Pursuant to section 107(b) of the Sarbanes-Oxley Act of 2002 (the “Act”), notice is hereby given that on September 10, 2026, the Public Company Accounting Oversight Board (the “Board” or the “PCAOB”) filed with the Securities and Exchange Commission (the “Commission” or the “SEC”) the proposed rules described in items I and II below, which items have been prepared by the Board. On September 14, 2026, the Board filed with the Commission a technical correction to one of the proposed rules. The Commission is publishing this notice to solicit comments on the proposed rules from interested persons.

I. Board's Statement of the Terms of Substance of the Proposed Rules

On September 9, 2026, the Board adopted proposed rule amendments to QC 1000, A Firm's System of Quality Control, related amendments to PCAOB Rule 2203A, PCAOB forms, and technical amendments to AS 2101, Audit Planning. (collectively, the “proposed rules”). On September 11, 2026, the Board adopted a technical correction to the proposed rule amendments to QC 1000. The text of the proposed rules appears in Exhibit A to the SEC Filing Form 19b-4 and is available on the Board's website at pcaobus.org/​about/​rules-rulemaking/​rulemaking-dockets/​docket-057.

II. Board's Statement of the Purpose of, and Statutory Basis for, the Proposed Rules

In its filing with the Commission, the Board included statements concerning the purpose of and basis for the proposed rules and discussed any comments it received on the proposed rules. The text of these statements may be examined at the places specified in Item IV below. The Board has prepared summaries, set forth in sections A, B, and C below, of the most significant aspects of such statements. In addition, to the extent necessary, the Board is requesting that the Commission approve the proposed rules pursuant to section 103(a)(3)(C) of the Act for application to audits of emerging growth companies (“EGCs”), as that term is defined in section 3(a)(80) of the Securities Exchange Act of 1934 (“Exchange Act”). The Board's request is set forth in section D.

A. Board's Statement of the Purpose of, and Statutory Basis for, the Proposed Rules

(a) Purpose

The Board adopted QC 1000, A Firm's System of Quality Control (“QC 1000”), on May 13, 2024,^[1] to lead registered public accounting firms (“firms”) to significantly improve their quality control (“QC”) systems. The Board believes that, as firms prepare for the effective date of QC 1000, many such improvements have been and will continue to be implemented as firms develop more rigorous QC systems. The Board's experience during the implementation period led us, however, to consider whether the new standard imposes costs that may not be necessary for us to achieve the Board's regulatory goals and, relatedly, whether there were certain aspects of QC 1000 that could be brought into closer alignment with other audit firm quality management standards.^[2]

The Board adopted amendments to QC 1000 that it believes address concerns regarding the implementation challenges identified by firms and better align certain provisions with other quality management standards. These amendments are designed to reduce compliance costs while maintaining the investor protection benefits of QC 1000.

The principal amendments the Board adopted:

• Rescind the “design-only” requirement so that QC 1000 imposes requirements only on firms that are required to comply with applicable professional and legal requirements with respect to any “engagement” as defined in QC 1000 (QC 1000.06 and .07d);
• Provide increased flexibility in filling certain specified roles in the QC system by permitting roles to be assigned to non-firm personnel and divided among multiple individuals (QC 1000.12);
• Rescind the requirement to have an External QC Function (“EQCF”) (QC 1000.28);
• Narrow and simplify communication requirements relating to metrics that the firm communicates to external parties about its audit practice, firm personnel, or engagements (QC 1000.53e);
• With respect to identified engagement deficiencies, require evaluation of whether similar engagement deficiencies exist on other engagements only if the identified deficiency resulted or could result in (i) a failure to obtain sufficient appropriate evidence to support the conclusion reached on an engagement or (ii) an inappropriate overall conclusion on the subject matter of an engagement (QC 1000.68d);
• Revise the definition of QC deficiency to make clear that, when firms have implemented more than one quality response to address the same quality risk, they can take those other quality responses (e.g., compensating responses) into account when determining whether a QC deficiency exists (QC 1000.A8);
• Allow firms to select the date as of which they annually evaluate the effectiveness of their QC system, rather than requiring firms to evaluate as of September 30 (QC 1000.77);
• Revise the QC system evaluation conclusions to align more closely with the conclusions in other quality management standards, while retaining a structured process, including specified factors for consideration, to guide the evaluation (QC 1000.77 and .78); and
• Simplify the requirements for retention of QC system documentation and abbreviate the retention period from seven to five years (QC 1000.84 and .86).

Additional amendments the Board adopted, including conforming amendments, are discussed below.

Several of the amendments the Board adopted bring QC 1000 into closer alignment with other quality management standards, both internationally and in the United States. However, differences remain in areas where the Board continues to believe that alternative or incremental provisions of QC 1000 better address its legal and regulatory environment, the needs and priorities of the Board's stakeholders, and the Board's statutory mandate of protecting investors and the public interest.

QC 1000 and the related amendments to PCAOB standards, rules, and forms adopted in 2024 will take effect on December 15, 2026. If approved by the ( printed page 59355) SEC, the amendments to QC 1000 that the Board adopted and the related amendments to a PCAOB rule and PCAOB forms will also take effect on December 15, 2026.

The proposed rules also include technical amendments to AS 2101, Audit Planning, to remove references to an auditing standard that was rescinded by another rulemaking.^[3] The Board adopted these amendments as final due to their technical nature, and the Board did not seek public comment on these amendments. These amendments will be effective upon SEC approval.

(b) Statutory Basis

The statutory basis for the proposed rules is Title I of the Act.

B. Board's Statement on Burden on Competition

Not applicable. The Board's consideration of the economic impacts of the proposed rules is discussed in section D below.

C. Board's Statement on Comments on the Proposed Rule Change Received From Members, Participants, or Others

The Board released proposed rule amendments for public comment on June 9, 2026, in its release titled Supplemental Request for Comment: Proposed Amendments to QC 1000, A Firm's System of Quality Control, and Related Rule and Forms, PCAOB Release No. 2026-002. The Board received 25 comment letters in response to that supplemental request for comment. See Comment Letters for Docket 057, pcaobus.org/​about/​rules-rulemaking/​rulemaking-dockets/​docket-057/​comment-letters. The Board also received 26 comment letters in response to a request for public comment on the PCAOB strategic priorities, identified at footnote 12 below, and 4 comment letters in response to a request for public comment on PCAOB standard setting, identified at footnote 289 below, and 1 comment letter in response to a request for public comment on the Draft 2026-2030 Strategic Plan Goals and Objective, identified at footnote 300 below, which all raised comments specifically to QC 1000, among other things. See Comment Letters on the PCAOB website available at pcaobus.org/​about/​strategic-plan-budget/​public-comments-on-pcaob-strategic-priorities, pcaobus.org/​oversight/​standards/​standard-setting-research-projects/​agenda-consultation--request-for-public-comment-on-pcaob-standard-setting, and pcaobus.org/​about/​strategic-plan-budget/​public-comments-on-goals-and-objectives-for-pcaob-strategic-plan-2026-2030, respectively. The Board has carefully considered all comments received. The Board's responses to the comments received, including revisions to the proposed rule amendments, are discussed below.

Background

This section presents background information on this rulemaking, including recent rulemaking history and staff implementation support efforts since SEC approval of QC 1000 in September 2024.

Recent Rulemaking History

On May 13, 2024, the Board adopted QC 1000 and related amendments. They were approved by the SEC on September 9, 2024, with an effective date of December 15, 2025.^[4]

On August 28, 2025, to provide firms with additional time for implementation, the Board proposed to delay the effective date of QC 1000 and the related amendments to December 15, 2026, and that postponement became immediately effective.^[5] The SEC received 15 comment letters in response to its notice regarding the postponement.^[6] Commenters generally supported providing additional implementation time but raised concerns regarding certain provisions of QC 1000 that they viewed as more prescriptive than other quality management standards and as creating unnecessary operational complexity and cost.

On July 23, 2025, and March 20, 2026, the PCAOB received letters from a firm-related group regarding implementation of QC 1000 and related implementation challenges.^[7]

On March 31, 2026, the Board issued a request for public comment on the PCAOB's strategic priorities, including future standard-setting activity.^[8] Several commenters provided observations regarding QC 1000.^[9] The comments relating to QC 1000 were generally consistent with themes raised in comment letters submitted to the PCAOB and SEC in connection with the extension of the effective date of QC 1000. Most commenters urged the Board to adopt or align more closely with ISQM 1, suggesting it may better support global implementation, while emphasizing that differences in structure, terminology, and prescriptive requirements in QC 1000 create operational challenges, limit firm judgment, and increase complexity for global firms.

After considering feedback and information obtained through implementation support efforts,^[10] on June 9, 2026, the Board issued a supplemental request for comment on potential targeted amendments to certain provisions of QC 1000 and related amendments to the QC reporting rule and PCAOB forms.^[11] The Board received 26 comment letters. ^[12] ( printed page 59356) Commenters included firms and firm-related groups, investor-related groups, and others. Firms, firm-related groups, and most other commenters generally supported the Board's objective of making targeted amendments to QC 1000 and most of the proposed amendments, particularly those intended to increase flexibility, improve operability, reduce unnecessary compliance burdens, and better align QC 1000 with other quality management standards.^[13] One investor-related group did not support the proposed amendments overall because of the proposed rescission of the EQCF requirement.^[14] Other investor-related groups generally supported the proposed amendments that reduce compliance costs without reducing audit quality, but opposed the removal of the EQCF requirement, emphasizing the importance of independent oversight and investor protection, and other amendments they viewed as weakening investor-protection-focused provisions of QC 1000.^[15] Many commenters, particularly firms and firm-related groups, also requested implementation guidance and clarification in certain areas discussed below.^[16]

The Board considered all comments received on the supplemental request for comment. As discussed below, the Board is adopting the proposed amendments to QC 1000, with certain modifications.

Implementation Support Efforts

Since SEC approval of QC 1000, PCAOB staff have supported implementation through guidance, workshops, outreach activities, and engagement with stakeholders, which provided insight into implementation progress, challenges, and questions and informed the Board's consideration of the proposed amendments.^[17] Additionally, as part of inspection outreach activities, the Board obtained feedback on the progress made by firms in implementing QC 1000 in their QC systems.^[18]

As part of staff implementation support efforts, the PCAOB staff released QC 1000 Questions and Answers (“QC 1000 Q&As”) in August 2026.^[19] The QC 1000 Q&As provide technical guidance on various aspects of QC 1000, including roles and responsibilities, evaluation and reporting, documentation, and other areas of designing, implementing, operating, and evaluating a firm's QC system. The QC 1000 Q&As were developed in response to questions and requests for clarification received from firms through staff implementation support efforts and are intended to reduce uncertainty and support firms' implementation of the standard.

The QC 1000 Q&As do not address the specific topics that are the subject of the amendments to QC 1000 that the Board adopted, but they do address some questions and clarification requests on other topics that were included in comment letters submitted in response to the supplemental request for comment. As implementation continues, additional guidance, including updates to the QC 1000 Q&As, may be issued to help address other areas identified by commenters or through staff implementation support efforts.

Amendments to QC 1000, PCAOB Rule 2203A, and PCAOB Form QC

This section describes the requirements of QC 1000, Rule 2203A, and Form QC that the Board amended.

Requirement To Design, Implement, and Operate a QC System

As originally adopted, QC 1000.06 requires all firms to design a QC system that complies with the standard, regardless of whether the firm is subject to applicable professional and legal requirements with respect to an engagement as defined in QC 1000. As explained in the supplemental request for comment, the Board understands that this “design-only” requirement would impose costs on firms that do not perform engagements requiring registration under the Sarbanes-Oxley Act of 2002 (“Sarbanes-Oxley”) ^[20] or PCAOB rules ^[21] without commensurate benefits for investors and the public. Therefore, the Board proposed to eliminate the requirement and sought comment on potential alternatives, as well as any circumstances that potentially could trigger a design requirement. As proposed in the supplemental request for comment, paragraphs .05 through .07 of QC 1000 would be revised to eliminate the separate obligation to design a QC system and would maintain unchanged the obligation to design, implement, and operate a QC system in compliance with QC 1000 when a firm is subject to applicable professional and legal requirements with respect to any of the firm's engagements.

Many commenters supported the proposal to rescind the design-only requirement.^[22] One commenter stated that they did not object to rescinding the design-only requirement when a firm neither performs nor intends to perform PCAOB engagements.^[23] One of the commenters supporting rescission stated that it did not believe registered firms should be required to comply with PCAOB standards until the firm undertakes an engagement requiring compliance with those standards and that the design-only requirement was inconsistent with the text of Sarbanes-Oxley.^[24] Commenters that addressed the question of whether the Board should adopt an alternative design-only requirement generally did not support such a requirement.^[25]

However, one commenter stated support for a QC design requirement that included effective operation of a system of quality management under relevant standards for the jurisdiction in which the firm operates, such as ISQM 1 or SQMS 1.^[26] This commenter noted that, in practice, registered firms would already maintain some form of a system of quality management to support their ( printed page 59357) PCAOB registration.^[27] The Board does not believe QC 1000 should explicitly require compliance with rules of local jurisdictions, as PCAOB standards generally do not impose such requirements. Another commenter noted that, although some registered firms do not conduct audits, that fact does not necessarily signify the need for an exemption from standard best practices or audit quality requirements; such firms should be subject to QC 1000 on the level of preparedness or some QC regime that parallels QC 1000 in its design, implementation, and operation.^[28] The Board does not believe that the suggestion to base a design-only requirement on a level of preparedness or a system paralleling QC 1000 is workable because it is too vague as to the requirements that would apply to firms not performing PCAOB engagements.

Commenters raised concerns over the costs of the design-only requirement in relation to the benefits.^[29] One commenter stated that the requirement would have resulted in unnecessary costs of compliance without commensurate benefits.^[30] Another commenter similarly stated that requiring firms not performing PCAOB engagements to comply with the design-only requirement did not provide a commensurate benefit to investor protection, as such firms do not present risk to U.S. capital markets.^[31] Another commenter stated that requiring firms to build compliance infrastructure for work they may never undertake imposes cost without a corresponding investor benefit.^[32] Another commenter observed that, because firms performing engagements would be fully subject to the requirement to design, implement, and operate a QC 1000-compliant system, rescinding the requirement for firms not performing such work would preserve the Board's objective of promoting high-quality audits, while reducing unnecessary burdens for those firms.^[33] Another commenter stated that, while the value to the public of the design-only requirement was unclear, the costs would be real in the form of training costs, consulting costs, and professional time.^[34] Other commenters noted the limited benefits of the requirement for investors, stating that rescission would not diminish investor protection ^[35] or introduce any risk to investors,^[36] or that retaining the requirement would not help ensure improved audit quality.^[37]

Two commenters also raised concerns about requiring firms to address hypothetical situations. One of these commenters stated that it would be difficult for a firm not subject to applicable professional and legal requirements with respect to any engagement to design a QC system based on hypothetical circumstances.^[38] The second commenter stated that such a firm's QC system “would be hypothetical at best and would likely become obsolete over time as practice conditions change, leading to the false pretense that [the firm is] in a position to immediately implement these standards.” ^[39]

The Board is rescinding the design-only requirement and adopting paragraphs .05 through .07 as proposed.^[40] The Board believes rescinding the design-only requirement will reduce costs for firms without any significant detriment to audit quality.

As confirmed by commenter feedback, implementing the design-only requirement has proven more difficult and costly than originally anticipated. The requirement may compel some firms that have no intention of performing PCAOB engagements in the foreseeable future to design a QC 1000-compliant system, perhaps based on hypothetical circumstances. As described in the supplemental request for comment, the Board believes that the design-only requirement may have contributed to an increase in withdrawals from registration by firms that are not performing engagements. Although the impact of such activity on the marketplace (discussed below in the economic analysis) may be limited, the Board believes investors and the public interest are better served by incentivizing firms to register and consider seeking PCAOB engagements, thereby promoting competition.^[41]

In the Board's view, rescission of the design-only requirement would entail foregoing the benefits associated with greater preparedness of firms to take on a PCAOB engagement for the first time. The Board believes this benefit to be modest, as any firm that actually takes on such an engagement will have become subject to the requirement to design, implement, and operate a QC 1000 system.^[42] In any event, and as noted by one commenter, registered firms that do not perform PCAOB engagements are generally well-positioned to implement QC 1000 if or when required to do so.^[43] This is so because most such firms, as some commenters observed, are generally either non-U.S. firms subject to international auditing standards or U.S.-based firms that conduct private company audits under the standards of the Auditing Standards Board of the American Institute of CPAs (“AICPA”); as such, those firms would be subject to ISQM 1 or SQMS 1, which both share a common basic structure with QC 1000.^[44] Finally, as stated in the supplemental request for comment, the investor protection concerns encompassed by the Board's statutory mandate are reduced where a firm is not performing PCAOB engagements.

Based on the above considerations, the Board decided not to adopt any of the design-only alternatives discussed in the supplemental request for comment.

The Board also considered whether to include provisions in QC 1000 specifying an earlier trigger for the requirement to design, implement, and operate a QC 1000-compliant system under QC 1000.06-.07. In this regard, one commenter encouraged the Board to consider whether compliance with QC 1000 after its December 15, 2026 effective date could be tied to an ( printed page 59358) established evaluation period and measurement date rather than a specific triggering event.^[45] The same commenter suggested that under such an approach, a firm would determine at the beginning of its selected evaluation cycle whether it is required to comply with QC 1000 during that period.^[46] Another commenter stated that a firm must have “an appropriately designed and operational QC system before accepting or commencing PCAOB audit work.” ^[47] Another commenter suggested that “a QC system must be in place prior to a firm tendering an offer for a public company audit and/or getting registered.” ^[48] Another commenter requested that the Board specify an earlier trigger—for example, when a firm bids for or is appointed to issuer or broker-dealer work—by which time a compliant QC system must be designed and operating, well in advance of the firm commencing that work.^[49]

While an earlier trigger may promote readiness by firms to commence PCAOB engagements, the Board expects that the effort required to design, implement, and operate a QC 1000-compliant system may vary significantly across firms. That variation could arise from several different factors, including the status of their existing QC systems, the nature of their assurance practice (if any), the experience of their personnel, and the nature of their governance systems, operating processes, and technology, among other things. The Board also understands that some firms may pursue engagements for issuers and broker-dealers months, or even years, before these firms are awarded and commence such work. In light of these considerations, it may not be necessary in all circumstances for a firm to have a QC system that fully complies with QC 1000 before it pursues an issuer or broker-dealer engagement that might not be awarded to it or that might not commence for a significant period of time. Therefore, the Board believes that requiring firms to design, implement, and operate a QC 1000-compliant system when a firm becomes subject to applicable professional and legal requirements with respect to any engagement is appropriate, and an earlier trigger is not warranted.

Roles and Responsibilities

1. Assignment of Roles and Responsibilities

As originally adopted, QC 1000 requires that the operational roles and responsibilities specified in paragraph .12 be assigned only to “firm personnel.” ^[50] The note to paragraph .12 provides that responsibility for the roles in subparagraphs a-c cannot be shared and is required to be assigned to only one individual, to reinforce that the individual assigned to a specified role would be responsible and accountable for the role.

The Board proposed amendments to paragraph .12 to allow flexibility in assigning the specified roles and responsibilities to any individual (whether firm personnel or an “other participant” ^[51] ), rather than limiting those roles and responsibilities to firm personnel. In connection with that change, the Board proposed a new footnote 5A to paragraph .12 to clarify that such individuals would be “associated persons” of the firm. As the Board explained in the supplemental request for comment, any individual who was not already an associated person would become an associated person by virtue of that assignment.^[52] The proposed amendments would align with ISQM 1 and SQMS 1 by permitting any qualified individual to fill the specified QC system roles.

To preserve the accountability and responsibility objectives of paragraph .12, the Board also proposed an amendment to emphasize that the individuals assigned specific roles understand and be accountable for their roles and responsibilities. The Board also proposed an amendment to the note to paragraph .12 to allow firms to divide the responsibilities of a role specified in paragraph .12 among multiple individuals. The proposed amendments align with ISQM 1 and SQMS 1.

Commenters generally supported allowing the specified roles to be assigned to other participants and divided among multiple individuals.^[53] Many commenters indicated the amendments would promote audit quality, for example, by enabling the firm to place the most experienced and qualified individuals in those roles.^[54] Several commenters also supported allowing firms the flexibility to assign roles and responsibilities to multiple individuals based on their specialized expertise and capacity, including within their existing structures, while maintaining accountability.^[55] Several commenters stated that the proposed amendments to paragraph .12 were sufficiently clear and appropriate.^[56]

A commenter stated that the proposed amendments would be especially helpful to firms that issued audit reports with respect to less than 100 issuers.^[57] Another commenter supported the addition of footnote 5A, which clarifies that an individual assigned operational responsibility for any of the roles in paragraph .12 would become an associated person of the firm by virtue of that assignment.^[58] One commenter recommended retaining clear firm-level accountability and documentation requirements to avoid diffusion of responsibility.^[59] Another commenter recommended the final standard require clear identification of those ultimately responsible for the QC system and key QC areas; this commenter further suggested that the PCAOB encourage firms to consider the firms' retirees for QC system roles, as such individuals would provide valuable experience.^[60]

One commenter did not support assigning roles to individuals outside the firm because individuals outside the firm may have conflicting interests, and they cannot provide the day-to-day ownership the roles require.^[61] The same commenter stated that there remains a need for an ultimate point of accountability and there needs to be assurance that accountability is not diffused when responsibilities are divided.^[62] Further, the commenter requested that whenever a QC role is divided among multiple individuals, the firm's reporting to the PCAOB identify (1) who holds ultimate responsibility and accountability for the QC system as a whole; (2) who is accountable for each function, such as ethics, independence, monitoring, and remediation; and (3) the scope of each individual's assigned responsibilities, so that no part of any role is left unassigned.^[63]

As to the question of whether the flexibility afforded by the proposed amendments should be available only ( printed page 59359) on a scaled basis to certain firms, many commenters generally favored applying the amendments to all firms.^[64] Several of these commenters emphasized that the flexibility the proposed amendments would offer is important for firms of all sizes, although for reasons that may differ between larger and smaller firms.^[65] One commenter said such flexibility appears appropriate regardless of firm size, while noting that larger firms may be better equipped to operate under a more restrictive and specialized set of requirements.^[66] Another commenter stated they would not be opposed to a limited degree of scaling these requirements to address cost considerations for small and large firms.^[67]

After consideration of the comments received, the Board is adopting these amendments as proposed. The Board believes the flexibility afforded by the amendments should be available to all firms rather than on a scaled basis, because audit quality is enhanced when firms can assign the specified roles and responsibilities to the most qualified individuals, whether or not they are firm personnel. In the Board's view, the amendments will expand the pool of individuals with the requisite experience, competence, authority, and time to serve in specified roles. For example, a firm may improve its QC system and overall audit quality by assigning to one individual operational responsibility for ethics and to another individual operational responsibility for independence, where each individual has specific expertise in their respective area.

In response to commenters that recommended clear firm-level accountability and documentation when roles are divided, paragraph .27 requires a firm to establish and maintain clear lines of responsibility and supervision within the QC system, including defining authorities, responsibilities, accountabilities, and supervisory and reporting lines for roles within the firm up to and including the principal executive officer(s). Additionally, paragraph .82a requires the firm to document the lines of responsibility and supervision required by paragraph .27. In response to a commenter's call for specific reporting to the PCAOB about divided roles, the Board notes that Item 3.1 of Form QC requires firms to disclose (1) who holds ultimate responsibility and accountability for the QC system as a whole and (2) which individual or individuals have operational responsibility for ethics and independence and for monitoring and remediation. Although the specific scope of each individual's assigned responsibilities would not be reported, that information must be documented under paragraph .82a and would be available to the PCAOB in connection with its oversight activities, including inspections.^[68]

2. Responsibilities for Roles With Operational Responsibility

To align with the amendments to QC 1000.12, the Board proposed conforming amendments to paragraphs .15-.17 that would acknowledge the possibility that multiple individuals could share the specified roles and clarify that such individuals' obligations would be limited to the scope of their assigned responsibilities.

