better Markets (July 2, 2024) (``Better Markets''); Sherrod Brown,
Chairman, U.S. Senate Committee on Banking, Housing, and Urban
Affairs (Aug. 15, 2024) (``S. Brown''); CFA Institute (July 1, 2024)
(``CFA Institute''); Jack Ciesielski, CPA (July 2, 2024) (``J.
Ciesielski''); Consumer Federation of America (July 1, 2024)
(``Consumer Federation of America''); Robert A. Conway, CPA (June
26, 2024) (``R. Conway''); Council of Institutional Investors (June
27, 2024) (``CII''); Members of the Investor Advisory Group (June
28, 2024) (``Members of IAG''); and Lynn E. Turner (Aug. 20, 2024)
(``L. Turner'') (discussing the history of quality control standards
in the audit profession).
\45\ See letter from CII. See also letter from Members of IAG
(``We believe the Amendments, if approved by the SEC, would provide
enhanced protections for investors, consistent with the mandate set
forth in SOX.'').
\46\ See letter from Consumer Federation of America.
\47\ Id. See also letters from AFL-CIO (``The need for
enforceable quality control standards is demonstrated by the fact
that approximately 40 percent of audits inspected by the PCAOB in
2022 contained deficiencies where the auditor failed to obtain
sufficient appropriate audit evidence to support its opinion.'');
Better Markets (stating that ``the PCAOB's recent Staff Inspection
Briefs indicate that significant improvements to firms' quality
control systems are necessary and long overdue'' and that ``the
deficiencies that inspection staff describe do not simply involve
arcane, highly technical issues that could trip up even the most
experienced, ethical auditor--they involve foundational issues of
critical importance to high quality audit'').
\48\ See letter from R. Conway.
\49\ See letter from L. Turner.
\50\ Id. (listing fundamental changes such as the change from
peer reviews by other audit firms to PCAOB inspections for audits of
issuers, significant growth in the size of audit firms, expansion of
consulting and other non-audit services, international expansion,
increased efforts by partners and leadership to monetize their
investment in an audit firm, and firms establishing external QC
advisory committees).
\51\ See, e.g., letters from Better Markets (stating that
although ``it is pleased that the PCAOB has adopted improvements to
auditing quality control standards'' that it is ``disappointed that
the Proposal does not sufficiently ensure high-quality audits or
adequate transparency and accountability''); Consumer Federation of
America (stating ``while these amendments do not go as far as we
would have liked, we nonetheless expect that they will benefit
investors''); and L. Turner (recommending that the PCAOB adopt an
approach of requiring an independent board of directors for audit
firms as proposed by the U.S. Treasury Advisory Committee on the
Auditing Profession (``ACAP'') and used by the U.K. Financial
Reporting Council (``FRC'') and the Japan Financial Services
Agency).
---------------------------------------------------------------------------
Other commenters stated that the Commission should not approve the
Amendments.\52\ While several
[[Page 74328]]
commenters stated that they supported the Board's efforts and goal to
modernize quality control standards, they did not support certain
aspects of the Amendments.\53\ For example, one commenter stated that
it was concerned that the Amendments ``could potentially have
unintended negative consequences to the profession, including
significant costs without notable improvement to audit quality.'' \54\
One commenter expressed its ``overall support for the project and the
large majority of the provisions of the standard'' but stated that the
Commission should not approve the standard in its final form because
the EQCF function ``raises significant concerns,'' including being
inconsistent with SOX, and because, in the commenter's view, the PCAOB
did not adequately address concerns it and others raised regarding the
ability for small firms to comply with QC 1000, in particular the
design-only requirement.\55\ Another commenter stated that ``the SEC
should reject the PCAOB's final QC 1000 standard because it contains
fundamental failures and flaws.'' \56\ Commenters also provided
feedback on specific aspects of the Amendments as described below,
which informed their general views discussed above.
---------------------------------------------------------------------------
\52\ See, e.g., letters from BDO USA, P.C. (July 2, 2024)
(``BDO''); Ernst & Young, LLP (Aug. 26, 2024) (``EY''); Forvis
Mazars, LLP (July 2, 2024) (``Forvis Mazars''); Moss Adams, LLP
(July 2, 2024) (``Moss Adams''); and Tom Quaadman, Executive Vice
President, Center for Capital Markets Competitiveness, U.S. Chamber
of Commerce (July 15, 2024) (``Chamber'').
\53\ See, e.g., letters from BDO; EY; Forvis Mazars; Johnson
Global Advisory (June 26, 2024) (``Johnson Global''); Moss Adams;
Pennsylvania Institute of CPAs (June 24, 2024) (``PICPA'');
PricewaterhouseCoopers LLP (July 1, 2024) (``PWC''); and RSM US LLP
(July 16, 2024) (``RSM'').
\54\ See letter from Forvis Mazars.
\55\ See letter from PWC.
\56\ See letter from Chamber.
---------------------------------------------------------------------------
We have considered the information contained in the Notice of
Filing of Proposed Rules and the PCAOB's response letter \57\ as well
as the comments received by the Commission. Having carefully weighed
all of the information before us, we find that the Amendments are
consistent with the requirements of Title I of SOX and the rules and
regulations thereunder and are necessary or appropriate in the public
interest or for the protection of investors. In particular, we believe
the Amendments as a whole will further the Board's statutory mandate
under SOX and enhance investor protection by creating an integrated,
risk-based QC standard that can be applied by firms of varying sizes
and complexities and is compatible with Other QC Standards that either
have already been or are required to be implemented by the vast
majority of registered public accounting firms. The Amendments will
lead registered public accounting firms to significantly improve their
quality control systems, thereby improving audit quality and investor
protection. The existing interim QC standards--which were adopted on an
interim basis in 2003 and were developed by the audit profession under
an environment of self-regulation--do not adequately reflect the risks
and requirements of the current auditing environment, overly focus on
evaluating firms' compliance with their own internally-developed
policies designed in a peer review environment, and do not require
evaluation or reporting that ultimately enhances audit quality and
investor protection.
---------------------------------------------------------------------------
\57\ As discussed below, the Commission views the statements in
the PCAOB response letter as being on par with statements made by
the Board in the Adopting Release about the scope and application of
the QC 1000 requirements. See Section III.G.
---------------------------------------------------------------------------
The Amendments emphasize the importance of accountability and firm
governance and a QC system that is proactive and responsive to risks.
Replacing interim standards with permanent standards provides
additional regulatory certainty that may have an incremental benefit of
allowing audit firms to make long-term investments in their QC systems.
Further, the Amendments will promote compliance by registered public
accounting firms with applicable professional and legal requirements
(including PCAOB auditing standards), which should help eliminate
information asymmetries and expectation gaps for issuers, registered
broker-dealers, and investors regarding whether audit firms are
complying with such requirements. Improved compliance by registered
public accounting firms with PCAOB auditing standards, among other
professional and legal requirements, would result in improved financial
reporting quality, which would further benefit investors.
In addition, the Amendments share a common framework with Other QC
Standards that are widely implemented by auditing firms across the
globe, with specific enhanced requirements for the U.S. regulatory
environment, which allows firms to leverage costs already expended or
that will be expended to comply with these standards. In addition to
the overarching structure and the eight components being the same among
QC 1000 and the Other Standards as noted above in Section II, the
requirements within the components are also aligned. Specifically, the
required quality objectives (i.e., the outcomes specified by the
standards that drive the firm's responses) generally are substantively
similar \58\ although some of QC 1000's quality objectives contain
additional prescriptive requirements \59\ that the Board considered to
be relevant to the U.S. public company legal and regulatory environment
as discussed in more detail below.\60\ Both QC 1000 and the Other QC
Standards provide firms with flexibility to design responses to achieve
these quality objectives taking into account the particular risks and
circumstances faced by the firm. Further, there is overlap in the
limited number of specified quality responses (i.e., individual
responses required by QC 1000 and the Other QC Standards). In other
words, the quality objectives that firms establish (and their resulting
responses) under QC 1000 are expected to be sufficiently responsive to
those of the Other QC Standards.\61\
---------------------------------------------------------------------------
\58\ We note that QC 1000's quality objectives may use different
terminology from the Other QC standards to align with other PCAOB
standards and requirements (e.g., using the term ``QC system''
instead of ``system of quality management'').
\59\ For example, in establishing quality objectives in the
Governance and Leadership component, QC 1000.25.e requires firms to
establish an objective that ``The firm's organizational and
governance structure and the assignment of roles, responsibilities,
and authority enable the design, implementation, and operation of
the firm's QC system and support performance of the firm's
engagements in accordance with applicable professional and legal
requirements'' (emphasis added). ISQM 1.28 requires firms to
establish an objective that ``The organizational structure and
assignment of roles, responsibilities and authority is appropriate
to enable the design, implementation and operation of the firm's
system of quality management.'' These objectives are substantively
the same, but QC 1000 places more emphasis on supporting the firm's
engagements, which is inherent in the operation of the firm's QC
system, and therefore implicitly included in both standards. The
additional specificity in QC 1000 is not expected to result in
substantively different responses (i.e., policies and procedures)
between the two standards.
\60\ See Adopting Release, supra note 9, at 38. Many of the
prescriptive requirements in QC 1000 that are incremental to those
that are in the Other QC Standards relate to existing PCAOB
standards that the PCAOB determined were still relevant. See, e.g.,
QC 20.10, .13a, .13b, and .15a.
\61\ For example, the specified responses to determine the
nature, timing, and extent of monitoring in the Monitoring and
Remediation Processes (see QC 1000.64 and ISQM 1.37) are
substantively similar, except QC 1000.64(d) and (f) specifically
require firms to consider characteristics of particular engagements
and partners. When a firm designs its monitoring process, as long as
a firm considers the characteristics of particular engagements and
partners, the same policies and procedures would likely be suitable
for both QC 1000 and ISQM 1.
---------------------------------------------------------------------------
QC 1000 does go beyond the Other QC Standards in that it contains
relatively more prescriptive requirements than the Other QC
Standards.\62\ The Board
[[Page 74329]]
considered these requirements to be relevant to the U.S. regulatory
environment and investors.\63\ Many of these additional requirements
only apply to firms that issue audit reports for more than 100 issuers
in the prior calendar year.\64\ Because QC 1000 provides more precise
and prescriptive requirements that drive accountability, it will
enhance the Board's ability to perform its inspections and to enforce
its standards, which will further incentivize firms to design,
implement, and operate effective QC systems.\65\ It is the Board's view
that building on the well-understood basic framework of the Other QC
Standards, appropriately tailored and strengthened to address the U.S.
legal and regulatory environment and our investor protection mandate,
will enable firms to implement and comply with QC 1000 more
effectively.\66\ In designing, implementing, and operating their QC
systems, firms that are subject to both PCAOB standards and the Other
QC Standards, which the Commission estimates to be 88% of registered
firms that have performed engagements under PCAOB standards for an
issuer or registered broker-dealer (``PCAOB engagements'') in the past
year and 72% of registered firms that have not,\67\ will be able to
leverage the work they have already done and the investments they have
already made to comply with such Other QC Standards.\68\ In support of
this conclusion, neither the Commission staff nor commenters have
identified aspects of QC 1000 that are incompatible with the Other QC
Standards.
---------------------------------------------------------------------------
\62\ For example, QC 1000.33.a and ISQM 1.34(a)(i) both require
firms to establish policies and procedures to identify threats to
independence; however, QC 1000.34 provides specific procedures the
firm should establish in order to do so, including, for example,
maintaining and making available the list of restricted entities.
While maintaining a list of restricted entities is likely a common
way of complying with ISQM 1.34(a)(i), it is not explicitly
required.
\63\ See supra note 60.
\64\ See, e.g., QC 1000.28.
\65\ See, e.g., QC 1000.14(d) (requiring a firm's principal
executive officer to certify the firm's report to the PCAOB on its
annual evaluation of the QC system).
\66\ Adopting Release, supra note 9, at 7.
\67\ See details of Commission staff analysis in Section III.C.
\68\ See Adopting Release, supra note 9, at 7.
---------------------------------------------------------------------------
A. Requirements Related to the Design of QC System
As discussed above, QC 1000 includes a design-only requirement. The
PCAOB stated in the Adopting Release that the design-only requirement
may facilitate timely implementation and operation of a compliant QC
system.\69\ The Board also stated that not requiring all registered
public accounting firms to design their QC system would create a risk
that firms could be unprepared to accept and perform such engagements
in compliance with applicable professional and legal requirements.\70\
Finally, the PCAOB stated that because registering with the PCAOB
enables a firm to issue audit reports or play a substantial role on
audits performed under PCAOB standards for issuers and registered
broker-dealers, and because investors and companies considering
engaging the firm could reasonably expect that any firm that could
pursue such an engagement would already have a PCAOB-compliant QC
system designed and ready for implementation and operation, it believes
that imposing a design requirement on all registered firms promotes its
mission of protecting investors and promoting the public interest.\71\
---------------------------------------------------------------------------
\69\ Id. at 60-61.
\70\ Id. at 368.
\71\ See PCAOB response letter at 25-26.
---------------------------------------------------------------------------
General
A number of commenters expressed concerns regarding the design-only
requirement.\72\ Commenters stated that this requirement will increase
the barriers to entry for small firms to take on audits of small
publicly-held companies, including EGCs, or registered broker-dealers
and will incentivize firms to de-register.\73\ A few commenters stated
they agreed with concerns expressed by PCAOB Board Member Ho in her
statement accompanying the adoption of QC 1000 indicating that the
design-only requirement appears to be inconsistent with both the
statutory text of SOX and a statement the PCAOB made to Congress in
2023, and that the requirement would impose undue burdens on
competition.\74\ The PCAOB response letter responds to commenter
feedback on the design-only requirement, including addressing why
applying such a requirement to firms that do not presently have
obligations with respect to PCAOB engagements is consistent with the
PCAOB's statutory mandate.\75\
---------------------------------------------------------------------------
\72\ See, e.g., letters from BDO; Chamber; Forvis Mazars; PICPA;
and PWC.
\73\ See, e.g., letters from BDO; Chamber; PICPA; and PWC.
\74\ See letters from BDO and PICPA (citing Board Member Ho,
Statement on the QC 1000 Adoption--Demise to Audit Competition (May
13, 2024) (``C. Ho Statement''), available at https://pcaobus.org/news-events/speeches/speech-detail/statement-on-the-qc-1000-adoption---demise-to-audit-competition). See also letters from
Chamber (``The Chamber urges the Commission to heed the serious
concerns raised by Board Member Ho's statement.'') and RSM (same).
\75\ See PCAOB response letter at 25-27.
---------------------------------------------------------------------------
While we acknowledge the concerns raised by commenters, we find
that the design-only requirement is consistent with the requirements of
Title I of SOX and the rules and regulations issued thereunder and is
necessary or appropriate in the public interest or for the protection
of investors. Allowing registered firms to design their QC system only
upon entering into an audit engagement would create a risk that
registered firms could be unprepared to accept and perform engagements
in compliance with applicable professional and legal requirements,
which in turn risks a reduction in audit quality to the detriment of
investors. For example, one component of a well-designed QC system is
policies and procedures around the acceptance of an engagement. Without
having designed a QC system in advance, such firms would not be in a
position to ensure that their QC system is effective in order to
evaluate and take on a new PCAOB engagement.
Below we discuss the views of commenters with respect to specific
aspects of QC 1000's design-only requirement, as well as the
Commission's findings regarding those matters.
Statutory Authority
We have considered comments on the statutory authority questions
raised in Board Member Ho's statement as well as the PCAOB's response
letter and find that the Board has the authority to require that all
registered firms design a QC system that complies with QC 1000. The
Supreme Court has stated that, in cases of statutory construction, a
court's analysis begins with ``the language of the statute'' and
``where the statutory language provides a clear answer, it ends there
as well.'' \76\ SOX Section 103(a)(2)(B) refers to quality control
standards that the Board adopts with respect to the issuance of audit
reports.\77\ This section of SOX requires the PCAOB to include, in the
quality control standards that it adopts with respect to the issuance
of audit reports, seven requirements for every registered public
accounting firm relating to: (i) monitoring of professional ethics and
independence from issuers, brokers, and dealers on behalf of which the
firm issues audit reports; (ii) consultation within such firm on
accounting and auditing questions; (iii) supervision of audit work;
(iv) hiring, professional development, and advancement of personnel;
(v) the acceptance and continuation of engagements; (vi)
[[Page 74330]]
internal inspections; and (vii) such other requirements as the Board
may prescribe (subject to the general rulemaking authority provided to
the PCAOB in SOX Section 103(a)(1)).\78\ QC 1000 is a quality control
standard with respect to the issuance of audit reports that includes
each of these seven statutory requirements. Moreover, the fact that one
of the statutory requirements relates to the acceptance of engagements
implies that the PCAOB's QC standards must address firms that have not
yet accepted engagements and not just firms that currently issue audit
reports.
---------------------------------------------------------------------------
\76\ See Hughes Aircraft Co. v. Jacobson, 525 U.S. 432, 438
(1999); see also Loper Bright Enter. v. Raimondo, 144 S. Ct. 2244
(June 28, 2024) (``Courts interpret statutes, no matter the context,
based on the traditional tools of statutory construction, not
individual policy preferences.'').
\77\ See 15 U.S.C. 7213(a)(2)(B).
\78\ See 15 U.S.C. 7213(a)(2)(B).
