Public Company Accounting Oversight Board; Order Granting Approval of QC 1000, A Firm's System of Quality Control, and Related Amendments to PCAOB Standards, Rules, and Forms

September 9, 2024.

I. Introduction

On May 24, 2024, the Public Company Accounting Oversight Board (the “Board” or the “PCAOB”) filed with the Securities and Exchange Commission (the “Commission”), pursuant to Section 107(b) of the Sarbanes-Oxley Act of 2002 (“SOX”) and Section 19(b) of the Securities Exchange Act of 1934 (the “Exchange Act”), a proposal to adopt Quality Control (“QC”) 1000, A Firm's System of Quality Control (“QC 1000”), and supersede existing PCAOB QC standards; adopt EI 1000, Integrity and Objectivity, and supersede existing ET 102, Integrity and Objectivity; and amend several other related existing auditing standards, rules, and forms (collectively, the “Amendments”).

The Amendments were published for comment in the Federal Register on June 11, 2024. On July 1, 2024, the Commission extended the public comment period until July 16, 2024, and extended the date by which the Commission shall either approve or disapprove, or institute proceedings to determine whether to approve or disapprove, the Amendments to August 25, 2024. On August 13, 2024, the Commission further extended the date by which the Commission shall either approve or disapprove, or institute proceedings to determine whether to approve or disapprove, the Amendments to September 9, 2024. The Commission received over 20 comment letters from the public regarding the Amendments and one response to comments from the PCAOB (“PCAOB response letter”). This order approves the Amendments, which we find to be consistent with the requirements of Title I of SOX and the rules and regulations issued thereunder and necessary or appropriate in the public interest or for the protection of investors. The Amendments and the Commission's findings with respect thereto are discussed in further detail below.

II. Description of the Amendments

On May 13, 2024, the Board adopted the Amendments. The Amendments were preceded by a 2019 concept release, a proposal in November 2022, and other outreach engaged in by the PCAOB. QC 1000 would replace current PCAOB QC standards that were developed decades ago by the American Institute of Certified Public Accountants (“AICPA”), before the PCAOB was established, and which were adopted by the Board on an interim, transitional basis in 2003.

In the Notice of Filing of Proposed Rules, the PCAOB stated that it was proposing a new QC standard that it believes will lead registered public accounting firms to significantly improve their QC systems and thereby protect investors by facilitating the consistent preparation and issuance of informative, accurate, and independent audit reports. As described by the Board, QC 1000 is an integrated, risk-based standard that mandates quality objectives and key processes for all firms' QC systems. While QC 1000 requires all public accounting firms that are registered with the PCAOB to design a QC system that meets the requirements of QC 1000, firms are only required to implement and operate the QC system in compliance with QC 1000 when they lead an engagement under PCAOB standards, play a substantial role in the preparation or furnishing of an audit report (as defined in PCAOB rules), or have current responsibilities under “applicable professional and legal requirements” regarding any such engagement.

According to the Board, QC 1000 provides a framework for a QC system that is grounded in the ongoing practice of proactively identifying and managing risks to audit quality, with a feedback loop from ongoing monitoring, an explicit focus on firm governance and leadership, firm culture, and individual accountability, and specific direction in a number of areas the current PCAOB standards do not address. QC 1000 consists of two process components: (1) the firm's risk assessment process and (2) the monitoring and remediation process. It also consists of six components that address aspects of the firm's organization and operations: (1) governance and leadership; (2) ethics and independence; (3) acceptance and continuation of engagements; (4) engagement performance; (5) resources; and (6) information and communication. The risk assessment process applies to these six components, requiring firms to: (i) establish outcome-based “quality objectives,” including those specified throughout the standard ( i.e., the desired outcomes to be achieved by the firm with respect to that component); (ii) identify and assess “quality risks” to the quality objectives; (iii) design and implement “quality responses” ( i.e., policies and procedures to address the quality risks); and (iv) establish policies and procedures to monitor internal and external changes that may require modifications to the quality objectives, quality risks, or quality responses. The monitoring and remediation process applies to all of the components of the QC system, including monitoring and remediation itself ( i.e., firms are required to identify and remediate deficiencies that are observed in their monitoring and remediation activities).

QC 1000 also requires an annual evaluation of the effectiveness of the QC system and reporting to the PCAOB on the QC system evaluation by the registered public accounting firm for any period in which it is required to implement and operate a QC system. The standard includes requirements regarding individual roles and responsibilities in the QC system and documentation requirements.

As noted above, firms are required to design and implement quality responses as part of the risk assessment process. Although QC 1000 requires firms to design and implement their own quality responses to respond to their particular assessed quality risks, QC 1000 also includes some specified quality responses, which are mandatory for the firms to which they apply. Some specified quality responses carry requirements from current PCAOB standards into QC 1000 or provide new requirements that the PCAOB stated were important to a firm's QC system.