In addition, the Board proposed amendments to paragraph .17b(2) through (3) to delete the communication requirements related to major QC deficiencies to align with the amendments to the evaluation requirement in paragraph .77 discussed below.

Commenters who addressed these amendments supported the proposed changes to paragraphs .15-.17 and stated they are sufficiently clear.^[69] Two commenters acknowledged that the conforming amendments are appropriately aligned with the revisions to paragraph .12.^[70] One commenter stated the conforming amendments reinforce a more principles-based approach ^[71] and another commenter stated the conforming amendments increase flexibility.^[72] After consideration of the comments received, the Board is adopting these conforming amendments as proposed.

External QC Function

As originally adopted, paragraph .28 of QC 1000 includes a specified quality response that requires firms with a larger PCAOB audit practice ^[73] to incorporate into their governance structure an EQCF for the QC system composed of one or more persons who:

• Are not partners, shareholders, members, other principals, or employees of the firm;
• Do not otherwise have a commercial, familial, or other relationship with the firm that would interfere with the exercise of independent judgment with regard to matters related to the QC system; and
• Have the experience, competence, authority, and time necessary to enable them to carry out the responsibilities assigned to the EQCF by the firm.

The EQCF's responsibilities include, at a minimum, evaluating the significant judgments made and the related conclusions reached by the firm when evaluating and reporting on the effectiveness of its QC system.

The Board proposed rescinding the EQCF requirement based on information obtained in connection with staff implementation support efforts and outreach discussions, which revealed that implementing this requirement had proven more difficult and more costly than originally anticipated. The Board was concerned that the potential benefits may not justify the potential costs of the EQCF requirement, except potentially for the largest U.S. global network firms.

Many commenters expressed support for rescinding the EQCF requirement.^[74] Some of these commenters said rescission would allow firms the flexibility to utilize existing external governance structures to promote audit quality in a manner tailored to their specific circumstances.^[75] Some commenters stated that removing the EQCF requirement would not diminish the focus on quality because QC 1000 advances the objectives of strengthening trust in governance, reinforcing accountability, and supporting a commitment to quality through other provisions in the standard.^[76] Other commenters offered support for the proposed rescission by asserting that existing governance structures, leadership accountability, monitoring activities, reporting processes, and PCAOB inspections already provide meaningful oversight or help promote the effective operation of the QC system.^[77]

In addition, many commenters observed that the costs associated with ( printed page 59360) the EQCF requirement, as well as any incremental benefits to audit quality, remain uncertain.^[78] Some commenters who supported removing the requirement cited significant implementation challenges and costs associated with identifying, recruiting, and onboarding individuals with the necessary expertise, independence, and availability to serve in the role.^[79] Other commenters pointed to additional costs, including obtaining liability insurance and making governance-related structural changes, as further reasons to support the proposed rescission.^[80] One commenter cautioned that rescission of the EQCF requirement would remove a level of assurance with respect to internal processes and audit quality in firms but described the requirement as expensive, redundant, overreaching, and unnecessary.^[81] Two commenters acknowledged the narrow responsibilities of an individual serving in an EQCF role, but asserted that the Board may have overstated the potential costs of the EQCF requirement by using particular benchmarks involving compensation of non-employee company directors to estimate potential costs.^[82] These commenters also suggested that the Board may have understated the potential benefits of the EQCF requirement by failing to consider the ongoing trend of private equity investing in accounting firms.^[83] Another commenter stated that many of the firms most likely to be affected already use external advisers and that the incremental burden of establishing the mandated function may be less substantial than the proposal implies.^[84] This commenter also stated that the Board did not have direct evidence on the cost of the EQCF to firms.^[85]

One commenter raised concerns that the size and complexity of a large firm's QC system would create practical constraints on the depth of engagement individuals serving in the EQCF role can achieve, thereby limiting the EQCF's overall effectiveness and value beyond the oversight already available through existing channels.^[86] Another commenter supported rescission of the EQCF requirement because its current form is not scalable for firms only moderately above the 100-issuer threshold.^[87]

Some commenters opposed the proposed rescission of the EQCF requirement.^[88] Two commenters disagreed with the PCAOB's reasoning “that the benefits of the requirement may not justify the costs, except potentially for the largest U.S. global network firms.” ^[89] The same commenters, while acknowledging concerns related to potential costs, liability, and implementation, stated that some form of independent challenge remains a critical component of an effective QC system.^[90] Another commenter viewed the EQCF as essential to audit quality.^[91] One commenter expressed concern that rescinding the EQCF requirement would leave judgments about the firms' QC systems entirely to the firms themselves.^[92] This commenter stated the EQCF is the clearest structural safeguard against the commercial and network pressures and interests that can affect a firm's judgments regarding its QC system.^[93] This commenter further asserted that, as the PCAOB moves the focus of its audit inspections to the firm rather than the engagement level, and as private-equity ownership and other commercial pressures within the auditing profession continue to grow, retaining such a safeguard is particularly important.^[94]

Two commenters also asserted that the requirement for larger PCAOB audit practices to have an EQCF would be applicable to only five firms.^[95] However, absent rescission of the EQCF requirement, 13 firms, based on 2025 data, would become subject to that requirement.^[96]

In responding to the question regarding an alternative threshold for the EQCF requirement, many commenters stated it was not necessary to impose the EQCF requirement on any firm, regardless of size or number of issuers audited.^[97] Some commenters did not support an alternative threshold ( e.g., restricting the requirement only to firms auditing more than 500 issuers) because retaining the requirement in any form would not resolve the underlying concerns about operability, costs, availability of qualified individuals, and uncertain incremental benefit.^[98] Some commenters said that firms should have the flexibility to create governance structures that align with the nature and extent of their existing structure and risks of the firm.^[99]

One commenter stated that if the Board concludes that some relief is necessary, it is better to retain the EQCF requirement as adopted for firms auditing more than 500 issuers because it would apply to the five firms where nearly all U.S. public market capitalization sits.^[100] One commenter stated that if the current 100-issuer threshold were not retained, they would not oppose amending the threshold to firms that issued audit reports for more than 200 issuers during the prior calendar year, because they believe that the large revenue base received from those firms' issuer audit clients could support the incremental costs associated with the EQCF requirement.^[101] One commenter suggested retaining the EQCF requirement for firms that have accepted any form of outside investment, other than traditional debt financing, and operate through an alternative practice structure.^[102] In addition, one commenter who opposed removing the EQCF requirement expressed the view that smaller firms (under 100 audits per year) should not be exempted from robust and functioning alternative EQCF requirements if the PCAOB were to scale the provisions.^[103] Another commenter noted that, given the unchanged effective date of QC 1000, adopting alternative oversight frameworks could present implementation challenges and leave firms with limited time to thoughtfully design and integrate new requirements into their governance structures.^[104]

In the supplemental request for comment, the Board sought input on the alternative of reverting the requirement for an independent oversight function to that contained in the 2022 proposal. Several commenters did not support such an alternative.^[105] One commenter stated that the 2022 proposed requirement lacked sufficient clarity ( printed page 59361) and could create uncertainty regarding whether existing firm governance and oversight arrangements would satisfy such a requirement.^[106] Another commenter indicated that the effect or impact of adopting the requirement as initially proposed in 2022 could not be determined.^[107] One commenter did not support reverting back to the 2022 proposed requirement because it carried no defined duty to evaluate the firm's QC conclusions—the very check the EQCF was adopted to provide.^[108]

After consideration of the comments received, the Board is rescinding the EQCF requirement. Based on staff implementation support efforts, the Board understands that implementation of this requirement may have proven more difficult and costly than originally anticipated. The Board also acknowledges the concerns raised by commenters about the costs, operability, and potential limited benefit of the EQCF requirement, including the availability of qualified individuals to serve in an EQCF role, for firms of any size. In the Board's view, rescinding the EQCF requirement means giving up the benefits of an external second look. That external second look would have focused on the significant judgments made and related conclusions reached when evaluating and reporting on the effectiveness of firms' QC systems. The Board believes those incremental benefits are difficult to quantify and potentially limited. They would come from the fresh perspectives of an individual serving in an EQCF role, beyond the benefits already provided by other aspects of QC 1000. See below for further discussion on economic impacts.

The Board believes that the implementation concerns apply equally to all firms, including those operating under alternative practice structures or accepting private equity investments, regardless of the number of issuers they audit.

One commenter opposed the rescission, asserting that firm leadership should be held accountable through independent oversight.^[109] Further, the commenter suggested that firms might lack the ability to “convince investors they can do the right thing when left to their own judgment.” ^[110] As designed, though, the EQCF lacks a mechanism or the authority to hold firm leadership accountable; the EQCF is not required to provide concurring approval of the firm's evaluation or reporting.^[111] Nor would the EQCF supplant the firm's judgment.

Furthermore, the Board notes that the QC 1000 quality objectives for the governance and leadership component continue to call for (i) firm leadership to communicate and promote the firm's commitment to quality; (ii) the firm to clearly define leadership's responsibility for quality and hold them accountable; (iii) firm leadership to demonstrate a commitment to quality through actions and behaviors; (iv) the firm's strategic decisions and actions to be consistent with and support the firm's commitment to quality; and (v) resources to be obtained, developed, allocated, and assigned in a manner that enables an effective QC system and the performance of engagements in accordance with applicable professional and legal requirements.^[112] To achieve these quality objectives, firms are required to design and implement quality responses that are based on the related quality risks and on the reasons for the assessments given to the quality risks and to reduce to an appropriately low level the risk that quality objectives will not be achieved. The Board has also observed that several firms already incorporate external advisors into their organizational and governance structures and they may continue to do so as part of their response to the quality risks associated with these quality objectives. The Board has long considered firm governance and leadership to be an important aspect of firms' QC systems that will continue to be subject to oversight by the PCAOB, including as part of PCAOB inspections.

Information and Communication

QC 1000 requires a firm to establish a quality objective that, if the firm communicates firm-level or engagement-level information with respect to the firm's audit practice, firm personnel, or engagements, such as firm or engagement metrics, to external parties, such information is accurate and not misleading and, with respect to any such metrics that are communicated in writing, the communication explains in reasonable detail how the metrics were determined and, if applicable, how the method of determining them changed since the metrics were last communicated.

As discussed in the QC 1000 2024 adopting release, the information that this requirement applies to includes public communications about firm-level or engagement-level information, such as firm metrics and financial data.^[113] For example, some firms publish transparency or audit quality reports, either voluntarily or in response to the requirements of other jurisdictions, that contain data such as:

• Revenue breakdown by service line, by year, or by geographic segment;
• Professional staff ratios;
• Staff turnover ratios;
• Average training hours per professional; and
• Partner workload.

Firms may also communicate such data via web pages or other media, such as promotional publications, social media, interviews, or presentations via webcast or video.^[114]

In the supplemental request for comment, the Board proposed to narrow the requirements of QC 1000.53e regarding the need for an explanation of written metrics to those metrics that the firm makes publicly available. This was consistent with the initial focus of the requirement on public communications.^[115] The Board believes that recipients of nonpublic communications regarding metrics, such as regulators, company management, and audit committees, are generally in a position to request additional information about the metrics if they desire it. Further, some nonpublic metrics may already be calculated in accordance with a method prescribed by the recipient (for example, in response to a regulatory requirement or an audit committee request for proposal). In contrast, where metrics are publicly available, such as in firm transparency reports or promotional publications, these are usually one-way communications in which the external parties do not have the ability to ask questions or request clarification from the firm.

Several commenters supported the proposed amendments to paragraph .53e.^[116] One commenter said they did not object to confining the explanation requirement to metrics the firm makes publicly available.^[117] One of these commenters stated that the proposed amendments were generally clear and seem appropriate but suggested that the term “metric” be defined or explained in the rule text.^[118] Another commenter stated that the PCAOB must clearly communicate to firms that the intent of the provision is that firms ensure that ( printed page 59362) the explanation remains accurate and publicly available.^[119] Another commenter encouraged the Board to make explicit that simplification of communication requirements does not alter the firm's monitoring obligations.^[120] One commenter stated that it would be helpful to further clarify whether the requirement applies only to those communications required under applicable professional and legal requirements or to all such metrics publicly disclosed.^[121] The commenter further requested clarification of whether all changes to the calculation of disclosed metrics to which this requirement applies must be explained or whether this requirement applies only to material changes in the calculation of the disclosed metrics.^[122]

One commenter stated that the operability of the requirement could be further enhanced by restructuring the requirement into two distinct quality objectives—one that addresses whether the information is accurate and not misleading, and a second, conditional objective requiring an explanation for publicly communicated metrics.^[123]

The Board is adopting the proposed amendments to QC 1000.53e with modifications. Specifically, the Board is revising paragraph .53e by adding subparagraphs .e(1) and .e(2) to more clearly distinguish firm responsibilities when communicating firm-level or engagement-level information to external parties and in written public communications. The Board agrees with the commenter that this change will improve the operability of paragraph .53e without changing a firm's responsibilities. In addition, the Board believes that the change will help to address a commenter's concern regarding the clarity of the provision's intent with respect to metrics communicated in writing and made publicly available by the firm.

The requirement in paragraph .53e(2) applies to any metrics that are communicated in writing and made publicly available by the firm—it is not limited in application to metrics that are required to be communicated under applicable professional and legal requirements. Paragraph .53e(2) also requires a firm to communicate how the method of determining any metrics changed since previously communicated, if applicable, and that requirement applies to any such change in methodology, without regard to the firm's assessment of its materiality. The Board does not believe that it is necessary to define the term “metric” for purposes of applying paragraph .53e(2). The Board believes the term is reasonably understood in practice, and the Board previously clarified, in the supplemental request for comment, that the Board intends for the requirement to apply only to calculated measures, not to underlying data.^[124] As illustrated in the supplemental request for comment, if a firm publicly discloses its auditor-employee headcount for a region or office, the firm will not need to describe how it counted the employees.^[125] The requirement will apply, however, to any calculated figures derived using that data, such as the average years of experience for audit personnel ( i.e., total years of audit experience divided by auditor-employee headcount).

The Board also does not believe it is necessary to clarify that the proposed amendment would not alter a firm's monitoring obligations. As stated by the commenter who suggested doing so, the amendments simplify communication requirements but do not affect QC 1000 monitoring obligations.

The Board believes that the amendments will carry out its initial intent for public communications and avoid unnecessary costs associated with making additional disclosures to recipients who can request more information if they need it, while still ensuring that recipients of written public communications have access to an explanation of any metric provided.

In addition, the Board proposed adding a note to paragraph .53e stating that the explanation of the method for determining metrics can be provided either within the public written communication that includes the metrics or by referring in the communication to a publicly available explanation presented elsewhere, such as the firm's website.

Several commenters supported allowing firms to provide explanations of metrics in a publicly available location, such as the firm's website.^[126] One commenter stated that they supported the proposed amendment provided that those explanations are clear, balanced, accessible, and sufficiently specific to help users of the metrics.^[127] Another commenter stated that they favored public disclosures in one place for ease of use and that placement on the relevant website seems appropriate as long as there are clear instructions on how to access the explanation.^[128] The commenter further stated that, while disclosures on websites are useful, investors would want to make sure that any restatements, changes in definitions, or metrics are clearly noted, communicated in writing, and updated on a timely basis.^[129] While one commenter agreed that publishing an explanation of metrics on a website would not adversely affect the utility of metrics made public, this commenter questioned whether public information about firm metrics should be subject to certification or verification before publication.^[130] Another commenter said that an explanation that was accurate on the day it was published is of little use to an investor comparing metrics two or three years later, and that simplification of the requirement should not come at the expense of transparency or comparability over time within a single firm.^[131] This commenter requested that the Board require that any report containing a publicly disclosed metric include, in the report itself, a hyperlink to the explanation of how that metric is calculated, maintained on the firm's own website, and stated that the hyperlink must remain stable, archived, and year specific.^[132] This commenter also said that when a metric or its methodology changes from one year to the next, the change must be prominently identified in the base report itself—not only in the linked explanation—together with a description of the change and a presentation of the comparable prior year metric.^[133]

After consideration of the comments received,^[134] the Board is adopting the note to paragraph .53e as proposed but relocating it under new paragraph .53e(2).

The Board believes that allowing firms to explain metrics either in the same communication as the metric itself or by reference to another publicly available explanation would streamline firms' communications about their audit practices without adversely affecting the quality of information received by ( printed page 59363) external parties. The Board does not believe that permitting firms this flexibility will create confusion for stakeholders. Given the volume of information that a firm might communicate about itself, and the possibility that the same information may be repeated through various communication platforms, the Board believes that permitting a firm to make reference to a single publicly available explanation could reduce unnecessary duplication of disclosures and provide additional clarity to stakeholders. Also for this reason, the Board believes it is not necessary to require a change made to a metric or its methodology be identified in the written communication. The Board is not requiring firms to provide hyperlinks for the metrics because the Board seeks to preserve the principles-based nature of the requirement and avoid prescribing a specific method that may become less effective as technology changes over time.

To satisfy paragraph .53e(2), any publicly available explanation, including one provided through a website, would need to be clear, accessible, and sufficiently specific to explain how the metric was determined and any changes in the method used to determine the metric since it was last communicated. In addition, the Board does not believe that requiring certification or verification of such explanations is necessary to achieve the objectives of paragraph .53e(2). Firms would need to ensure that their explanations remained specific as to the public metric to which they relate and are publicly available for as long as they continue to make available the written public communication that refers to the location of the metrics. Firms may update the publicly available explanation as necessary to maintain its accuracy; however, such updates do not require the issuance of a new written public communication identifying or describing those updates.

Monitoring and Remediation Process

1. Responding to Engagement Deficiencies

Engagement monitoring activities are designed to provide information on whether engagement or QC system-level areas may require additional attention. These activities may identify pervasive issues where a number of engagements have similar problems, possibly highlighting the need to revise methodologies, provide additional training, or take other actions at the QC-system level. QC 1000 requires monitoring activities to include determining, on a timely basis, whether engagement deficiencies exist and, if so, taking certain actions in response to the identified engagement deficiencies.

QC 1000 defines an engagement deficiency as an instance of noncompliance with applicable professional and legal requirements by the firm, firm personnel, or other participants with respect to an engagement of the firm, or by the firm or firm personnel with respect to an engagement of another firm. Under QC 1000.68, a firm is required to take certain action when an engagement deficiency exists, with the required action depending on circumstances such as whether the engagement is completed or still in-process or is related to work performed on other firms' engagements.

i. Engagement Deficiency Related to an In-Process Engagement (QC 1000.68a)

As originally adopted, QC 1000 requires firms, for engagement deficiencies relating to in-process engagements, to take action to address the deficiency in accordance with applicable professional and legal requirements (to the extent necessary, before the issuance of the engagement report(s)), such that the engagement report(s) are appropriate in the circumstances.

The Board proposed to amend paragraph .68a to (i) replace the language “the engagement report(s) are appropriate in the circumstances” with “the engagement is free of significant engagement deficiencies” and (ii) add a footnote describing what significant engagement deficiencies are. The concept of a significant engagement deficiency is derived from AS 1220, and the description used in the proposed footnote in paragraph .68a aligns with that in AS 1220. The footnote to QC 1000.68a also clarifies that the concept applies to all engagements as that term is defined in QC 1000 (which includes, for example, engagements performed pursuant to PCAOB interim attestation standards), not only those engagements described in AS 1220.

Many commenters supported the proposed amendments to paragraph .68a.^[135] However, one commenter stated that the proposed threshold for a “significant engagement deficiency” remained overly broad and could be interpreted to encompass any instance in which an engagement team failed to perform a procedure required by PCAOB standards, regardless of whether the omission affected the sufficiency or appropriateness of audit evidence supporting a material assertion or the engagement conclusions.^[136] This commenter suggested that the definition should incorporate the concepts of materiality, relevant assertions, and the significance of the deficiency to the overall audit.^[137]

The proposed description for when a significant engagement deficiency exists is consistent with concepts in AS 1220. Under AS 1220, an engagement quality reviewer (“EQR”) may provide concurring approval of issuance only if, after performing with due professional care the review required by the standard, the EQR is not aware of a significant engagement deficiency.^[138] The description of significant engagement deficiency in the proposed amendments to paragraph .68a appropriately focuses firms on matters that must be corrected before an audit report is issued or before an engagement conclusion is communicated to the company.^[139] Therefore, the Board does not agree that the description is overly broad; a significant engagement deficiency would not be any instance in which an engagement team failed to perform a procedure required by PCAOB standards but rather is specifically related to the circumstances described in footnote 40A. Further, the Board believes the concept is well understood by the profession and does not require any revision.

The Board is adopting the amendments to paragraph .68a as proposed.

ii. Evaluating Whether Similar Engagement Deficiencies Exist on Other Engagements (QC 1000.68d)

As originally adopted, QC 1000 requires that, when the firm determines that an engagement deficiency exists, the firm should evaluate whether similar engagement deficiencies exist in other in-process engagements, completed engagements (unless it is probable that the engagement report is not being relied upon), and work performed on other firms' engagements, and if so, take actions as required by paragraphs .68a-c, as applicable.

The Board proposed to limit the requirement to evaluate whether similar engagement deficiencies exist so it would apply only with respect to a ( printed page 59364) subset of engagement deficiencies, specifically those that resulted or could result (i) a failure to obtain sufficient appropriate evidence to support the conclusion reached on an engagement ^[140] or (ii) an inappropriate overall conclusion on the subject matter of an engagement.

Most commenters generally supported the proposed amendments to paragraph .68d.^[141] The Board is adopting the amendments to paragraph .68d as proposed, along with a new note discussed further below.

The discussion below addresses specific commenter feedback related to the proposed amendments.

a. “Resulted or Could Result in”

Several commenters raised concern regarding the proposed language “resulted or could result in.” ^[142] Commenters stated that the language would introduce new complexity ^[143] and interpretation challenges,^[144] or would involve substantial implementation effort with limited incremental investor protection.^[145] One commenter stated that without further context, the term “could” effectively sets a threshold closer to a remote possibility, which, in practice, would require firms to evaluate an unbounded population of engagements.^[146] This commenter suggested that the Board consider revising the language to specify that the requirement applies “where there is a reasonable possibility” that an engagement deficiency could result in either a failure to obtain sufficient appropriate audit evidence or an inappropriate overall conclusion, to distinguish from those that represent more remote possibilities.^[147] Another commenter recommended changing the proposed language to “reasonably could result.” ^[148] Another commenter stated that it was not clear whether “could” should be assessed at the individual engagement level or at a broader thematic level, such as when a theme or trend of similar engagement deficiencies emerges.^[149] Another commenter stated that a deficiency that appears immaterial on the engagement where it was first identified can still be a symptom of a firm-wide QC weakness and a narrower trigger reduces the number of opportunities a firm has to find that pattern before it results in an audit failure.^[150] One commenter highlighted that the intended benefits of the proposed amendment could be offset by concerns regarding specific provisions ( i.e., the “could result in” language).^[151] Another commenter stated that it was difficult to determine whether the proposed amendment will meaningfully reduce complexity, subjectivity, or implementation costs.^[152] The Board is concerned that some commenters may have misinterpreted the intent of the phrase “could result in.” As adopted, QC 1000 requires the firm to evaluate all engagement deficiencies under paragraph .68d. The goal of the amendment is to narrow the types of engagement deficiencies subject to the evaluation to only those that relate to obtaining sufficient appropriate evidence or the overall conclusion of an engagement.^[153] Other engagement deficiencies would not need to be evaluated under paragraph .68d, as amended. Such other engagement deficiencies include, for example, engagement deficiencies related to communications to the audit committee; the filing of Form AP, Auditor Reporting of Certain Audit Participants; or the registration status of an other auditor that performed substantial role work.^[154] In other words, this “could result in” language is not intended to introduce an assessment of the likelihood that the engagement deficiency could result in, for example, a failure to obtain sufficient appropriate evidence to support the conclusion on another engagement. This language is instead intended to help firms assess whether a particular engagement deficiency falls within either of the two types of engagement deficiencies subject to the evaluation under the revised paragraph .68d.