---------------------------------------------------------------------------
Furthermore, we find the use of the term ``every'' in Section
103(a)(2)(B) significant, because it is the only place in SOX that uses
that term. In other sections of SOX, such as Sections 101, 104 and 106,
Congress used narrower language when it wanted to apply a particular
regulation to a smaller universe of public accounting firms or
registered public accounting firms.\79\ Further, requiring all
registered public accounting firms to design a system of quality
control that complies with QC 1000 is consistent with the Congressional
directive in SOX Section 102, which requires applicant firms that want
to register with the PCAOB to provide for review a description of ``the
quality control policies of the firm for its accounting and auditing
practices.'' \80\ We therefore find the Amendments are within PCAOB's
authority under Title I of SOX.
---------------------------------------------------------------------------
\79\ See 15 U.S.C. 7211(c)(1) (``. . . register public
accounting firms that prepare audit reports for issuers, in
accordance with section 102. . . '') (emphasis added); 15 U.S.C.
7214(a)(2)((A) (``The Board may, by rule, conduct and require a
program of inspection in accordance with paragraph (1), on a basis
to be determined by the Board, of registered public accounting firms
that provide one or more audit reports for a broker or dealer.'')
(emphasis added); 15 U.S.C. 7216 (``Any foreign public accounting
firm that prepares or furnishes an audit report with respect to any
issuer, broker, or dealer shall be subject to this Act . . .'')
(emphasis added).
\80\ 15 U.S.C. 7212. We also disagree that the design-only
requirement is contrary to the statements in the PCAOB's February
2023 letter to Senators Warren and Wyden. See C. Ho Statement
(citing https://www.warren.senate.gov/imo/media/doc/2023-02-08%20PCAOB%20Chair%20Erica%20Williams%20response%20letter%20to%20Senators%20Warren%20and%20Wyden.pdf). The PCAOB's letter specifically
addressed the PCAOB's statutory authority as it relates to the
cryptocurrency industry and stated, among other things, that ``[a]s
a general matter, audit firms registered with the PCAOB must follow
PCAOB standards and rules specifically in connection with their
audits of SEC-registered issuers, brokers or dealers only.'' The
letter does not specifically address whether an accounting firm that
does not perform audits for issuers, brokers, or dealers that
chooses to register with the PCAOB must comply with statutory
requirements related to systems of quality control.
---------------------------------------------------------------------------
Barriers to Entry
As noted above, several commenters expressed concerns that the
design-only requirement will increase the barriers to entry for small
firms to take on audits of smaller issuers or registered broker-dealers
and incentivize firms to de-register. Some commenters suggested the
requirement be revised to require the system to address only elements
of QC covered by the professional QC standards the firm is currently
subject to for the type of engagements they currently perform (e.g.,
the Other QC Standards).\81\ Similarly, one commenter suggested the
Commission defer the effective date of QC 1000 for inactive firms until
they become active.\82\ In the PCAOB response letter, the Board
reiterated that the design-only requirement would benefit investors and
explained why it believed the alternatives proposed by commenters would
not achieve the same level of investor protection as QC 1000.\83\ The
Board further stated that the design-only requirement comports with its
historical practice of requiring firms to provide a summary of the
design of their QC system upon registration, regardless of whether such
firms perform engagements under PCAOB standards.\84\
---------------------------------------------------------------------------
\81\ See letters from Chamber and Forvis Mazars.
\82\ See letter from PWC. See also letters from PICPA
(recommending that an ``inactive firm . . . not have to design its
quality control system until after it decided to accept an
engagement with a public company, broker, or dealer''); RSM
(recommending that firms be required to design, implement, and test
the effectiveness of their system of quality control in compliance
with QC 1000 prior to being engaged to issue public company audit
reports rather than upon registration).
\83\ See PCAOB response letter at 26-27.
\84\ Id. at 26.
---------------------------------------------------------------------------
We acknowledge concerns that the design-only requirement could
create barriers to entry or otherwise impact the decision to either
register, or remain registered, with the PCAOB for firms that do not
perform PCAOB engagements, and as discussed more fully in Section III.C
below, we have considered the overall competitive effects of the
Amendments on the market for audit services. These concerns must be
weighed against the investor protection benefits of the design-only
requirement. In particular, as the Board noted in the Adopting Release,
if a registered firm that has not led an engagement or played a
substantial role on an engagement in the past anticipates the
possibility of transitioning to performing engagements, the design-only
requirement may facilitate timely implementation and operation of their
QC 1000 compliant QC system.\85\ As would be the case in any profession
or industry when quickly adopting business-wide quality control
processes, allowing registered firms to design their QC system only
upon entering into an audit engagement would create a risk that
registered firms could be unprepared to accept and perform engagements
in compliance with applicable professional and legal requirements,
which in turn risks a reduction in audit quality.\86\
---------------------------------------------------------------------------
\85\ See Adopting Release, supra note 9, at 60-61.
\86\ Id. at 368.
---------------------------------------------------------------------------
We further considered the alternatives raised by commenters,
including allowing for compliance with Other QC Standards, or delaying
the effective date until firms accept an engagement under PCAOB
standards. However, we do not believe that either of these alternatives
sufficiently addresses the risks to investors of a firm entering into
audit engagements with an issuer or registered broker-dealer without a
QC system in place that provides reasonable assurance the firm could
conduct the engagement in accordance with applicable professional and
legal requirements. An audit firm's failure to conduct an engagement in
accordance with applicable professional and legal standards undermines
audit quality, puts at risk capital formation, and places investors and
issuers at risk.
Further, there are reasons to believe that the design-only
requirement will not be a significant barrier to entry or cause for
smaller firms to deregister, primarily due to the expected costs to the
majority of registered firms being substantially mitigated by
investments made by those firms to comply with the Other QC Standards,
which have already been adopted by the IAASB and AICPA and will be
effective at or before the effective date of QC 1000. In the Adopting
Release, the PCAOB stated that QC 1000 shares a basic structure and
approach with the Other QC Standards, so designing for the incremental
features unique to QC 1000 is not expected to be unduly burdensome for
firms that are subject to either or both of those Other QC
standards.\87\ The PCAOB also stated in the Adopting Release that it
believes most audit firms will have either already implemented or be
implementing one or both of the Other QC Standards when QC 1000 goes
into effect on December 15, 2025.\88\ The Commission staff compared the
[[Page 74331]]
requirements of QC 1000 with the requirements of the Other QC Standards
and similarly concluded that there is significant overlap and did not
identify anything that is incompatible with those other requirements.
Further, no commenters identified any aspects of QC 1000 that are
incompatible with these other requirements. Many of the specified
requirements in QC 1000 that are not in the Other QC Standards are
applicable only to firms issuing audit reports for more than 100
issuers. Therefore, with respect to these incremental requirements, any
firms required to design but not implement a QC system under QC 1000
would not be required to adopt those specified requirements. Further,
any other incremental requirements over Other QC Standard requirements
that are applicable to such firms are not expected to be burdensome to
design, especially given the inherent scalability of QC 1000. The
Commission staff also performed an analysis of registered firms and
determined, consistent with the PCAOB's evaluation, that most
registered firms will be subject to the Other QC Standards by the time
QC 1000 is effective.\89\ Based on the Commission staff's assessment,
we believe that these existing standards are likely to mitigate
compliance costs for a very substantial majority of registered firms.
---------------------------------------------------------------------------
\87\ Id. at 61.
\88\ See, e.g., id. at 330-31.
\89\ Commission staff estimate that approximately 77% of
registered firms are subject to the requirements of one or both of
the Other QC Standards. Details on this analysis can be found in
Section III.C.
---------------------------------------------------------------------------
Furthermore, other factors may serve to mitigate any adverse
competitive effects from the design-only requirement for smaller firms.
For example, some registered firms currently participate in PCAOB
engagements at a level below that of a ``substantial role,'' with the
level of involvement varying, with some of those firms participating at
a level approaching a ``substantial role.'' \90\ Larger firms could
have a greater incentive to use the work of registered public
accounting firms that are currently participating at a level below that
of a ``substantial role,'' or that are not participating in PCAOB
engagements at all, if the larger firms knew that such firms had
already designed a QC system in accordance with QC 1000. Therefore,
such smaller firms may have more opportunity to participate in audits
pursuant to PCAOB standards in the future. Other firms that would have
been subject to the design-only requirement may indeed choose to
deregister. Such deregistration may, nevertheless, not have an adverse
competitive effect if such firms were only intending to continue to
compete for work that does not require PCAOB registration, such as
participating in an audit pursuant to PCAOB standards at a level below
that of a ``substantial role,'' as their registration status would not
impact their eligibility for this work. Accordingly, for these reasons
and the reasons discussed in Section III.C, the Commission does not
believe this aspect of the Amendments is likely to have a significant
negative impact on the market for audit services or the pool of
registered audit firms.
---------------------------------------------------------------------------
\90\ Commission staff reviewed the publicly available PCAOB Form
AP database, ``FirmFilings,'' and filtered for Forms AP with an
``Audit Report Date'' between April 1, 2022 to March 31, 2023 to
identify ``other participant'' firms listed in column ``Audit Not
Divided Percent Information,'' available at https://pcaobus.org/resources/auditorsearch. For purposes of this analysis, staff
assumed that only ``other participant'' firms with a ``Firm ID'' in
the database were registered. Staff then compared this information
to the corresponding publicly available Form 2 data related to audit
reports filed between April 1, 2022 to March 31, 2023 to identify
firms that did not perform issuer audits, broker-dealer audits, or
perform any substantial role work based on responses to questions in
Part III, indicating that while not required to register, these
firms are registered. Staff then filtered the Form AP data to
isolate these firms, noting their roles are at less than a
``substantial role'' to varying degrees from 5-10% to 20-30% of
total audit hours in many cases.
---------------------------------------------------------------------------
B. EQCF Role
As described above, QC 1000 includes a requirement for the small
number of firms that issue audit reports for more than 100 issuers
during the prior calendar year to implement an EQCF. Composed of one or
more persons who are not principals or employees of the firm and do not
otherwise have a commercial, familial or other relationship with the
firm that would interfere with the exercise of independent judgment
with regard to the matters related to the QC system, the EQCF is
required to evaluate the significant judgments made and related
conclusions reached by the firm when the firm is evaluating and
reporting on the effectiveness of its QC system.\91\ The PCAOB stated
in the Adopting Release that an external oversight function should
enhance the discipline with which the firm carries out its own QC
system evaluation.\92\ The PCAOB also stated that, based on comments it
received on the Concept Release and the Proposing Release and
experience with inspections of firms' systems of quality control, it
believes that investors, audit committees, and other stakeholders will
benefit from the EQCF's evaluation.\93\
---------------------------------------------------------------------------
\91\ See Adopting Release, supra note 9, at 118.
\92\ Id. at 124.
\93\ Id.
---------------------------------------------------------------------------
General
Some commenters stated that they specifically supported the EQCF
role.\94\ One commenter emphasized the importance of the EQCF role.\95\
This commenter stated that it made sense to require firms that issue
audit reports for more than 100 issuers per year to be subject to
incremental requirements, such as the EQCF role, ``given such firms'
greater involvement in the U.S. capital markets and their impact on
investors.'' \96\ This commenter further stated that it appreciated
that the Amendments stressed ``the independence of the external
oversight function.'' \97\ Another commenter stated that the creation
of the EQCF ``is necessary in light of ongoing instances around the
globe which suggest the firms suffer from a lack of ethics throughout
the firms, including senior leadership.'' \98\
---------------------------------------------------------------------------
\94\ See letters from Consumer Federation of America and L.
Turner.
\95\ See letter from Consumer Federation of America.
\96\ Id.
\97\ Id.
\98\ See letter from L. Turner.
---------------------------------------------------------------------------
On the other hand, several commenters stated that they do not
support the requirement to incorporate an EQCF within the QC
system.\99\ Among other concerns, commenters asserted that the EQCF
requirement included prescriptive elements that were not exposed for
public comment; that the costs and benefits of the EQCF requirement had
not been adequately considered; that the requirement could vitiate
confidentiality protections under SOX; and that the requirement raised
personal liability and other concerns that could render the requirement
unworkable. Several commenters expressed the view that the requirement
would necessitate disclosure of firm deficiency information included in
Part II of PCAOB inspection reports to the person or persons serving in
the EQCF role in conflict with SOX and PCAOB rules or Congressional
intent.\100\ More
[[Page 74332]]
generally, commenters stated that it was unclear ``how the EQCF would
function within a firm's system of quality control'' \101\ and
suggested that the standard the PCAOB adopted ``expanded the
professional obligations and responsibilities'' of the EQCF role, which
would impose additional liability costs for those professionals.\102\
Another commenter stated that the EQCF requirement is ``neither
realistic nor needed'' given that the QC systems of firms are complex
and involve a multitude of judgments and conclusions and the PCAOB
already inspects large firms annually.\103\ One commenter stated that
``[f]irms that are close to or just above the 100-issuer mark may feel
compelled to consider reducing their issuer count below this
threshold'' as a result of the EQCF requirement.\104\ One commenter
raised concerns about the EQCF role in its initial comment letter to
the Commission and stated, in a subsequent supplemental comment letter,
that the PCAOB response letter ``provides additional clarity on several
of our questions,'' including with regard to the EQCF role,\105\ but
stated the PCAOB response ``did not address certain other key matters
raised by commenters'' \106\ and that the letter ``raises additional
questions.'' \107\ Specifically, this commenter stated ``it is not
clear how to square the Board's stated belief that requiring the EQCF
will `improve audit quality' and `drive improvement in a firm's QC
system' with the view that EQCF members would only be considered
`supervisory persons' if the EQCF had the `responsibility, ability, or
authority to affect the conduct of . . . associated persons. . . .' ''
\108\
---------------------------------------------------------------------------
\99\ See, e.g., letters from BDO; CAQ; Chamber; EY; Forvis
Mazars; Moss Adams; PICPA; and PWC.
\100\ See, e.g., letters from BDO; CAQ; Chamber; Forvis Mazars;
and PWC. See also letter from the Center for Audit Quality (Aug. 29,
2024) (``CAQ Supplemental Letter'') (stating that the PCAOB response
letter did not address ``certain other key matters'' raised by
commenters, such as ``the PCAOB's authority to compel disclosure of
information afforded confidential and privileged by The Sarbanes-
Oxley Act (e.g., Part II of PCAOB Inspection Reports)''); letter
from PICPA (expressing the view that the EQCF ``presents concerns
regarding the confidentiality of PCAOB Part II inspection
findings''); letter from RSM (``The SEC should consider whether SOX
restrictions on public disclosure of Part II inspection findings and
confidentiality of communications with inspection teams create
complexities for effectuating the PCAOB's intention with respect to
the EQCF's role.'').
\101\ See letter from Forvis Mazars.
\102\ See letter from BDO.
\103\ See letter from Chamber. See also letter from PWC (stating
``[w]e do not believe that firms should be viewed as incapable of
performing their own evaluations and conclusions on their QC systems
with full transparency to the PCAOB through its inspections process
but without third-party involvement'').
\104\ See letter from Moss Adams.
\105\ This commenter stated that, for example, the PCAOB comment
letter clarified the Board's belief that those serving in an EQCF
role would meet the definition of an ``associated person.'' See CAQ
Supplemental Letter.
\106\ This commenter stated that, for example, the PCAOB
response letter did not address the point raised in several comment
letters that the Amendments would require firms to disclose
confidential and privileged information to ``individuals a firm is
not otherwise even required to employ or contract.'' Id. In
addition, the commenter stated that the Board ``does not address
concerns raised by commenters about the new EQCF requirements being
stated by the Board to be analogous in some ways to an Engagement
Quality Reviewer.'' Id.
\107\ Id. The commenter asked the Commission to clarify whether
the PCAOB response letter ``can be viewed as equally authoritative
as the Final Standard and Adopting Release.'' We respond to this
comment in Section III.G below.
\108\ Id.
---------------------------------------------------------------------------
While we acknowledge the concerns raised by commenters about the
EQCF requirement, the Commission finds that the EQCF role is consistent
with the requirements of Title I of SOX and the rules and regulations
issued thereunder and is necessary or appropriate in the public
interest or for the protection of investors. We believe that an
independent oversight function for the small number of firms subject to
the requirement will enhance the effectiveness of a registered firm's
QC system, ultimately leading to improvements in audit quality. In
support of the EQCF requirement, one commenter pointed to the
importance of independence to ``high quality corporate governance in
the United States'' and stated that ``as independence has been
implemented, enhanced and monitored, it has led to investors relying to
a greater extent on corporate boards.'' \109\ We agree with this
commenter's views on the benefits of independence to governance
structures and concur with the PCAOB that adding an independent
perspective to an annually inspected firm's QC system self-evaluation
will promote a more rigorous evaluation process by those firms and
drive improvements in audit quality.\110\ In fact, the PCAOB stated
that, in connection with its oversight, ``certain firms have
acknowledged the limitations of internal QC functions led by non-
independent firm employees and have touted the benefits of independent
review.'' \111\ The PCAOB further stated that some firms have already
created leadership or advisory roles for independent third
parties.\112\ We find this evidence persuasive and therefore conclude
that requiring an external quality control function for registered
firms will serve the public interest and the protection of investors.
---------------------------------------------------------------------------
\109\ See letter from L. Turner.
\110\ See PCAOB response letter at 3, 9. In 2008, one of ACAP's
recommendations was to urge the PCAOB and the SEC, in consultation
with others, to ``analyze, explore, and enable, as appropriate, the
possibility and feasibility of firms appointing independent members
with full voting power to firm boards and/or advisory boards with
meaningful governance responsibilities to improve governance and
transparency of audit firms.'' See letter from L. Turner (citing and
quoting from ACAP recommendations).
