Divided SEC Approves PCAOB’s Quality Control Standard
The Securities and Exchange Commission (SEC) on September 9, 2024, voted 3-2 to approve the Public Company Accounting Oversight Board’s (PCAOB) new quality control (QC) standard that imposes a combination of principles-based and prescriptive requirements to make sure that audit firms have a robust QC system to better protect investors.
The board in May adopted the rule that establishes new QC 1000, A Firm’s System of Quality Control, to require firms to identify risks that are specific to their audit practice. At the same time, the standard also mandates certain requirements that are intended to make sure that firms’ QC systems are designed, implemented, and operated “with an appropriate level of rigor.”
Firms are not only required to operate the QC system that they designed but must also monitor the system and take steps to fix areas that do not operate effectively. This is an important aspect of the system as it is intended to create a continuous feedback loop to improve audit quality.
In addition, the PCAOB requires audit firms to evaluate their QC system annually and report the results of their assessment to the board on new Form QC certified by key firm personnel. This is intended to reinforce individual accountability.
The PCAOB imposes an additional requirement for larger firms, which affected firms, the Center of Audit Quality (CAQ), and the U.S. Chamber of Commerce strongly criticized. The CAQ is an affiliate of the AICPA that represents accounting firms that audit public companies.
In particular, firms that audit more than 100 issuers are required to establish an external quality control function (EQCF) for the audit practice that includes at least one independent person who will evaluate the significant judgments made and the related conclusions reached by the firm when evaluating and reporting on the effectiveness of the QC system.
But auditors and the U.S. Chamber of Commerce strongly objected to the EQCF, arguing that this is not a logical outgrowth of the PCAOB’s 2022 proposal, among other problems. They believe the PCAOB should have proposed that requirement for feedback before finalizing it. The U.S. Chamber even threatened to sue the SEC if it does not address the problems.
In response, the PCAOB submitted a letter to the SEC, defending the EQCF, stating that the board had done extensive outreach before adopting a final requirement for the EQCF, including a concept release in 2019. Moreover, the PCAOB pointed out that some firms already have some sort of independent oversight function.
‘Fast and Furious’
Two Republican Commissioners—Hester Peirce and Mark Uyeda—voted against the new standard, largely echoing auditor concerns. QC is foundational to audit quality because it deals with a firm’s system of employee training and compliance with professional standards and its standards of quality. But because the PCAOB had continued to find deficiencies in audit engagements as well as problems in firms’ QC systems, the board said the standard needs to be improved.
The dissenting commissioners, however, said the SEC ought to have taken more time to consider the issues before moving to approve the standard.
“Fast and Furious’ might be a good theme for summer movies, but not for agency rulemaking,” Uyeda summed it up. “To be clear, my concern is not about whether there should be strong quality control requirements; there should be. The question is when.”
Gensler, echoing investor concerns, on the other hand, said he supports the new QC standard as it will significantly improve upon the PCAOB’s interim standards, which the board adopted from the accounting profession when the board was established. Before the Sarbanes-Oxley Act of 2002, the AICPA wrote the rules even for public company audits. Today, the association only writes audit standards for private companies.
“The auditing profession has changed in the 21st century, and the amendments … are long overdue,” Gensler said. “To put in context how important it is to update the quality control standards, the PCAOB found that 46 percent—nearly half—of the auditing engagements it reviewed in 2023 fell short of obtaining sufficient appropriate audit evidence.”
“Twenty-two years after the passage of Sarbanes-Oxley, I’m proud to support the PCAOB’s proposed changes to instill greater trust among investors and issuers in our markets,” he added.
After the accounting frauds at Enron, WorldCom, and other companies were unmasked in 2001-2002, Congress passed Sarbanes-Oxley. The law established the PCAOB to prevent abuses like those at Enron that allowed senior executives to manipulate the company’s financial reporting.
Reactions
PCAOB Chair Erica Williams thanked the SEC for approving the standard.
“When a firm’s QC system operates effectively, quality audits follow. And when QC systems operate ineffectively, investors are put at risk,” Williams said in a statement. “Our new QC standard takes an integrated, risk-based approach that can be applied by firms of varying sizes and complexity. When put into practice, it will improve investor protection.”
Former SEC chief accountant Lynn Turner agreed.
“This new standard, if complied with, should result in investors being able to again place trust in the audits of financial information they receive,” said Turner, who serves on the PCAOB’s advisory groups.
In a statement, Stephen Hall, legal director and securities specialist of Better Markets, said the PCAOB’s new standards “are a step in the right direction, and we are pleased that the SEC has voted to approve them.”
However, “we are disappointed that the proposed standard does not go further to sufficiently ensure high-quality audits or adequate transparency and accountability,” Hall added. “Significant deficiencies repeatedly appear in the audit process. Although the updated Standard is an improvement from the status quo, the PCAOB should therefore revisit this proposal with the clear objective of proposing a Quality Control Standard that better prioritizes audit quality, transparency, and accountability. This includes realigning quality control standards to incentivize higher performance beyond mere compliance and reconsidering the lack of meaningful disclosure about a firm’s quality control system. The simple truth is that trust and accountability are only made possible with adequate transparency.”
While the U.S. Chamber of Commerce did not definitively say whether it will sue the SEC, Executive Vice President Tom Quaadman said: “We are concerned that the SEC and PCAOB are pursuing standards and policies under hurried procedure that do not improve financial reporting while creating disincentives for businesses to go or stay public. As with any SEC rule, we will review the standards and weigh our options for potential further action.”
In the meantime, former PCAOB member Daniel Goelzer said that “it was interesting that both Commissioners Pierce and Uyeda focused on the possibility that implementing QC1000 could lead to costs and challenges comparable to those that arose from the internal control audit requirements of SOX 404.”
Section 404(b) of Sarbanes-Oxley requires auditors to attest to the management’s evaluation of its internal control over financial reporting (ICFR). This requirement had sparked a huge fight from business groups, arguing that costs do not provide commensurate benefits. Over the years, the U.S. Chamber incrementally scored some victories by getting regulators to exempt more classes of companies from complying with Section 404(b).
“Their comments and questions underscored the need for the PCAOB to give further guidance on the external control review function requirement for the largest firms,” Goelzer said. “They also recognized that there are many questions about the practical effect of requiring firms that aren’t performing PCAOB-regulated audits to design a QC system. I hope the PCAOB will take these concerns seriously as implementation unfolds.”
The SEC’s approval is in Release No. 34-100968. QC 1000 will take effect on December 15, 2025.