For example, if the engagement deficiency related to not making a required communication to the audit committee, this type of engagement deficiency does not affect the auditor's ability to obtain sufficient appropriate audit evidence or reach the appropriate overall conclusion of the engagement and, therefore, would not be within the scope of the revised paragraph .68d. In contrast, if the engagement deficiency related to the auditor not making or observing a physical inventory count in accordance with AS 2510, Auditing Inventories, this type of an engagement deficiency would be within the scope of paragraph .68d, because it relates to obtaining sufficient appropriate evidence.

Some commenters requested clarification of an example the Board provided in the supplemental request for comment.^[155] To clarify and illustrate the application of the “resulted or could result in” language in paragraph .68d, consider the following scenario: During internal monitoring activities for the current year, a firm selected one of its completed engagements for inspection and identified that the engagement team failed to evaluate cash confirmation exceptions pursuant to AS 2310.20. As a result, the engagement team violated PCAOB requirements ( i.e., applicable professional and legal requirements) and the firm determined that an engagement deficiency exists. Because noncompliance with the requirement of AS 2310.20 (that is, the failure to evaluate confirmation exceptions) relates to obtaining sufficient appropriate evidence ( i.e., it could result in a failure to obtain such evidence), this engagement deficiency meets the requirement for evaluation under the revised language of paragraph .68d.^[156]

The Board believes that the amendment appropriately focuses a firm's attention and efforts on the types of engagement deficiencies that represent the greatest risk to audit quality. It also reduces compliance costs by narrowing the population of engagement deficiencies that a firm is required to evaluate.

b. “Evaluate Whether Similar Engagement Deficiencies Exist”

A commenter stated that the nature and extent of the procedures required to evaluate whether similar engagement ( printed page 59365) deficiencies exist should be more explicitly grounded in the root cause of the engagement deficiency identified and an assessment of whether that root cause suggests a potential QC deficiency.^[157] This commenter suggested that an evaluation anchored to root cause would provide a more meaningful and risk-based framework for determining the scope of further procedures.^[158] As it relates to the evaluation required under paragraph .68d, another commenter requested scenarios to help firms distinguish between engagement deficiencies and identified root causes that are (i) indicative of systemic issues and (ii) isolated incidents.^[159]

As described in the QC 1000 2024 adopting release, understanding the nature of the engagement deficiency will assist the firm in determining the extent of the necessary evaluation.^[160] The intent of the requirement to evaluate whether similar engagement deficiencies exist was not to require an unbounded look at every engagement the firm has. The Board believes understanding the circumstances that led to the engagement deficiency ( e.g., the underlying cause) would help the firm identify other engagements to evaluate for similar engagement deficiencies. The Board acknowledges, as commenters suggested, that this was not clear in the proposed amendments. Therefore, the Board is adding a new note to paragraph .68d to indicate that understanding the circumstances that led to the engagement deficiency may assist the firm in identifying other engagements (or work performed by the firm on other firms' engagements) to evaluate for similar engagement deficiencies.

The procedures performed can be scalable and practical in the circumstances and may be developed based on the nature of the engagement deficiency. However, it would not be appropriate for a firm's evaluation to be based on narrower criteria than those underlying the cause(s) for the engagement deficiency, nor would it be appropriate to include only a subset of the engagements that are identified based on the understanding of the circumstances that led to the engagement deficiency.

To continue with the example provided above regarding cash confirmations, the firm then gained an understanding of the circumstances that led to the engagement deficiency ( e.g., the underlying cause) to identify which other engagements to evaluate for similar engagement deficiencies. In this example, the firm might determine that the engagement deficiency was caused by an error in the firm's cash confirmations methodology, which is required to be used on all engagements that use cash confirmations. To identify whether other engagements used the same methodology (or, in the case of in-process engagements, are currently using the same methodology), the firm sends an inquiry email to each engagement partner. Based on the responses received to the emails and any follow-up with non-respondents, the firm identifies the engagements (and work performed on other firms' engagements) that followed the same methodology. It is these engagements and work performed on another firm's engagements that followed the same methodology that the firm will evaluate for similar engagement deficiencies.

If the firm identifies, for example, twenty engagements that followed the same cash confirmations methodology, the firm evaluates whether a similar engagement deficiency exists on each of the twenty engagements, i.e., a failure to evaluate confirmation exceptions pursuant to AS 2310.20. Out of the twenty engagements, if the firm identifies four engagements in which the engagement team did not perform procedures to evaluate confirmation exceptions pursuant to AS 2310.20, then the firm would need to take appropriate actions pursuant to subparagraphs a-c of paragraph .68 on each of those four engagements.

Importantly, paragraph .68d does not prescribe the manner in which the firm would identify engagements to evaluate. In the above example, the firm decided to send an email to each engagement partner to identify engagements that followed the same methodology. However, the firm could use other approaches, such as a data analysis tool or performing a search of engagement files, to identify engagements that followed the same methodology. The evaluation approach a firm takes may differ depending on the nature of the engagement deficiency, the circumstances that led to the engagement deficiency, and a firm's specific facts and circumstances. As discussed above, once the firm identifies the population of engagements subject to the evaluation of whether similar engagement deficiencies exist, it would not be appropriate for a firm's evaluation to be based on narrower criteria nor would it be appropriate to evaluate only a subset of the engagements that were identified.

The following graphic illustrates the process for evaluating whether similar engagement deficiencies exist:

c. Response to Other Commenter Feedback

One commenter did not support a requirement that would require the firm, after finding an engagement deficiency in one engagement, to evaluate whether similar deficiencies exist in all other completed engagements.^[161] This commenter stated that the cost of the requirement could be extremely high and it is unclear whether the benefit would outweigh the cost.^[162] This commenter suggested that the Board instead change the requirement so that examining a completed engagement would be required only when, based on the information available at the time, the firm believed that it was probable the financial statements were materially misstated and the likelihood was more than remote that the audit report was still being relied upon.^[163] The Board does not agree with the commenter who stated that the amendment would require that the firm evaluate whether similar deficiencies exist in all other completed engagements, as the note to paragraph .68d indicates understanding the circumstances that led to the engagement deficiency may assist the firm in identifying other engagements to evaluate for similar engagement deficiencies.

A commenter stated that a deficiency found in one engagement should prompt the firm to ask whether the same problem exists in other engagements and why it occurred, with the answers feeding back into the firm's risk assessment.^[164] The Board agrees that an engagement deficiency identified in one engagement may provide information that is relevant to the firm's broader monitoring and remediation and risk assessment processes. All engagement deficiencies are subject to action as required under paragraph .68a-c (in that particular engagement), and certain engagement deficiencies will require evaluation under paragraph .68d. Furthermore, all engagement deficiencies are treated as QC observations under paragraph .72 and must be evaluated to determine whether they are QC deficiencies. Additionally, under paragraph .20a(3), the firm obtains an understanding of information from the firm's monitoring and remediation activities, including its identification of engagement deficiencies, in identifying and assessing quality risks. In this way, the evaluation of engagement deficiencies represents one part of the broader monitoring and remediation feedback loop: information identified through that process informs the firm's evaluation of QC observations and feeds back into the firm's identification and assessment of quality risks.

This commenter also stated that deficiency rates are not materially better than in the early years of the inspection program more than twenty years ago and suggested this is not the moment to narrow the lens through which firms look for systemic problems.^[165] The Board believes that the amendments to paragraph .68d appropriately focus firms' evaluations on engagement deficiencies related to obtaining sufficient appropriate evidence to ( printed page 59367) support the conclusion reached on an engagement or the overall conclusion on the subject matter of an engagement that may indicate systemic issues on the firm's engagements.

A commenter suggested that the Board could further enhance the proposed amendment by aligning more closely with ISQM 1, which permits firms to use their judgment to determine the nature and extent of any investigation of identified engagement deficiencies and whether those deficiencies might indicate a deficiency in the system of quality management.^[166] The Board believes the requirement in paragraph .68d is fundamental to achieving the objective of the QC system that each engagement report issued by the firm is in accordance with applicable professional and legal requirements.^[167]

A commenter questioned why only items (1) and (2) from footnote 40A to proposed paragraph .68a were included in proposed paragraph .68d, while items (3) and (4) (the engagement report is not appropriate in the circumstances and the firm is not independent of its client, respectively) were not.^[168] With regard to paragraph .68d, the amendment focuses on those types of engagement deficiencies that most directly affect the sufficiency and appropriateness of procedures performed on the engagement as well as the ultimate opinion expressed by the firm.

2. Definition of QC Deficiency

As originally adopted, the note to paragraph .A8(1) of the definition of QC deficiency states that the likelihood of not achieving the reasonable assurance objective or one or more quality objectives would be above an acceptably low level if, for example, a quality objective is not established, a quality risk is not properly identified or assessed, or a quality response is not properly designed or implemented or is not operating effectively.

The Board proposed to amend this note to clarify that a failure of a quality response would be regarded as evidencing a QC deficiency only if other quality responses do not achieve the relevant objective(s). As stated in the QC 1000 2024 adopting release, the relationship across quality objectives, quality risks, and quality responses is generally not one-to-one.^[169] Most quality objectives are likely to have multiple quality risks. Some quality risks may affect one or more quality objectives, either within a single component or across several components, and may require multiple quality responses. Some quality responses may address multiple quality risks.

Many commenters supported the proposed amendment to the definition of QC deficiency,^[170] noting, for example, that allowing firms to take compensating quality responses into account when determining whether a QC deficiency exists better reflects how a risk-based system of quality control operates in practice and also aligns more closely with the principles-based framework of other quality management standards, such as ISQM 1.

Two commenters suggested revisions to the proposed amendment.^[171] One commenter stated that the rule text could clarify that multiple other quality responses are not necessarily required by adding the words “one or more” before “other quality responses” in the Note to paragraph .A8(1) for situations where there is just one other quality response.^[172] The Board believes the rule text is sufficiently clear that the clause “and other quality responses do not achieve the relevant objective(s)” applies only if the firm has designed and implemented at least one other quality response relative to the objective(s). Another commenter suggested amending the definition as follows: “(other quality responses have been implemented to address the same risk, and) `other quality responses do not achieve the relevant objectives.' ” ^[173] The Board does not believe it is necessary for the rule text to specify that “other quality responses” must have been designed and implemented to address the particular quality risk. As stated in the supplemental request for comment and reiterated here, when firms have implemented more than one quality response to address the same quality risk, they can take those other quality responses into account when determining whether a QC deficiency exists.

One commenter expressed concern that without a documented, inspectable basis for concluding that a “compensating response” actually operated effectively, this amendment risks becoming a way to explain away deficiencies rather than a genuine test of whether investors remain protected.^[174] Another commenter expressed concern that the proposed amendment would give firms/networks additional temptation to identify compensating responses when the linkage is tenuous.^[175] The Board believes the revised note makes clear that, when a quality response is not properly designed or implemented or is not operating effectively, the other quality responses would need to achieve the relevant objective(s), that is, they would need to be properly designed, implemented, tested, and found to operate effectively. And, as one commenter observed, paragraph .82 requires firms to document their evaluation of QC observations to determine whether QC deficiencies exist and the basis for each determination.^[176]

Another commenter stated that it is unclear how allowing the evaluation of compensating controls will work in practice.^[177] For example, where a quality risk has a single response that fails, the commenter stated it was unclear whether firms may consider other responses that mitigate other identified risks to support achievement of the overall objective.^[178] This commenter suggested that there may be responses where a precision level is too high to singularly address a specific risk on their own, but when considered collectively, may reduce the risk of failing to achieve the objective to an acceptable level.^[179]

As explained in the QC 1000 2024 adopting release, the purpose of this note is to provide examples of circumstances where the likelihood of the firm not achieving the reasonable assurance objective or one or more quality objectives would not be reduced to an acceptably low level.^[180] The amendments to this note further emphasize that, when a quality response is not properly designed or implemented or is not operating effectively and other quality responses do not achieve the relevant objective(s), the likelihood of the firm not achieving the reasonable assurance objective or one or more quality objectives has not been reduced to an acceptably low level. Under QC 1000, quality risks are defined as “[r]isks (whether or not related to intentional acts by firm personnel or other participants to deceive or to violate applicable professional and legal requirements) that, individually or in combination ( printed page 59368) with other risks, have a reasonable possibility of occurring and, if they were to occur, a reasonable possibility of adversely affecting the firm's achievement of one or more quality objectives.” The amendment clarifies that, when firms have implemented more than one quality response to address the same quality risk, they can take those other quality responses into account when determining whether a QC deficiency exists; if the other quality responses were effective in achieving the relevant objective(s), no QC deficiency would exist.

After consideration of the comments received, the Board is adopting the amendment to the definition of QC deficiency as proposed.

Evaluation of and Reporting on the QC System

1. Annual Evaluation of the QC System

i. Evaluation Date

As originally adopted, QC 1000 requires that the firm perform an evaluation of the effectiveness of its QC system annually as of September 30.

The Board proposed to amend QC 1000 to permit firms to select their own annual evaluation date for their QC system by adding a new defined term, “evaluation date,” defined as the date selected by the firm as of which to evaluate its QC system under paragraph .77, and making conforming changes to paragraph .77.

The Board also proposed to include language in a new footnote to guide the firm's selection of its evaluation date by recognizing that the firm's choice may be influenced by the nature and circumstances of the firm and its engagements, including, for example, the firm's fiscal year-end or the timing of monitoring activities.

All commenters who commented on this aspect of the proposed amendments expressed support.^[181] One commenter, who did not object to this aspect of the proposed amendments, expressed concern that timing should not become a tool for managing findings and a firm should not be able to use its initial selection, or a later change of date, to defer capturing known or anticipated inspection findings within an evaluation period.^[182] This commenter, however, acknowledged that under the amendments, no period of time escapes evaluation altogether and any change of evaluation date must be reported to the Board together with the firm's rationale for the change.^[183] The Board agrees with the commenter that these are useful guardrails.^[184]

The choice of evaluation date is an aspect of QC system design and, as such, has to be made and documented by the time the firm becomes subject to the QC 1000.06 requirement to design, implement, and operate an effective QC system. The firm has to have the information needed to identify unremediated QC deficiencies and to reach a conclusion about the effectiveness of its QC system as of the evaluation date, and for the individuals with ultimate responsibility and accountability and operational responsibility and accountability for the QC system as a whole, acting with due professional care, to certify the firm's report to the PCAOB on its annual evaluation of the QC system. This suggests that the evaluation date and the firm's monitoring and remediation cycle ought to be coordinated so that sufficient, timely information is available when needed about the implementation and operation of the QC system (including the status of remediation efforts) and the compliance of the firm's engagements with applicable professional and legal requirements. Because of the relationship between the evaluation date and the firm's monitoring and remediation activities, The Board does not anticipate that firms will change their selected evaluation date without a specific reason ( e.g., regulatory requirements, business combination transactions, or changes in fiscal year or business cycles).

The Board is adopting these amendments as proposed.

The Board believes allowing each firm to select its evaluation date based on the firm's particular facts and circumstances responds to the implementation challenges experienced by some firms and, in particular, could reduce the burden and costs of multiple annual evaluations that some firms could have experienced due to differences in required evaluation dates under QC 1000 versus other regulations to which they are subject. This change better aligns with the flexibility provided by other quality management standards, which permit firms to choose their own evaluation date. Additionally, the Board does not believe that allowing firms to select their own evaluation date impairs the Board's ability to carry out its inspection program.

ii. Five-Month Threshold for the Initial Evaluation of the Firm's QC System

The Board proposed to add language to paragraph .77 that would require a minimum period of operation before a firm is first required to evaluate its QC system. Under the proposed amendment, a firm would be required to evaluate its QC system once the firm has been subject to the requirement to design, implement, and operate a QC system under paragraph .06 for at least five consecutive months (whether due to the effectiveness of QC 1000 on December 15, 2026, or to the firm's later becoming subject to the requirements of QC 1000.06).

Most commenters who commented on this topic supported the proposed amendment.^[185]

However, one commenter stated that the proposed approach may create practical challenges for firms seeking to align their QC 1000 evaluation process with evaluations performed under other quality management standards, which contemplate annual evaluation periods that generally do not exceed twelve months.^[186] This commenter observed that a firm that has chosen, for example, March 31 as its evaluation date would likely be required to perform an evaluation under ISQM 1 or SQMS 1 as of March 31, 2027, while the corresponding QC 1000 evaluation would not occur until March 31, 2028, and would encompass a 15-month evaluation period.^[187] This commenter suggested that the Board could permit firms to perform their initial evaluation of their QC system as of their selected evaluation date, consistent with their normal quality control processes, but require the first Form QC filing only for the first 12-month evaluation period ending after September 30, 2027.^[188] This commenter believes that the Board could obtain information regarding that firm's initial evaluation, implementation progress, significant findings, and remediation activities through its oversight activities ( e.g., inspections, implementation outreach, annual data requests, and other regulatory interactions) prior to the firm's first Form QC filing.^[189] Another commenter stated that, combined with a free choice of evaluation date, the proposed five-month threshold could defer some firms' first evaluation well into 2028.^[190] This commenter stated ( printed page 59369) that the Board should set an outer limit so that every firm completes its first evaluation within a reasonable period of becoming subject to the standard.^[191]

The Board acknowledges that, depending on the evaluation date chosen by the firm, the first evaluation period may encompass more than 12 months, but observes that subsequent periods would proceed on a 12-month cycle (absent a change of the evaluation date). The Board believes that this approach sets a reasonable outer limit for a firm's first evaluation. The Board also believes that the five-month minimum duration of the initial evaluation period ensures that firms have sufficient information to evaluate the effectiveness of their QC system. A firm can elect to voluntarily perform its initial evaluation covering a less-than-five-month period, but that evaluation would not be a required evaluation under QC 1000. Consequently, under General Instruction 4(a) to Form QC, the firm's first Form QC filing would be required to cover the period beginning on the date the firm first incurred an obligation to implement and operate a QC system under QC 1000.06 and ending on the firm's evaluation date.

Another commenter suggested that the five-month period should commence on the first day of the month immediately following the event that triggers the firm's obligation to design, implement, and operate its QC system, which would allow firms a full five-month operating period on which to base their evaluation.^[192] This commenter also requested that the Board clarify that the five-month period applies solely to the initial operation of the broader QC system and does not establish a mandatory minimum operating period for concluding that a specific remedial action is effective.^[193] To clarify, as noted above, a firm becomes subject to the requirements of QC 1000 on (1) December 15, 2026 (the effective date of QC 1000), or (2) the day the firm becomes subject to the requirement to design, implement, and operate a QC system under paragraph .06. Therefore, in all circumstances, a firm's QC system will have operated for a full five months or longer before the firm is required to evaluate the effectiveness of its QC system. Additionally, because the five-month threshold refers to the evaluation of the effectiveness of the firm's QC system as a whole, it does not impose any minimum time requirement for any other purpose other than for QC 1000.77.

Another commenter also suggested that the Board clarify whether engagements should be included in a firm's evaluation based on the financial statement year-end or the date the auditor's report is issued.^[194] This commenter encouraged the Board to clarify how firms should approach the initial evaluation when the completion of a firm's engagements falls outside this five-month timeframe and when the initial evaluation has little or no engagement activity within the evaluation period.^[195]

QC 1000 requires that the firm design, implement, and operate a monitoring and remediation process to provide relevant, reliable, and timely information about the design, implementation, and operation of the QC system and to provide a reasonable basis for timely detection of engagement deficiencies and QC deficiencies.^[196] Firms are required to monitor completed engagements.^[197] A completed engagement is one for which the firm has issued an engagement report. Firms also are required, depending on the size of their PCAOB audit practice, to either perform in-process engagement monitoring ^[198] or consider doing so.^[199] If the firm has no completed engagements during the firm's initial evaluation of its QC system, in-process monitoring could provide relevant, reliable, and timely information about the performance of the firm's engagements.

Finally, one commenter questioned the rationale behind the Board's decision to use five months as opposed to, for example, six months.^[200] In developing the minimum time period for the initial QC system evaluation, the Board determined and continues to believe that the five-month threshold strikes the right balance such that the QC system has ample time to operate while also ensuring the PCAOB's timely receipt of information related to firms' QC systems.

Accordingly, the Board is adopting this amendment as proposed.

To illustrate how the five-month threshold for the initial evaluation of the firm's QC system would operate, if a firm that is subject to the requirements of QC 1000.06 when the standard becomes effective (on December 15, 2026) selects June 30 as its evaluation date, the firm would first evaluate the effectiveness of its QC system in accordance with QC 1000 as of June 30, 2027, because the firm would have been required to operate a QC 1000-compliant system for at least five months (specifically, from December 15 to June 30) as of June 30, 2027. Alternatively, if such a firm selects March 31 as its evaluation date, the firm would be required to first evaluate the effectiveness of its QC system as of March 31, 2028, because the firm would not have been required to operate a QC 1000-compliant system for at least five months as of March 31, 2027. As another example, if a firm first became subject to the requirements of QC 1000.06 on June 1, 2027 (because the firm became subject to applicable professional and legal requirements with respect to an engagement at that time), and the firm selects July 31 as its evaluation date, the firm would be required to first evaluate the effectiveness of its QC system as of July 31, 2028, because the firm would not have been required to operate a QC 1000-compliant system for at least five months as of July 31, 2027.

iii. Evaluation Conclusions

As originally adopted, QC 1000 requires the firm to evaluate its QC system annually and conclude that the QC system is effective, is effective except for one or more unremediated QC deficiencies that are not major QC deficiencies, or is not effective ( i.e., one or more major QC deficiencies exist).

The Board proposed to amend the above three conclusions to align QC 1000 more closely with other quality management frameworks. Under proposed paragraph .77, the firm would be required to conclude, as of the evaluation date, that its QC system:

• Is effective in achieving the reasonable assurance objective; or
• Is effective in achieving the reasonable assurance objective except for unremediated QC deficiencies that have a severe but not pervasive effect on the design, implementation, and operation of the QC system (and do not render the QC system not effective); or
• Is not effective in achieving the reasonable assurance objective.

To clarify when a firm may conclude that its QC system is effective in achieving the reasonable assurance objective under paragraph .77a, the Board proposed to include a note explaining that such a conclusion would be appropriate when, as of the evaluation date, there are no unremediated QC deficiencies other than those that, individually or in ( printed page 59370) combination, are not severe. This clarification was intended to emphasize that the presence of unremediated QC deficiencies did not, in all cases, preclude a conclusion under paragraph .77a that the QC system is effective. Rather, the determination would depend on the severity of those deficiencies and their effect on the firm's ability to achieve the reasonable assurance objective. Under the proposed approach, QC deficiencies that are not severe, whether considered individually or in combination, would not indicate that the QC system is failing to operate effectively, which would be consistent with the ISQM 1 evaluation framework and the reasonable assurance objective of QC 1000.

Under proposed paragraph .77b, a firm would conclude that its QC system was effective in achieving the reasonable assurance objective except for unremediated QC deficiencies that have a severe but not pervasive effect on the design, implementation, and operation of the QC system (and do not render the QC system not effective). To clarify, when evaluating the effect of unremediated QC deficiencies on the QC system, a firm would evaluate whether the QC deficiencies have a severe but not pervasive effect on each of the following: (1) the design of the QC system, (2) the implementation of the QC system, and (3) the operation of the QC system. Therefore, with respect to the conclusion under paragraph .77b, QC deficiencies may have a severe but not pervasive effect on the design, implementation, or operation of the QC system; they need not have such an effect on all three aspects of the QC system for a firm to reach the conclusion under proposed paragraph .77b. The parenthetical statement is intended to clarify that if QC deficiencies are so severe as to prevent the firm from achieving the reasonable assurance objective, the appropriate conclusion would be under proposed paragraph .77c. A firm would reach the conclusion set forth in paragraph .77c if its QC system was not effective in achieving the reasonable assurance objective.

QC 1000 specifies that an unremediated QC deficiency is one for which remedial actions that completely address the QC deficiency have not been fully implemented, tested, and found effective. The Board proposed to modify the existing note to paragraph .77 to explain that, while remedial actions must be fully implemented as of the evaluation date, they can be tested and found effective no later than the date Form QC is due under paragraph .79 (or, if earlier, the date Form QC is filed). The note distinguishes between the implementation of remedial actions and the demonstration of their effectiveness. For purposes of determining whether a QC deficiency is remediated, firms are expected to have fully implemented remedial actions as of the evaluation date, but the assessment of whether those actions are operating effectively may be supported by testing their operating effectiveness after the evaluation date but before the Form QC filing date.