\111\ See PCAOB response letter at 3.
\112\ Id. (including, for example, one firm that disclosed it
had ``robust discussions'' regarding its initial QC system
evaluation under ISQM 1 with its external quality advisors and
another firm that indicated its audit advisory council, which
includes two independent members, addresses matters related to the
QC system, including inspection results and remediation efforts).
See also PWC, 2023 Audit Quality Report, at 31 (describing its
``independent Assurance Quality Advisory Committee'' as providing
advice ``on aspects of the business, operations, culture,
governance, and risk management approach that are reasonably
expected to impact audit and assurance quality'' and stating that
such committee ``made us the first firm with both a Board that
includes external members and an independent advisory committee
focused on quality''), available at https://www.pwc.com/us/en/services/audit-assurance/library/audit-quality-report.html.
---------------------------------------------------------------------------
One commenter expressed doubts that the EQCF would improve audit
quality or drive improvements in a firm's QC system given the PCAOB's
view that the EQCF would only be considered a supervisory person if it
had responsibility, ability, or authority to affect the conduct of
associated persons.\113\ We understand this commenter to be suggesting
that the EQCF role will not result in improvements unless the EQCF has
some control with respect to decision-making at the firm. To the extent
the registered public accounting firms subject to the EQCF requirement
share the concern raised by this commenter, the Amendments provide
firms with flexibility to vest the EQCF with decision-making authority
to the extent they see fit. However, even absent decision-making or
other authority, we believe that the EQCF role will be able to drive
improvements in audit quality and a firm's QC system. An independent
perspective on the significant judgments made and conclusions reached
by the firm during its annual evaluation will help firms identify areas
of improvement in their QC systems that they can consider when
operating their QC systems. It is not uncommon for businesses to seek
external perspectives on a variety of topics or issues and the fact
that the business is the ultimate decision-maker does not mean that the
input provided is not valuable or beneficial to the process. In
addition, as noted above, some audit firms have voluntarily added
independent oversight to their governance structures, indicating that
they see a benefit to having an independent perspective.
---------------------------------------------------------------------------
\113\ See CAQ Supplemental Letter.
---------------------------------------------------------------------------
Relatedly, we do not believe that imposing an independent QC
monitor or independent QC consultant for a prescribed period of time as
remedial relief in a PCAOB enforcement action would serve as a viable
substitute for the EQCF requirement for the small number of firms
subject to the requirement, as suggested by one commenter.\114\ Based
on our experience with Commission enforcement actions,
[[Page 74333]]
audit quality and investor protection benefits are greater with a
prophylactic requirement aimed at preventing such violations from
occurring in the first place--before investors are potentially placed
at risk--than with only remedial relief in a handful of enforcement
actions for limited periods of time.\115\
---------------------------------------------------------------------------
\114\ See letter from PWC.
\115\ See PCAOB response letter at 10.
---------------------------------------------------------------------------
In addition to the overall benefits that an independent oversight
function would provide, we find that the Board's approach to mandating
this requirement in QC 1000 appropriately balances the need to enhance
the effectiveness of registered firms' QC systems with an approach that
provides flexibility in internal governance structures to minimize cost
and disruption. As adopted by the Board, the EQCF requirement will
provide significant flexibility for firms to design procedures that
work best for their individual firm governance structure and
requirements. QC 1000 does not specify where within the registered
public accounting firm the EQCF must be housed or to whom the EQCF must
report.\116\ These determinations are left to the discretion of the
firm. This flexibility will allow an independent EQCF \117\ to also
serve, for example, as an independent member of a firm's advisory
committee or audit quality committee or governance body, including one
that has a majority of non-independent members.\118\ Furthermore, to
the extent that firms have existing QC advisory committees, nothing in
the rule would prevent those committees, or independent members of
those committees, from serving as EQCF, provided they meet the rule's
independence standard and can discharge the assigned duties.
---------------------------------------------------------------------------
\116\ See QC 1000.28.
\117\ The EQCF must be independent in accordance with the
requirements in QC 1000.28. See Adopting Release, supra note 9, at
122 (stressing the importance of the independence requirement but
otherwise providing firms with discretion to determine the specific
credentials the EQCF must have as long as they have the experience,
competence, authority, and time necessary to carry out their
assigned responsibilities); PCAOB response letter at 8 (``As long as
the firm incorporates into its governance structure an EQCF that can
appropriately discharge its single prescribed responsibility (and
any additional responsibilities the firm might voluntarily assign to
it) in accordance with the QC 1000 standard, the firm would have
wide latitude to decide--in its discretion and based on its
particular circumstances--how best to design its EQCF.'').
\118\ A number of the audit firms that would be subject to the
EQCF requirement have stated publicly that they have independent
representation in their governance structure or plan to add such a
role in the near-term. See supra notes 31 and 112.
---------------------------------------------------------------------------
The Amendments also do not prescribe specific procedures to be
followed by the EQCF and require only one EQCF activity.\119\ The EQCF
must evaluate ``the significant judgments made and the related
conclusions reached by the firm when evaluating and reporting on the
effectiveness of the QC system.'' \120\ Notably, the EQCF's
responsibility does not extend to all of the firm's QC-related
judgments and conclusions, but only to significant ones made in
connection with the firm's annual QC-system evaluation and
reporting.\121\ Firms may, but are not required to, consider additional
oversight functions for the EQCF, such as reviewing the firm's
remediation actions and monitoring plan, or identifying and monitoring
emerging risks or trends that could potentially affect the firm's QC
system.\122\ Similar to the flexibility provided to audit firms in
determining how the EQCF will perform its responsibilities, audit firms
would have flexibility to consider, based on their individual firm
needs, what other functions, if any, would be beneficial. Along these
lines, one commenter noted that the PCAOB has pointed out the
flexibility of its approach and how a firm implementing it can apply
that flexibility. The commenter further stated that, based on the
commenter's experience with the auditing profession, the commenter
believes that the PCAOB is correct and that the approach the PCAOB took
with respect to the EQCF ``should, and will ultimately, allay the
concerns of audit firm commenters.'' \123\ Below we discuss the views
of commenters with respect to specific aspects of QC 1000's EQCF
requirement, as well as the Commission's findings regarding those
matters.
---------------------------------------------------------------------------
\119\ See QC 1000.28.
\120\ Id.
\121\ See PCAOB response letter at 7.
\122\ See Adopting Release, supra note 9, at 119-24.
\123\ See letter from L. Turner.
---------------------------------------------------------------------------
Notice and Comment
Several commenters expressed the view that the EQCF requirement was
not included in the Proposing Release and therefore was not properly
exposed for public comment before being adopted by the Board.\124\ One
commenter stated that the change from requiring an ``oversight function
for the audit practice'' in the Proposing Release to requiring an
``oversight function for the QC system'' in the Adopting Release
represents a significant change that ``effectively deprives us of an
opportunity for public input into the revised requirement.'' \125\
Another commenter stated that the requirement for the EQCF to evaluate
all ``significant judgments'' introduces ``prescriptive elements not
included in the original proposal.'' \126\ Conversely, one commenter
stated that ``[c]learly anyone who read and responded to the Concept
Release and exposure draft were aware that the PCAOB was moving to
adopt such a function in its final rule.'' \127\
---------------------------------------------------------------------------
\124\ See, e.g., letters from CAQ; Chamber; EY; Forvis Mazars;
Moss Adams; and PWC.
\125\ See letter from PWC.
\126\ See letter from Grant Thornton LLP (July 16, 2024)
(``GT'') (explaining that although the firm has an Audit Quality
Advisory Counsel, it does not meet the EQCF requirements in QC 1000,
particularly regarding the necessary authority and review of all
``significant judgments'').
\127\ See letter from L. Turner (discussing the relevant history
of the proposed QC standard, including the 2008 ACAP recommendation,
2019 Concept Release, and 2022 Proposing Release, and stating that
the PCAOB has gone through an ``extensive process of outreach'' to
both its Investor Advisory Groups and Standards Advisory Groups with
respect to quality control standards and noting that members of the
Standards Advisory Groups include members of the ``Big Four'' as
well as smaller firms).
---------------------------------------------------------------------------
As a threshold matter, we find that the public had a meaningful
opportunity to comment on the Amendments both as they were being
developed by the PCAOB and after they were filed with the Commission
for approval. The PCAOB received and considered comments in connection
with both the 2019 Concept Release and 2022 Proposing Release. The
comment period for the Proposing Release was open for 75 days, but the
PCAOB continued to accept comments up until its adoption of the
Amendments. The PCAOB considered all comments it received. After the
Amendments were filed with the Commission for approval, the Commission
published a notice to solicit comment on the Amendments with comments
due 21 days after the Notice of Filing of Proposed Rules was published
in the Federal Register. To provide additional time for consideration
of the Amendments and the issues raised therein, the Commission twice
extended the date by which it must act on the Amendments. During this
time, the Commission received additional input from both the Board and
public commenters. We have considered all of these comments in deciding
to approve the Amendments.
The Commission finds that the Board's process for approving the
Amendments complied with all applicable requirements. Although the
Board is not ``an agency or establishment of the United States
Government,'' \128\ for statutory purposes and therefore is not subject
to the requirements of the Administrative Procedure Act (``APA''),\129\
the Board as
[[Page 74334]]
a matter of policy has adopted a notice-and-comment process to inform
its decision-making.\130\ The Board followed that process here. The
PCAOB response letter details the standard-setting history relating to
the EQCF requirement, beginning with the 2008 recommendations from ACAP
and including the Concept Release, Proposing Release, consideration of
comments received to each, and Adopting Release.\131\ The Board
describes the outreach it performed and the input it received from a
variety of stakeholders over the course of that multi-year
process.\132\ The Board's analysis demonstrates that the core tenets of
``independent oversight over firm's QC systems'' were introduced in the
Concept Release,\133\ and were refined through the Board's stakeholder
engagement, including in response to comments received on their Concept
Release and Proposing Release.\134\ Accordingly, we find the Board's
process for approving the Amendments reasonable and appropriate.
---------------------------------------------------------------------------
\128\ 15 U.S.C. 7211(b).
\129\ See 5 U.S.C. 551(1) (defining an ``agency'' as ``each
authority of the Government of the United States''); id. Sec.
551(5) (defining ``rule making'' as ``agency process for
formulating, amending, or repealing a rule''); id. Sec. 553
(setting forth the requirements for agency rule making).
\130\ See PCAOB Staff Guidance on Economic Analysis in PCAOB
Standard Setting (2014), available at https://pcaobus.org/oversight/standards/economic-analysis/05152014_guidance.
\131\ See PCAOB response letter at 3-5.
\132\ Id.
\133\ Id. (noting that the Concept Release included a request
for comment asking, ``Should a future PCAOB QC standard incorporate
mechanisms for independent oversight over firms' QC systems (e.g.,
boards with independent directors or equivalent)?'').
\134\ Id. (stating that in response to the Proposing Release
``[m]any commenters called for more clarity and specificity about
the role of the oversight function'').
---------------------------------------------------------------------------
As proposed, consistent with the Concept Release,\135\ the PCAOB
contemplated an independent QC oversight function within the governance
structure of an audit firm.\136\ Specifically, the PCAOB proposed to
require an ``oversight function for the audit practice'' writ large
that included at least one individual who was not a principal or
employee of the firm and who did not have a relationship with the firm
``that would interfere with the exercise of independent judgment with
regard to matters related to the QC system'' (emphasis added).\137\ The
PCAOB explained in the Proposing Release that the proposed requirements
``would not specify how the firm would establish its governance
structure or assign authority, other than having one person in an
oversight role who would be in a position to exercise independent
judgment with regard to QC matters'' (emphasis added).\138\ The
proposed oversight function, coupled with the general requirement
relating to the ``exercise of independent judgment with regard to
matters related to the QC system,'' reasonably could have been read to
include, for example, oversight over all aspects of the QC system
including design, sufficiency, judgment, and overall effectiveness.
---------------------------------------------------------------------------
\135\ See Concept Release, supra note 10 (``We are considering
whether a future PCAOB QC standard should address mechanisms for
independent oversight over firms' QC systems.'') (emphasis added).
\136\ See Proposing Release, supra note 11, at 97 (``[T]he
firm's governance structure should incorporate an oversight function
for the audit practice that includes at least one person who is not
a partner, shareholder, member, other principal, or employee of the
firm and does not otherwise have a commercial, familial, or other
relationship with the firm that would interfere with the exercise of
independent judgment with regard to matters related to the QC
system.'').
\137\ Id. at 97 (``If the firm issued audit reports with respect
to more than 100 issuers during the prior calendar year, the firm's
governance structure should incorporate an oversight function for
the audit practice that includes at least one person who is not a
partner, shareholder, member, other principal, or employee of the
firm and does not otherwise have a commercial, familial, or other
relationship with the firm that would interfere with the exercise of
independent judgment with regard to matters related to the QC
system.'').
\138\ Id.
---------------------------------------------------------------------------
In response to the Proposing Release, commenters requested
specificity regarding the function and scope of the responsibilities
such an independent QC governance role would entail.\139\ After taking
such comments into consideration, the Board adopted an amended QC
standard that clarified the EQCF's status and role. Specifically, the
PCAOB narrowed the focus of the role from the proposal which, as
explained above, would have required an ``oversight function for the
audit practice'' to require an ``oversight function for the QC system''
and specified a single responsibility for the EQCF: ``evaluating the
significant judgments made and the related conclusions reached by the
firm when evaluating and reporting on the effectiveness of the QC
system.'' \140\
---------------------------------------------------------------------------
\139\ See Adopting Release, supra note 9, at 119-20 (citing
relevant commenter feedback on the Proposing Release).
\140\ Id. at 118.
---------------------------------------------------------------------------
One commenter specifically stated that the change from an
``oversight function for the audit practice'' to an ``oversight
function for the QC system'' was a significant change that was not
adequately explained or proposed for public comment.\141\ We disagree
with this commenter. The QC system is the process by which a firm
manages and improves its audit practice and therefore is an integral
and significant part of the audit practice, so that a role overseeing
the audit practice would necessarily also oversee the QC system in
addition to other aspects of a firm's audit operations. Therefore, an
``oversight function for the QC system'' is a subcomponent of an
``oversight function for the audit practice'' (e.g., a narrower version
of what was proposed). Moreover, the EQCF role was proposed in the
context of the PCAOB's new quality control standard and both the
PCAOB's proposed and adopted formulations of the oversight requirement
required that the individual or individuals who fill the role not have
any relationships with the firm ``that could interfere with the
exercise of independent judgment with regard to matters related to the
QC system'' (emphasis added).\142\ In our view, these explicit
references to the individual's responsibilities as they relate to the
``QC system'' weigh against commenters' claims that the EQCF role could
not have been anticipated from the proposal.\143\
---------------------------------------------------------------------------
\141\ See letter from PWC.
\142\ See Proposing Release, supra note 11, at 97.
\143\ See letters from CAQ and Chamber.
---------------------------------------------------------------------------
Moreover, many aspects of the Amendments related to the EQCF role
remain unchanged from the proposal. For example, the EQCF requirement
only applies to firms that issue audit reports with respect to more
than 100 issuers during the prior calendar year.\144\ The requirement
for independence remained the same with the exception of changing the
terminology from the singular to plural form (i.e., a grammatical
change).\145\ Although the Amendments describe the EQCF role as an
``external oversight function,'' the PCAOB response letter explains
that it used the phrase ``external'' to ``underscore that the function
is to be carried out by one or more persons who are independent and,
necessarily, external to the firm'' rather than imposing a separate
requirement.\146\ The proposal required the EQCF role to be composed of
``at least one person'' while the Amendments require the EQCF role to
be composed of ``one or more persons.'' In either case, only one
individual is required but a firm can choose to assign
[[Page 74335]]
more than one individual to the role.\147\ As discussed in greater
detail below, the individual or individuals who fill the EQCF role will
be ``associated persons of a registered public accounting firm,'' and
the same would have been true under the proposal. Finally, the
Amendments state that the ``EQCF should have the experience,
competence, authority, and time necessary to enable them to carry out
the responsibilities assigned to the EQCF by the firm.'' The PCAOB
explained in the Adopting Release that this change was made to
``conform[ ] the provision to the descriptions in QC 1000.12 of other
specified QC system roles'' that require the same qualifications to
perform their responsibilities.\148\
---------------------------------------------------------------------------
\144\ See Adopting Release, supra note 9, at 118-20.
\145\ Compare Proposing Release, supra note 11, at 97 (``. . .
includes at least one person who is not a partner, shareholder,
member, other principal, or employee of the firm and does not
otherwise have a commercial, familial, or other relationship with
the firm. . .'') and Adopting Release, supra note 9, at 118 (``. .
.composed of one or more persons who are not partners, shareholders,
members, other principals, or employees of the firm and do not
otherwise have a commercial, familial, or other relationship with
the firm. . .'').
\146\ See PCAOB response letter at 6.
\147\ See Adopting Release, supra note 9, at 118-20.
\148\ Id. at 120. Both the PCAOB's proposed and adopted versions
of QC 1000.12 stated, ``[t]he firm must assign other roles and
responsibilities with respect to the QC system to firm personnel who
have the experience, competence, authority, and time to enable them
to carry out their responsibilities.'' See Proposing Release, supra
note 11, at 68; Adopting Release, supra note 9, at 82. The EQCF is a
role with respect to the QC system, which is further clarified
through the conforming change described above.
