Modernizing Audit Firm Quality Control Standards

The Sarbanes-Oxley Act, enacted unanimously in the U.S. Senate and nearly unanimously in the U.S. House, explicitly required the PCAOB (“Board”) to establish, and modify, quality control (“QC”) standards. This important law required the Board to establish expert advisory boards to make recommendations on QC standards. When registering with the Board, auditing firms are required to include a statement on QC policies. And when inspecting audit firms, the Board is required to evaluate QC systems.

Congress enacted these provisions in 2002 to address accounting fraud and systemic misconduct in financial reporting by several public companies. The law also addressed the failure of several audit firms to fulfill their role as gatekeepers. These events undermined public and market confidence in the financial reporting system of the time.

Congress advanced the general principle that strong QC systems are a powerful tool at auditors’ disposal and are essential for protecting investors. They ensure consistency in the preparation and issuance of informative, accurate, and independent audit reports.

Current QC standards were developed decades ago. The auditing environment has changed significantly since that time, but the standards have lagged far behind.

Audit deficiencies reported by Board inspectors in recent years suggest that some firms’ QC systems are not providing reasonable assurance that its personnel comply with the firm’s standards of quality.

Recent Board inspection reports indicate that 46 percent of the engagements reviewed in 2023 had at least one significant deficiency, compared to 40 percent in 2022, and 34 percent in 2021. This is a concerning trend.

For several years, the Board’s advisory groups have generally supported strengthening the QC standard.

This past May, the Board adopted an integrated, risk-based standard, one that sets out quality objectives and key processes for all firms’ QC systems.

This modernized standard achieves a careful balance between a risk-based approach and standardized requirements. The result is a common baseline that fosters predictability and a level playing field.

All Board-registered firms are required to design a QC system that complies with the new standard. But the part of the standard requiring an external quality control function (“EQCF”) applies only to firms that audit more than 100 issuers annually. In 2023, only 14 firms, out of a total of more than 1600 registered firms, met this threshold.

The EQCF is based on the notion that a second pair of impartial eyes can be helpful when evaluating the significant judgments and conclusions that an audit firm has made with respect to its QC system. This provision has been informed by, and evolved from, extensive stakeholder input over many years.

As required by law, the Commission’s staff has determined that the Board’s amendments to an audit firm’s system of quality control standards is consistent with Title I of the Sarbanes-Oxley Act and associated rules and regulations. Following its own thorough review of the Board’s efforts, Commission staff has also determined that the amendment is necessary or appropriate in the public interest or for the protection of investors and is recommending Commission approval.

Because the amendments will help audit firms design, implement, and operate more effective QC systems, and potentially contribute to improved compliance with professional audit standards, I am pleased to support the staff’s recommendation.