Commenters supported the proposed amendments to the evaluation framework and evaluation conclusions, particularly the effort to align more closely with other quality management standards.^[201] Several commenters noted that this alignment would reduce the complexity of managing evaluations under multiple frameworks and help avoid potential confusion among stakeholders.^[202] Two commenters observed that the three-tiered conclusions framework better supports informed decision-making and meaningful communication with stakeholders, and reflects a more accurate representation of how QC systems operate in practice.^[203] Two other commenters noted that the proposed evaluation framework would enhance transparency by allowing firms to distinguish among varying degrees of effectiveness, including through the use of the “except for” conclusion.^[204] One commenter further stated that the proposed evaluation framework better aligns with the reasonable assurance objective because it clarifies that a QC system may provide reasonable assurance even when unremediated QC deficiencies exist.^[205] In addition, some commenters indicated that the proposed conclusions in paragraph .77 were sufficiently clear and appropriate.^[206] One commenter stated the evaluation framework in proposed paragraphs .77-.78 is generally clear but requested clarification on the latitude of firms to change their conclusions as of the evaluation date if, before the date that Form QC is filed, a firm identifies shortcomings when further testing its remedial actions.^[207]

While commenters generally supported the proposed framework, one commenter recommended expanding the “except for” category to include both “severe but not pervasive” and “pervasive but not severe” unremediated QC deficiencies to minimize potential blurring among the conclusion categories.^[208] This commenter expressed concern that a conclusion under paragraph .77a could be confusing because a firm may arrive at a favorable conclusion despite having experienced significant quality control issues during the evaluation period that were subsequently remediated.^[209] The same commenter also noted that deficiencies may take time to become apparent and suggested requiring statements or certifications indicating that firms considered previously unidentified deficiencies relating to prior years in their evaluations.^[210] Another commenter urged the Board to retain the “effective, with no unremediated QC deficiencies” conclusion as originally adopted.^[211] The commenter expressed concern that allowing firms to reach an unqualified “effective” conclusion despite the existence of unremediated QC deficiencies would broaden the circumstances in which firms may reach a favorable conclusion.^[212]

One commenter supported the proposed modification to the existing note to paragraph .77 because it provides helpful guidance and better reflects how remediation occurs in practice.^[213] Another commenter questioned whether the phrase “completely address” in the first sentence of the note, which is not part of the proposed modification, establishes an unnecessarily stringent standard and suggested replacing it with “sufficiently address.” ^[214] Another commenter requested clarification on the description in the release for determining whether a QC deficiency is remediated, specifically whether the phrase “may be supported by evidence obtained from testing after the evaluation date” refers to testing of instances that occurred before the evaluation date or the related response activities after the evaluation date.^[215] One commenter requested clarification on how firms should assess the effect of remediation efforts when frequency constraints preclude testing enough instances of the remedial actions in ( printed page 59371) evaluating remaining QC deficiencies.^[216]

In developing the proposed amendments to paragraph .77, the Board also considered an alternative evaluation framework under which a firm would be required to reach a binary conclusion ( i.e., that its QC system is either effective or not effective in achieving the reasonable assurance objective).

One commenter stated that a binary conclusion may be particularly appropriate for many triennial firms and suggested that a binary framework would simplify the evaluation process.^[217] Another commenter stated that whether the alternative evaluation framework with a binary conclusion is more appropriate is undefined, and it would be appropriate and constructive to retain the factors included in paragraph .78 (which are discussed further below) under this alternative framework.^[218]

Many commenters did not support the binary approach for the evaluation framework.^[219] Some commenters were concerned that it would limit firms' ability to communicate the nature and severity of identified deficiencies and would decrease alignment with other quality management frameworks.^[220] In addition, some commenters stated that a binary framework could provide insufficient information regarding significant deficiencies that are not pervasive enough to warrant a conclusion that the QC system is ineffective.^[221] Two commenters noted that a binary framework would be less informative.^[222] Another commenter expressed concern that the binary approach could reduce the rigor of the evaluation process.^[223] Another commenter stated that the existing three-tiered conclusion structure provides more meaningful information by distinguishing QC systems with severe but not yet pervasive QC deficiencies and serves as an important early-warning mechanism.^[224] This commenter also stated that the middle category allows severe but not yet pervasive unremediated QC deficiencies to be identified, escalated, and remediated before the QC system fails.^[225]

After considering the comments received, the Board is adopting the amendments to paragraph .77 as proposed.

The Board believes that unremediated QC deficiencies that are pervasive but not severe may nevertheless allow the QC system to achieve its reasonable assurance objective and therefore support a conclusion under paragraph .77a. The Board also believes the evaluation framework appropriately focuses on the condition of the QC system as of the evaluation date and provides firms with the incentive to timely and effectively remediate identified QC deficiencies as of the evaluation date to reach a conclusion under paragraph .77a.

The Board notes that, despite increased alignment between the evaluation conclusions under QC 1000 and other quality management standards, the possibility remains that firms may reach different conclusions regarding the effectiveness of their QC systems under QC 1000 and ISQM 1 or SQMS 1. For example, there are differences in the professional and legal requirements that apply to a firm's audit practice under PCAOB standards compared to other standards, including variations between applicable auditing standards and independence requirements. The relevant populations of engagements are different. There could also be differences relating to the individuals who perform such engagements or perform activities within the QC system, including with regard to training and supervision. In addition, QC 1000 would continue to require a more structured approach to the evaluation process than other standards, including through the application of specific defined terms and factors that are required to be considered. The Board believes this more structured approach is important both in supporting consistent and appropriate evaluation of the QC system by firms and in providing a foundation for PCAOB oversight in the future.

The Board does not believe that an additional certification requirement, as suggested by one commenter, is necessary because QC 1000 already requires firms to consider the results of prior monitoring activities and remedial actions when determining the nature, timing, and extent of the firm's monitoring activities. The Board is also retaining the phrase “completely address” in the first sentence of the note to paragraph .77 describing the meaning of an unremediated QC deficiency. The commenter's suggested phrase “sufficiently address” could introduce subjectivity regarding whether a QC deficiency has been adequately remediated. The Board believes the phrase “completely address” conveys the expected level of remediation necessary before concluding that a QC deficiency is fully remediated.

With respect to requests for clarifications of (i) the phrase “may be supported by evidence obtained from testing after the evaluation date” and (ii) frequency constraints on testing remedial actions, the note to paragraph .77 distinguishes between the implementation of remedial actions and the demonstration of their effectiveness. For purposes of determining whether a QC deficiency is remediated, firms are expected to have fully implemented remedial actions as of the evaluation date, but the assessment of whether those actions are operating effectively may be supported by testing their operating effectiveness after the evaluation date but before the Form QC filing date. For example, when a remedial action has been implemented prior to the evaluation date but evidence from multiple instances of operation is needed to conclude that the remediation is effective, the firm may test one or more instances of operation of the remedial action that took place after the evaluation date but before the filing of Form QC to demonstrate effectiveness of the remedial action. However, if multiple instances of operation are needed to conclude that a remedial action is effective and, due to frequency constraints, only one instance of operation can be tested before the filing of Form QC, then the QC deficiency would be considered an unremediated QC deficiency.

Regarding the requested clarification of a firm's ability to change its conclusion on QC effectiveness between the evaluation date and the date Form QC is filed, the Board notes that the firm's final conclusion about the effectiveness of its QC system is the conclusion reported on Form QC. When additional information related to the QC system as of the evaluation date becomes available before Form QC is filed, the firm is expected to evaluate that information and make appropriate determinations regarding the information in a timely manner and report any relevant conclusions it reaches. ( printed page 59372)

iv. Evaluating the Severity and Pervasiveness of Unremediated QC Deficiencies

As originally adopted, QC 1000.78 includes the concept of a “major QC deficiency” and provides presumptions and factors to determine whether a major QC deficiency exists and, therefore, the QC system is not effective. The Board proposed to eliminate the concept of a “major QC deficiency,” including the associated presumptions. The Board proposed to retain, in modified form, the factors to consider in evaluating the severity and pervasiveness of unremediated QC deficiencies.

Specifically, the Board proposed to amend paragraph .78 to require firms to evaluate the severity and pervasiveness of unremediated QC deficiencies in reaching the evaluation conclusion under paragraph .77. Proposed paragraph .78 clarifies that the firm's evaluation would consider all unremediated QC deficiencies individually and in combination, considering both quantitative and qualitative implications. The proposed paragraph .78 also describes severity and pervasiveness for purposes of this evaluation. Severity reflects the seriousness of a QC deficiency or combination of QC deficiencies, including the potential impact on the firm's ability to achieve the reasonable assurance objective. Pervasiveness reflects the breadth of impact of the QC deficiency or combination of QC deficiencies on the QC system or across the firm's portfolio of engagements.

Commenters generally supported removing the concept of a “major QC deficiency” from QC 1000.^[226] Some commenters noted that the concept constituted a fundamental departure from other quality management standards and reduced consistency across quality management frameworks.^[227] One commenter stated that the removal of the major QC deficiency concept and related presumptions could reduce the information value of the evaluation conclusions and lessen the prominence with which serious QC issues are escalated and communicated.^[228] The commenter urged the Board to preserve escalation presumptions in some form and clarify how serious QC issues that fall short of overall ineffectiveness will be escalated and communicated if the “major QC deficiency” concept is removed.^[229]

Some commenters supported the factors used to evaluate the severity and pervasiveness of unremediated QC deficiencies, stating that the factors promote consistency and rigor in the evaluation process.^[230] One commenter stated that the factors in proposed paragraph .78 appropriately address QC deficiencies individually and collectively and account for both qualitative and quantitative considerations.^[231]

One commenter stated that considering deficiencies “in combination” when assessing severity may blur the distinction between the concepts of severity and pervasiveness.^[232] The same commenter also indicated that this distinction may be further blurred because the same factors are used to evaluate both severity and pervasiveness.^[233] Another commenter supported the objective of providing a structured framework for evaluating the severity and pervasiveness of unremediated QC deficiencies but viewed proposed paragraph .78 as overly complex and prescriptive.^[234] The same commenter suggested an alternative model for paragraph .78, incorporating concepts from the AICPA Peer Review Program guidance for evaluating deficiencies, that would focus on the nature, cause, and effect of the deficiency, including: (1) whether the deficiency is an isolated event or a systemic weakness; (2) the significance of the deficiency to the firm's practice, including the likelihood to affect other engagements or components of the QC system; (3) the effect of the deficiency on the firm's ability to achieve the reasonable assurance objective; and (4) the extent to which remedial actions have been implemented and demonstrated to be effective.^[235]

The Board does not believe that removing the major QC deficiency concept removes the framework's ability to identify and appropriately distinguish particularly severe QC deficiencies. Under the amended evaluation framework, firms would still be required to evaluate the severity and pervasiveness of all unremediated QC deficiencies, individually and in combination, and report information regarding unremediated QC deficiencies in Form QC regardless of the evaluation conclusion reached. The evaluation conclusions in paragraph .77 and the factors in paragraph .78 would provide a structured framework for identifying and assessing unremediated QC deficiencies and for communicating unremediated QC deficiencies to the PCAOB. Further, the conclusion under paragraph .77b can only be selected when unremediated QC deficiencies have a severe but not pervasive effect on the QC system and also do not render the QC system not effective. As reflected in the parenthetical statement in paragraph .77b, if unremediated QC deficiencies are so severe as to prevent the firm from achieving the reasonable assurance objective, the firm would be required to conclude under paragraph .77c that its QC system is not effective in achieving the reasonable assurance objective.

The Board believes it is important to consider unremediated QC deficiencies both individually and in combination because doing so may reveal patterns of similar findings or indicate a broader issue that may not be evident from evaluating each deficiency in isolation. The Board also believes that allowing the same factors to inform assessments of both severity and pervasiveness provides firms with relevant information for their evaluations. In many cases, it may not be practicable to categorize a factor as relating exclusively to either severity or pervasiveness. Additionally, the Board believes the alternative factors for evaluating deficiencies, suggested by one commenter, are already reflected in paragraph .78 as proposed. The factors in paragraph .78 are intended to assist firms in performing the internal evaluation required to reach a conclusion under paragraph .77. The Board believes the approach in paragraph .78 provides clear direction to firms in evaluating the severity and pervasiveness of unremediated QC deficiencies.

One commenter noted that the term “component” in proposed paragraph .78a is undefined and could be unclear and recommended that the standard more explicitly link the term to the eight integrated components of a firm's QC system described in QC 1000.03, either through a cross-reference or by using consistent terminology.^[236] To clarify the intended meaning of the term “component” in proposed paragraph .78a, the Board is revising the paragraph to refer to the “components of the firm's QC system.”

Another commenter questioned if the factor of persistence in paragraph .78d affects the evaluation of severity and pervasiveness and provided an example of an issue that persists unchanged for three years.^[237] The Board continues to believe that the persistence of a deficiency may provide useful information in assessing its severity and pervasiveness. However, persistence alone may not determine the severity or pervasiveness of a QC deficiency, and those assessments depend on the particular facts and circumstances as well as other factors in paragraph .78.

Another commenter stated that the proposed amendments to paragraphs .78e-f introduce the phrase “or could result in” and expressed concern that the use of “could” may imply an evaluation threshold approaching absolute assurance because it encompasses even remote possibilities.^[238] This commenter suggested revising the language to refer instead to circumstances “where there is a reasonable possibility.” ^[239] The factors to consider in evaluating the severity and pervasiveness of unremediated deficiencies do not relate to providing any level of assurance. They are intended to help the firm evaluate how severe or pervasive unremediated QC deficiencies are in performing the evaluation and reaching a conclusion regarding the effectiveness of the firm's QC system. The use of “could” in these factors is intended for the firm to evaluate whether the unremediated QC deficiencies remaining as of the evaluation date have the potential to cause significant engagement deficiencies or revisions of engagement reports, or to be associated with financial statement restatements or reissuances of management reports on internal control over financial reporting or broker-dealer compliance or exemption reports that are the subject of the firm's audit or attestation engagements.

One commenter expressed concern that the wording regarding the significance to the firm's portfolio of engagements in paragraph .78g could unintentionally imply that some engagements are less important than others.^[240] While all unremediated QC deficiencies are required to be evaluated for severity and pervasiveness, the Board recognizes that there may be certain engagements where unremediated QC deficiencies are more likely to affect the firm's overall practice under PCAOB standards due to the engagement's significance to the firm's portfolio. For example, if an unremediated QC deficiency is likely to result in engagement deficiencies that occur across the primary industry that represents a substantial portion of the firm's PCAOB engagements, the unremediated QC deficiency could be severe or pervasive because of its significance to the firm's engagement portfolio.

Another commenter supported the factors if they continue to include consideration of whether remedial actions have been implemented, tested, and determined to be effective, consistent with paragraph .78h.^[241]

The Board is adopting the factors in paragraph .78 as proposed with the revision made to paragraph .78a discussed above. The Board believes these factors promote consistency by identifying circumstances that are particularly relevant in assessing the severity and pervasiveness of unremediated QC deficiencies. The final factors with general descriptions are:

a. The number and nature of components of the firm's QC system or quality objectives directly or indirectly affected.

This factor focuses on how many components of the firm's QC system or quality objectives are affected, what they are, and whether the impact is direct or spread through other components or quality objectives.

b. The extent to which the unremediated QC deficiency or combination of unremediated QC deficiencies relates to a component, quality objective, or quality response that affects the design or operation of other aspects of the QC system.

This factor focuses on how widespread the impact of the unremediated QC deficiency or combination of unremediated QC deficiencies is throughout the QC system.

c. The number and pervasiveness of root causes.

The factor focuses on what the firm's root cause analysis reveals about why the QC deficiency occurred and how significantly or broadly it affects the QC system.

d. The persistence of the unremediated QC deficiency or combination of unremediated QC deficiencies over time.

This factor focuses on the existence of a QC deficiency or combination of QC deficiencies that recurs or continues unremediated year over year.

e. Whether the unremediated QC deficiency or combination of unremediated QC deficiencies has resulted or could result in significant engagement deficiencies.

This factor focuses on whether the unremediated QC deficiency or combination of unremediated QC deficiencies is leading to or likely to lead to significant engagement deficiencies.

f. Whether the unremediated QC deficiency or combination of unremediated QC deficiencies has resulted or could result in the need for revisions to engagement reports, or is or could be associated with restatements of financial statements or reissuances of company-prepared reports that are the subject of audit or attestation engagements.^[242]

This factor focuses on whether the unremediated QC deficiency or combination of unremediated QC deficiencies has already led or could lead to revisions of engagement reports, or is or could be associated with financial statement restatements or reissuances of management reports on internal control over financial reporting or broker-dealer compliance or exemption reports.

g. With respect to the factors in subparagraphs d-f, the number and significance (to the firm's portfolio of engagements) of engagements that are affected by the unremediated QC deficiency or combination of unremediated QC deficiencies or are likely to be affected in the future in the absence of remediation, and the nature of the effect.

This factor focuses on how important the affected engagements are compared to the firm's overall practice under PCAOB standards. The number and significance of affected engagements to the firm's portfolio of engagements depends on, for example, firm personnel affected or likely to be affected, the associated revenue or profit, the associated risks, and the relevant industry.

h. The effects of any remedial actions that have been implemented, tested, and found to be effective.

Before the annual evaluation date, a firm may implement remedial actions that may reduce the severity or pervasiveness of an unremediated QC deficiency while not completely addressing it. For a firm to take credit for the effects of these remedial actions, they would need to be implemented as ( printed page 59374) of the evaluation date, and they would need to be tested and found to be effective before Form QC is due and filed. For example, in response to a QC deficiency related to a problem identified with a firm's audit software, the firm designs and implements five remedial actions as of the evaluation date. Of those five remedial actions, two remedial actions have been tested and found to be effective before Form QC is due and filed. When determining the severity and pervasiveness of the unremediated QC deficiency, the firm can consider the effects of the two remedial actions that have been tested and found to be effective.

The process flow that follows illustrates how to apply the above considerations in reaching one of the three evaluation conclusions in paragraph .77.

2. Reporting to the PCAOB

i. Reporting on the Annual Evaluation of the Effectiveness of the QC System

As originally adopted, QC 1000 provides that firms have until November 30 each year to report to the PCAOB on Form QC the outcomes of their QC system evaluations, based on a fixed evaluation date of September 30. This provides firms with 61 days after the evaluation date of September 30 to file Form QC. Based on the proposed amendment to permit firms to select their own evaluation dates, the Board proposed to amend the due date of Form QC in paragraph .79 to 60 days after the firm's chosen evaluation date. The Board also proposed to amend the Form QC reporting rule, PCAOB Rule 2203A, Report on the Evaluation of the Firm's System of Quality Control, and General Instruction 3 to Form QC to reflect this proposed amendment (see below).

Commenters generally supported the proposed amendments to paragraph .79, Rule 2203A, and Form QC.^[243]

One commenter expressed concern related to the 60-day reporting deadline for Form QC, stating that, for many smaller firms, completing the annual evaluation of the system of quality control, hiring and coordinating external resources, obtaining the necessary internal reviews and approvals, and preparing the required report within 60 days may not be practicable.^[244] This commenter recommended that the Board adopt a more scalable approach, for example, by permitting firms below an appropriate threshold to file Form QC within 180 days of their evaluation date.^[245] In allowing firms to select their own evaluation date, the Board believes it is appropriately providing firms with the ability to select a date that works best for their business cycles; however, the Board also believes that timely receipt by the PCAOB of information contained in Form QC to support the Board's oversight activities requires a shorter timeline than this commenter suggested. The Board continues to believe that the 60-day filing requirement provides firms with sufficient time from the evaluation date to the reporting date to complete their evaluation and report to the PCAOB.

The Board also proposed an amendment to General Instruction 4 to Form QC to clarify the reporting period covered by the firm's evaluation. As proposed, the reporting period would be the period beginning the day after the most recent previous evaluation date and ending on the evaluation date, with the following exceptions as to the beginning of the reporting period:

• If a firm has not previously been required to evaluate its QC system under QC 1000, the reporting period is the period beginning on the date the firm first incurred an obligation to design, implement, and operate a QC system under QC 1000.06.
• If a firm was previously required to evaluate its QC system under QC 1000, but such obligation lapsed because the firm ceased having any obligations under applicable professional and legal requirements with respect to one or more engagements, the reporting period is the period beginning when the firm subsequently incurred an obligation to design, implement, and operate a QC system under QC 1000.06.

Under this proposed amendment, the reporting period would generally be twelve months long, but it would be longer or shorter if the obligation to design, implement, and operate the QC system arises mid-period (whether by virtue of the effective date of QC 1000 or the firm's otherwise becoming subject to the requirement to design, implement, and operate a QC system). For example, for a firm that selects March 31 as its evaluation date, upon the effective date of QC 1000 the firm's first evaluation would cover the reporting period from December 15, 2026, to March 31, 2028, resulting in a greater-than-15-month reporting period, with the first Form QC due to be filed no later than 60 days following March 31, 2028. This is because as of March 31, 2027, the firm would not have been subject to the requirement to design, implement, and operate a QC system for at least five consecutive months (under the five-month threshold in paragraph .77 discussed above). By contrast, for a firm that selects May 31 as its evaluation date and is subject to QC 1000 on the standard's effective date, this firm's first evaluation would cover approximately five and a half months beginning on December 15, 2026, and ending on May 31, 2027, with the first Form QC due to be filed no later than 60 days following May 31, 2027.

The proposed amendment to General Instruction 4 did not draw comment.

The Board is adopting as proposed the amendments to paragraph .79, PCAOB Rule 2203A, and Form QC described above.

One commenter stated that two important elements of Form QC reporting would be lost with the removal of the “major QC deficiency” concept: (1) the requirement to flag whether each unremediated deficiency is major, and (2) the narrative required where a major deficiency is presumed but determined not to exist.^[246] This commenter requested that the Board preserve equivalent signals under the proposed evaluation framework and require that firms (1) indicate, for each unremediated QC deficiency, whether the firm assessed it as severe, and (2) explain the basis for any determination that severe deficiencies do not, individually or in combination, render the QC system not effective.^[247] QC 1000 continues to require that firms report all unremediated QC deficiencies as of the evaluation date on Form QC, regardless of the conclusion reported under paragraph .80a. Accordingly, a firm's Form QC reporting must include any unremediated QC deficiencies identified as of the evaluation date, including QC deficiencies that were determined not to be severe or pervasive. The Board continues to believe that reporting of all unremediated QC deficiencies will inform various aspects of the Board's oversight activities. Upon receipt of a Form QC, the PCAOB will have the ability to perform further inquiries of a firm regarding any of the information provided. Additionally, the firm is required to document under paragraph .82d the basis for the conclusion reached under paragraph .77, which would include the firm's evaluation of the severity and pervasiveness of unremediated QC deficiencies, and this information would be available to the PCAOB in connection with its oversight activities, including inspections.^[248]

Based on the amendments described above, the Board is adopting additional conforming amendments to paragraph .80 and Form QC, substantially as proposed.^[249] The Board is also adopting amendments to paragraph .80 and Form QC to replace the language “the issuance of unsupported opinions” with “significant engagement deficiencies,” consistent with the amendments to QC 1000.68a described above, as proposed.

ii. Reporting Changes to the Firm's Evaluation Date

Under the amendments to QC 1000.77, as discussed above, each firm selects its own evaluation date. The Board proposed that any change in the ( printed page 59376) evaluation date, together with a brief statement of the firm's rationale for making the change, be reported on Form QC within 30 days after the firm's decision. The Board believes this information would inform the timing of the Board's oversight efforts.

To codify this requirement, the Board proposed to recaption Rule 2203A as “ Reporting on the Evaluation of the Firm's System of Quality Control,” amend paragraph (a) of Rule 2203A to require notification of a change in the evaluation date on Form QC, and amend paragraph (b) of Rule 2203A to require such notification to be filed no later than 30 days after the firm's decision to change the evaluation date.

Relatedly, the Board proposed to amend Form QC to add a new Item 1.2, Change to the Evaluation Date, for providing notice of a change to the evaluation date, including the new evaluation date and a brief statement of the rationale for making the change. Additional language was also proposed to be added to General Instruction 3 to explain that Form QC is required to be filed no later than 30 days after the firm's decision to change the evaluation date and that a notification of change in the evaluation date need only include a completed Part I and the signed certification in Part V of Form QC.