---------------------------------------------------------------------------
Therefore, having considered the standard-setting process preceding
the EQCF requirement, we find that the public had considerable
opportunity to comment on the function and responsibilities of the EQCF
role included in the Amendments as well as on the similar, but more
broadly focused, independent oversight function in the Proposing
Release, on which the EQCF is based. Moreover, we find the changes made
to that role in the Adopting Release to be responsive to comments
received by the PCAOB from a variety of stakeholders. We also agree
with the Board that the only prescriptive requirement of the function--
the requirement to evaluate the significant judgments made and the
related conclusions reached by the firm when evaluating and reporting
on the effectiveness of the firm's QC system \149\--is both responsive
to requests for greater clarity and specificity and would benefit
investors by enhancing the discipline with which a firm carries out its
own QC system evaluation.\150\ Overall, we believe the changes
described above addressed feedback on the role that the Board received
on the Concept Release and Proposing Release, including that the role
did not go far enough; that the role's undefined authority made it
likely to be ineffective; and that more specificity and prescription
was needed to avoid overly broad interpretations of the requirements;
while maintaining a principles-based approach to allow firms to design
the EQCF as appropriate for their audit practice.
---------------------------------------------------------------------------
\149\ QC 1000.28 (``Responsibilities of the EQCF should include,
at a minimum, evaluating the significant judgments made and the
related conclusions reached by the firm when evaluating and
reporting on the effectiveness of the firm's QC system.'').
\150\ See PCAOB response letter at 6.
---------------------------------------------------------------------------
In addition, the public had the opportunity to provide comments to
the Commission on the Amendments adopted by the PCAOB. One commenter
stated that the ``time-period for providing comments to the SEC'' was
``constrained.'' \151\ As discussed above, however, the Commission
provided an initial comment period of 21 days, followed by an extension
of 14 days. The Commission also extended its period to consider the
Amendments two times, for a total of a 90-day period. Over the course
of the 90 total days during which the Amendments were under
consideration by the Commission, the public was able to continue to
submit comment letters. The Commission received over 20 letters in
total, several of which addressed the EQCF role in particular.\152\ The
Commission has considered the concerns raised by commenters and
addresses them below.
---------------------------------------------------------------------------
\151\ See Chamber letter.
\152\ See, e.g., letters from BDO; CAQ; Consumer Federation of
America; Chamber; EY; Forvis Mazars; Moss Adams; PICPA; PWC; and L.
Turner.
---------------------------------------------------------------------------
Alternatives to the EQCF Role
One commenter stated that it was concerned that the EQCF may not
achieve the effectiveness and accountability that is necessary because
of the flexibility provided to firms, and questioned whether a single
person would be able to fulfill the EQCF's responsibilities inside the
largest accounting firms.\153\ The commenter believed that a preferable
approach would be to require the creation of an independent board as
proposed by the ACAP and used by the FRC and the Japan Financial
Services Agency.\154\ As the PCAOB states in the Adopting Release, the
EQCF role may be carried out by ``one or more persons'' and therefore
larger firms will be able to determine whether it would be appropriate
to assign more than one person to the role given their size and
complexity.\155\ We note that the firms that will be subject to the
Amendments are of varying sizes and complexities and we therefore agree
with the PCAOB that a ``one size fits all'' approach is unwarranted.
Furthermore, we note that the PCAOB has stated that it intends to
monitor the implementation of QC 1000 through its inspections program
and outreach activities and ``will remain vigilant'' for any
information regarding the standard's effectiveness or implementation
challenges.\156\ With respect to the commenter's preferred approach of
creating an independent board, although we agree with the commenter
that experience has indicated that independent boards of issuers can be
very effective, such a requirement is not part of the Amendments and
therefore it is beyond the scope of this Order. In addition, we believe
that consideration would need to be given to how an independent board
requirement would interact with any applicable corporate governance
laws, particularly for those registered public accounting firms located
outside of the United States.
---------------------------------------------------------------------------
\153\ See letter from L. Turner.
\154\ Id.
\155\ See Adopting Release, supra note 9, at 121.
\156\ See PCAOB response letter at 24-25.
---------------------------------------------------------------------------
Disclosure, Confidentiality and Liability
Several commenters stated that the EQCF requirement conflicts with
SOX Sections 104(g)(2) or 105(b)(5)(A) \157\ because it would compel
audit firms to share non-public QC criticisms with the EQCF, who is
external to the firm.\158\ One commenter stated that the EQCF (or
members of the EQCF) would not be an associated person, given the
definition of associated persons in PCAOB Rule 1001(p)(i), and
considering that the EQCF consists of one or more independent third-
parties.\159\ This commenter further stated that discussions in the
Adopting Release ``cloud this issue,'' including the discussion of
whether the EQCF would be subject to supervisory liability under SOX
Section 105(c)(6).\160\ One commenter responded to the PCAOB response
letter stating that their ``objection is in the PCAOB requiring
disclosure to individuals a firm is not otherwise even required to
employ or contract.'' \161\
---------------------------------------------------------------------------
\157\ See 15 U.S.C. 7214(g)(2); 15 U.S.C. 7215(b)(5)(A).
\158\ See, e.g., letters from BDO; CAQ; Chamber; Forvis Mazars;
PICPA; and PWC.
\159\ See letter from Chamber. The CAQ Supplemental Letter
stated that the PCAOB response letter provided clarity on whether
the EQCF would be considered an associated person.
\160\ Id. See also letter from PWC (stating that the ``adopting
release raises the possibility that individuals filling this role
could be subject to liability under Section 105(c)(6) of SOX'').
\161\ See CAQ Supplemental Letter.
---------------------------------------------------------------------------
SOX Section 104(g)(2) provides that ``no portions of [a PCAOB]
inspection report that deal with criticisms of or potential defects in
the quality control systems of the firm under inspection
[[Page 74336]]
shall be made public if those criticisms or defects are addressed by
the firm, to the satisfaction of the Board, not later than 12 months
after the date of the inspection report.'' \162\ SOX Section
105(b)(5)(A) provides that, with certain exceptions, ``all documents
and information prepared or received by or specifically for the Board,
and deliberations of the Board and its employees and agents, in
connection with an inspection . . . or with an investigation . . .
shall be confidential and privileged as an evidentiary matter . . . in
any proceeding in any Federal or State court or administrative agency,
and shall be exempt from disclosure . . . under the Freedom of
Information Act . . . or otherwise.'' \163\
---------------------------------------------------------------------------
\162\ 15 U.S.C. 7214(g)(2).
\163\ 15 U.S.C. 7215(b)(5)(A).
---------------------------------------------------------------------------
The Commission finds that the disclosure of information to the EQCF
would not be a public disclosure under Section 104(g)(2) or
inconsistent with the confidentiality protections provided by Section
105(b)(5)(A) because those serving in the EQCF role would be associated
persons and therefore subject to the same confidentiality requirements
as the firm's partners, employees, and other associated persons.\164\
Under SOX Section 2(a)(9), an ``associated person of a public
accounting firm'' includes any ``independent contractor'' who, ``in
connection with the preparation or issuance of any audit report,''
receives compensation from the firm or ``participates as agent or
otherwise on behalf of'' the firm ``in any activity of that firm.''
\165\ For reasons the PCAOB explained, because individuals serving in
an EQCF role cannot be partners, shareholders, members, other
principals, or employees of the firm, they are likely to be engaged as
independent contractors.\166\ And those independent contractors would
meet the definition of an ``associated person'' under SOX Section
2(a)(9) because they are likely to be compensated for their work and,
in any event, would participate in the firm's activities--at least the
firm's evaluation and reporting process--on behalf of the firm.\167\
---------------------------------------------------------------------------
\164\ We note that the external oversight role as described in
the Proposing Release similarly would have met the definition of
associated person of a public accounting firm.
\165\ 15 U.S.C. 7201(a)(9). PCAOB Rule 1001(p)(i) provides a
substantially similar definition of ``person associated with a
public accounting firm.''
\166\ PCAOB response letter at 10.
\167\ One commenter suggested that its concerns about the
disclosure of confidential and privileged information to the EQCF
stem from the fact the PCAOB is ``requiring disclosure to
individuals a firm is not otherwise even required to employ or
contract.'' See CAQ Supplemental Letter. However, the Amendments
require the largest firms to establish and maintain an EQCF. As
explained above, we believe that such individual or individuals
serving in the EQCF would be associated persons--likely independent
contractors--and therefore, we expect that firms will enter into
contracts to set forth the terms and conditions of the role,
including non-disclosure agreements, just as with their other
independent contractors.
---------------------------------------------------------------------------
Like all associated persons, such independent contractors are part
of the PCAOB inspection or investigation process, not strangers to it.
They must cooperate with PCAOB inspections and investigations, comply
with related PCAOB requests, and prepare inspection- or investigation-
related documents for the PCAOB.\168\ Accordingly, such independent
contractors are not part of the public, and their involvement in Board
inspections and investigations and awareness of information related
thereto would not vitiate confidentiality protections.\169\ Indeed, as
the PCAOB observed, some firms currently share confidential information
with external advisors, including those serving in audit quality
advisory roles.\170\
---------------------------------------------------------------------------
\168\ 15 U.S.C. 7212(b)(3); 15 U.S.C. 7215(b)(5)(A).
\169\ See PCAOB response letter at 13 n.55 (citing In re Bieter
Co., 16 F.3d 929, 940 (8th Cir. 1994) (addressing the waiver of
attorney-client privilege in the context of disclosure to an
independent contractor); In re Flonase Antitrust Litig., 879 F.
Supp. 2d 454, 459 (E.D. Pa. 2012) (same); In re Copper Mkt.
Antitrust Litig., 200 FRD. 213, 219 (S.D.N.Y. 2001) (same); Am. S.S.
Owners Mut. Protection & Indem. Ass'n v. Alcoa S.S. Co., 232 FRD.
191, 198 (S.D.N.Y. 2005) (addressing the waiver of attorney-client
privilege in the context of disclosure to corporate directors);
Strougo v. BEA Assocs., 199 FRD. 515, 525 (S.D.N.Y. 2001) (same,
with respect to outside directors)); see also letter from L. Turner
(stating that the legislative history of the SOX Section 104(g)(2)
indicates that it was intended to prohibit the PCAOB from disclosing
information it obtained regarding quality control deficiencies but
that the firms could disclose that information to their audit
committee if they chose to).
\170\ See PCAOB response letter at 12 (citing the 2023 Audit
Quality Report of BDO, which states that its audit advisory council
addresses matters related to its QC system, including inspection
results and remediation efforts, and the 2022 Audit Quality and
Transparency Report of Grant Thornton, which states that it grants
its audit quality advisory council full access to firm information
to help them fully understand the system of quality control). We
note that BDO states in its 2023 Audit Quality Report that two
members of its audit advisory council are independent and Grant
Thornton states in its 2022 Audit Quality and Transparency Report
that two members of its audit quality advisory council are
independent.
---------------------------------------------------------------------------
QC 1000 does not specify what information affected firms must share
with the EQCF, giving firms flexibility in determining the
responsibilities of the EQCF and what information is needed for the
EQCF to fulfill its role, as long as the EQCF complies with the minimum
requirement to evaluate all significant judgments made by the firm with
respect to its QC system. Also, firms may enter other types of
independent-contractor arrangements, including with individuals at an
affiliated firm within a global network or personnel at shared services
centers outside of the firm.\171\ A determination that the EQCF is not
an associated person would have significant consequences for those
arrangements. Finally, a firm would be free to impose confidentiality
or non-disclosure requirements on the EQCF to the same extent a firm is
able to impose such requirements on its other independent contractors.
---------------------------------------------------------------------------
\171\ See PCAOB response letter at 13-14.
---------------------------------------------------------------------------
Although their status as associated persons could result in
potential personal liability for individuals that take on the EQCF
role, we believe this is appropriate given that the EQCF, like any
other associated person, should exercise due professional care when
fulfilling their responsibilities--responsibilities that, as we have
explained above, serve an important investor protection role. We note
that the significant flexibility afforded to firms under the Amendments
to design procedures for the EQCF that work best for their individual
firm governance structure may help to mitigate concerns that the
attendant personal liability could discourage qualified individuals
from taking on such a role.
Commenters also raised concerns about the potential liability
exposure of the EQCF if the individual serving in that role was
considered not only an associated person of the firm, but also a
supervisory person. Under SOX Section 105(c)(6), the Board may impose
sanctions on a ``supervisory person'' who ``fail[s] reasonably to
supervise an associated person'' and ``such associated person commits a
violation'' of a relevant law, rule, or standard.\172\ The Commission
agrees with the PCAOB that the minimum requirements of the EQCF would
not, on their own, make the individual or individuals ``supervisory
persons,'' and that the assessment of whether any particular individual
serving in the EQCF role is a supervisory person would need to consider
any additional responsibilities or authorities the audit firm assigned
to them.\173\ Again, however, the flexibility
[[Page 74337]]
afforded to firms under the Amendments to determine what additional
functions, if any, would be performed by EQCF should serve to mitigate
concerns.
---------------------------------------------------------------------------
\172\ 15 U.S.C. 7215(c)(6).
\173\ Section 105(c)(6) addresses supervision in terms that are
``similar to those that apply to broker-dealers under section
15(b)(4) of the Securities Exchange Act of 1934.'' S. Rep. No. 107-
205 at 11, 49. Exchange Act Sections 15(b)(4)(E) and 15(b)(6)
provide a theory of liability for broker-dealers and their
associated persons that have failed reasonably to supervise, with a
view to preventing violations of the federal securities laws and the
rules thereunder, another person who commits such a violation, if
such other person is subject to the broker-dealer or associated
person's supervision. 15 U.S.C. 78o(b)(4)(E) and (b)(6). In that
context, the Commission has explained that ``determining if a
particular person is a `supervisor' depends on whether, under the
facts and circumstances of a particular case, that person has a
requisite degree of responsibility, ability or authority to affect
the conduct of the employee whose behavior is at issue.'' John H.
Gutfreund, Rel. No. 34-31554, 51 SEC 93, 113 (Dec. 3, 1992) (settled
order and Exchange Act 21(a) Report). See also, e.g., SEC v. Yu, 231
F.Supp.2d 16 (D.D.C. 2002) (court found individual violated
supervisory bar by retaining involvement in hiring and firing, and
supervising compliance staff); Steven E. Muth, Rel. No. 34-52551,
2005 WL 2428336 (Oct. 3, 2005) (Commission opinion) (individual had
requisite degree of control where he participated in decision to
hire and later to suspend registered representative).
---------------------------------------------------------------------------
Relatedly, several commenters raised concerns that potential
liability under Section 105(c)(6) of SOX for the person or persons
fulfilling the EQCF role could limit the pool of candidates for this
role.\174\ However, we do not believe that any potential liability will
significantly impact the pool of candidates, given the flexibility
afforded to firms in the structuring of the role and the impact of such
flexibility on liability considerations, as well as the fact that the
requirement only applies, as the PCAOB observed, to the small number of
firms meeting the 100-issuer threshold \175\ and that several of those
firms already have independent members of their firm governance or
audit quality structure whose responsibilities, in some cases, may
already meet the requirements of the EQCF, or who otherwise may be
willing to expand such responsibilities.
---------------------------------------------------------------------------
\174\ See, e.g., letters from BDO; CAQ; and PWC.
\175\ See PCAOB response letter at 17-21. See also supra note 30
(only 14 of the approximately 1,600 PCAOB-registered firms issued
audit reports to more than 100 issuers as of 2023 but one of those
firms has since filed an application for withdrawal from
registration).
---------------------------------------------------------------------------
Other
One commenter stated that firms that are close to or just above the
annual 100-issuer audit report threshold may feel compelled to consider
reducing their issuer count below this threshold to avoid the EQCF
requirement and that such exits would undermine competition.\176\
However, we believe such an effect is unlikely to be significant given
that, as the Board observed in the Adopting Release and in the PCAOB
response letter, very few firms are close to the 100-issuer threshold.
Specifically, PCAOB staff analysis of audit reports included in
Commission filings during the 2022 calendar year indicated that two
registered public accounting firms audited between 80 and 100 issuers
and two registered public accounting firms audited between 100 and 120
issuers.\177\ In addition, we expect that the minimum requirements for
the EQCF role and the flexibility provided to firms to implement the
role would reduce the likelihood that firms would be motivated to stay
below the 100-issuer threshold to avoid the requirement. Furthermore,
we agree that using the 100-issuer threshold is a reasonable approach
because, as the PCAOB noted in the Adopting Release, firms are already
familiar with this statutory threshold in the PCAOB inspection context
and because we agree with the commenter who stated that the 100-issuer
threshold was appropriate ``given such firms' greater involvement in
the U.S. capital markets and their impact on investors.'' \178\ SOX
provides that firms that provide audit reports for more than 100
issuers are subject to annual inspection by the PCAOB and firms that
provide audit reports for 100 issuers or fewer are subject to
inspection triennially.\179\ Therefore, not only are firms familiar
with the threshold, we believe firms monitor the size of their issuer
practice for purposes of monitoring their inspection requirements and
using the same threshold would avoid requiring the small number of
firms that are close to or above the 100-issuer threshold to track a
different threshold for purposes of compliance with QC 1000.
---------------------------------------------------------------------------
\176\ See letter from Moss Adams (stating ``[f]rom the
standpoint of a firm that is subject to annual inspection and
marginally exceeds the 100-issuer threshold, the disparity in scale,
operational scope, and complexity when compared to other firms under
similar scrutiny is substantial. Thus, we encourage the Board
conduct a more in-depth economic analysis of the EQCF role, along
with qualitative analysis of the proposed impact to audit quality
and the interplay with the PCAOB's annual inspection of firms'
systems of quality.'').