Several commenters expressed support for the proposed reporting changes regarding the firm's evaluation date.^[250] Some commenters requested additional clarifications regarding (1) whether the firm should use business days or calendar days when calculating the deadline for submitting Form QC to notify the Board of a new evaluation date, (2) changes in the firm's evaluation date (for example, due to mergers or acquisitions), and (3) changing an evaluation date after the first year of implementation.^[251] Because the deadline for submitting Form QC is greater than seven days, the 30-day submission deadline when providing notice of a new evaluation date is based on calendar days, taking into account the exception that applies if the last day of the 30-day period is a Saturday, Sunday, or Federal legal holiday.^[252] Additionally, the standard does not limit when a firm can change its evaluation date, but a change to a firm's evaluation date would likely involve significant changes to many aspects of the firm's QC processes, so a firm will need to consider the implications to its QC system of making such a change. As noted above, if the firm decides to change its evaluation date, the change must be reported on Form QC within 30 days after the firm's decision, together with a brief statement of the firm's rationale for the change.

The Board is adopting these amendments as proposed.

Documentation

As originally adopted, QC 1000 provides firms until December 14 following the firm's annual evaluation to assemble for retention a complete and final set of QC documentation.

The Board proposed amendments to QC 1000.84 to clarify that the QC documentation should be completed and retained “in a manner that permits timely retrieval,” rather than “assembled for retention,” by the QC documentation completion date. Documentation is considered timely retrievable when it is made available in a manner that does not hinder an experienced auditor's ability to understand the design, implementation, and operation of the QC system during a particular evaluation period in accordance with QC 1000.83b and the accompanying note. In addition, in conjunction with the amendments to paragraphs .77 and .79 of QC 1000, which permit firms to select their own evaluation date and require them to report on that evaluation no later than 60 days after that date, the Board proposed to amend the QC documentation completion date to be 14 days after Form QC is filed (or due to be filed, if earlier).

Many commenters supported the proposed amendments to paragraph .84 ^[253] but some stated they continue to have concerns regarding the scope of the documentation requirements, particularly the extent of documentation required to be retained.^[254] One of these commenters raised concerns regarding the clarity and practical application of “timely retrieval of documentation” that is not maintained in the quality monitoring tool and stated that firms would otherwise need to identify, monitor, and retain documentation across a broad range of decentralized locations.^[255] One commenter stated that, while they did not object to the proposed amendments, the proposed amendments did not address a key issue related to real-time systems, namely, that such systems may not allow for the reconstruction of information back to a specific point in time unless versions are archived or captured otherwise.^[256] Another commenter did not object to the proposed amendments allowing firms to retain QC documentation within their original systems of record, provided it remains promptly retrievable.^[257]

Two commenters expressed uncertainty as to the nature of the documentation required to be retained, for example, emails or other documentation that relate to QC processes.^[258] One of these commenters requested clarification that other evidence of the underlying documentation, such as system-generated reports or other reproducible outputs, would meet the documentation requirements.^[259] This commenter stated that the release text in the supplemental request for comment indicated that firms were expected to retrieve documentation from live systems “as it existed at the time that it was considered complete,” which might not be feasible with continuously updating systems and would appear to reintroduce the same operational challenges the proposed amendment was intended to alleviate.^[260] The other commenter stated that it was unclear as to how to address documentation residing in systems or applications that have been replaced during the evaluation period.^[261]

Two commenters requested changes to documentation retention requirements, including limiting the retention requirement to evidence generated through the firm's own monitoring activities and reducing the volume of documentation required to be retained for five years.^[262] Another commenter stated that the proposed amendments to paragraph .84 do not clarify whether firms are required to retain evidence of every instance of every response, or just those instances that were tested to support the firm's QC system evaluation.^[263]

After consideration of the comments received, the Board is adopting the amendments to paragraph .84 as proposed. ( printed page 59377)

The proposed amendments clarify that firms are afforded flexibility in determining the manner(s) in which they retain documentation. Specifically, the proposed amendment to this documentation requirement clarifies that firms are permitted to maintain their QC documentation in the original system(s) of record, or in any manner or combination of manners they deem appropriate, and do not have to undergo the potentially costly and time-consuming process of transferring and assembling documentation from various source systems into a single system for archiving and retention. In addition, the Board believes that the proposed amendments clarify that it is not necessary for the firm to implement new technology solutions for the purpose of meeting QC 1000's documentation requirements because the amendment makes clear that documentation can continue to exist within the systems in which it originated or is used as long as it remains available for retrieval, e.g., for purposes of subsequent monitoring or inspection.

The Board believes the proposed amendments should provide operational relief for firms when maintaining documentation of their QC systems. If circumstances arise, such as when a firm decides to replace an existing system or determines that the decentralization of a firm's QC documentation is too broad, then a firm can maintain the required documentation of its QC system in the manner that is most appropriate for the firm—provided that the documentation is retained in a manner that permits timely retrieval. QC 1000 does not impose requirements on firms with respect to the specific systems in which QC documentation must be retained or the number of systems that retain a firm's QC documentation.

The Board acknowledges that a firm's QC system is continuously operating and the firm might not have the capability to take snapshots of system-based evidence at a point in time or for the systems to be locked down to allow for documentation to be archived. Therefore, the proposed amendment requires that the documentation be retained in a manner that permits timely retrieval, but does not specify a particular approach. Firms are not expected to continuously or periodically take snapshots of their system's data to meet this amended requirement. However, given that QC documentation may reside within live systems, the firm will need to be able to access and timely retrieve documentation sufficient to demonstrate compliance with paragraphs .81-.83 for the applicable evaluation as of the time the documentation was considered complete. If certain information related to the operation of the firm's QC systems is relevant or needed for the firm to monitor and evaluate whether a quality response operated as intended, then the firm would need to retain that information.

In determining the nature of the QC documentation to be retained, a firm may identify aspects within the QC system for which the evidence required to demonstrate that the QC system was designed, implemented, or operating effectively may not entail retention of all information that the system produces in its daily operation. For example, rather than retaining printed copies or screenshots of the restricted entity list after each change, the firm may produce the current listing along with a system-generated report listing the changes after a specified date.

As noted in the QC 1000 2024 adopting release, in light of the scope of the Board's statutory mandate, the Board's inspection procedures cannot be limited to quality responses (and, to the extent applicable, samples of the operation of quality responses) that the firm chose to monitor in the period.^[264] On the contrary, firms will be expected to provide evidence of the operating effectiveness of any quality responses selected for inspection.

As originally adopted, QC 1000 includes a requirement that the firm retain QC documentation for seven years from the QC documentation completion date, unless a longer period is required by law.

The Board proposed to amend paragraph .86 to reduce the QC documentation retention period to five years from the QC documentation completion date.

Many commenters supported the proposed amendment to paragraph .86,^[265] but some of these commenters encouraged the Board to consider whether the retention period could be further reduced,^[266] with two of them suggesting that a three-year retention period may be sufficient.^[267] Another commenter stated that a single retention period applied to all QC documentation may not be necessary and encouraged consideration of an approach whereby documentation supporting the firm's evaluation of its system of quality control be retained for a period of five years, while broader system documentation could be subject to a shorter retention period, such as three years.^[268] Another commenter suggested that the Board should clarify whether the same documentation expectations apply to both the firm's overall evaluation and conclusion on its QC system and the day-to-day execution of individual quality responses.^[269] The commenter added that documentation supporting the firm's evaluation and conclusion is generally more centralized and better suited to a five-year retention period, whereas execution-level documentation is often more detailed and may reside in several systems that change over time.^[270] One commenter cited specific concerns relating to the need to update systems and maintain system licenses for five years for the purpose of retaining records,^[271] and another commenter stated that there are still significant costs associated with retaining the required data for five years.^[272]

One commenter stated that an argument for requiring a seven-year retention period is that the retention period for QC documentation should be no shorter than that of the audit documentation requirements included in AS 1215, Audit Documentation.^[273] However, the commenter also stated that if that argument is not persuasive, then the minimum retention period should be as low as possible based on users' needs, including regulators', and in that context five years sounded excessive.^[274] Another commenter stated that a consideration for retaining the seven-year requirement could be that some U.S. Federal and state tax retention periods are a minimum of seven years.^[275] Another commenter questioned whether it would be preferable to use the term “applicable professional and legal requirements” instead of “law” in the phrase “unless a longer period of time is required by law.” ^[276]

Another commenter asked the Board to reconsider the proposed reduction from seven years to five years, stating that, under a five-year QC documentation retention period, engagement workpapers would remain available to inspection and enforcement for up to two years after the QC records ( printed page 59378) that contextualize them—such as monitoring results, root cause analyses, and remediation evidence—could have been lawfully destroyed.^[277] The commenter said that, at a minimum, the retention period must remain long enough for the PCAOB to identify deficiency patterns that only become visible across more than one inspection cycle.^[278] The commenter further stated that QC documentation relevant to an identified deficiency, or to an open inspection or enforcement matter, should be retained until the matter is resolved.^[279]

The Board has considered the costs and benefits of various retention periods, including both retaining a seven-year retention period to be consistent with audit documentation requirements under AS 1215 and adopting a retention period shorter than five years. The Board believes that a five-year retention period appropriately balances the objective of reducing unnecessary retention costs with the need to preserve documentation relevant to the PCAOB's oversight activities. In particular, the Board believes that a retention period shorter than five years could adversely affect the PCAOB's ability to carry out its oversight responsibilities and evaluate information relating to a firm's QC system over time—and carrying out our responsibilities may require access to information beyond that supporting the firm's evaluation and conclusion.

The Board also does not believe that adopting multiple retention periods for different categories of QC documentation would be appropriate. QC 1000 contemplates an integrated and interrelated system of quality control, and the documentation required by paragraphs .81-.83 is intended to support an understanding of the design, implementation, and operation of that system as a whole. Applying different retention periods to different categories of QC documentation could introduce unnecessary complexity and inconsistency and diminish the usefulness of documentation in understanding the operation of the firm's QC system over time.

Regarding commenter concerns relating to the need to update systems or maintain system licenses over time, as discussed above in connection with the proposed amendment to paragraph .84, QC 1000 does not prescribe the systems in which QC documentation should be retained or the number of systems that may be used to retain such documentation. Firms may determine the most appropriate retention approaches based on their own facts and circumstances, provided that the documentation of the firm's QC system can be timely retrieved and is retained for five years from the QC documentation completion date unless a longer period of time is required by law.

QC 1000 acknowledges that firms may be subject to laws requiring retention of QC documentation for a longer period than what the standard requires. In such situations, firms would be required to retain documentation for that longer period. This approach is consistent with that used in AS 1215, which similarly recognizes that longer retention periods required “by law” may override the period specified in the standard. The Board acknowledges the comment suggesting use of a longer period whenever required by applicable professional and legal requirements, but the Board has determined to follow the approach of AS 1215 for consistency.

After consideration of the comments received, the Board is adopting this amendment as proposed.

Requests for Implementation Guidance and Additional Commenter Feedback

1. Requests for Implementation Guidance

Commenters requested additional guidance on QC 1000, including specific examples and general guidance related to the proposed amendments, noting that such guidance would help promote consistent and effective implementation of the standard.^[280] While some of these commenters acknowledged and appreciated the staff's ongoing engagement with firms,^[281] a few commenters also requested that the Board memorialize the substance of those discussions into interpretive guidance available to all firms, suggesting that doing so would further enhance consistency and effectiveness in implementing QC 1000.^[282]

Several commenters requested guidance on specific areas of QC 1000 and related changes to other PCAOB standards that are not subject to this rulemaking, including:

a. The definition of quality response, suggesting that it is not intended to require every quality response to consist of both a policy and a procedure; ^[283]

b. The requirement in QC 1000.33e to monitor compliance by affiliates of the firm with applicable professional and legal requirements and related firm policies and procedures; ^[284]

c. The requirement in QC 1000.34b to update and communicate at least monthly additions to the restricted entities list; ^[285]

d. The scope of the requirement in QC 1000.53d regarding communications of information to external parties in accordance with applicable professional and legal requirements; ^[286]

e. Evaluating and responding to information that becomes known after the annual evaluation date but before the filing date on Form QC; ^[287]

f. The nature and extent of documentation required to be retained, including questions regarding reperformance and the level of documentation necessary to support monitoring conclusions; ^[288]

g. QC considerations related to technological resources, particularly due diligence on artificial intelligence tools, used on engagements or in the firm's system of quality control; ^[289]

h. Clarification of the meaning of specified terms used in AS 1310, Notification of Termination of the Auditor-Issuer Relationship;  ^[290]

i. How to respond to engagement deficiencies on audits of internal control over financial reporting under AS 2901, Responding to Engagement Deficiencies After Issuance of the Auditor's Report;  ^[291] and

j. How to report on Form AP the use of other quality reviewers given the rescission of SECPS section 1000.45, Appendix K—SECPS Member Firms With Foreign Associated Firms That Audit SEC Registrants.^[292]

As discussed, in the Background section above, the staff recently issued QC 1000 Q&As.^[293] Those Q&As address the guidance requests discussed in bullets a.-f. above. The staff will continue to evaluate implementation questions and requests for clarification, including those received through the Firm Consultation Process,^[294] and may address additional matters through future updates to the QC 1000 Q&As or other implementation guidance.

2. Additional Commenter Feedback

Some commenters also provided feedback on aspects of QC 1000 that were outside the scope of the proposed amendments in the supplemental request for comment and that were not requests for additional implementation guidance.^[295] These comments recommended changes to various other provisions of the standard and expressed concerns regarding scalability and cost:

• Two commenters requested the Board revisit the 100-issuer threshold.^[296] One of these commenters expressed concern that the requirement for firms auditing more than 100 issuers to maintain an automated independence-monitoring process could impose significant implementation costs on firms that currently use spreadsheet-based processes.^[297]
• One commenter requested clarification or modification of various provisions of QC 1000, including defined terms, risk assessment, governance and leadership, communication, monitoring and remediation, and documentation requirements.^[298]
• Another commenter stated that they continued to have concerns regarding the confidentiality of information submitted through Form QC, particularly information relating to identified deficiencies, root causes, remediation strategies, governance matters, and other aspects of a firm's system of quality control, and suggested that additional clarity on certain matters would provide firms with greater certainty regarding the treatment of highly sensitive quality management information.^[299]
• One commenter recommended that Form QC should, at a minimum, be made public with the PCAOB-identified deficiencies redacted, because the information included in it would be beneficial to investors for investment or proxy voting decisions.^[300]
• Another commenter recommended that the Board clarify that quality responses addressing personnel competence and capability—including structured programs to develop and assess professional judgment—are valid quality responses within this framework.^[301]
• Three commenters requested the PCAOB publish a consolidated adopting release that provides the entirety of the revised standard and relevant content from the original adopting release, and updated interpretive guidance.^[302]

The Board has considered these comments but is not making additional changes to QC 1000 beyond the amendments in this release. As discussed above, these comments relate to aspects of QC 1000 that were outside the scope of the supplemental request for comment. The Board will continue to monitor implementation of QC 1000 and may consider whether further changes to the standard or related guidance are warranted based on experience gained from implementation.

Amendments to PCAOB Form 1 and Form 2

In conjunction with the Board's adoption of QC 1000, Form 1 and Form 2 were each amended to include an item directing firms to confirm whether they have designed a QC system in accordance with QC 1000. In light of the proposed amendments discussed above, the Board also proposed to rescind these amendments to Form 1 and Form 2.

All commenters who commented on this topic supported these proposed amendments to Form 1 and Form 2.^[303] As part of the supplemental request for comment, the Board sought comment on whether a firm applying for registration should be required to identify on Form 1 the quality management standard(s)—for example, QC 1000, ISQM 1, or SQMS 1—upon which its QC policies were based. Some commenters supported this concept,^[304] but two commenters questioned the Board's intended use of the information.^[305] The Board will consider this feedback and determine in the future whether any changes to its registration processes, including the content of Form 1, are necessary.

The Board is adopting as proposed the amendments to Form 1 and Form 2.

D. Economic Considerations and Application to Audits of Emerging Growth Companies

Economic Analysis

The Board is mindful of the economic impacts of its standard setting. When the Board adopted QC 1000, it included an economic analysis of the new standard in the QC 1000 2024 adopting release, including discussion of the benefits and costs of key provisions, some of which would be affected by the amendments.^[306] The Board also submitted a comment letter to the SEC (“Board Letter”) that provided additional information regarding its economic analysis, including the benefits and costs of the EQCF requirement that the Board is rescinding.^[307] When the SEC approved QC 1000, it included additional discussion of the benefits and costs of certain of the provisions of QC 1000 and related amendments in its order granting approval.^[308] Finally, as discussed above, the Board issued a supplemental request for comment on the amendments to QC 1000 and a related PCAOB rule and forms. The Board considered the comments received in response to that request as part of this economic analysis.

This economic analysis describes the baseline for evaluating the economic impacts of the amendments, the need for the amendments, their expected economic impacts (including benefits, costs, and potential unintended consequences), and reasonable alternatives considered. There are limited data and research findings available to estimate quantitatively the economic impacts of the amendments. Therefore, the economic analysis is largely qualitative in nature. However, ( printed page 59380) certain parts of the economic analysis, where reasonable and feasible, incorporate newly available quantitative information ( e.g., in the “Need” section when discussing challenges firms have encountered designing and implementing QC 1000).^[309] The economic analysis also considers information about firms' implementation activities obtained through the PCAOB's implementation support efforts and PCAOB oversight as well as information provided by commenters.

The supplemental request for comment sought public comment on the amendments, including the economic considerations.^[310] Most commenters generally agreed that the amendments would reduce complexity and the overall cost burden, especially for smaller firms.^[311] Some commenters generally said that the amendments would not negatively impact audit quality.^[312] Some commenters raised concerns with the proposed rescission of the EQCF requirement.^[313] The Board has considered all the comments received, including the quantitative perspectives and academic research the comments referenced.

Baseline

The economic analysis considers potential impacts relative to a regulatory baseline in which QC 1000, as originally adopted by the PCAOB and approved by the SEC, would become effective. Accordingly, the baseline reflects the regulatory framework that would exist absent the amendments. The Board has limited direct experience with the QC 1000 baseline, as it is not yet effective and will not go into effect until December 15, 2026. However, the data presented below indicate the number of firms that would have been impacted by QC 1000, including requirements that the Board is amending or rescinding.

As originally adopted, all firms are required to design a QC system that complies with QC 1000. However, certain of its provisions apply to only a subset of these firms.^[314] Specifically:

• Firms are required to implement and operate a QC system that complies with QC 1000 when they lead an engagement under PCAOB standards, play a substantial role in the preparation or furnishing of an audit report (as defined in the Board's rules), or have current responsibilities under applicable professional and legal requirements regarding any such engagement.^[315] The Board refers to such firms as “full-implementation” firms. All other firms registered with the PCAOB are required to design (but not implement or operate) a QC system that complies with QC 1000; the Board refers to these herein as “design-only” firms. The Board is rescinding this design-only requirement.
• Firms that issued audit reports with respect to more than 100 issuers in the prior calendar year are required to implement several additional requirements, such as the requirement to have an EQCF.^[316]

Table 1 summarizes the number of registered firms, and whether they would likely be considered either design-only or full-implementation firms. It further breaks down the number of full-implementation firms by the number of audit reports the firm recently issued. Firms that reported any engagements on their Form 2 filings from the prior seven reporting years are classified as full-implementation firms because they are likely subject, at a minimum, to audit documentation requirements and therefore would likely have implementation obligations under QC 1000.^[317] Table 1 is relevant to several of the analyses that appear below because it identifies the principal populations affected by the amendments and provides context for later discussion of the economic significance of those populations.^[318]

• Table 1 shows that 49% (734 ÷ 1,489) of the firms in the sample are design-only firms. Figure 1 below utilizes the same methodology to identify design-only firms. The Board discusses below the impacts of the amendment to rescind the design-only requirement, which primarily impacts these design-only firms.
• Table 1 also shows that 1% (12 ÷ 1,489) of the firms in the sample are subject to QC 1000's requirements that apply to firms that audit more than 100 issuers. The Board discusses below the impacts of the amendment to rescind the EQCF requirement, which is one such requirement with a 100-issuer threshold. The Board also provides additional discussion on how the impacts of the amendments would vary by firm size.^[319]

Finally, Table 1 shows that 23% (336 ÷ 1,489) of the firms in the sample issued no audit reports for issuers during the 2025 reporting period yet still qualify as full-implementation firms based on (1) broker-dealer audit reports issued during the 2025 reporting period; (2) substantial roles played with respect to an issuer or broker-dealer audit report during the 2025 reporting period; or (3) issuer or broker-dealer audit reports issued or substantial roles ( printed page 59381) played with respect to such audit reports during the six prior reporting periods.

Need

In 2024, the PCAOB adopted QC 1000 to strengthen firms' QC systems. Since adoption, however, the Board received new information—through comment letters, implementation support efforts, and data obtained during inspection outreach activities—suggesting that certain provisions of QC 1000 were unclear in their application, might impose higher costs than initially anticipated in relation to the potential benefits, or might be unnecessarily prescriptive.^[320]

This new information is primarily qualitative and provides limited quantitative estimates of QC 1000 implementation costs, with the following exceptions. One commenter described an anonymous firm's experience implementing QC 1000, including an estimate that implementation had increased annual operating costs by approximately 1% to 1.5% of firm revenue.^[321] Through PCAOB inspection outreach activities, several firms provided quantitative information related to their implementation efforts.^[322] Among a sample of 57 firms subject to inspection in 2026, three provided estimates of the total costs of implementing QC 1000, ranging from $6,250 to $10,000 per issuer audit.^[323] The March 20, 2026 CAQ comment letter (“CAQ 2026 Letter”) reports that average estimated one-time and ongoing QC 1000 costs are $18.9 million and $12.1 million, respectively.^[324] One commenter said ( printed page 59382) that the estimates provided in the CAQ 2026 Letter should be closely scrutinized and independently validated, particularly given the methodological limitations.^[325] The Board has assessed that methodology and acknowledged its limitations.^[326]

Data received through inspection outreach activities also indicates the prevalence of certain implementation challenges. Of the 57 firms in the sample, 48 indicated that they were preparing for, assessing, or designing a system for the implementation of QC 1000, or had begun some form of implementation to comply with the standard. Among these 48 firms, five firms, including one annually inspected firm, reported experiencing significant implementation challenges that the amendments address. The annually inspected firm reported challenges related to the EQCF requirement, the determination of a QC deficiency, the QC system evaluation date, and the seven-year QC documentation retention period. Among the four triennially inspected firms, two reported challenges related to allocating and filling certain roles, one reported difficulty aligning two different QC system evaluation dates, and one reported uncertainty about the required level of documentation.

This new information has led the Board to re-evaluate the benefits and costs of alternative approaches to several QC 1000 requirements.^[327] While QC 1000 as a whole remains necessary to enhance firms' QC systems and improve audit quality, this new information points to specific QC 1000 requirements whose costs may be disproportionate to their benefits. The need addressed here is the rescission or amendment of those specific requirements; it does not relate to other provisions of QC 1000 adopted in 2024. Accordingly, the amendments are intended to preserve QC 1000's core investor-protection objectives while reducing unnecessary complexity, duplication, and implementation costs. The amendments the Board is making to QC 1000 involve:

• Rescinding Requirements: The amendments rescind the requirement for “design-only” firms to design a QC system that complies with QC 1000. The amendments also rescind the EQCF requirement.
• Reducing Scope: The amendments narrow and simplify communication requirements relating to metrics that the firm communicates to external parties about its audit practice, firm personnel, or its engagements. With respect to identified engagement deficiencies, the amendments reduce the set of circumstances in which firms would be required to evaluate whether similar engagement deficiencies exist on other engagements. Furthermore, the amendments simplify the requirements for retention of QC system documentation and abbreviate the retention period from seven to five years.
• Increasing Alignment and Flexibility: The amendments increase alignment with other quality management standards, including ISQM 1, by providing flexibility in assigning roles and responsibilities, selecting the evaluation date, and generally aligning the QC system evaluation conclusions.
• Improving Clarity: The amendments revise the definition of a QC deficiency to make clear that, when firms have implemented more than one quality response to address the same quality risk, they can take those other quality responses ( e.g., compensating responses) into account when determining whether a QC deficiency exists.