\177\ See Adopting Release, supra note 9, at 362; PCAOB response
letter at 17 n. 72.
\178\ See Adopting Release, supra note 9, at 67; letter from
Consumer Federation of America. See also,15 U.S.C. 7214(b)(1)(A).
\179\ See 15 U.S.C. 7214(b)(1)(A).
---------------------------------------------------------------------------
Some commenters raised questions about the Board's analogy of the
EQCF to the Engagement Quality Reviewer (``EQR'').\180\ One commenter
stated that the analogy the PCAOB made between the EQCF and the EQR was
``not well analogized'' because the EQR is required to perform a review
under specific requirements that are the subject of an auditing
standard while the PCAOB has not provided such specific requirements
for the performance of the EQCF's evaluation.\181\
---------------------------------------------------------------------------
\180\ See, e.g., letters from EY; CAQ Supplemental Letter; and
PWC.
\181\ See letter from PWC.
---------------------------------------------------------------------------
The analogy the PCAOB drew between the EQCF and the EQR in the
Adopting Release noted certain similarities between the two roles, but
also identified important differences between the requirements for the
roles, including that the EQCF is not required to provide concurring
approval, as is required of an EQR.\182\ The EQR's concurrence instills
responsibility and authority over the activities of the audit
engagement team and places the EQR in a supervisory position in an
audit engagement. On the other hand, as the PCAOB has made clear, the
EQCF is not required to approve the firm's conclusions regarding its
significant judgments for the firm to make a conclusion on the
effectiveness of the QC system.\183\ As explained above, the
requirement to evaluate the significant judgments and conclusions
reached does not, by itself, impose supervisory responsibilities on the
EQCF nor is the EQCF's concurrence with the firm's conclusions
required. The EQCF's evaluation is an input into the firm's assessment
of its QC system and while it may inform the actions of individuals, it
does not direct such actions.
---------------------------------------------------------------------------
\182\ See Adopting Release, supra note 9, at 121.
\183\ Id.; PCAOB response letter at 7.
---------------------------------------------------------------------------
Another commenter who addressed the PCAOB's comparison of the EQCF
and EQR roles stated that, unlike the EQR who is governed by the
requirements in the PCAOB's engagement quality review standard, the
Amendments do not prescribe certain details regarding the EQCF's role
and responsibilities.\184\ Specifically, the commenter stated that the
final standard does not, among other things: (1) specify the procedures
the EQCF should perform to evaluate the significant judgments made and
related conclusions reached; (2) address the nature, timing, and extent
of the EQCF's review; or (3) address how differing judgments made by
the EQCF and the firm should be resolved or documented.\185\ This
commenter stated that this creates uncertainty regarding the
application of the responsibilities specified in the standard and
raises questions about the potential liability of the EQCF.\186\ We
disagree with the views expressed by the commenters discussed above.
The PCAOB adequately explained this comparison in the Adopting Release,
noting
[[Page 74338]]
similarities between the two roles, but also explaining important
differences, which we have highlighted, above.\187\ In our view, the
referenced discussion sought to clarify aspects of the EQCF without
imposing any new requirements on registered public accounting firms or
changing the requirements for the EQCF as set forth in the Amendments.
---------------------------------------------------------------------------
\184\ See letter from EY.
\185\ Id.
\186\ Id. We addressed the liability concerns related to the
EQCF role earlier in this Order.
\187\ See Adopting Release, supra note 9, at 121.
---------------------------------------------------------------------------
With respect to the commenter's concerns about the lack of
prescriptiveness of the EQCF requirement, the PCAOB explained its
decision to provide firms with flexibility to design the EQCF role to
fit their particular circumstances and firm governance structure in
both the Adopting Release and the response letter.\188\ As discussed
above, we find that the Board's approach to the EQCF requirement in QC
1000 appropriately balances enhancing the effectiveness of audit firm
QC systems with flexibility that allows for effective scaling and
customization for firms of varying sizes, structures, and risk
profiles, as well as minimizing cost and disruption. Regarding the
question on resolution of differences, the Amendments provide audit
firms with broad flexibility with respect to the implementation of the
EQCF role, including applicable internal procedures. As the Amendments
do not require that the EQCF have any specific decision-making
responsibility or other authority, firms are generally free to
determine an approach to any such differing judgments between the EQCF
and the firm in the manner that they deem most appropriate for their
firm.
---------------------------------------------------------------------------
\188\ Id. at 122; PCAOB response letter at 7.
---------------------------------------------------------------------------
To the extent that firms have questions about the implementation of
the EQCF role, the PCAOB stated that it anticipates that, consistent
with its historical practice, its staff will issue implementation
guidance and will engage in other activities to support firms'
implementation efforts.\189\ We encourage the PCAOB to provide this
implementation guidance and other support, which could be useful to
firms, with respect to the Amendments generally and in particular for
the EQCF role.
---------------------------------------------------------------------------
\189\ PCAOB response letter at 28.
---------------------------------------------------------------------------
Two commenters suggested that the EQCF is unnecessary because a
firm's annual self-evaluation of its QC system, coupled with the
PCAOB's annual inspections of that QC system, should suffice.\190\ We
are persuaded, however, that the EQCF requirement will provide
meaningful additional safeguards beyond those realized from self-
evaluations and inspections. The EQCF's evaluation should provide the
firm with real time, independent feedback, enabling the firm to enhance
its quality control system on an ongoing basis whereas any response it
receives from the PCAOB during its inspections process occurs at a
later point in time. In this way, the EQCF role is consistent with the
objective of a quality control standard that fosters continuous
improvement--one of the PCAOB's express aims in adopting QC 1000.\191\
---------------------------------------------------------------------------
\190\ See letters from PWC and Chamber.
\191\ See Adopting Release, supra note 9, at 5 (``We are
adopting an integrated, risk-based standard, QC 1000, A Firm's
System of Quality Control, that mandates quality objectives and key
processes for all firms' QC systems, with a focus on accountability
and continuous improvement.).
---------------------------------------------------------------------------
Some commenters stated the requirements for the EQCF are unclear
(e.g., requirements around documentation of EQCF's evaluation).\192\
The PCAOB response letter addresses the documentation requirements as
they relate to the EQCF.\193\ The PCAOB response letter states that,
under QC 1000, it is the firm that bears responsibility for complying
with documentation requirements related to the EQCF role not the
individual or individuals who comprise the EQCF.\194\ Indeed, the EQCF
could provide its evaluation orally because there is no requirement in
QC 1000 that the EQCF must document or provide its evaluation in
writing.\195\ Further, QC 1000 does not prescribe to whom the EQCF must
report, giving firms flexibility to develop the form of reporting and
the line of reporting by the EQCF. We note, moreover, that it is
typical for implementation questions to arise around new accounting or
auditing requirements. To the extent additional clarity on specific
requirements related to EQCF is necessary, we believe PCAOB staff
implementation or other guidance would sufficiently assist firms with
interpreting the requirement. As noted above, the PCAOB stated that it
anticipates that, consistent with its historical practice, its staff
will issue implementation guidance and will engage in other activities
to support firms' implementation efforts.\196\
---------------------------------------------------------------------------
\192\ See, e.g., letters from CAQ; Forvis Mazars; and GT. See
also letter from EY (stating ``it is unclear how firms will
understand and document the EQCF's identification of and conclusion
about the firm's significant judgments'').
\193\ See PCAOB response letter at 14-15.
\194\ Id. at 14.
\195\ Id. at 15 (stating ``QC 1000 imposes a documentation
requirement regarding the EQCF's operation on the firm, not on the
individuals who comprise the EQCF--though the firm's EQCF policies
could provide guidance to those individuals about what they should
or should not do to facilitate the firm's retention of appropriate
documentation about the EQCF's operation'' (emphasis added)) and 14
(stating that all of the firm's documentation under QC 1000 must be
documented ``in sufficient detail to enable an experienced auditor
who understands QC systems but has no experience with the firm's QC
system to understand how the EQCF is designed'').
\196\ Id. at 28. One commenter stated that subsequent PCAOB
staff guidance is an insufficient alternative to or remedy for the
lack of notice and comment for the EQCF requirement. See letter from
Chamber. However, as explained above, the Board followed its own
notice-and-comment process and the EQCF requirement included in the
Amendments was the result of changes made in light of commenter
feedback on the PCAOB's proposed external oversight function.
---------------------------------------------------------------------------
C. Economic Implications of the Amendments
Commenters expressed concerns that the costs arising from QC 1000
and certain of its requirements are not appropriately described and
that a more rigorous economic analysis is necessary before the
Amendments can be approved.\197\ One commenter stated that the economic
analysis conducted by the PCAOB in the Adopting Release was deficient
because it did not discuss any plans for post-implementation review or
details on how such a review will be conducted.\198\ By contrast,
another commenter observed that the PCAOB issued a staff white paper in
November 2022 identifying research that suggests the PCAOB's proposed
QC standard could lead to greater compliance with professional
standards and improve financial reporting quality.\199\ This commenter
also stated that the ``costs of deficient failed audits, can and have
been significant and even catastrophic to investors, employees, and the
U.S. economy.'' \200\
---------------------------------------------------------------------------
\197\ See, e.g., letters from BDO; Chamber; PICPA; and PWC.
\198\ See letter from Chamber.
\199\ See letter from L. Turner (citing Public Company
Accounting Oversight Board, Staff White Paper, The Impact of Quality
Control System Remediation on Audit Performance and Financial
Reporting Quality (Nov. 2022), available at https://assets.pcaobus.org/pcaob-dev/docs/default-source/rulemaking/docket046/qc-staff-white-paper-november-2022.pdf?sfvrsn=ddb22504_4).
\200\ Id.
---------------------------------------------------------------------------
The PCAOB response letter addresses commenter feedback on its
economic analysis.\201\ The Board stated that, where possible,
quantitative data was used and that, when this data was not available,
the Board used qualitative factors in its analysis.\202\ The Board also
stated that available data and methods do not permit them to fully
quantify all of the benefits and costs of QC 1000 and that commenters
on this topic did not provide studies or data that permitted complete
quantification of the benefits or costs of QC 1000.\203\ When
commenters did suggest relevant data or research, the Board stated that
it
[[Page 74339]]
considered it and incorporated that data or research into its economic
analysis as appropriate.\204\
---------------------------------------------------------------------------
\201\ See PCAOB response letter at 21-22.
\202\ Id.
\203\ Id.
\204\ Id.
---------------------------------------------------------------------------
As part of our assessment of the Amendments, we have considered the
economic analysis conducted by the PCAOB in the Adopting Release as
well as the comments received on this point and the additional
information provided in the PCAOB response letter. Below we evaluate
the PCAOB's analysis in order to reach our own conclusion about the
economic implications of the Amendments. On many points, we find the
PCAOB's analysis reasonable; however, where appropriate, we have
expanded upon that analysis. Moreover, we have considered the specific
concerns raised by commenters about the unintended consequences of the
Amendments and, as discussed in more detail below, have concluded that
the Amendments are unlikely to have a significant adverse effect on
efficiency and competition within the market for audit services.\205\
---------------------------------------------------------------------------
\205\ One commenter stated that Exchange Act Section 3(f), 15
U.S.C. 78c(f), requires the Commission to consider the economic
implications of the Amendments before approving or disapproving
them. See letter from Chamber. Regardless of whether Section 3(f)
applies in Commission review of PCAOB rules, because the PCAOB
addressed the economic implications of the Amendments and commenters
have raised concerns about that analysis, the Commission has
likewise considered the economic implications of the Amendments and
addresses those implications here. See Bloomberg, L.P. v. SEC, 45
F.4th 462, 476 (D.C. Cir. 2022) (APA requires the Commission to
``respond adequately'' to ``relevant concerns about the direct and
indirect costs of'' a proposal raised by commenters, regardless of
what Section 3(f) requires).
---------------------------------------------------------------------------
The PCAOB's economic analysis addresses the benefits and costs
associated with the Amendments, including, but not limited to, the
design requirement, which applies to all registered firms, and the EQCF
requirement, which applies to a small number of firms. The PCAOB's
analysis explains the expected benefits to investors and other
financial statement users that will be realized by improving compliance
with applicable professional and legal requirements and thereby
improving financial reporting quality.\206\ In addition, the PCAOB's
analysis addresses unintended consequences of the Amendments, such as
potential effects on human capital, competition concerns, including the
concern raised by some commenters that the requirements could diminish
the availability of global network resources and that smaller firms
around the world could decline to assist U.S. firms with global audits,
and the potential negative consequences related to increased
accountability or liability.\207\ Finally, the Board stated in the
PCAOB response letter that it intends to follow its normal practice
under which staff in its Office of Economic and Risk Analysis will
conduct an analysis and make a recommendation to the Board as to
whether to conduct a post-implementation review of the Amendments.\208\
We encourage the Board to conduct such a post-implementation review.
---------------------------------------------------------------------------
\206\ See Adopting Release, supra note 9, at 341-43.
\207\ Id. at 358-66; see also letter from BDO (``There should be
further consideration of the potential impacts of this standard on
the competitive landscape of firms outside the U.S. where
possible.'').
\208\ See PCAOB response letter at 24.
---------------------------------------------------------------------------
Below we examine the individual elements of the Board's economic
analysis, including its consideration of the effects on efficiency,
competition, and capital formation.
Consistent with best practice when conducting an economic
analysis,\209\ the Board includes a baseline assessment of existing
audit requirements and practices against which the potential effects of
the Amendments can be considered. The Board presents analyses of
quantitative proxies for the level of compliance with existing
professional standards, including information on Part I.A deficiencies,
QC deficiencies related to audit performance, and broker-dealer
engagement deficiencies, from the audits or engagements inspected by
the PCAOB. Overall, these analyses suggest that some firms' QC systems
may not be providing the required reasonable assurance. The Board's
analysis indicates that broker-dealer engagements and issuer audits
performed by firms other than the U.S. global network firms (``GNFs'')
\210\ appear to have more room for improvement on average based on the
period examined. The Board also presents research that it conducted on
existing policies and procedures at U.S GNFs. This research finds that
U.S. GNFs are already devoting extensive resources to the design,
implementation, and operation of QC policies and procedures related to
the ISQM 1 requirements.\211\ Further, the Board observes that
commenters on the Proposing Release indicated that non-GNFs have been
devoting resources to the design, implementation, and operation of QC
policies and procedures related to ISQM 1 and/or SQMS 1 requirements,
though some of these firms may have more narrowly focused their
resources on the design component and may not yet be spending resources
to operate QC policies in line with SQMS 1. Lastly, the Board's
baseline assessment provides information on the evolution of firms' QC
policies and procedures and discusses academic research on behaviors
that suggest certain weaknesses in QC systems in practice.
---------------------------------------------------------------------------
\209\ See SEC Staff, Current Guidance on Economic Analysis in
SEC Rulemaking (Mar. 16, 2012), available at https://www.sec.gov/divisions/riskfin/rsfi_guidance_econ_analy_secrulemaking.pdf; PCAOB
Staff, Staff Guidance on Economic Analysis in PCAOB Standard-Setting
(Feb. 14, 2014), available at https://pcaobus.org/oversight/standards/economic-analysis/05152014_guidance.
\210\ See Adopting Release, supra note 9, at 54. The six global
networks that contain the largest number of registered, non-U.S.
firms as reported on Form 2s filed in 2023 are: BDO International
Limited, Deloitte Touche Tohmatsu Limited, Ernst & Young Global
Limited, Grant Thornton International Limited, KPMG International
Cooperative, and PricewaterhouseCoopers International Limited (the
member firms of these networks are collectively referred to herein
as ``GNFs''). The non-affiliated firms (``NAFs'') include registered
public accounting firms that are not members of global network
firms.
\211\ See Adopting Release, supra note 9, at 318-23.
---------------------------------------------------------------------------
Several commenters on the Proposing Release suggested that some
firms have already designed and implemented, or are in the process of
designing and implementing, QC policies and procedures consistent with
the requirements of Other QC Standards.\212\ The Board supported that
view, but many commenters on the Proposing Release disagreed with this
characterization of the baseline and stated that QC 1000 will impose
significant costs.\213\ The Commission staff independently examined the
number of PCAOB-registered audit firms that will be affected by QC
1000, including the extent to which they may be affected.
---------------------------------------------------------------------------
\212\ Id. at 331.
\213\ Id. at 351-60.
---------------------------------------------------------------------------
There are 1554 audit firms registered with the PCAOB as of August
2024.\214\
[[Page 74340]]
Among these, 659 firms performed an engagement under PCAOB standards
for an issuer or registered broker-dealer. These firms will have to
fully implement QC 1000. Out of these 659 firms, 323 are U.S. firms
that issued opinions under AICPA standards and, should they continue to
do so, will have to implement SQMS 1; 199 are non-U.S. firms that are
GNFs and are therefore likely to implement ISQM 1; and another 60 are
non-U.S. firms that have an audit-related membership, affiliation, or
similar arrangement. We believe that non-U.S. firms that have an audit-
related membership, affiliation, or similar arrangement, especially
GNFs, are likely to have implemented ISQM 1 due either to their own
issuance of audit reports under International Auditing Standards, or as
a recommendation or requirement due to its audit-related membership,
affiliation, or similar arrangement.\215\ Hence, in total, we believe
that 582 of the 659 firms (i.e., 88%), by the effective date of QC
1000, will already be subject to quality control requirements that
share a basic structure with the requirements in QC 1000. This overlap
significantly reduces the cost and benefits of the Amendments, to the
extent that these firms in fact comply with the Other QC Standards.
Recognizing that the Amendments are likely to increase compliance with
these shared quality control requirements (i.e., as a result of PCAOB
inspections and enforcement of QC 1000), firms may incur costs relative
to the baseline, and there may be corresponding benefits to investors
stemming from audit quality improvement.
---------------------------------------------------------------------------
\214\ Based on Commission staff analysis. Data on firms
registered with the PCAOB come from the PCAOB's website: Registered
Firms, PCAOB, https://pcaobus.org/oversight/registration/registered-firms. We identify whether an audit firm has performed an engagement
under PCAOB standards for an issuer or registered broker-dealer
using the ``Audit Report Activity'' filter. Staff identified U.S.
and non-U.S. firms by using the country variable in the PCAOB data.
U.S. firms include those in the United States and Puerto Rico. To
identify firms that participate in the AICPA peer review program,
staff extracted a list of participating firms from the following
website: Public File Search, AICPA Peer Review Web Program, https://peerreview.aicpa.org/public_file_search.html. Staff manually matched
those firms by auditor name and, if necessary, city and state to the
PCAOB data. Staff identified non-U.S. firms that were part of the
GNF by collecting data listed at Global Network Firms, PCAOB,
https://pcaobus.org/oversight/registration/global-network-firms, and
matching it to the PCAOB data by auditor name, city, state, and
manually reviewing the firm summaries to compare Firm IDs. Finally,
for non-US firms that were non-GNF, staff determined whether they
were members of or affiliated with some other network, arrangement,
alliance, partnership, or association using Form 2 (i.e., any audit
firm that answered ``Yes'' for either Item 5.2a.1 or Item 5.2a.2 has
an ``audit-related membership, affiliation, or similar
arrangement'').
\215\ For example, each of the following transparency reports
state that global network policies require compliance with ISQM 1.
See, e.g., EY Global Audit Quality Report (June 2024), available at
https://www.ey.com/content/dam/ey-unified-site/ey-com/en-gl/insights/assurance/documents/ey-global-audit-quality-report-06-2024.pdf; BDO Transparency Report (June 2023), available at https://www.bdo.global/en-gb/about/global-network/transparency-report-2023;
Crowe Global Transparency Report (2024), available at https://www.crowe.com/global/-/media/crowe/international/files/about-us/crowe_global_transparency_report.pdf?rev=015641ea64c9491983ed47106226ddcf&hash=492F11006140712E365E07C80FF9CD5E.
---------------------------------------------------------------------------
Another 845 firms of the 1,554 firms registered with the PCAOB have
not performed an engagement under PCAOB standards for an issuer or
registered broker-dealer within the past year and thus would only be
subject to the design-only requirement.\216\ Out of these 845 firms,
259 are U.S. firms that issued opinions under AICPA standards and,
should they continue to do so, will have to implement SQMS 1; 98 are
non-U.S. firms that are GNFs and are therefore likely to implement ISQM
1; and another 255 are non-U.S. firms that have an audit-related
membership, affiliation, or similar arrangement. As discussed above, we
believe having an audit-related membership, affiliation, or similar
arrangement indicates these firms will likely have implemented ISQM 1.
Hence, in total, we believe that 612 of the 845 firms that have not
performed an engagement under PCAOB standards for an issuer or
registered broker-dealer within the past year (i.e., 72%), by the
effective date of QC 1000, will already be subject to quality control
requirements that share a basic structure with the design-only
requirements in QC 1000. This significantly reduces both the costs and
benefits of the Amendments to these firms, as discussed above. Taken
together, 1,194 of the 1,554 (i.e., 77%) firms registered with the
PCAOB are unlikely to incur significant incremental costs under QC
1000.
---------------------------------------------------------------------------
\216\ Lastly, 50 of the 1554 firms have not yet filed a Form 2;
thus, staff could not determine which of these firms had an audit
report or played a substantial role for the audit of at least one
issuer or registered broker-dealer. Staff were also unable to
determine how many of these 50 firms will already be subject to
quality control requirements that share a basic structure with the
requirements in QC 1000.
---------------------------------------------------------------------------
One commenter stated that the Board did not adequately consider the
extent to which the Amendments could impact entities other than issuers
and registered broker-dealers in its assessment of the Amendments'
economic effects.\217\ We agree that QC 1000 will indirectly affect
parties other than issuers and registered broker-dealers, as the
Commission has promulgated rules requiring the use of PCAOB-registered
or PCAOB-registered and inspected audit firms by other entities,
including, but not limited to, certain investment advisers, pooled
investment vehicles, security-based swap data repositories, and
clearing agencies.\218\ For example, Rule 206(4)-2 under the Investment
Advisers Act of 1940 requires that (1) advisers using a related person
as custodian must obtain their surprise examination and internal
control report from a PCAOB-registered and inspected auditor, and (2)
advisers relying on the audit exception from the surprise examination
requirement with respect to a pooled investment vehicle must have the
pooled investment vehicle audited by a PCAOB-registered and inspected
auditor.\219\ Below we discuss some of the potential effects of the
Amendments on these other regulated entities.
---------------------------------------------------------------------------
\217\ See letter from Chamber.
\218\ See, e.g., 17 CFR 275.206(4)-2 (custody of funds or
securities of clients by investment advisers); 17 CFR 240.13n-11
(chief compliance officer of security-based swap data repository;
compliance reports and financial reports); 17 CFR 240.17ad-22
(standards for clearing agencies); 17 CFR 240.15c3-1g (conditions
for ultimate holding companies of certain brokers or dealers,
Appendix G to 17 CFR 240.15c3-1); and 17 CFR 240.18a-1 (net capital
requirements for security-based swap dealers for which there is not
a prudential regulator).
\219\ See 17 CFR 275.206(4)-2.
---------------------------------------------------------------------------
One commenter on the Proposing Release asserted that audit firms'
financial incentives to operate too lean undermine audit quality.\220\
The Board agreed and, more generally, identified market failures and
thus a need for regulatory action. As a general matter, the Board
explained that there are information asymmetries between auditors and
investors and other financial statement users regarding the services
performed by auditors.\221\ Also there are positive externalities in
the audit market. Specifically, while the services of an auditor
provide benefits to a variety of investors and financial statement
users, auditors do not bargain with all of these parties, but, rather,
are appointed, compensated, and retained by the audit committee.\222\
The Board stated that some beneficiaries of the auditor's work (e.g.,
the investing public generally, who benefit from overall confidence in
the quality of financial information provided to the market) may have
no influence on the auditor at all.\223\
---------------------------------------------------------------------------
\220\ See Adopting Release, supra note 9, at 335.
\221\ Id. at 333.
\222\ Id.
\223\ Id. at 334.
---------------------------------------------------------------------------
We agree that the information submitted by the PCAOB demonstrates
that these market failures exist in the market for audit services.
Information asymmetries could create a risk that auditors may under-
perform and gather insufficient audit evidence to support their opinion
or may otherwise depart from applicable requirements unbeknownst to
market participants who rely on financial statements. This risk could
be exacerbated as auditors directly contract with issuers (through the
audit committee), not investors and financial statement users. The
principal-agent relationship between audit firms and issuers could
exacerbate the risk that auditors may not be incentivized to gather
sufficient audit evidence to support their opinion or otherwise depart
from applicable requirements, potentially harming financial statement
users or market participants generally.
[[Page 74341]]
As a result, we agree with the Board that the audit market may not
provide sufficient economic incentives for all firms to design,
implement, and operate QC systems that provide reasonable assurance.
Additionally, the Board explains that current PCAOB QC standards do not
directly address recent QC developments, so that the current regulatory
baseline is not rigorous enough to sufficiently support the Board's
ability to address audit performance deficiencies through PCAOB
inspection and enforcement activities related to firms' QC
systems.\224\
---------------------------------------------------------------------------
\224\ Id. at 336-37.
---------------------------------------------------------------------------
Having established the regulatory baseline and need for regulatory
action, the PCAOB's analysis then discusses the anticipated economic
benefits of the Amendments. With respect to benefits, the Board states
that the QC 1000 requirements provide substantial additional direction
to firms regarding the design, implementation, and operation of their
QC systems. The Board identifies three overarching beneficial features
of these requirements. The first feature pertains to the mandate for a
more integrated, proactive, and risk-based QC system. The second
pertains to the enhancements to accountability within the firm to
achieve the reasonable assurance objective. The third pertains to more
precise language and more prescriptive requirements in several key
areas.\225\
---------------------------------------------------------------------------
\225\ Id. at 338.
---------------------------------------------------------------------------
We agree with the Board that the QC 1000 requirements will benefit
investors and other financial statement users by improving compliance,
including through PCAOB inspections and enforcement, with applicable
professional and legal requirements via a more risk-based, accountable,
and detailed QC standard.\226\ Such a QC standard will help improve
audit quality resulting in more accurate and more reliable financial
statements regarding the financial position and operating results of
companies.\227\ Investors may, in turn, use this information to improve
the efficiency of their capital allocation decisions (e.g., investors
may more accurately identify companies with the strongest prospects for
generating future risk-adjusted returns and allocate their capital
accordingly), thereby also improving market efficiency.\228\ Investors
may also perceive reduced risk in capital markets generally, promoting
capital formation.\229\ The magnitude of these effects will depend on
the degree to which auditors improve their QC systems and the degree to
which the incremental improvements lead to higher audit quality.
---------------------------------------------------------------------------
\226\ Id. at 341-43.
\227\ See id. at 343.
\228\ See id. at 343-45.
\229\ See id. at 344.
---------------------------------------------------------------------------
The PCAOB's analysis also discusses the anticipated economic costs
of the Amendments. The Board stated that it expects the QC 1000
requirements will result in direct and indirect costs to auditors and,
potentially, indirect costs to the companies that they audit. The Board
also noted that the extent of these costs will depend on the degree to
which firms otherwise have QC systems in place designed to comply with
Other QC Standards and the specific policies and procedures adopted by
the firm. We agree that audit firms will incur compliance costs, both
one-time implementation costs and ongoing operating costs (at the firm
level and at the engagement level), associated with the QC 1000
requirements. To the extent that audit firms pass on these cost
increases to their clients, these clients would incur indirect costs
such as in the form of higher audit fees.
As the Adopting Release acknowledges, the Board received a number
of comments stating there will be costs and challenges to implement and
operate features of QC 1000 that are incremental to the systems firms
have established to comply with Other QC Standards.\230\ Several
commenters also asserted that firms that audit between 100 and 500
issuers will be significantly impacted by costs associated with some or
all of QC 1000's incremental requirements for firms that issue audit
reports for more than 100 issuers, and some of the commenters noted
resource differences between GNFs and annually-inspected NAFs.\231\
Other commenters stated that smaller firms may be especially affected
by the new QC requirements, including requirements incremental or
alternative to ISQM 1 and SQMS 1 standards.\232\
---------------------------------------------------------------------------
\230\ See id. at 44.
\231\ See id. at 66.
\232\ See id. at 58.
---------------------------------------------------------------------------
Similarly, the Commission received a number of comments about the
potential costs of the Amendments.\233\ One commenter stated that the
requirements mean that PCAOB-registered, but not inspected, audit firms
must comply with the design-only requirement, although these firms do
not render audit reports on issuer or broker-dealer engagements or play
a substantial role in such engagements.\234\ The same commenter stated
that firms that are registered, but not inspected, are smaller audit
firms that serve market segments for entities that become smaller
issuers and broker-dealers, including emerging growth companies.
Another commenter similarly stated the adopting release's design-only
requirement for firms that do not issue audit reports for issuers
imposes undue burdens on competition that will hurt smaller issuers
(including emerging growth companies), investors, and the
competitiveness of the audit marketplace.\235\ One commenter expressed
concerns over the significant costs of designing a system of QC in
accordance with QC 1000 on a hypothetical basis, also stating that even
for firms that are performing a small number of engagements under PCAOB
standards, the requirement to comply with two standards (i.e., either
ISQM 1 or SQMS 1 and QC 1000) with two different sets of deficiency
definitions and conclusion frameworks could present similar cost
constraints.\236\ The same commenter requested that the effective date
of QC 1000 implementation for these firms be deferred until such time
as they determine they intend to perform engagements in accordance with
PCAOB standards and consider whether explicit guidance could be
developed that would explain that a registered accounting firm is
essentially prohibited from undertaking PCAOB engagements until a
system of QC that complies with QC 1000 is in place.
---------------------------------------------------------------------------
\233\ See, e.g., letters from BDO; Chamber; PIPCA; and PWC.
\234\ See letter from Chamber.
\235\ See letter from PICPA. See also, e.g., letters from BDO
and Chamber.
\236\ See letter from PWC.
---------------------------------------------------------------------------
We agree with the Board's assessment that there are costs to
designing and implementing a QC system. As discussed above, as of
August 2024, 845 firms of the 1,554 firms (i.e., 54%) registered with
the PCAOB have not performed an engagement under PCAOB standards for an
issuer or registered broker-dealer within the past year and would
therefore not bear the costs to implement and operate the QC
system.\237\ QC systems are resource-
[[Page 74342]]
intensive, and audit firms could incur significant costs to respond to
certain provisions in QC 1000 or to otherwise adapt the QC system to
the auditing environment for issuers and registered broker-dealers.
Furthermore, as noted above, these costs would extend to PCAOB-
registered firms providing audits to entities other than issuers and
broker-dealers pursuant to SEC rules (including, but not limited to,
certain investment advisers, pooled investment vehicles, security-based
swap data repositories, and clearing agencies), which may have an
indirect impact on such other entities.\238\
---------------------------------------------------------------------------
\237\ This count does not account for the 50 firms out of 1,554
that have not yet filed a Form 2, as Commission staff could not
determine which of these 50 firms issued an audit report or played a
substantial role for the audit of at least one issuer or registered
broker-dealer. See supra note 216. The PCAOB made similar findings
in 2023. See Adopting Release, supra note 9, at 345 (stating that,
based on Form 2 reporting as of June 30, 2023, approximately 60% of
registered firms reported that they had not issued an audit report
for an audit of an issuer or broker-dealer or played a substantial
role in such an engagement during the preceding 12 months).
\238\ See supra note 218.
---------------------------------------------------------------------------
The Board also acknowledges that the Amendments could
disproportionately affect smaller firms and cause some firms to exit
the public company audit market or deter other firms from future entry.
Entry deterrence could be exacerbated by the fact that being registered
with the PCAOB will subject firms to certain QC requirements even if
they do not perform engagements. Nevertheless, the Board states that it
does not expect the effects on smaller firms to be significant.\239\
The Board expressed the view that QC 1000 shares a basic structure and
approach with ISQM 1 and SQMS 1,\240\ so designing for the incremental
features unique to QC 1000 should not be unduly burdensome for firms
that are subject to either or both of those Other QC standards.
---------------------------------------------------------------------------
\239\ See Adopting Release, supra note 9, at 354; see also PCAOB
response letter at 23.
\240\ As discussed in Section III above, Commission staff
compared QC 1000 with the requirements of ISQM 1 and SQMS 1 and
similarly concluded that there is significant overlap.
---------------------------------------------------------------------------
We agree that implementation costs could be disproportionately
greater for smaller audit firms than for larger audit firms. The cost
of implementing QC 1000 depends in significant part on the degree to
which auditors' existing QC systems already comply with QC 1000
requirements. PCAOB-registered, but not inspected, audit firms that
decide to comply with the design portions of QC 1000 will incur the
design costs. This could, as discussed above in Section III.A, place
these firms in a better position to compete for work participating in
audits of issuers or registered broker-dealers at a level below that of
a ``substantial role.'' This could also position these firms to expand
their business into audits of SEC-registered issuers and broker-
dealers, but these firms would incur additional implementation and
operation costs to do so. Alternatively, these firms could choose to
avoid the design costs by withdrawing from PCAOB registration given
that they are not required to be registered with the PCAOB; however, we
note that this withdrawal would not impact these firms' eligibility to
compete for work participating in audits of issuers or registered
broker-dealers at a level below that of a ``substantial role.'' The
impact of QC 1000 implementation and operation costs on an audit firm
will also depend on the audit firm's ability to absorb those costs or
pass them onto their clients (i.e., higher audit fees). Smaller audit
firms may be disproportionally vulnerable to implementation costs,
because smaller firms will distribute their fixed implementation costs
over a smaller number of engagements, thus resulting in a higher
average implementation cost per engagement. By contrast, larger PCAOB
audit firms, especially those that already have extensive QC systems in
place, may benefit from economies of scale or scope when incorporating
the new requirements into their existing systems, which would in turn
reduce their cost of implementing and operating QC 1000 per engagement.
Conversely, larger audit firms are likely to have more complex clients
and more diverse client portfolios, which could require higher
implementation costs for an effective QC system.
The Commission also received several comments expressing concern
that the EQCF requirement, in particular, would be costly or difficult
to fulfill, especially for firms that audit between 100 and 500
issuers.\241\ One commenter stated that the proposed EQCF role is
``vastly different'' from the role that the PCAOB proposed in 2022 and
asserted that the economic analysis in the Adopting Release ``does not
provide substantive analysis to justify the costs, benefits and
unintended consequences.'' \242\ Another commenter stated the EQCF
requirement would involve ``significant additional internal and
external costs arising from (1) entering into a new arrangements [sic]
with the same or other individuals who are determined to have
sufficient competence for the specific role and who satisfy the rule as
adopted, (2) sufficiently compensating individuals fulfilling the EQCF
role for their time and potential liability, and (3) the additional
resources needed for the firm to enable the EQCF to perform the
required duties.'' \243\ This commenter added that these costs would be
passed on to issuers (and ultimately investors).