Economic Impacts

The economic analysis evaluates potential impacts of the amendments relative to a regulatory baseline in which QC 1000, as originally adopted by the PCAOB and approved by the SEC, will be effective. Since QC 1000 is not yet effective, the amendments could allow many firms to avoid some QC system design and implementation costs that would be incurred if QC 1000 were to take effect as originally adopted. Some firms, however, may already have incurred certain design and implementation costs to comply with the requirements the amendments rescind or revise, and some of those costs may not be recoverable. For example, one commenter said that many firms had already designed and implemented processes, monitoring activities, and documentation protocols around a September 30 evaluation date requirement under QC 1000 and that, as a result, modifying those processes before the initial effective date may present practical challenges, particularly for smaller firms.^[328] Another commenter said that their firm had incurred some paperwork preparation costs as well as internal costs related to reviewing literature related to QC 1000.^[329] One commenter said that many of the costs in establishing the EQCF or similar advisory functions have likely already been incurred.^[330] The Board recognizes that, to the extent incurred costs cannot be recovered, some of the cost savings discussed below would be attenuated.

In the QC 1000 2024 adopting release, the Board noted that QC 1000 would benefit investors by improving compliance with applicable professional and legal requirements, thereby improving audit quality and in turn improving investors' capital allocation decisions, increasing capital formation, and reducing cost of capital to audited companies.^[331] Regarding costs, the Board noted that there would be direct costs to firms to design and, as applicable, implement and operate a QC system that complies with QC 1000, and that such costs would be largely fixed in nature and would decline over time.^[332] The Board also noted there could be indirect costs to audited companies to the extent firms request more audit evidence from them.^[333] Finally, the Board also noted that firms may require greater fees.^[334]

As in the supplemental request for comment, the Board analyzes the potential impacts of the amendments, each of which revises or rescinds certain ( printed page 59383) requirements of QC 1000. Because QC 1000 establishes outcome-based quality objectives, any risk to audit quality that may arise from an amended requirement in QC 1000 may be mitigated by other QC 1000 requirements or other policies and procedures firms have established to achieve those quality objectives. As previously noted, the economic impacts of the amendments are measured against the baseline of QC 1000 as adopted. The supplemental request for comment was the first to analyze impacts against that baseline; although it did not formally define the baseline, the Board has done so above.

Commenters generally supported the Board's analysis of the economic impacts of the proposed amendments to QC 1000 in the supplemental request for comment; ^[335] however, some commenters raised concerns about the Board's analysis of the economic impacts of rescinding the EQCF requirement.^[336] One commenter also said the economic analysis could be improved by addressing how the amendments would impact cost reductions, audit quality, firm capacity, inspection outcomes, investor confidence, and smaller issuers.^[337] The Board discusses the impacts on audit quality throughout the economic analysis. As discussed below, taking the entirety of QC 1000 into consideration, the Board believes any negative impact of the amendments on audit quality would likely be limited, so any downstream effect on the incidence of engagement deficiencies identified in PCAOB inspection reports, investor confidence, or the broader public would be correspondingly minor. As to firm capacity, the amendments would likely free some staff resources for redeployment to other activities, including those that may more directly support audit quality.

Regarding smaller issuers, the amendments would impact issuers primarily through lower audit fees relative to the baseline to the extent audit firms pass on the direct cost savings provided by the amendments. Reduced audit fees may have a relatively greater effect on smaller issuers' profitability compared to larger issuers since audit fees typically represent a larger share of their revenue.^[338] One commenter noted that smaller issuers may rely especially heavily on the external audit given greater information asymmetry and less market coverage.^[339] Thus, to the extent the amendments negatively impact audit quality, this would imply smaller issuers could be disproportionately impacted. However, as discussed below, the Board believes any negative impacts on audit quality will be minimal. One commenter said cost savings retained by firms should not be assumed to constitute investor benefits.^[340] The Board agrees and does not make this assumption. The extent to which firms would choose to pass on any cost savings arising from the amendment to their clients is unclear. The commenter also said there is no quantification of whether the hypothetical cost savings the Board expects firms to realize will flow through to lower audit fees.^[341] The Board is unaware of data or a methodology that would allow the Board to reliably quantify the pass through of cost savings to audited companies, including any impact on audit fees.

The same commenter expressed concern that the economic considerations discussion in the supplemental request for comment conflated smaller audit firms with smaller issuers and that the economic analysis must be segmented because the amendments affect each segment differently.^[342] The economic considerations did not conflate smaller audit firms with smaller issuers. Where necessary and appropriate, the economic analysis segments the discussion of impacts ( e.g., by reference to impacts on firms, issuers, smaller firms, smaller issuers, and EGCs).

This commenter also suggested that the Board disclose the methodology behind any cost estimates it relies on in the economic analysis.^[343] The economic analysis describes the methodology the Board used for the independent analyses. In cases where the economic analysis relies on external research, it provides sourcing. In cases where the economic analysis discusses cost estimates provided by commenters, it presents and assesses any information provided by the commenter about the methodology used.

The same commenter expressed concern that the economic considerations discussion in the supplemental request for comment does not provide a quantitative assessment of the impact on audit quality and the costs for investors.^[344] The commenter suggested that the PCAOB perform and publish its own cost estimates that are comparable and methodologically transparent rather than relying solely on cost estimates provided by the auditing profession.^[345] The commenter also suggested that the PCAOB measure the tradeoff between reduced firm costs against the risk of weakened QC effectiveness and audit quality (or do so qualitatively) provision by provision.^[346] The Board is not aware of data or a methodology that would allow the Board to quantitatively assess all the impacts of the amendments or the tradeoff between benefits and costs on a provision-by-provision basis. While the commenter questioned reliance on data provided by audit firms, the commenter did not provide alternative data sources.^[347] The economic analysis discusses the potential economic impacts of the amendments grouped into key areas and, as stated above, is largely qualitative in nature. However, where reasonable and feasible, the economic analysis incorporates quantitative information.

One commenter made three further points about the economic impacts of the amendments. First, the commenter said some of the amendments weaken key requirements and risk undermining the overall importance of a firmwide approach to quality that investors value and are willing to pay for.^[348] As discussed in greater detail below, however, the Board believes any negative impacts on audit quality will be minimal. To the extent the amendments reduce firms' compliance costs, moreover, firms may not pass all of those savings—or any associated costs—through to their clients. Taken together, the Board believes the amendments will reduce unnecessary regulatory burden for firms while essentially achieving the same quality objectives that investors value.

Second, the commenter said that investors ultimately pay for investment in quality assurance services.^[349] The Board acknowledges that investors ( printed page 59384) ultimately pay for audit services. However, specific investments by firms may not necessarily be passed on to investors in the form of higher audit fees. The commenter also asserted that investments in high-quality systems should pay off for firms over the longer term and drive down costs because the cost reductions to firms arising from the amendments will tend to occur mostly in the first year but would come down over time.^[350] The Board agrees that, as a general matter, the costs of quality management systems decrease over time.^[351] The Board also acknowledges that some of the cost savings resulting from the amendments would be concentrated in largely fixed or one-time activities, such as designing a QC system. Many of the other cost savings discussed below, however, are associated with ongoing activities—such as eliminated EQCF compensation and fewer resources devoted to identifying similar engagement deficiencies on other engagements—rather than initial implementation activities. Therefore, the Board is not persuaded that, without the amendments, the benefits of the requirements the Board is amending would necessarily exceed their costs in the longer term.

Third, the commenter also noted that QC 1000 costs could be spread over the costs of all public audits and, therefore, seemed to be a reasonable price to pay.^[352] In the QC 1000 2024 adopting release, the economic analysis acknowledged that larger firms would be able to spread the fixed costs over a larger number of issuers.^[353] As discussed in below, the same is true of the fixed costs that the amendments will allow firms to avoid ( e.g., identifying an individual to serve in an EQCF role and adjusting firm governance). However, many registered firms have relatively few engagements over which to spread fixed costs and some QC 1000 costs scale with the number of engagements. As discussed below, the Board has also heard from larger firms that certain of the requirements are proving to be costly as compared to the expected benefits, notwithstanding their ability to spread fixed costs over a relatively large number of engagements.

1. Requirement To Design, Implement, and Operate a QC System

The amendments rescind the requirement for design-only firms to design a QC system that complies with QC 1000.

In the QC 1000 2024 adopting release, the Board noted that requiring design-only firms to design a QC system that complies with QC 1000 would better position these firms to accept and perform engagements in compliance with applicable professional and legal requirements because design-only firms would have a PCAOB-compliant QC system ready for implementation and operation.^[354] The Board also noted that design-only firms would face design costs incremental to the requirements of complying with ISQM 1 or SQMS 1, including around ethics, independence, monitoring, and remediation, and that these costs could lead some firms to withdraw from PCAOB registration.^[355]

Table 1 indicates that, based on the set of firms registered as of March 31, 2025, approximately 734 firms would be design-only under QC 1000 as originally adopted. Although design-only firms comprise 49% (734 ÷ 1,489) of registered firms, their role in the issuer and broker-dealer audit market is small: based on their Form 2 filings, they played no lead or substantial role on any engagements in the 2019 through 2025 reporting periods. Only 5% (35 ÷ 734) provided at least 5% of total audit hours on the audits of 51 issuers during the 2025 reporting period, with audit fees to the lead auditor and all participants on these engagements totaling approximately $379 million.^[356] The remaining 95% (699 ÷ 734) of design-only firms were not identified on any Form AP filings for audit reports issued during the 2025 reporting period.

The Board understands that most PCAOB-registered firms have implemented either ISQM 1 or SQMS 1, including design-only firms.^[357] In ( printed page 59385) addition, 11% (82 ÷ 734) of the 2025 design-only firms have failed to file a Form 2 and pay their annual fees to the PCAOB for at least two consecutive years; these firms might no longer be operational, and if their delinquencies persist, they would be eligible for withdrawal from PCAOB registration at the Board's discretion.^[358]

Potential Benefits

The amendments will generate direct cost savings for many design-only firms, including firms that are already subject to ISQM 1 or SQMS 1. For such firms that remain registered following the effective date of QC 1000, the amendments would essentially eliminate the need to make any initial changes to their QC system design and to annually identify and assess quality risks to comply with QC 1000. One commenter estimated that, for its own firm, the costs to design a QC system that complies with QC 1000 might be close to $1,000.^[359] Another commenter said the design-only requirement would have entailed training costs, consulting costs, and professional time.^[360] For design-only firms that register (or re-register) in the future, the amendment would also eliminate the need to annually identify and assess risks after they register.^[361] These cost savings would be largest for the subset of design-only firms that are not already subject to ISQM 1 or SQMS 1, since for them the savings reflect the avoided cost of designing a wholly new QC system rather than designing incremental changes to an existing one.

By reducing burdens to design-only firms, the amendments may also increase or help to maintain the number of registered firms. Several commenters agreed that the design-only requirement could lead registered firms to withdraw from registration.³⁶²

To inform the Board's consideration of the potential impacts of the amendments on registration activity, Figure 1 shows trends in requests to withdraw from registration (Panels A and B, for full-implementation and design-only firms respectively) and in applications for registration (Panel C), for calendar years 2020 through 2025. The figure also shows the number of firms in each category as of March 31 of each year, using the Table 1 methodology. Overall, the Board observes an uptick in requests to withdraw from registration that appears to be related in some part to QC 1000. For example, 154 (2 + 60 + 4 + 9 + 79) withdrawal requests were filed in 2025, greater than any year since 2020, and 7% ((2 + 9) ÷ 154) of these cited QC 1000 as a reason. This trend appears to be more pronounced for design-only firms. Notably, 10% (9 ÷ (9 + 79)) of their withdrawal requests cited QC 1000, versus 3% (2 ÷ (2 + 60 + 4)) for full-implementation firms. It is important to note that Panels A and B of Figure 1 report on firms that requested to withdraw from registration and do not include firms that are considering requesting to withdraw from registration but have not yet filed the request. Similarly, Panel C of Figure 1 reports on firms that applied to register and does not include firms that are considering applying for registration but have not yet filed the application.

For design-only firms that have withdrawn, or plan to withdraw, as a result of QC 1000, the amendments could incentivize some to re-apply or remain registered. The comments received are consistent with this potential benefit. One commenter said the amendment would alleviate concerns about smaller firms withdrawing their PCAOB registration and allow more flexibility for these firms to remain registered and apply the QC 1000 requirements only when they choose to accept engagements requiring registration with the PCAOB.^[363] Another commenter stated concern that some firms had withdrawn from registration in response to QC 1000 and that this unintended consequence of the design-only requirement could be detrimental to the quality of multinational company audits because firms may seek creative ways to complete the audits when a registered firm cannot be found in a particular jurisdiction.^[364] Another commenter said that the proposed rescission of the design-only requirement would make it more likely that firms would remain registered, where they would be able to pursue opportunities for PCAOB engagements if they appropriately planned for compliance with QC 1000.^[365] Another commenter stated that the design-only requirement incentivized firms to deregister and that, while they could later re-register, that process adds time and effort and restricts a firm's ability to bid on work or quickly respond to the marketplace.^[366] The rescission of the design-only requirement could benefit these firms by facilitating greater participation in the PCAOB audit market—for example, where lead auditors may prefer to use registered firms for less-than-substantial-role work—offset in part by the cost of re-registering (in the case of firms that have already withdrawn from registration).

An increase in the number of registered firms could also benefit audited companies by expanding the supply of firms able, after designing, implementing, and operating a QC 1000-compliant system, to serve as a lead auditor or play a substantial role.^[367] Staff analysis suggests that this is not uncommon: roughly 8% (62 ÷ 778) of firms classified as design-only as of March 31, 2020, later reported a lead or substantial role at least once over the following five reporting periods.^[368] Although lead auditors may continue using design-only firms below a substantial role even after those firms withdraw from registration, some may prefer registered firms; if such firms remain registered, lead auditors with this preference can continue using their work and avoid the cost and risk of transitioning it elsewhere. Similarly, some audit committees may consider only already-registered firms as lead auditors. Accordingly, the increased supply of registered firms could support competition in the audit market.^[369]

Additionally, by rescinding the design-only requirement, design-only firms that were planning to withdraw ( printed page 59389) from registration may choose to remain registered, avoiding the time and costs associated with re-applying for registration if they decide to take on an engagement in the future. Staff analysis indicates that the registration process takes on average 133 days from filing a Form 1 to Board approval, plus a $500 fee.^[370]

Nevertheless, the effect of rescission of the design-only requirement on re-registration and withdrawals may be limited. Panel B of Figure 1 shows that just 7% ((9 + 2) ÷ (9 + 2 + 59 + 79 + 1)) of design-only firms that requested withdrawal in 2024 and 2025 cited QC 1000, suggesting many recent withdrawals are for reasons unrelated to the amendments the Board is adopting.^[371] These firms also had small market share, so their re-registration would be unlikely to significantly affect audit fees or audit quality. The 11 design-only firms that withdrew citing QC 1000 reported no lead or substantial roles since 2019; four were named on Form AP as other accounting firms on seven audits of four issuers, with total audit fees to the lead auditor and all participants of $17 million.^[372] The Board recognizes that withdrawal requests arising in part from QC 1000 could increase in the future if QC 1000 were to take effect as originally adopted.^[373]

The amendments could also affect registration applications, but the Board sees no strong evidence of a significant impact. Almost all firms that applied to register in 2020-2025 had not performed an engagement in the prior seven years and would be classified, upon entry, as design-only.^[374] Panel C of Figure 1 shows that registration applications did not decline in anticipation of QC 1000; to the contrary, they peaked in 2024, the year QC 1000 was adopted.^[375] The Board recognizes applications may decrease in the future once QC 1000 takes effect.

Potential Costs

The amendments may also have some negative impacts. Design-only firms that choose not to voluntarily design a QC system compliant with QC 1000 may be less prepared to implement and operate such a system if they later take on an engagement. If such a firm implements its QC system within a compressed timeline and fails to account for a quality risk or otherwise fails to implement an effective QC system, the firm increases its risk that it may fail to comply with applicable professional and legal requirements when performing an engagement. As discussed above, roughly 8% (62 ÷ 778) of design-only firms as of March 31, 2020, reported a lead or substantial role at least once over the subsequent five reporting periods. One commenter said that a QC system cannot be designed and made operational overnight, and the first investors served by a newly active firm should not bear the risk of a system still under construction.^[376]

These impacts would be mitigated, however, to the extent firms most interested in leading or performing a substantial role on an engagement have incentives to voluntarily design a QC 1000-compliant system to compete for engagements. One commenter observed that firms actively proposing on PCAOB engagements would be wise to do so.^[377] The impacts would also be mitigated to the extent these firms already have a QC system that complies with ISQM 1 or SQMS 1 or have already designed a QC system that complies with QC 1000.

Some commenters were generally skeptical that the design-only requirement was beneficial in relation to its costs.^[378] For example, one commenter said the benefits of the design-only requirement were unclear as these firms are not performing engagements subject to PCAOB requirements, and that the design would be hypothetical, likely to become obsolete, and could create a false impression of readiness.^[379] The Board notes that the annual reassessment of quality risks the requirement would have entailed mitigates this last concern. Others said that the amendment introduces no risk to investors because these firms neither perform nor serve in a substantial role on PCAOB engagements.^[380] The Board believes that the costs of rescinding the design-only requirement will likely be minimal, taking mitigating factors into account.

2. Roles and Responsibilities

The amendments provide increased flexibility in filling certain specified roles in the QC system by permitting roles to be assigned to non-firm personnel and divided among multiple individuals.

Potential Benefits

The amendments will help address the implementation challenges of the original requirement that commenters raised. Some commenters said that QC 1000 would have required some firms to change their existing structures and incur unnecessary operational challenges and disruptions without a commensurate benefit.^[381] One of these commenters said it is challenging to identify a singular firm personnel member to assume operational responsibility for the entire scope of ( printed page 59390) requirements of paragraph .16, which relates to ethics and independence.^[382]

The amendments will reduce restructuring costs for firms that currently assign roles to non-firm personnel or divide roles among multiple individuals when operating their QC systems. The reduced restructuring costs may be particularly significant for firms that are already implementing ISQM 1 or SQMS 1.^[383] One commenter said that the proposed amendment would provide welcome and needed flexibility, which is important for firms of varying sizes and structures, including for some non-U.S. firms with smaller PCAOB audit practices that have found that using others from outside the firm to perform certain functions specified in paragraph .12 of QC 1000, such as monitoring and remediation and ethics and independence roles, has had a positive impact on audit quality as it brings sufficiently competent and experienced individuals with relevant subject matter expertise to the firm.^[384]

The amendments could also improve audit quality to the extent the responsibilities performed over firms' QC systems are carried out more effectively under the amendments. Firms with larger and more complex audit practices ( e.g., the U.S. GNFs) may find that some specific responsibilities required under QC 1000, such as the responsibility over ethics and independence compliance, require the expertise of multiple individuals. Firms may also find it excessively burdensome to identify a single individual willing to bear the entire responsibility for these areas. Firms with fewer staff that are part of a network may prefer to use individuals from other firms within their network (whether registered or unregistered) that have more expertise and capacity. For context, 4% (31 ÷ 755) of the full-implementation firms identified in Table 1 have just one accountant on staff and 12% (89 ÷ 755) have between two and 10 accountants. Among these firms, 19% (23 ÷ (31 + 89)) are a member of one of the six largest global networks or indicated on Item 5.2 of their most recent Form 2 filing that they are a member of or affiliated with some other audit-related network, arrangement, alliance, partnership, or association.^[385]

Commenters provided examples to support the view that the amendments would improve audit quality.^[386] One commenter asserted that the amendments would allow a firm to assign subject matter experts inside their firm networks to specific compliance tasks, which is likely to yield higher quality results.^[387] Another commenter said that assigning roles and responsibilities to other individuals who are not firm personnel often enhances the experience, competence, and authority specific to functional areas, such as ethics and independence, or provides the individuals with the time needed to carry out their responsibilities effectively.^[388] One commenter also said that the amendments would enhance audit quality outcomes by promoting the effective execution of quality control responsibilities, while maintaining accountability for results.^[389] Another commenter noted that certain functions in a quality management system draw on disciplines that firms do not uniformly maintain in-house and the amendment would allow firms to engage qualified external specialists for such roles, which should improve the quality of those functions.^[390] One commenter asserted that ethics and independence are disciplines that benefit from the dedicated focus of individuals with different skills and areas of expertise and confirmed these roles have been assigned to different individuals to drive the highest quality outcome.^[391] This commenter believed the amendment would allow firms to designate individuals serving across registered firms within a network and enable firms to place the most experienced and qualified individuals in those positions, which is accretive to audit quality.^[392] The Board agrees that the amendments could improve audit quality.

Potential Costs

The amendments could also have some negative consequences. If a firm's QC system responsibilities are split into subcomponents across multiple individuals, there could be a risk that subcomponents of the responsibilities are never assigned, leading to a less effective QC system. For example, if a firm's QC system responsibility over monitoring and remediation is split into responsibility over monitoring and responsibility over remediation, responsibilities that could reasonably be associated with either monitoring or remediation may inadvertently never be assigned. Absent an explicit assignment, individuals may not be motivated to pick up these responsibilities voluntarily. On the other hand, there could be a risk that certain subcomponents are assigned multiple times, leading to unnecessary costs for firms. However, these risks would be mitigated by paragraph .27 of QC 1000, which requires the firm to establish and maintain clear lines of responsibility and supervision—including defining authorities, responsibilities, accountabilities, and supervisory and ( printed page 59391) reporting lines for roles within the firm, up to and including the principal executive officer(s) or equivalent—within the QC system. These risks would also be mitigated through the governance and leadership component of the QC system.^[393]

The amended requirements could also require greater coordination and communication between individuals with responsibility over related subcomponents ( e.g., monitoring and remediation) and between these individuals and the individual(s) with ultimate responsibility. If information is not shared effectively, individuals may be forced to make decisions with incomplete information. However, this risk would be mitigated by the firm's implementation of quality responses that reduce to an appropriately low level the risk that the quality objectives related to information and communication will not be achieved.^[394]

If responsibility is assigned to an individual external to the firm, this external individual's incentives may not be aligned with the firm's incentives. For example, while firms may be able to align external individuals' incentives with the success of the firm's QC system to some extent through incentive contracting, such external individuals may remain more attentive to the reputation and commercial success of their home firms than to their QC responsibilities to another firm. One commenter said that individuals outside the firm may have conflicting interests, and because these responsibilities are not their full-time job, they cannot provide the day-to-day ownership the roles require.^[395] An external individual may also be less familiar with the firm and, as an “other participant” for purposes of QC 1000, would not be subject to the firm's QC system in the same way as “firm personnel.” These factors could reduce the effectiveness of the QC system. However, this risk would be mitigated by the requirement that the individual(s) assigned roles and responsibilities with respect to the QC system understand and be accountable for their roles and responsibilities.^[396]

A commenter said that investors would not be opposed to an amendment to enable a limited degree of scaling the roles and responsibilities requirements to address cost considerations for small and large firms, but would be concerned about any dilution of requirements due to costs alone that impact audit quality.^[397] Another commenter acknowledged that some may question whether the flexibility provided by the amendments could dilute accountability or weaken the clarity of responsibilities within a firm's QC system.^[398] This commenter asserted that QC 1000 will continue to require that roles and responsibilities be clearly defined and understood and require firms to be accountable for allocating responsibilities in a way that supports effective oversight and execution, even where responsibilities are divided.^[399] The Board believes these potential negative consequences would be mitigated by other QC 1000 provisions.^[400]

3. External QC Function

The amendments rescind paragraph .28 of QC 1000, which requires firms that issued audit reports for more than 100 issuers in the prior calendar year to incorporate into their governance structure an EQCF. In evaluating the economic impacts of rescinding the EQCF requirement, the Board considered the potential benefits of eliminating implementation and ongoing compliance costs and complexity, as well as the potential costs of foregoing an additional perspective on significant judgments made and the related conclusions reached by the firm when evaluating and reporting on the effectiveness of its QC system. As discussed below, limited data and information are available to quantify these benefits and costs. However, where reasonable and feasible, this discussion considers relevant indirect evidence, including commenter input, implementation experience, and academic research, to inform the Board's assessment of the potential impacts of rescission.

The Board estimates that the EQCF requirement would apply to 13 firms based on the threshold of more than 100 issuer audit reports during the 2025 calendar year.^[401] Those firms collectively audited 8,085 issuers, representing approximately 70% of all issuer audits and approximately 82.3% of aggregate issuer market capitalization.^[402]

Potential Benefits

Rescinding paragraph .28 of QC 1000 will eliminate the costs to firms of identifying, hiring, retaining, and compensating suitable individuals for the EQCF role, including the specific costs highlighted by commenters. Firms could redirect the funds and resources that otherwise would have been devoted to implementing the EQCF requirement to other activities, including activities that may support audit quality.

One commenter said that some of the costs in establishing the EQCF have likely already been incurred.^[403] The Board agrees that any cost savings could be attenuated to the extent that firms have already incurred costs to identify and contract with individuals to perform the EQCF role.^[404]

As discussed above, commenters have stated that implementing the EQCF has proven more difficult and more costly than originally anticipated. Some commenters identified significant implementation challenges and costs associated with identifying, recruiting, and onboarding individuals with the necessary expertise, independence, and availability to serve in the role.^[405] One commenter confirmed some of its member firms found it challenging to identify candidates willing and able to perform the EQCF function.^[406] Another commenter noted that firms have experienced challenges identifying appropriate individuals that meet what this commenter characterized as “overly prescriptive guidelines” for the EQCF ( printed page 59392) requirement.^[407] The commenter also identified practical constraints that could make suitable candidates difficult to identify, including the need for sufficient experience and competence and compliance with applicable independence requirements.^[408] Another commenter said that their firm experienced practical challenges with the “ambiguity” of the EQCF requirement, particularly in defining the appropriate scope of activities and distinguishing advisory oversight from operational involvement.^[409]

The Board is not aware of evidence that bears directly on the magnitude of the cost to firms that are required to incorporate an EQCF in their QC systems. In the QC 1000 2024 adopting release, the Board used the average compensation per non-employee director at SP 500 public companies in 2023 as a potential benchmark to inform some of the costs to retain appropriate individuals from outside the firm to serve in an EQCF role.^[410] The Board also used the range and average of total remuneration for individual independent non-executives (“INEs”) under the United Kingdom's (“U.K.”) audit firm governance rules ^[411] in 2023 as another potential benchmark for the potential costs of the EQCF.^[412]

In the supplemental request for comment, the Board used the same potential benchmarks with more recent data to inform the potential cost savings that could result from rescinding the EQCF requirement. First, the Board reported recent compensation for INEs disclosed by PCAOB-registered firms based in the U.K.: the total annual remuneration per INE ranges from $25,935 to $387,288 with an average of $141,691; the total annual remuneration is on average $180,850 for Big 4 firms ^[413] and $110,364 for other firms that must comply with the EQCF requirement.^[414] Second, the Board used the average compensation per non-employee board director at SP 500 public companies, which was $336,352 in 2025.^[415]

Two commenters asserted potential flaws in the PCAOB's analysis of the potential benefits associated with rescinding the EQCF requirement in QC 1000.^[416] Specifically, these commenters stated that using either the compensation of a non-employee director at SP 500 public companies or the remuneration for INEs under the U.K.'s audit firm governance rules as benchmarks overstates the potential costs of the EQCF requirement.^[417] Another commenter said that a non-executive director of a SP 500 public company has a very different role than an external quality review professional; however, this commenter agreed that a U.K. INE who would serve on a firm's board is a good model for considering the potential costs of the EQCF requirement.^[418] Another commenter said that the supplemental request for comment provided no evidence with direct relevance to the cost savings from rescission and relied only on “a proxy-based cost case.” ^[419]

While the total cost of the EQCF role could differ substantially from these benchmarks, the Board continues to believe that they provide illustrative reference points for considering the potential costs associated with retaining qualified individuals to perform the role. In the supplemental request for comment, the Board acknowledged the limitations of using the compensation of non-employee directors at SP 500 public companies or the remuneration for INEs under the U.K.'s audit firm governance rules as benchmarks for estimating the potential cost savings from rescinding the EQCF requirement, including differences in the responsibilities of an oversight function and those of a non-employee director function, as well as differences in their litigation risk profiles.^[420] These differences limit the extent to which either benchmark can be used to estimate the actual costs of the EQCF role. The Board has not identified new data or research, or received new information through comments, that would allow the Board to quantify those costs more reliably.

In addition, the compensation cost for the EQCF role may be affected by factors such as qualification requirements, liability concerns, and the availability of candidates willing to serve. Through implementation support efforts, the Board learned that some firms experienced challenges in identifying individuals willing to take on the role, and one commenter cited liability concerns as a contributing factor.^[421] It appears that these concerns may be limiting the effective supply of willing individuals and would require firms to offer compensation sufficient to attract them.

Furthermore, the EQCF requirement sets no ceiling on the level of involvement that the EQCF may undertake in performing its mandated role, which could increase the total cost of the role. Paragraph .28 of QC 1000 requires the EQCF to serve as “an external oversight function for the QC system” and, at a minimum, to evaluate the significant judgments made and the related conclusions reached by the firm when evaluating and reporting on the effectiveness of its QC system. This minimum responsibility is a focused, analytical task that could, depending on how a firm chooses to implement the requirement, involve substantial engagement with a complex QC system. Given the complexity of the QC systems at annually inspected firms, a firm may choose to have the EQCF devote substantial time and effort to understanding its QC system or have multiple individuals perform the role.^[422] Indeed, through implementation ( printed page 59393) support efforts, the Board learned that some firms were considering assigning multiple individuals to serve in an EQCF role. Therefore, depending on how firms choose to implement the EQCF requirement, the total cost of the role could vary substantially.

One commenter asked the Board to compute and publish, for each of the largest firms, the cost of the EQCF per audit performed, as such information would allow investors to weigh the claimed burden against the value of “independent oversight.” ^[423] The commenter also stated that the cost savings from rescission, when spread across thousands of audits, would not meaningfully reduce audit fees.^[424] While such estimates could inform consideration of the potential impacts of rescinding the EQCF requirement, the Board has limited information to reliably estimate each large firm's actual EQCF costs. As discussed above, these costs could vary substantially depending on how each firm chooses to implement the requirement. Although the Board cannot estimate the EQCF cost per audit for each firm, the Board acknowledges that the incremental costs may not impose a large per-audit burden on the largest firms, given the number of issuers and broker-dealers they audit and the associated audit revenue. The Board also agrees that the extent to which the corresponding cost savings from rescission would affect audit fees is unclear. Even so, the incremental costs should be evaluated together with the incremental benefits that the EQCF might provide. As discussed below, the magnitude of those benefits is uncertain and may be limited, particularly with respect to the EQCF's ability to provide effective “independent oversight.”

One commenter said that a minority of its members opposed rescinding the EQCF requirement, noting that the largest firms have voluntarily established functions that could be upgraded to satisfy the EQCF requirement.^[425] Similarly, another commenter stated that many of the firms subject to the EQCF requirement already use external advisors and that the incremental burden of establishing the mandated function may be less substantial than the proposal implied.^[426] The functions the commenters identified are external advisory bodies whose current responsibilities differ from those of the EQCF, and their members would not necessarily satisfy the roles and responsibilities described in the EQCF requirement unless the external advisory bodies are modified and these members are willing to assume these new roles and responsibilities. The Board also observed that one commenter acknowledged that its existing external advisory council structure does not satisfy the EQCF requirement.^[427] Another commenter said that identification and onboarding of the EQCF role would be a significant undertaking because, among other things, it has many existing governance and advisory structures in place.^[428] Another commenter opined that the EQCF responsibilities described in QC 1000 extend well beyond the responsibilities of the structures currently in place at the largest six firms.^[429] These comments are consistent with the observations in the QC 1000 2024 adopting release and the supplemental request for comment that firms with an existing external advisory function would still incur incremental costs to incorporate the EQCF requirement, including the costs of hiring new individuals, providing liability insurance, or committing additional time and resources.^[430] On the other hand, as discussed below, the EQCF could provide incremental benefits by bringing a fresh perspective to the firm's evaluation of its QC system. That benefit may be smaller at firms that already obtain external perspectives through existing advisory structures.

Potential Costs

The potential costs of rescinding the EQCF requirement are the foregone benefits that the EQCF might provide if the requirement were to take effect and operate as intended. The Board believes the main value of the EQCF requirement would be the introduction of an external second look at the firm's significant judgments made and related conclusions reached when evaluating and reporting on the effectiveness of its QC system. An individual from outside the firm could bring an additional perspective that may help identify issues or risks the firm may have missed when evaluating and reporting on the effectiveness of its QC system. By providing an external evaluation of significant QC judgments, the EQCF could help improve the firm's QC system and thereby benefit investors.

The magnitude of such benefits, however, is uncertain and difficult to quantify. Paragraph .28 of QC 1000 provides firms with flexibility regarding implementation and does not prescribe detailed procedures beyond the EQCF's core responsibility to evaluate significant judgments and related conclusions concerning the effectiveness of the firm's QC system. The implementation support efforts indicated that firms were considering a range of approaches to complying with the requirement; as a result, any resulting benefits would likely have varied across firms. The Board does not expect rescission to result in significant negative impacts on audit quality, particularly taking into account existing governance structures, monitoring, PCAOB oversight, and other QC 1000 requirements that will remain in place.

Most commenters supported the rescission of the EQCF requirement.^[431] Some commenters said that removing the EQCF requirement would not diminish the focus on audit quality because QC 1000 advances the objectives of strengthening trust in governance, reinforcing accountability, and supporting a commitment to quality through other provisions in the standard.^[432] Other commenters observed that existing governance structures, leadership accountability, monitoring activities, and PCAOB inspections already provide meaningful oversight.^[433] Some commenters also said that rescission would allow firms to leverage existing external governance structures or develop other mechanisms tailored to their circumstances to support audit quality.^[434] For example, based on information obtained through recent PCAOB oversight activities, 9 of the 13 firms that would likely have been subject to the EQCF requirement already have an independent individual serving in an advisory role for the firm.^[435]

Some commenters opposed rescission of the EQCF requirement.^[436] One commenter said that some form of independent challenge is vital.^[437] This commenter said that the PCAOB may have understated the potential benefits of the EQCF requirement by failing to consider the impact of the ongoing trend of private equity investment in accounting firms.^[438] Another commenter echoed this point and identified three annually inspected firms that have received some form of private equity investment since 2024.^[439] These two commenters asserted that the consideration of the risks that private equity investments present to auditor independence, including the potential trade-offs between audit quality and commercial decisions, increases the benefits of the EQCF requirement.^[440] Another commenter said that the EQCF is essential to audit quality and that independent oversight is essential for investor protection, which is even more important given the changes in ownership structures and more complex transactions.^[441] Another commenter said that the EQCF is the clearest structural safeguard against the commercial and network pressures and interests that can affect a firm's own judgments about its QC system.^[442] This commenter expressed concern that the rescission would remove that safeguard, while evolving ownership structures and continuing commercial pressures heighten the importance of independent oversight.^[443] By reference to academic research, one commenter said that alternative practice structures embed pressures that reshape firm priorities, compensation systems, and strategic decision making.^[444] One commenter, while expressing the view that the EQCF may be costly and unnecessary, cautioned that rescission of the EQCF requirement would remove a level of assurance regarding firms' internal processes and audit quality.^[445]

The QC 1000 2024 adopting release recognized that the EQCF could reduce negative impacts of commercial considerations on decision making by firms, which may occur in some circumstances when the EQCF's perspective causes the firm to reconsider significant QC judgments and related conclusions when evaluating and reporting on the effectiveness of its QC system.^[446] The commenters who opposed rescission, however, appear to view this potential benefit as much more certain than was reflected in the 2024 adopting release. In particular, the commenters appear to expect the EQCF's “independent oversight” to serve as a “safeguard” against firms' “commercial decisions” or “commercial and network pressures and interests” that may adversely affect audit quality.^[447]

The commenters' expectations should be considered in light of the structure of the EQCF role. Audit firms have an obligation to serve the public interest. This obligation is bolstered by PCAOB oversight and professional obligations, as well as reputational and litigation risks, all of which create strong incentives for firms to fulfill their professional duty to produce high-quality audits. As a result, firms' interests in maintaining high audit quality are often aligned with investor interests. The concerns raised by the commenters, however, relate to circumstances in which those interests may diverge and to the expectation that the EQCF would prioritize investors' interests when such divergence occurs. Although the EQCF requirement is established in QC 1000, the EQCF would remain a private service obtained by the firm. The audit firm would be responsible for selecting, engaging, compensating, retaining, and removing the individual performing an EQCF role.^[448] As a private contractor operating in a commercial market in which future business opportunities depend on client relationships, the individual performing an EQCF role would also have his or her own commercial interests, which could create incentives to avoid challenging the judgments of the firm in circumstances where protecting investor interests would require such a challenge. Further, because QC 1000 does not prescribe how individuals serving in the EQCF role should perform the evaluation and because the evaluation necessarily involves subjective and discretionary assessments, the judgments they make in conducting the evaluation may be influenced by their own incentives. The structural features of the EQCF may limit the EQCF's ability to reliably meet commenters' expectations regarding the role.

Taking these considerations together, the Board believes the primary benefit the EQCF could reasonably provide is an additional, external perspective on the firm's significant judgments and conclusions made in connection with its QC system evaluation and reporting. Although this external-perspective benefit is real, its magnitude is uncertain and would depend on firm-specific implementation choices that QC 1000 does not standardize or require. The Board recognizes that rescission will forgo such potential benefits, while retaining the requirement would impose implementation and ongoing compliance costs.

4. Information and Communication

The amendments narrow and simplify communication requirements relating to metrics that the firm communicates to external parties about audit practice, firm personnel, or engagements.

Potential Benefits

The amendments should reduce costs for firms when disclosing written metrics to external parties on a nonpublic basis. The amendments may also incentivize firms to provide more disclosure of written metrics to external parties on a nonpublic basis because the costs of doing so would be less. One commenter said that paragraph .53e as originally adopted and approved would be impractical and may not meaningfully enhance audit quality.^[449] Some commenters noted that the amendments would focus on more relevant information, reduce the risk of over-collection and duplication, and enhance clarity and accessibility for investors and other users.^[450] The Board ( printed page 59395) agrees with these observations about potential benefits.

Potential Costs

The Board expects these amendments would have limited negative impacts. External parties receiving nonpublic written metrics should already understand these metrics and some may be able to request additional information directly from the firm on an as-needed basis. One commenter said that dialogue and follow-ups are readily available to these external parties.^[451] The Board agrees with this observation.

5. Monitoring and Remediation Process

i. Evaluating Whether Similar Engagement Deficiencies Exist on Other Engagements

With respect to identified engagement deficiencies, the amendment requires evaluation of whether similar engagement deficiencies exist on other engagements only if the identified engagement deficiency resulted or could result in (1) a failure to obtain sufficient appropriate evidence to support the conclusion reached on an engagement or (2) an inappropriate overall conclusion on the subject matter of an engagement.

Potential Benefits

This amendment will reduce costs for firms to operate their QC systems because they will be required to evaluate whether similar engagement deficiencies exist in fewer cases. Some commenters said the amendment could reduce the complexity, subjectivity, and costs associated with evaluating engagement deficiencies across other engagements.^[452]

Potential Costs

The Board believes it is unlikely the amendment would have a significant impact on audit quality because the amendment scopes out only engagement deficiencies that are less likely to impact audit quality. Furthermore, firms would still be required to address all types of engagement deficiencies on the engagements on which they have been identified in accordance with subparagraphs a-c of paragraph .68 and evaluate them to determine whether QC deficiencies exist in accordance with paragraph .72. To the extent firms are constrained by limited staff resources, focusing firms' attention on engagement deficiencies that are most likely to impact audit quality may improve audit quality overall.

One commenter suggested that the amendment could improve audit quality as it would allow firms to focus attention on those engagement deficiencies that are most relevant.^[453] Another commenter noted the amendment could allow firms to focus their efforts on matters that are likely to have an effect on audit quality.^[454] However, one commenter questioned why only items (1) and (2) from footnote 40A to proposed paragraph .68a were included in proposed paragraph .68d while items (3) and (4) (the engagement report is not appropriate in the circumstances and the firm is not independent of its client, respectively) were not.^[455] Another commenter stated that a deficiency that appears immaterial on the engagement where it was first identified can still be a symptom of a firm-wide QC weakness and a narrower trigger reduces the number of opportunities a firm has to find that pattern before it results in an audit failure.^[456] The commenter also said the economic analysis offers no data or analysis on which deficiencies would no longer require evaluation of whether similar engagement deficiencies exist on a firm's other engagements.^[457] See above for a discussion of the types of deficiencies that would require evaluation under the revised paragraph .68d. The amendment to this paragraph focuses on those engagement deficiencies that most directly affect the sufficiency and appropriateness of evidence obtained on the engagement as well as the ultimate opinion expressed by the firm.

ii. Definition of QC Deficiency

The amendments revise the definition of “QC deficiency” to make clear that, when firms have implemented more than one quality response to address the same quality risk, they can take those other quality responses ( e.g., compensating responses) into account when determining whether a QC deficiency exists; if the other quality responses were effective in achieving the relevant objective(s), no QC deficiency would exist.

Potential Benefits

By clarifying the scope of the definition, this amendment would reduce regulatory uncertainty about the existence of, and thus the need to remediate, QC deficiencies in firms' QC systems. One commenter explained that QC systems often include multiple, interrelated quality responses to address the same quality risk and that evaluating one quality response in isolation could overstate the significance of an issue.^[458] Another commenter said that this amendment would improve the evaluation of QC observations and help focus monitoring and remediation efforts on issues that have the greatest potential impact on audit quality.^[459] The Board agrees with the commenters' assessments of these potential benefits.

Potential Costs

At the same time there would be limited risk to the overall functioning of the QC system because the amendment is only a clarification. One commenter expressed concern that the amendment would give firms or networks additional temptation to identify compensating responses when the linkage is tenuous.^[460] Another commenter said that without a documented, inspectable basis for concluding that a “compensating response” actually operated effectively, the amendment risks becoming a way to explain away deficiencies rather than a genuine test of whether investors remain protected.^[461] The Board acknowledges these concerns. However, as described above, while firms are permitted to take other quality responses into account when determining whether a QC deficiency exists, they may do so only if the other quality responses are effective in achieving the relevant objective(s), that is, they would need to be properly designed, implemented, tested, and found to operate effectively.

6. Evaluation of and Reporting on the QC System

i. Evaluation Date

The amendments allow firms to select the date as of which they annually evaluate the effectiveness of their QC system, rather than requiring firms to evaluate as of September 30. In the QC 1000 2024 adopting release, the Board noted that a benefit of a fixed September 30 evaluation date is that the PCAOB would have relatively current information available when it selects firms and engagements for inspection.^[462] However, the Board also noted that the evaluation requirement would be less costly to firms if they were able to choose the date because, for example, they could choose to use the ( printed page 59396) same evaluation date under QC 1000 and ISQM 1.^[463]

Commenters generally supported the proposed amendment to allow firms to select their own annual evaluation date for their QC systems because the prescribed September 30 evaluation date had led to significant challenges.^[464] For example, one commenter said that their network firms generally have a fiscal year end of May 31 and anchor their evaluation dates relative to that fiscal year-end for European Union (“EU”) transparency reporting purposes.^[465] This commenter also said the practical costs of duplicative evaluation dates are significant.^[466] One commenter asserted that many firms struggled with operationalizing a mandated September 30 evaluation date given their respective operations and other quality management processes.^[467] Another commenter said that it is appropriate to permit firms to select the evaluation date based on their individual facts and circumstances and noted that the fixed September 30 date could be detrimental to audit quality for some firms if it requires the diversion of resources away from other activities.^[468]

Potential Benefits

The Board believes that the amendment would effectively address the concerns discussed above, generate cost savings, and enhance QC system evaluations. These cost savings would be particularly significant for the firms that have already implemented ISQM 1 or SQMS 1 and are using an evaluation date under these standards that is different from September 30.⁴⁶⁹ Firms that would have performed two separate evaluations ( e.g., to address separate evaluation and reporting requirements) can avoid the recurring costs of doing so, while firms that would have chosen to align their existing QC system evaluation to September 30 can avoid the costs of doing so, to the extent they have not already implemented the September 30 evaluation date.

Commenters generally agreed the amendment would be beneficial.^[470] One commenter said the amendment would reduce costs and support a more integrated evaluation process.^[471] Another commenter said the amendment would promote both efficiency and effectiveness.^[472] However, one commenter noted that, even with the amendments, firms' initial evaluation periods may not be 12 months and therefore may not align with their ISQM 1 evaluation periods.^[473] Another commenter said many firms have already designed and implemented processes and protocols around a September 30 evaluation date and, as a result, for a firm that chooses an earlier date ( e.g., May 31), modification of those processes before the initial effective date may present practical challenges, particularly for smaller firms.^[474] The Board recognizes that the potential benefits may be offset in part by these challenges. Firms that have already implemented a September 30 evaluation date would be free to avoid costs related to modification of their processes and protocols by retaining the September 30 evaluation date.

To help inform the Board's consideration of the potential magnitude of concerns about a fixed September 30 evaluation date, staff performed an analysis of firms' QC system annual evaluation dates disclosed pursuant to EU transparency rules.^[475] Figure 2 shows the distribution of firms' existing annual evaluation dates based on their recent transparency reports.^[476] Panel A shows the distribution by month while Panel B shows the distribution by month relative to the month of the firm's fiscal year-end. Panel A shows that 79% (19 ÷ 24) of the firms in the sample use evaluation months other than September (86% (6 ÷ 7) of the annually inspected firms in the sample). Panel B shows that 78% (18 ÷ 23) of the firms in the sample set the month of their evaluation date to be the same as the month of their fiscal year-end (43% (3 ÷ 7) of the annually inspected firms in the sample). Allowing these firms to select the evaluation date that aligns with their individual circumstances ( e.g., fiscal year-end, other reporting date(s)) would thus appear to confer substantial, widespread benefits.

Potential Costs

The PCAOB could have relatively less current information available when making inspection planning decisions depending on the evaluation dates firms choose. However, the PCAOB may seek to minimize this cost in the future by adjusting its inspection program.

While the Board believes the amendment would generally reduce costs to firms, one commenter said that many firms have already designed and implemented processes, monitoring activities, and documentation protocols around a September 30 evaluation date.^[477] Accordingly, to the extent firms choose to switch their evaluation date, such firms may incur additional one-time costs to design and implement processes, monitoring activities, and documentation protocols around a new evaluation date. However, the Board expects firms would only incur these costs if they conclude that the new evaluation date provided long-run efficiencies that justified the initial adjustment costs.

ii. Evaluation Conclusions

The amendments revise the QC system evaluation conclusions to align more closely with the conclusions in other quality management standards, while retaining a structured process, including specified factors for consideration, to guide the evaluation.