---------------------------------------------------------------------------
\241\ See, e.g., letters from BDO; Chamber; PICPA; and PWC.
\242\ See letter from BDO.
\243\ See letter from PWC; see also, e.g., letters from BDO and
PICPA.
---------------------------------------------------------------------------
The PCAOB's economic analysis considered the economic implications
of the EQCF requirement. The Board states that all U.S. GNFs indicate,
as of the 2020 inspection cycle, they already have a governance
structure that includes a non-employee, suggesting that, in contrast to
commenters' assertions, the costs (as well as the benefits) of this
requirement could be attenuated.\244\ In addition, in response to
comments critiquing the Board's analysis of the EQCF requirement, the
Board provided in the PCAOB response letter additional data from the
U.K., as the independent non-executive (``INE'') role for audit firms
in the U.K. is partially analogous to the EQCF. The Board reports that,
according to transparency reports from six large U.K. audit firms,
total per firm compensation for individual INEs ranged from roughly
$80,000 to $400,000 in 2023.\245\
---------------------------------------------------------------------------
\244\ See Adopting Release, supra note 9, at 356-57.
\245\ See PCAOB response letter at 19-20.
---------------------------------------------------------------------------
The Board has scaled the EQCF requirement to apply to only 13 of
the PCAOB-registered firms, namely those that issued audit reports for
more than 100 issuers as of 2023.\246\ Scaling the EQCF requirement in
this way, while reducing the benefits, significantly mitigates concerns
regarding competition in the audit market. Further, the incremental
demand for qualified individuals would be relatively small compared to
the available supply, further limiting potential costs to compensate
individuals performing the EQCF role.
---------------------------------------------------------------------------
\246\ See supra note 30.
---------------------------------------------------------------------------
In addition, as discussed in Section III.B above, the Amendments
provide firms with significant flexibility to implement the EQCF
requirement in a manner that suits their particular needs and
circumstances. For example, the Amendments do not prescribe specific
qualifications for the EQCF. Aside from the responsibility of
evaluating the significant judgments made and the related conclusions
reached by the firm on the effectiveness of its QC system, firms can
determine the appropriate scope, responsibilities, and qualifications
for the EQCF based on their existing governance structures and the
complexity of their QC systems. This flexibility will allow firms to
integrate the EQCF into their current practices without the need for
significant restructuring or additional resources, thereby minimizing
the financial and operational burden of compliance. In addition, the
flexibility of the QC 1000 standard will allow firms to focus on
addressing their
[[Page 74343]]
unique risks and challenges, reducing the potential for duplicative
efforts or unnecessary expenditures.
Relatedly, some commenters noted that, because certain provisions
of the Amendments, such as the EQCF requirement, have a 100-issuer
threshold, this threshold could deter triennially inspected firms from
accepting new public company audit engagements or cause firms to feel
compelled to consider reducing their issuer count to avoid crossing the
100-issuer threshold.\247\ We acknowledge this possibility, but for the
reasons discussed below, we believe its economic effect is likely
modest, as there is a limited number of firms near the 100-issuer
threshold. PCAOB staff analysis of audit reports included in SEC
filings identified that, during the 2022 calendar year, only two NAFs
audited between 80 and 100 issuers and only two NAFs audited between
100 and 120 issuers. In addition, as discussed above, the Amendments
provide firms with significant flexibility to implement the EQCF
requirement, which should help to mitigate costs associated with this
requirement and thus any potential incentives for firms near the 100-
issuer threshold to alter their audit engagement practices.
---------------------------------------------------------------------------
\247\ See, e.g., letter from Moss Adams.
---------------------------------------------------------------------------
Several commenters on the Proposing Release expressed the concern
that competition in the audit market will be adversely impacted by the
requirements.\248\ One commenter stated that the incremental
requirements of QC 1000 relative to Other QC Standards could lead
smaller high-quality firms to exit the market. One commenter said that
the certification requirement would be an especially significant driver
of exit, particularly for smaller firms. Some commenters suggested that
the design-only requirement could lead those firms to deregister with
the PCAOB or create a barrier to entry. One commenter added that the
design-only requirement could impact audit markets beyond the United
States by creating a disincentive for foreign firms to serve specific
audit markets. One commenter also noted that QC 1000 requirements may
serve as an impediment to audit firm mergers and acquisitions and
otherwise perturb market activity.
---------------------------------------------------------------------------
\248\ See Adopting Release, supra note 9, at 361-62.
---------------------------------------------------------------------------
We agree that the compliance costs associated with the QC 1000
requirements could lead some firms to exit the public company audit
market, thereby lessening competition in that market. However, as
discussed above, many firms already are, or will be, subject to
comparable standards and are unlikely to incur costs so substantial
that they exit the public company audit market. Moreover, as also
described above, the Amendments are targeted so that the largest firms,
which would be less likely to exit the market, are the ones likely to
incur the most significant costs. These factors considerably lessen the
potential adverse impact on competition in the audit market.
D. Form QC Confidentiality
QC 1000 provides that a firm must report annually to the PCAOB on
nonpublic Form QC, in accordance with the instructions to that form,
the results of the evaluation of its QC system.\249\ The PCAOB
explained in the Adopting Release that, although it recognized the
desire of investors and other stakeholders for information related to
audit quality and the effectiveness of QC systems, the Board's ability
to require firms to publicly disclose their QC deficiencies is subject
to certain legal constraints imposed by SOX as discussed in greater
detail below.\250\
---------------------------------------------------------------------------
\249\ Id. at 258.
\250\ Id.
---------------------------------------------------------------------------
One commenter stated that they are concerned that the
confidentiality protections of Section 105(b)(5)(A) of SOX related to
information provided to the PCAOB through inspection does not appear to
apply to information reported through Form QC and stated that the
PCAOB's response to this issue in the Adopting Release appears to
acknowledge that it cannot guarantee the confidentiality it promised
under the proposed rule.\251\ This commenter also suggested that any
information required by QC 1000 should be submitted by firms to the
PCAOB only through the inspections process to ensure that it would
receive confidential treatment under SOX Section 105(b)(5)(A).\252\
---------------------------------------------------------------------------
\251\ See letter from BDO.
\252\ Id.
---------------------------------------------------------------------------
We believe these concerns are largely misplaced. Certain
information contained within a Form QC may be subject to the
protections of SOX Section 105(b)(5)(A), which addresses documents and
information prepared or received by or specifically for the Board in
connection with an inspection or investigation. Furthermore, in certain
circumstances, remedial actions reported in Form QC may be subject to
laws relating to the confidentiality of proprietary, personal, or other
information, and in such a scenario, the Board, in accordance with SOX
Section 102(e) would need to honor a firm's properly substantiated
request for confidential treatment of such information.\253\ The PCAOB
also adopted Rule 2203A(c), which provides that Form QC will be non-
public, in light of the confidentiality provision that applies to
quality control criticisms and potential defects identified during a
PCAOB inspection in SOX Section 104(g)(2).\254\ To the extent that
certain information contained within a Form QC meets the requirements
of the statutory confidentiality protections described above, such
protections would apply to that information to the same extent as any
other information submitted to the PCAOB. We find such an approach to
be appropriate in that it aligns the extent of the confidentiality of
information in Form QC with the broader statutory framework created by
Congress in SOX.
---------------------------------------------------------------------------
\253\ See 15 U.S.C. 7212(e); PCAOB Rule 2300(b). We understand
that firms are accustomed to requesting and receiving confidential
treatment from the Board.
\254\ See PCAOB Rule 2203A(c) as adopted.
---------------------------------------------------------------------------
In response to this commenter's suggestion that any information
required by QC 1000 should be submitted by firms to the PCAOB only
through the inspections process, we believe that the information
provided by Form QC, which in some cases would be provided more
frequently than firms are inspected, would provide important
information that could inform improvements in the PCAOB's standard-
setting, economic and risk analysis, and registration program--separate
and apart from the benefits of the PCAOB's inspection program which is
focused on audit engagements.\255\ These improvements, in our view,
would have concomitant benefits to audit quality and investors.
---------------------------------------------------------------------------
\255\ See Adopting Release, supra note 9, at 263-64.
---------------------------------------------------------------------------
E. Evaluation Date
The Amendments require firms to evaluate their QC system annually
as of September 30 and conclude whether any unremediated QC
deficiencies exist as of that date.\256\ The PCAOB stated it believed
an evaluation date of September 30 would provide firms with enough time
to identify and potentially remediate any QC deficiencies identified
from the most recent calendar year-end engagements, which might not be
possible if an earlier date were selected.\257\ In addition, the PCAOB
adjusted the specified evaluation date from the initially proposed date
of November 30th to September 30th to address commenter concerns that
the November 30th date would have caused
[[Page 74344]]
potential resource limitations during the traditional busy period for
many firms.\258\
---------------------------------------------------------------------------
\256\ Id. at 245.
\257\ Id. at 246.
\258\ Id.
---------------------------------------------------------------------------
Commenters raised concerns with the specified quality control
evaluation date of September 30th, citing concerns including that a
fixed evaluation date may misalign the assessment of quality with
employee or partner compensation to the extent firms have established
compensation cycles that do not align with the September 30th date, as
well as concerns regarding the timing of the inspection cycle
potentially limiting the firms' ability to fully assess the impact of
inspections in their QC evaluation.\259\ One commenter additionally
raised a concern that a firm that already chose its evaluation date
under ISQM 1 would be required to either change its ISQM 1 evaluation
date or perform two QC system evaluations per year.\260\
---------------------------------------------------------------------------
\259\ See, e.g., letters from BDO; Forvis Mazars; GT; Moss
Adams; PICPA; and RSM.
\260\ See letter from BDO.
---------------------------------------------------------------------------
We agree with the PCAOB's conclusion that an evaluation date of
September 30th would provide the audit firm with sufficient time to
identify and potentially remediate QC deficiencies identified from the
most recent calendar year-end engagements before the evaluation date.
Given the ongoing nature of audits, which are driven by issuers' fiscal
year-ends, firms' inspections cycles, and remediation activities, any
fixed evaluation date will necessarily result in certain activities
being split between QC evaluation years. The PCAOB's selected
evaluation date of September 30 addressed the comments the PCAOB
received on the proposal, as noted above, and we believe should provide
time for a majority of inspections to be completed and considered in
the same QC evaluation year. Moreover, including a specified evaluation
date across firms provides for consistency and comparability of the
firms' quality control reporting, which enhances the PCAOB's ability to
assess and respond to firms' QC evaluations and thereby increases
investor protection. We do not believe that firms that have already
selected an evaluation date under Other QC standards would be required
to perform two evaluations. First, QC 1000 allows firms to build on
work already done, to the extent applicable, for the purpose of
complying with the requirements of Other QC Standards. Second, firms
are permitted to change their evaluation date under Other QC Standards
so that the evaluation dates coincide.
F. Effective Date
As stated in the PCAOB's Adopting Release, QC 1000 and related
amendments to auditing standards, rules, and forms will take effect on
December 15, 2025.\261\ The PCAOB stated that it believes an effective
date of December 15, 2025 strikes an appropriate balance between the
benefits to investors of having QC 1000 take effect as promptly as
practicable, and allowing sufficient time for firms to design and
implement robust, QC 1000-compliant QC systems.\262\
---------------------------------------------------------------------------
\261\ See Adopting Release, supra note 9, at 378.
\262\ Id.
---------------------------------------------------------------------------
General
Commenters expressed concerns that the effective date would not
provide firms with sufficient time to implement the new standard,\263\
with one commenter suggesting the Commission require the PCAOB to
extend the implementation deadline.\264\ Another commenter stated that
the PCAOB should have reopened the comment period for the Amendments to
allow for additional comments on a reasonable effective date in light
of the PCAOB's other recently proposed or adopted standards and
rules.\265\
---------------------------------------------------------------------------
\263\ See, e.g., letters from Forvis Mazars; Johnson Global;
Moss Adams; and PICPA.
\264\ See letter from Moss Adams.
\265\ See letter from Chamber.
---------------------------------------------------------------------------
The PCAOB response letter reaffirms the Board's view stated above
that the effective date of December 31, 2025 strikes a reasonable
balance between providing firms with sufficient time and promptly
delivering the benefits to investors.\266\ The PCAOB acknowledged that,
subject to adoption by the PCAOB and approval by the Commission,
several PCAOB standards and rules could come into effect over the next
few years, and that the relevant audit labor market may be relatively
inelastic in the short run. However, the PCAOB explained that
implementing multiple PCAOB standards and rules in quick succession
could potentially reduce the incremental costs attributable to each
change in requirements, if, for example, firms were able to more
efficiently implement certain systems or training on an integrated
basis, addressing multiple new requirements simultaneously.\267\ We
understand that the PCAOB took into consideration its full standard-
setting and rulemaking agenda when selecting the effective date.\268\
---------------------------------------------------------------------------
\266\ See PCAOB response letter at 21-22.
\267\ Id. at 27-28.
\268\ See PCAOB response letter at 27-28.
---------------------------------------------------------------------------
In our view, December 15, 2025, is a reasonable effective date for
the Amendments. Commenters on the Proposing Release, which specified an
effective date of December 31, 2024, suggested a variety of
alternatives, including several that suggested December 31, 2025 or 12
to 18 months after SEC approval. The PCAOB took this feedback into
consideration when it revised the effective date to December 15, 2025.
Significantly, this date aligns with the implementation date of the
AICPA's SQMS 1 QC standard, which will be required for all U.S. audit
firms that issue reports under AICPA standards, and which shares a
basic structure with QC 1000. As a consequence, aligning the effective
date of QC 1000 with SQMS 1 may reduce implementation costs for U.S.
firms that are required to implement both. With respect to the
commenter's concerns about the effective date as it relates to the EQCF
requirement, we note that the PCAOB considered the implementation
requirements of the EQCF in determining the appropriate effective date
for QC 1000.\269\ Finally, with respect to the commenter's concerns
about sufficient time being provided for the general implementation of
other recently proposed and effective PCAOB standards, we acknowledge
there are instances where more than one standard becomes effective
within a six-month period; however, we think the effective dates are
sufficiently staggered such that audit firms will have either already
implemented, or largely implemented, some of the standards referenced
by the commenter or will have sufficient time to do so before
compliance with the Amendments is required.\270\
---------------------------------------------------------------------------
\269\ See Adopting Release, supra note 9, at 378.
\270\ For example, implementation efforts are expected to be
largely completed for recently adopted PCAOB standards relating to
the Supervision of Audits Involving Other Auditors and Dividing
Responsibility for the Audit with Another Accounting Firm (effective
for audits of financial statements for fiscal years ending on or
after December 15, 2024), available at https://www.sec.gov/files/rules/pcaob/2022/34-95488.pdf and Auditor's Use of Confirmation
(effective for audits of financial statements for fiscal years
ending on or after June 15, 2025), available at https://www.sec.gov/files/rules/pcaob/2023/34-99060.pdf, as the fiscal years for which
the standards apply have already begun. Certain other recently
adopted rules and standards, for example Auditing Standard 1000,
General Responsibilities of the Auditor in Conducting an Audit,
available at https://www.sec.gov/files/rules/pcaob/2024/34-100773.pdf and Amendment to PCAOB Rule 3502 Governing Contributory
Liability, available at https://www.sec.gov/files/rules/pcaob/2024/34-100772.pdf, are not expected to require significant
implementation efforts due to minimal changes to performance
requirements.
---------------------------------------------------------------------------
[[Page 74345]]
EQCF Considerations
One commenter raised concerns with the effective date specific to
the EQCF requirement, stating that the approximately 18-month time
period would not provide sufficient time to identify, vet, contract and
onboard an EQCF.\271\
---------------------------------------------------------------------------
\271\ See letter from Moss Adams.
---------------------------------------------------------------------------
The external oversight requirement was included in the standard
that the PCAOB proposed for comment. While the PCAOB made some changes
to the proposed requirement in response to commenters, such as
providing additional specificity and clarity about the role, the
changes made did not impact many of the fundamental requirements for
the role such as the requirement for the individual or individuals
filling the role to be able to exercise independent judgment with
regard to matters related to the QC system, the requirement for one or
more individuals to fill the role, and the significant flexibility
provided to audit firms to design procedures that work best for their
individual firm governance structure and requirements. We believe such
changes should not have a significant impact on the timeline for firms
to complete the hiring process for an EQCF, such that an extended
effective date would be necessary (nor does the commenter explain why
this would be so). We thus conclude the effective date as adopted is
appropriate.
G. Other Comments
One commenter stated that the PCAOB's comment period for the
Amendments was inadequate, or should have been reopened, in light of
other Board proposals.\272\ A few commenters stated that if the
Amendments are approved, PCAOB engagement with firms during the
implementation period is necessary.\273\ Several commenters encouraged
the PCAOB to undertake a post-implementation review of the Amendments
\274\ or provide implementation guidance.\275\
---------------------------------------------------------------------------
\272\ See letter from Chamber.
\273\ See, e.g., letters from CAQ and PWC.
\274\ See, e.g., letters from CII; Consumer Federation of
America; L. Turner (stating that the SEC should instruct the PCAOB
to conduct a post-implementation review); and Members of the IAG.
\275\ See letters from GT and RSM.