Several commenters highlighted challenges with the evaluation conclusions as originally adopted.^[478] For example, one commenter said that differences in conclusion types and definitions between QC 1000 and other quality management standards create challenges whereby different conclusions could be reached under the same set of circumstances.^[479] Another commenter said the amendments would appropriately address concerns raised regarding the downstream ramifications of communicating these conclusions to other participants as well as transparency reporting inconsistencies.^[480]

Potential Benefits

The amendments to evaluation conclusions would reduce potential confusion by reducing (but not eliminating) the likelihood that firms reach different conclusions about the effectiveness of their QC system under different QC standards.^[481] Even if QC 1000 and ISQM 1 were identical in all respects, differences in firm QC systems would remain, including due to variations in applicable professional and legal requirements, the populations of engagements subject to the QC systems, and the individuals performing such engagements or performing activities within the QC system. As to the QC system evaluation conclusions in particular, conclusions may also differ based on QC 1000's more precisely defined and potentially broader concept of an unremediated QC deficiency ( i.e., one for which remedial actions that completely address the QC deficiency have not been fully ( printed page 59398) implemented, tested, and found effective). One commenter agreed that the amendments would address the risk that the disclosure of a firm's evaluation conclusion under other quality management standards and voluntary disclosure of its assessment under QC 1000 could be confusing to stakeholders to the extent the conclusions differed under the same set of circumstances.^[482] Another commenter said the amendments provide more meaningful information to stakeholders regarding the effectiveness of a firm's QC system.^[483] Another commenter said that it would be uncommon for firms to come to different conclusions under QC 1000 and ISQM 1 under the amendments.^[484]

The amendments may also reduce the cost of a QC system evaluation as firms may be able to draw on, to some extent, the evaluation process they perform under ISQM 1 or SQMS 1 ( e.g., when assessing the severity and pervasiveness of unremediated QC deficiencies) or perform both evaluations concurrently. One commenter said that removing the concept of a “major QC deficiency” would reduce unnecessary complexity and better align the evaluation conclusions with the reasonable assurance objective of the QC system.^[485] Similarly, other commenters expressed support for the removal of the “major QC deficiency” concept and believe doing so simplifies the evaluation framework and improves alignment with other quality management standards.^[486]

Potential Costs

The amendments would likely broaden the conditions under which firms would be able to reach favorable conclusions about the effectiveness of their QC system. For example, firms could report that the system was effective, without an “except for” qualification, when there were unremediated QC deficiencies that, individually or in combination, are not severe. Under QC 1000 as originally adopted and approved, this reporting would have been permitted only if there were no unremediated QC deficiencies at all. The presumptions regarding the existence of a major QC deficiency would also be eliminated, affording firms greater latitude when determining whether the QC system failed to achieve the reasonable assurance objective. In either of these cases, firms may have less incentive to remediate QC deficiencies because doing so would not impact the overall conclusion they report to the PCAOB.

However, the Board acknowledges that firms would still have significant incentives to remediate QC deficiencies for reasons independent of these amendments. For example, firms would still need to consider a variety of factors when assessing the severity of unremediated QC deficiencies, including the persistence of those QC deficiencies. In addition, allowing QC deficiencies to remain unremediated may lead to pervasive or severe QC deficiencies in the future. Firms would also have an incentive to remediate QC deficiencies because unremediated QC deficiencies would be disclosed to the PCAOB on Form QC. Furthermore, to the extent QC deficiencies are determined to be Part II deficiencies, firms would have an incentive to remediate them.^[487]

7. Documentation

The amendments simplify the requirement for retention of QC system documentation and abbreviate the documentation retention period from seven to five years.

Potential Benefits

The amendment to simplify the documentation retention requirement will reduce costs to firms to design, implement, and operate their QC systems. For example, costs associated with developing IT systems and gathering, transferring, and retaining data should be reduced. One commenter said that the amendments would reduce operational complexity, administrative burden, and compliance costs.^[488] Another commenter said that the amendments would reduce the need for firms to build and maintain centralized archives solely for retention purposes.^[489]

The amendment to the documentation retention period will also reduce the costs for firms to design, implement, and operate their QC systems. Many commenters who commented on the supplemental request for comment supported this amendment.^[490] For example, one commenter said the reduction of the document retention period to five years helps alleviate a portion of the cost burden.^[491] Another commenter agreed that this amendment would reduce compliance costs for all firms.^[492] The commenter also said that the extent of cost savings would vary by firm size, structure, existing quality management framework, PCAOB engagement profile, and progress toward implementation.^[493] The Board agrees that the extent of cost savings will likely vary based on these characteristics.

Potential Costs

As the amendment to simplify the documentation retention requirement is intended to address specific potential unintended negative consequences, the Board does not expect it would negatively impact the overall effectiveness of firms' QC systems or the Board's ability to carry out its oversight. For example, the Board believes permitting firms to maintain documentation of their QC system in the documentation's original system of record should not have any impact on the overall effectiveness of their QC systems.

The amendment to shorten the retention period would reduce the length of time information is available to firms and to the PCAOB. This could negatively affect firms' ability to analyze the performance of their QC system over time. However, the salience of QC system documentation likely decreases with time and shortening the period by two years should not have a significant negative impact on firms' ability to monitor their QC systems or impair PCAOB oversight. ( printed page 59399)

8. Differential Impacts for Firms of Different Sizes

The impact of the amendments on an individual firm will depend on the firm's unique facts and circumstances, including the size of the firm's issuer and broker-dealer assurance practice ( e.g., the number of engagements and the amount of auditing required for those engagements, which may vary based on the size or complexity of those engagements). In the QC 1000 2024 adopting release, the Board noted that the direct costs of QC 1000 would likely depend on the size of the firm and the nature of the firm's audit practice.^[494] The Board noted that firms with larger PCAOB audit practices that already have extensive QC systems in place may benefit from economies of scale or scope when incorporating the new requirements into their existing systems, which would decrease the cost of QC 1000 per engagement.^[495] The Board further noted that firms with larger PCAOB audit practices would be able to distribute fixed implementation costs over a larger number of engagements, while firms with smaller practices would distribute fixed implementation costs over a smaller number of engagements.^[496] The Board also noted that, to the extent that QC 1000 improves compliance with applicable professional and legal requirements, the improvement might be greater with respect to broker-dealer engagements and issuer audits performed by firms other than U.S. GNFs because auditing deficiencies appeared to be more prevalent for these firms.^[497] The Board also noted that, under QC 1000, larger firms were subject to additional requirements meaningfully different from ISQM 1 or SQMS 1, which would increase the overall cost of QC 1000 to these firms.^[498]

The amendment to rescind the EQCF requirement would result in cost savings only for firms with larger PCAOB audit practices because the EQCF requirement applies solely to those firms that issued audit reports for more than 100 issuers in the prior calendar year. By contrast, the rescission of the QC system design requirement would result in cost savings only for design-only firms. These firms, by definition, do not serve as lead auditors and do not play a substantial role in PCAOB engagements, although some may participate in a more limited capacity. Accordingly, the two amendments affect different segments of the registered-firm population: the rescission of the EQCF requirement will reduce costs for a relatively small number of firms that audit a substantial portion of the issuer and broker-dealer audit market, while the rescission of the design-only requirement will reduce costs to a much larger population of firms with limited participation in the issuer and broker-dealer audit market.^[499]

Other amendments would apply to all firms required to design, implement, and operate a QC 1000-compliant system. For example, the amendments would allow multiple individuals and non-firm personnel to serve in certain QC system governance roles, allow firms to choose their own QC system evaluation date, and narrow the scope of deficiencies for which firms would be required to evaluate whether similar engagement deficiencies exist on other engagements. These amendments would reduce the costs of designing, implementing, and operating a QC system in compliance with QC 1000 for all firms. However, the magnitude of these effects may differ between larger and smaller firms. For example, smaller firms may be more likely to share resources with other firms. The ability to use non-firm personnel to serve in certain QC system governance roles may therefore be more beneficial to these firms.

Some of these cost savings would largely be fixed in nature and would not scale with the firm's size ( i.e., the number of engagements or the amount of auditing required for those engagements). For example, the flexibility to choose any QC system evaluation date is largely independent of the number of engagements a firm has. Because smaller firms have fewer engagements to distribute QC system cost savings across, these cost savings could have a more significant impact on smaller firms' profitability and competitiveness. On the other hand, some of the cost savings associated with the amendments would scale with the firm's size and therefore should benefit both smaller firms and larger firms proportionately. For example, the amendment to narrow the scope of deficiencies for which firms would be required to evaluate whether similar engagement deficiencies exist on other engagements would provide greater cost savings to larger firms in absolute dollars, but because the cost savings would be proportional to the size of the issuer and broker-dealer audit practice, the impact is not expected to be disproportionate.

Some commenters provided perspectives on potential differential impacts for smaller firms.^[500] One commenter said that a firm with a limited pool of PCAOB audit engagements and limited resources would likely find it more challenging than larger firms to have to parse its monitoring and remediation activities for the nuanced distinctions made in paragraph .77(b).^[501] The same commenter suggested that the amendments to paragraphs .12 and .15-.17 would be especially helpful to triennial firms.^[502] Similarly, a commenter said the amendments to paragraphs .12 and .15-.17 provide flexibility to smaller firms that may rely on other participants to obtain specialized skills, expertise, and objectivity.^[503] Another commenter said that smaller firms and firms with limited PCAOB engagements may experience proportionately greater benefits from rescission of the design-only requirement and added flexibility in assigning roles.^[504] The commenter also said larger firms may benefit from the removal of prescriptive requirements that are difficult to operationalize at scale, such as the EQCF requirement, and from clarifications that reduce duplicative or low-value compliance activities.^[505]

One commenter noted that the amendments collectively would improve the operability of QC 1000, which is particularly important for firms outside the six largest global networks.^[506] Another commenter said that the amendments would have a beneficial impact on smaller firms. ^[507] ( printed page 59400) The same commenter also explained that the vast majority of smaller firms operate with less complex organizational and governance structures, narrow service offerings and industry concentrations, and fewer personnel dedicated exclusively to quality control, monitoring, and remediation activities.^[508] Another commenter said that smaller firms will proportionally have integrated QC 1000 for much less economic and monetary costs than larger firms with a good-size subset of their operations devoted to compliance with QC 1000.^[509] The Board agrees that, as discussed above, some of the amendments could disproportionately benefit smaller firms.

Alternatives Considered

During the development of the amendments, the Board considered a number of alternative approaches to address the need described above, including those suggested by commenters. This section explains reasonable alternatives related to an earlier design requirement trigger, the EQCF requirement, the QC system evaluation framework, and the documentation requirements.

1. Earlier Design Requirement Trigger

In the supplemental request for comment, the Board considered whether the obligations to design a QC system should be triggered earlier than when a firm becomes subject to applicable professional and legal requirements with respect to an engagement. Commenters responding to possible earlier QC-system design requirement triggers generally did not support this alternative.^[510] However, one commenter requested that the Board specify an earlier trigger—for example, when a firm bids for or is appointed to issuer or broker-dealer work—by which time a compliant QC system must be designed and operating, well in advance of the firm commencing that work.^[511]

If an earlier trigger for the design requirement were adopted, registered firms that are not subject to any applicable professional and legal requirements would incur costs to monitor relevant facts and circumstances to determine whether the triggering event has occurred. If the triggering event were to occur, these firms would then incur costs to design their QC systems.^[512] To avoid incurring these costs, some of these firms may choose to withdraw from registration, depriving these firms of the benefit of greater participation in the issuer and broker-dealer audit market ( e.g., in cases where lead auditors prefer to use registered firms for less-than-substantial-role work) and reducing the supply of registered firms. A reduction in the supply of registered firms could in turn lead to a reduction in competition. As discussed above, we have observed that some design-only firms have already withdrawn from registration, citing QC 1000 as a reason. At the same time, since these firms are not subject to applicable professional and legal requirements, their design of a QC system under QC 1000 would not immediately benefit any engagements. To better prepare themselves for performing engagements, some of these firms may voluntarily design a QC 1000-compliant system.

These impacts would be offset to the extent firms have already implemented ISQM 1 or SQMS 1 when the event that requires them to design a QC system under QC 1000 occurs.^[513] Furthermore, as a commenter noted, the requirements of QC 1000 related to client acceptance and continuance and AS 2101, Audit Planning, currently require a firm to assess its readiness and ability to comply with QC 1000 before undertaking a PCAOB engagement.^[514] When a firm becomes subject to applicable professional and legal requirements with respect to an engagement, the firm will become subject to these QC 1000 and AS 2101 requirements, which, if properly implemented, should help firms prepare to perform the engagement. Accordingly, these requirements may offset any potential benefit of an earlier design requirement trigger.

2. EQCF for Largest Firms

The Board considered and solicited feedback on whether the alternative approach of retaining the EQCF requirement only for firms that issued audit reports with respect to more than 500 issuers during the prior calendar year would be appropriate. As discussed above, commenters responding to the question about the alternative approach generally did not support the 500-issuer threshold. However, one commenter expressed concern with rescinding the EQCF requirement and suggested instead retaining the requirement for firms auditing more than 500 issuers.^[515] The commenter asserted that, under this alternative, the defined, independent evaluation of the firm's self-assessment would survive at the five firms where “nearly all U.S. public market capitalization sits.” ^[516] Using 2025 data, the Board confirmed that the alternative 500-issuer EQCF requirement threshold would apply to five firms, which collectively audited 6,962 issuers, representing approximately 60% of all issuer audits and approximately 81.8% of aggregate issuer market capitalization.^[517]

If the EQCF requirement were retained and amended using a 500-issuer threshold, the five firms would incur implementation and compliance costs, including costs to identify, hire, retain, and compensate suitable individuals for the EQCF role. As discussed above, while we have limited information to reliably quantify the potential costs of compliance with the requirement, these costs could vary substantially depending on how each firm chooses to implement the requirement. The costs could be particularly high for these largest firms because they tend to have more complex QC systems. The incremental costs may be offset to the extent that these firms could modify their existing external advisory structures to satisfy the EQCF requirement. However, as discussed above, the firms would still incur incremental costs, including the costs of providing liability insurance and committing additional time and resources.

Retaining this requirement only for firms above the 500-issuer threshold would be unlikely to provide the independent evaluation the above commenter expected from the EQCF requirement.^[518] As discussed above, the structural features of the EQCF may limit its ability to independently evaluate firms' self-assessment, as an individual serving in an EQCF role would still be selected, compensated and retained by the firm, regardless of firm size. Retaining the EQCF requirement for these five firms could nevertheless provide potential benefits by introducing an external second look ( printed page 59401) at the significant judgments made and related conclusions reached by these firms when evaluating and reporting on the effectiveness of their QC systems. However, the benefits of such an external second look may be limited because the five firms already obtain, through existing advisory structures, some of the external perspectives that the EQCF's second-look review might otherwise provide.

3. QC System Evaluation Framework

In the supplemental request for comment, the Board considered an alternative evaluation framework under which a firm would be required to reach a binary conclusion ( i.e., that its QC system is either effective or not effective in achieving the reasonable assurance objective). Under this approach, the evaluation would not include a separate category for the conclusion that the firm's QC system is effective in achieving the reasonable assurance objective except for unremediated QC deficiencies that have a severe but not pervasive effect on the design, implementation, and operation of the QC system. Accordingly, the Board expects in these cases that firms would report that their QC system is effective because the reasonable assurance objective would still be met. One commenter suggested that a binary framework may be appropriate for many triennial firms as it would simplify their evaluations and provide the Board with more useful information.^[519] However, many commenters opposed the binary approach for the evaluation framework.^[520] These commenters generally argued that a binary conclusion would be less informative.^[521] One commenter said that the three-tiered structure conveys meaningfully more information than a binary conclusion would.^[522]

This alternative could reduce costs to firms as it would likely simplify to some extent the evaluation process. The Board acknowledges that some triennial firms may experience some challenges applying the evaluation criteria. However, many of these triennial firms should have experience with the three-tiered evaluation framework of ISQM 1 or SQMS 1. Furthermore, under this alternative, the Board believes firms would still need a structure for evaluating identified QC deficiencies and determining whether those deficiencies result in a conclusion that the QC system is not effective. For this reason, this alternative approach may not significantly reduce any potential challenges that may be faced by triennial firms. While unremediated QC deficiencies would still be reported to the Board under this alternative approach, the Board believes that a binary conclusion would result in less informative reporting to the Board. More specifically, if a firm's QC system is effective in achieving the reasonable assurance objective except for unremediated QC deficiencies that have a severe but not pervasive effect on the design, implementation, and operation of the QC system and do not render the QC system not effective, the firm would not be required to report this conclusion to the Board on Form QC. Furthermore, the binary conclusion framework may incentivize firms with severe but not pervasive unremediated QC deficiencies not to remediate their QC deficiencies since doing so would not change the conclusion they report to the PCAOB.

4. Documentation Requirements

Several commenters requested that the Board consider a shorter documentation retention period.^[523] Some commenters suggested that a shorter documentation retention period would reduce costs.^[524] Two commenters noted that a three-year retention period may suffice to accomplish the Board's oversight objectives.^[525] Another commenter said that the supplemental request for comment did not provide empirical evidence demonstrating that documentation older than several years is routinely relied upon in inspections or enforcement matters, nor did it explain why a five-year period, rather than a shorter period, is required to protect investors.^[526] Two commenters called for an approach that would scale the documentation retention period according to facts and circumstances.^[527] One commenter called for a more flexible approach to the documentation retention period.^[528] One commenter said that it could be argued that the documentation retention period should be either (1) no shorter than seven years so that any engagement deficiencies evidenced by the audit documentation could be understood in the context of the QC system policies and procedures at that time or (2) the shortest time possible to meet regulator needs which is likely less than five years.^[529] Another commenter said that a five-year retention period could continue to pose significant challenges and unintended costs to firms.^[530]

The Board recognizes that a shorter retention period or more flexible documentation requirements could reduce costs. However, the Board believes a five-year documentation period is necessary for PCAOB oversight. For example, enforcement staff may investigate misconduct occurring over several years, and the staff generally reviews relevant QC documentation as part of their investigation. Staff analysis of PCAOB enforcement orders published since 2020 indicates that 45% of the orders explicitly cite PCAOB QC standards.^[531]

Special Considerations for Audits of Emerging Growth Companies

Pursuant to section 104 of the Jumpstart Our Business Startups (“JOBS”) Act, any additional rules adopted by the Board subsequent to April 5, 2012, generally do not apply to the audits of EGCs, as defined in section 3(a)(80) of the Exchange Act, unless the SEC “determines that the application of such additional requirements is necessary or appropriate in the public interest, after considering the protection of investors and whether the action will promote efficiency, competition, and capital formation.” ^[532]

To inform consideration of the application of the amendments to audits of EGCs, staff performed an analysis of EGC audits as of November 15, 2024. ^[533] ( printed page 59402) The data remain generally consistent with the data outlined in the EGC white paper published May 23, 2025, which analyzed data as of November 15, 2023. PCAOB staff identified 2,379 EGCs.^[534] Of those 2,379, the 1,252 EGCs with common equity securities listed on a U.S. national securities exchange had a total U.S. market capitalization of $466 billion. These EGCs represented approximately 23% of all exchange-listed companies yet just 0.6% of U.S. total market capitalization. Forty-one percent of EGCs reported no revenue or self-identified as shell companies.

Of the 245 PCAOB-registered firms that audited EGCs:

• 203 firms (or 83%) performed audits for both EGC and non-EGC issuers. Approximately 97% of EGCs were audited by these 203 firms.
• 119 firms (or 49%) were headquartered in the U.S. Approximately 77% of EGCs were audited by these 119 firms.
• None were design-only firms, but design-only firms provided at least 5% of total audit hours on nine EGC audit engagements.^[535]
• 16 firms (or 7%) have withdrawn from PCAOB registration since November 15, 2024. None of these firms referenced QC 1000 as a reason for withdrawal.
• 14 firms (or 6%) issued audit reports with respect to more than 100 issuers. Forty-two percent of EGCs were audited by these 14 firms.

Any reduction in audit quality arising from the amendments could reduce financial reporting quality, which could result in less efficient capital allocation, higher cost of capital, and less capital formation. This effect could be particularly pronounced for EGCs. EGCs tend to be smaller and have a shorter SEC financial reporting history than the broader population of public companies. Academic research suggests that, for several reasons, smaller public companies tend to exhibit greater information asymmetry between management and investors.^[536] One commenter noted that EGCs “may rely especially heavily” on the external audit given greater information asymmetry and less market coverage.^[537] Accordingly, the Board believes that EGCs are likely to exhibit greater information asymmetry between management and investors and hence the importance of the external audit to investors in enhancing the credibility of EGC financial reporting may be more pronounced. However, as the Board believes the amendments would have minimal impact on audit quality, any impact on EGCs' financial reporting quality should also be minimal.

The amendments would also likely decrease costs incurred by firms to design, implement, and operate their QC systems. Firms could pass part of these cost savings down to their clients, including EGCs, in the form of lower audit fees. EGCs are disproportionately audited by smaller firms. Approximately 42% (993 ÷ 2,379) of EGCs were audited by firms that had over 100 issuer clients while approximately 12% (276 ÷ 2,379) were audited by firms that had 10 or fewer issuer clients. By contrast, approximately 73% (6,824 ÷ 9,294) of non-EGCs were audited by firms that had over 100 issuer clients while approximately 9% (797 ÷ 9,294) were audited by firms that had 10 or fewer issuer clients. However, because it is unclear whether the amendments would disproportionately impact smaller firms, it is also unclear whether EGCs would be disproportionately impacted by cost savings passthrough.

Reduced audit fees could increase capital formation by decreasing the overall regulatory burdens of being a public company ( e.g., accounting fees paid during IPO and for annual SEC reporting).^[538] Reduced audit fees could also lessen a competitive disadvantage for EGCs in their respective product markets to the extent EGCs compete with companies that are not audited by PCAOB-registered firms. This could increase competition in product markets where EGCs have a less than dominant market share, which is likely the case as EGCs tend to be newer companies. However, the Board believes any impacts on competition in EGC product markets would likely be modest because audit fees reflect a small percentage—0.6%—of exchange-listed EGCs' revenues.^[539]

In general, any new PCAOB standards and amendments to existing standards determined not to apply to the audits of EGCs would require auditors to design and implement differing requirements within their methodologies or policies and procedures with respect to audits of EGCs and non-EGCs, which would create the potential for confusion. This may not be practical in the context of the amendments; while some of the amendments may enable different approaches for audits of EGCs compared to audits of other companies ( e.g., evaluating whether similar engagement deficiencies exist), others are necessarily firm-wide and cannot easily be differentiated for different types of audits (rescinding the EQCF requirement and permitting selection of the evaluation date). Even where differentiation is possible, maintaining separate QC system components for EGC and non-EGC audits and separate methodologies may add cost or lead to confusion, and could run counter to the objectives of the QC system. These methodology and QC system differentiation costs would affect at least the 203 firms that audit both EGCs and non-EGCs and that, collectively, audit approximately 97% of EGCs.

The supplemental request for comment sought comment on the applicability of the proposed amendments to audits of EGCs. Commenters generally did not provide views on the impacts of the amendments to the audits of EGCs or whether the amendments should apply to the audits of EGCs.

Accordingly, and for the reasons explained above, the Board will request that the Commission determine that, to the extent necessary, it is necessary or appropriate in the public interest, after considering the protection of investors and whether the action will promote efficiency, competition, and capital formation, to apply the amendments to audits of EGCs. ( printed page 59403)

III. Date of Effectiveness of the Proposed Rules and Timing for Commission Action

Within 45 days of the date of publication of this notice in the Federal Register or within such longer period (i) as the Commission may designate up to 90 days of such date if it finds such longer period to be appropriate and publishes its reasons for so finding or (ii) as to which the Board consents, the Commission will:

(A) By order approve or disapprove such proposed rules; or

(B) Institute proceedings to determine whether the proposed rules should be disapproved.

IV. Solicitation of Comments

Interested persons are invited to submit written data, views and arguments concerning the foregoing, including whether the proposed rules are consistent with the requirements of Title I of the Act. Comments may be submitted by any of the following methods:

Electronic Comments

• Use the Commission's internet comment form (www.sec.gov/​rules/​pcaob); or
• Send an email torule-comments@sec.gov. Please include File Number PCAOB-2026-01 on the subject line.

Paper Comments

• Send paper comments in triplicate to Vanessa A. Countryman, Secretary, Securities and Exchange Commission, 100 F Street NE, Washington, DC 20549-1090.

All submissions should refer to File Number PCAOB-2026-01. This file number should be included on the subject line if email is used. To help the Commission process and review your comments more efficiently, please use only one method of submission. The Commission will post all comments on the Commission's website ( www.sec.gov/​rules/​pcaob). Copies of such filing will also be available for inspection and copying at the principal office of the PCAOB. Do not include personal identifiable information in submissions; you should submit only information that you wish to make available publicly. The Commission may redact in part or withhold entirely from publication submitted material that is obscene or subject to copyright protection. All submissions should refer to File Number PCAOB-2026-01 and should be submitted on or before October 9, 2026.