---------------------------------------------------------------------------
We acknowledge the importance of monitoring the implementation of
the Amendments, prior and subsequent to their effective date. The PCAOB
response letter states that the Board anticipates its staff will issue
implementation guidance and will engage in other activities to support
firms' implementation efforts.\276\ Further, the Commission staff works
closely with the PCAOB as part of our general oversight mandate. As
part of that oversight, Commission staff will keep apprised of the
PCAOB's activities for monitoring the implementation of the Amendments,
prior and subsequent to the effective date, and update the Commission,
as necessary and appropriate. Finally, as discussed above regarding
notice and comment considerations around the EQCF requirement, we
believe 75 days was an appropriate period for commenters to provide
feedback on the Proposing Release and note that, consistent with
typical practice, the Board did not limit its consideration of comments
to those received during its designated comment period but effectively
provided for a longer comment period by considering all comments it
received prior to the date of adoption.\277\
---------------------------------------------------------------------------
\276\ See PCAOB response letter at 28.
\277\ The Proposing Release was issued on November 18, 2022, and
it requested comments by February 1, 2023. See supra note 11. The
comment file includes comments that were submitted through March 6,
2023, and the PCAOB stated in the Adopting Release that it
considered all forty-two (42) comments it received. See Adopting
Release, supra note 9, at 35.
---------------------------------------------------------------------------
Some commenters reiterated comments made on the Concept Release and
Proposing Release, including: concerns regarding the requirement that
only one person be assigned operational responsibility for the firm's
compliance with ethics and independence requirements; \278\ a belief
that the Amendments are too prescriptive, especially in regards to the
specified quality responses; \279\ disagreement that all engagement
deficiencies require remediation; \280\ concerns that the Amendments
differ from Other QC Standards and will require firms to have multiple
QC systems; \281\ and a request that smaller firms (e.g., triennially
inspected firms that issue 100 or fewer issuer audit reports) be
provided with the option to comply with ISQM 1 or SQMS 1 as an
acceptable alternative to QC 1000.\282\
---------------------------------------------------------------------------
\278\ See letter from BDO.
\279\ See letter from PICPA (recommending that the standard
instead include more specified quality objectives, which would
reduce barriers to entry by promoting scalability).
\280\ See letter from Forvis Mazars.
\281\ See letters from Johnson Global and PICPA.
\282\ See letter from Johnson Global.
---------------------------------------------------------------------------
We acknowledge commenters concerns with these specific aspects of
the Amendments and note that the PCAOB considered and addressed all of
these matters in the Adopting Release.\283\ On balance, we find that
the Amendments strike an appropriate balance between specified mandates
to enhance the effectiveness of its QC systems and to ensure they are
designed and operated with an appropriate level of rigor, and providing
appropriate flexibility to tailor such systems to the specific risks
associated with the firm's practice or organizational structure.
Further, we do not believe that the Amendments will require firms to
maintain multiple systems of quality control. We find that QC 1000
shares the same basic structure as and is consistent with Other QC
Standards and firms are able to build upon the work performed for Other
QC Standards to implement incremental requirements from QC 1000.
Neither we nor any commenters identified anything in QC 1000 that is
incompatible with ISQM 1 or SQMS1. At least one registered public
accounting firm has recently noted that the evolution of its system of
quality management and its implementation of ISQM 1 has positioned the
firm well to adapt to future regulatory developments, such as the
quality control standard proposed by the PCAOB in November 2022.\284\
---------------------------------------------------------------------------
\283\ See, e.g., Adopting Release, supra note 9, at 83, 42, 63-
64, 246, 295, 60, and A1-43.
\284\ See PWC, 2023 Audit Quality Report at 49, available at
https://www.pwc.com/us/en/services/trust-solutions/library/pdfs/pwc-2023-audit-quality-report.pdf.
---------------------------------------------------------------------------
One commenter stated that the PCAOB response letter ``addresses and
provides additional clarity'' on several of the questions it raised in
the comment letter it submitted to the Commission, and the commenter
asked the Commission to clarify whether the PCAOB response letter ``can
be viewed as equally authoritative as the Final Standard and Adopting
Release.'' \285\ We view the statements in the PCAOB response letter as
being on par with statements made by the Board in the Adopting Release
about the scope and application of the QC 1000 requirements.
---------------------------------------------------------------------------
\285\ See CAQ Supplemental Letter.
---------------------------------------------------------------------------
Additionally, there were requests for clarification regarding the
definitions of ``applicable professional and legal requirements,''
\286\ ``other participants,'' \287\ ``QC deficiency,'' \288\ and ``firm
personnel'' \289\ and how various requirements of the Amendments apply
to non-employee professionals and organizations.\290\ These definitions
and the question about non-employee professionals and organizations
were addressed in the
[[Page 74346]]
Adopting Release,\291\ and to the extent additional clarity is needed,
we note that the Board stated in the PCAOB response letter that it
anticipates that its staff will issue implementation guidance and will
engage in other activities to support firms' implementation
efforts.\292\
---------------------------------------------------------------------------
\286\ See letter from PICPA.
\287\ See letter from Johnson Global.
\288\ See letter from PICPA (stating that it disagrees that all
engagement deficiencies are QC deficiencies and that a root cause
analysis is required for a firm to assess whether a simple mistake
is in fact a quality control deficiency).
\289\ See letter from Forvis Mazars.
\290\ Id.
\291\ See, e.g., Adopting Release, supra note 9, at A1-43, A1-
42, A1-43, A1-42, and 47-48.
\292\ See PCAOB response letter at 28.
---------------------------------------------------------------------------
IV. Effect on Emerging Growth Companies
In the Notice of Filing of Proposed Rules, the Board recommended
that the Commission determine that the Amendments apply to audits of
EGCs.\293\ Section 103(a)(3)(C) of SOX requires that any rules of the
Board requiring mandatory audit firm rotation or a supplement to the
auditor's report in which the auditor would be required to provide
additional information about the audit and the financial statements of
the issuer (auditor discussion and analysis) shall not apply to an
audit of an EGC.\294\ The provisions of the Amendments do not fall into
these categories.
---------------------------------------------------------------------------
\293\ See Notice of Filing of Proposed Rules, supra note 3.
\294\ 15 U.S.C. 7213(a)(3)(C).
---------------------------------------------------------------------------
Section 103(a)(3)(C) further provides that ``[a]ny additional
rules'' adopted by the PCAOB after April 5, 2012 do not apply to audits
of EGCs ``unless the Commission determines that the application of such
additional requirements is necessary or appropriate in the public
interest, after considering the protection of investors and whether the
action will promote efficiency, competition, and capital formation.''
\295\ The Amendments fall within this category. Having considered those
statutory factors, we find that applying the Amendments to the audits
of EGCs is necessary or appropriate in the public interest.
---------------------------------------------------------------------------
\295\ Id.
---------------------------------------------------------------------------
With respect to the Commission's determination of whether the
Amendments will apply to audits of EGCs, the PCAOB provided data and
analysis of EGCs identified by the Board's staff from public sources
that sets forth its views as to why the Amendments should apply to
audits of EGCs.\296\
---------------------------------------------------------------------------
\296\ See Adopting Release, supra note 9, at 374-77.
---------------------------------------------------------------------------
The Board states that the discussion of economic impacts of the QC
1000 requirements is generally applicable to the audits of EGCs. The
benefits to financial reporting quality, including improved efficiency
of capital allocation, lower cost of capital, and enhanced capital
formation, are also pertinent to EGCs. The Board states that EGCs tend
to be smaller and have a shorter SEC financial reporting history than
the broader population of issuers. The Board cites to academic research
that suggests that, for several reasons, smaller issuers tend to
exhibit greater information asymmetry between management and investors.
Also, PCAOB staff gathered information on Part I.A deficiencies for the
audits of EGCs between 2013 and 2022, and these data suggest that Part
I.A deficiencies are more common among audits of EGCs, raising
questions about whether QC systems of firms that audit EGCs are
effective in preventing audit deficiencies for these types of audit
engagements. We agree that the benefits of the QC 1000 requirements are
also relevant to EGCs.
The Board acknowledges that to the extent the compliance costs
associated with the QC 1000 requirements lead some smaller audit firms,
such as some NAFs, to exit the public company audit market, then EGCs
could be adversely impacted. PCAOB staff analysis indicates that,
compared to exchange-listed non-EGCs, exchange-listed EGCs are
approximately 2.6 times as likely to be audited by an NAF.
The Board presents evidence that a large number of audit firms,
including smaller audit firms, serve EGCs. PCAOB staff analysis
indicates that, as of November 15, 2022, there were 3,031 companies
that self-identified as EGCs and filed audited financial statements
with the Commission between May 16, 2021, and November 15, 2022. Of the
263 registered firms that audited EGCs, 227 firms (or 86%) performed
audits for both EGC and non-EGC issuers. Approximately 98% of EGCs were
audited by these 227 firms. These data suggest that the impact on EGCs
of any exit by some smaller audit firms, as a result of the
requirements, would likely be limited. For this reason, we expect that
any potential adverse impact on EGCs and their ability to be
competitive in their product markets will be modest.
In addition, the Board sought public input on the application of
the Amendments to the audits of EGCs. Those commenters that responded
to the Board agreed the Amendments should apply to the audits of
EGCs.\297\ In the Adopting Release, the Board explained that, in
general, any new PCAOB standards and amendments to existing standards
determined not to apply to the audits of EGCs would require auditors to
address differing requirements within their methodologies or policies
and procedures with respect to audits of EGCs and non-EGCs, which would
create the potential for confusion.\298\ The Board further stated this
may not be practical in the context of the QC standards because while
some components of the QC system (such as engagement monitoring) may
enable different approaches for audits of EGCs compared to audits of
other companies, other elements (for example, resources and governance
and leadership) are necessarily firm-wide and cannot easily be
differentiated for different types of audits.\299\ The Board further
stated that even where differentiation is possible, maintaining
separate components for EGC and non-EGC audits may add cost or lead to
confusion, and could run counter to the objective of integrating QC
practices into a single continuous cycle of risk assessment,
monitoring, and remediation.\300\
---------------------------------------------------------------------------
\297\ See, e.g., letter received by the PCAOB on the Proposing
Release from Ernst and Young, LLP (Feb. 1, 2023) (stating ``[w]e
believe the proposal should apply to the audits of both emerging
growth companies (EGCs) and non-EGC issuers.''), available at
https://assets.pcaobus.org/pcaob-dev/docs/default-source/rulemaking/docket046/30_ey.pdf?sfvrsn=34762808_4.
\298\ See Adopting Release, supra note 9, at 376.
\299\ Id.
\300\ Id.
---------------------------------------------------------------------------
In addition, the Board stated that the benefits of the higher audit
quality resulting from the Amendments may be more pertinent for EGCs
than for non-EGCs, including improved efficiency of market capital
allocation, lower cost of capital, and enhanced capital formation.\301\
The Amendments are expected to enhance audit quality and contribute to
an increase in the credibility of financial reporting by EGCs, which
are newer to the capital markets than typical non-EGCs.\302\
---------------------------------------------------------------------------
\301\ Id. at 376-77. Also, PCAOB staff gathered information on
Part I.A deficiencies for the audits of EGCs between 2013 and 2022,
analyzing the percentage of inspected EGC and non-EGC issuer audits
having at least one Part I.A deficiency. These data suggest that
Part I.A deficiencies are even more common among audits of EGCs,
raising questions about whether QC systems of firms that audit EGCs
are effective in preventing audit deficiencies for these types of
audit engagements. Id. at 375.
\302\ Id. at 377.
---------------------------------------------------------------------------
We agree with the Board's analysis and further emphasize the
benefits discussed by the PCAOB, including higher audit quality leading
to improved efficiency of capital allocation, lower cost of capital,
and enhanced capital formation with respect to EGCs. As noted above,
these improvements in the quality of the audit may be more pronounced
on the audits of EGCs. While improvements in audit quality benefit all
investors, such improvements may particularly benefit investors in
[[Page 74347]]
EGCs by increasing the credibility of their financial reporting given
that they are typically newer to the capital markets and feature a
higher degree of information asymmetry between management and
investors. Improvements in audit quality provide investors with more
accurate information, which helps them make more informed investment
decisions. More accurate information in financial statements may also
increase investors' confidence and, in turn, facilitate capital
formation.
To the extent that an EGC's auditor's existing quality control
standards do not meet the requirements under QC 1000 and the changes
that auditors make to their quality control system impact the
performance of audit engagements, this could lead to a spillover
externality effect whereby EGCs themselves may have to incur additional
costs. For example, an EGC could have to allocate more resources to its
own internal control systems or to additional requests for more
extensive or additional evidence from audit firms.\303\ While this
could be costly to the EGC, enhanced internal control over financial
reporting at the EGC and audits that are performed in compliance with
applicable professional standards are expected to also benefit
investors. Audit firms may also raise audit fees for EGCs as a result
of implementing QC 1000. Higher audit-related costs, in the form of
EGCs' costs to support the audit and/or in fees paid to auditors, would
in turn raise EGCs' overall costs and possibly adversely impact their
ability to be competitive in the product markets that they operate.
These potential costs to EGCs will be reduced to the extent EGC
auditors will already be required to comply with the Other QC Standards
or may choose not to pass on their incremental costs arising from the
QC 1000 requirements in the form of higher audit fees. As discussed
above, Commission analysis shows that approximately 88% of registered
firms performing PCAOB engagements will, by the effective date of QC
1000, already be subject to quality control requirements that share a
basic structure with the requirements in QC 1000. PCAOB staff analysis
also shows that approximately 98% of EGCs were audited by firms that
performed audits for both EGC and non-EGC issuers.\304\ Therefore, for
98% of EGCs being audited, there likely would be minimal incremental
costs for QC 1000 to apply to EGCs, either due to their auditor
implementing QC 1000, as required to audit its other issuers, or
implementing the Other QC Standards.
---------------------------------------------------------------------------
\303\ See Alexander, C, S. Bauguess, G. Bernile, Y. A. Lee, and
J. Marietta-Westberg (2013) ``Economic Effect of SOX Section 404
Compliance: A Corporate Insider Perspective,'' Journal of Accounting
and Economics, at 56, 267-290. Based on a survey data, this paper
shows the compliance costs of SOX 404 weigh disproportionately on
smaller firms.
\304\ See Adopting Release, supra note 9, at 375.
---------------------------------------------------------------------------
Accordingly, after considering the protection of investors and
whether the action will promote efficiency, competition, and capital
formation, we believe there is a sufficient basis to determine that
applying the Amendments to the audits of EGCs is necessary or
appropriate in the public interest.\305\
---------------------------------------------------------------------------
\305\ As noted above, during the Commission's comment period,
two commenters raised concerns that the design-only requirement
would burden smaller firms, which could impact smaller issuers and
broker-dealers, including emerging growth companies. See letters
from Chamber and PICPA. Although these commenters mentioned EGCs in
the context of commenting on the design-only requirement, neither
suggested that firms should be required to apply different quality
control standards to the audits of EGCs versus non-EGCs. For the
reasons stated above, we agree with the Board that QC 1000 should
apply to all registered public accounting firms, including with
respect to the audits of EGCs, because of the firm-wide nature of QC
systems.
---------------------------------------------------------------------------
V. Conclusion
The Commission has reviewed and considered the Amendments, the
information submitted therewith by the PCAOB, the comment letters
received, and the recommendation of the Commission's staff. The
Commission concludes that the determinations made by the PCAOB as
described in the Adopting Release are reasonable. Generally, the
Amendments establish an integrated, risk-based quality control standard
that can be applied by firms of varying sizes and complexities and that
will lead registered public accounting firms to significantly improve
their quality control systems, thereby improving audit quality and
investor protection. Specifically, the Amendments make the following
important changes, among others, to the existing quality control
standards, which will advance the Board's investor protection mandate
under SOX:
Replace the current standards, which: (i) were developed
by the AICPA, a professional organization for certified public
accountants; (ii) were last updated in 1997; (iii) focus on evaluating
firms' compliance with their own policies; (iv) do not require
evaluation or reporting; and (v) do not contain express obligations for
firms to perform any specific monitoring;
Incorporate a risk-based approach to quality control,
driving firms to proactively identify and manage the specific risks
associated with their practices, along with a set of mandates, tailored
to the size of the audit practice, which should assure that the quality
control system is designed, implemented, and operated with an
appropriate level of rigor;
Emphasize the importance of accountability and firm
governance through requirements around roles and responsibilities,
assigning operational responsibility to individuals for particular
aspects of the QC system, and the introduction of a certification by
certain responsible individuals; and
Create a framework for evaluation and reporting to the
PCOAB which will be consistently applied across all firms operating a
QC system under QC 1000.
Therefore, in connection with the PCAOB's filing and the
Commission's review,
A. The Commission finds that the Amendments are consistent with the
requirements of Title I of SOX and the rules and regulations thereunder
and are necessary or appropriate in the public interest or for the
protection of investors; and
B. Separately, the Commission finds that the application of the
Amendments to the audits of EGCs is necessary or appropriate in the
public interest, after considering the protection of investors and
whether the action will promote efficiency, competition, and capital
formation.
It is therefore ordered, pursuant to section 107 of SOX and section
19(b)(2) of the Exchange Act, that the Amendments (File No. PCAOB-2024-
02) be and hereby are approved.
By the Commission.
Vanessa A. Countryman,
Secretary.
[FR Doc. 2024-20714 Filed 9-11-24; 8:45 am]
BILLING CODE 8011-01-P