For example, with respect to the governance and leadership component, QC 1000 includes a specified quality response that requires firms with larger PCAOB audit practices (firms that issue audit reports for more than 100 issuers in the prior calendar year) to adopt and implement an external quality control function (“EQCF”) that is composed of one or more persons who are not principals or employees of the firm and do not otherwise have a relationship with the firm that would interfere with the exercise of independent judgment with regard to matters related to the QC system. The EQCF is required to evaluate the significant judgments made and related conclusions reached by the firm when evaluating and reporting on the effectiveness of its QC system. Firms have flexibility in how the role is structured, depending on their governance structure or other factors. In addition, firms may, at their discretion, assign additional responsibilities to the EQCF and those could vary across firms. As noted above, the EQCF requirement only applies to firms that issue audit reports for more than 100 issuers in the prior calendar year, which currently is 13 out of the approximately 1,600 PCAOB-registered firms. A number of these firms have stated publicly that they have independent representation in their governance structure or plan to add such a role in the near term. The EQCF role is discussed and analyzed in greater detail in Section III.B, below.

The Board described the QC 1000 framework as having commonalities with other international and domestic standards for firm QC systems, though it goes beyond those requirements in some areas. QC 1000, ISQM 1, and SQMS 1 (the latter two collectively, the “Other QC Standards”) share the same basic framework, with the same eight components and risk-based approach to quality control. Both QC 1000 and the Other QC Standards include requirements to design, implement, and operate specified quality objectives, risks, and responses on an annual basis; and specify structures of governance, including requiring the assignment of individuals to the same specified roles. A discussion of the similarities and differences between QC 1000 and the Other QC Standards is included below in Section III.

The Amendments also include expanding the auditor's responsibility to respond to deficiencies on completed engagements under an amended and retitled AS 2901, Responding to Engagement Deficiencies After Issuance of the Auditor's Report. These changes would extend the scope of AS 2901 to cover engagement deficiencies in audits of internal control over financial reporting, incorporate the concepts and terminology introduced in QC 1000, and bring the standard into alignment with the auditor's existing responsibility to obtain sufficient appropriate audit evidence to support the opinion. The changes also include related amendments to AT No. 1, Examination Engagements Regarding Compliance Reports of Brokers and Dealers, and AT No. 2, Review Engagements Regarding Exemption Reports of Brokers and Dealers, which would prompt auditors of registered brokers-dealers to take appropriate action if they discover that the opinion or conclusion in a previously issued attestation report was not supported. Finally, the Amendments replace existing standard ET 102, Integrity and Objectivity, with a new standard, EI 1000, Integrity and Objectivity, to better align PCAOB ethics requirements with the scope, approach, and terminology of QC 1000.

The Amendments will be effective on December 15, 2025. The first annual evaluation period will cover the period beginning on the effective date of the standard ( i.e., December 15, 2025) and ending on September 30, 2026. Subsequent evaluation periods will cover the 12-month period ending on September 30. The PCAOB has proposed application of the Amendments to include audits of emerging growth companies (“EGCs”), as discussed in Section IV below.

III. Discussion and Commission Findings

The Commission continues to observe concerning indications that registered firms' QC systems are inadequate to ensure the high level of audit quality necessary for investor protection. Recent PCAOB inspection reports indicate that inspection deficiency rates are continuing to rise, with 46% of the engagements reviewed in 2023 having at least one Part I.A deficiency, compared to 40% in 2022 and 34% in 2021. While PCAOB inspection deficiency rates are not the only measure of audit quality and cannot necessarily be generalized to all PCAOB audits, these high deficiency rates place investors in harm's way. Effective QC systems provide firms with reasonable assurance that their audit engagements will be performed in compliance with applicable legal and professional requirements. The continuing rise in deficiency rates supports the need for the Amendments as they would enhance registered audit firms' QC systems to help ensure firms are able to perform their gatekeeper function, which is critical to investor protection and the functioning of our capital markets.

As noted above, in response to the Notice of Filing of Proposed Rules, to date the Commission has received over 20 comment letters from the public and one response to comments from the PCAOB. Several commenters expressed support for the Amendments, stating that they would improve upon existing standards and lead to better protection of investors. For example, one commenter stated that the Amendments “would better protect the interests of investors, consistent with the mandate set forth in SOX.” Similarly, another commenter stated that it expected the Amendments “will enhance the quality of audits, raising the level of trust and confidence investors can place in the accuracy and reliability of public company financial disclosures.” This commenter also stated that “[c]urrent quality control systems at many firms are not achieving an even minimally acceptable level of audit quality, let alone the high level of audit quality that investors have a right to expect and on which the reliability of our financial reporting system depends.” Another commenter stated that “the PCAOB has done a good job of articulating why the improvements to the Quality Control Standards are warranted.” One commenter stated that it “strongly supported” the Amendments, highlighting requests by the investor community over the years to update “outdated quality control standards” that were written in a pre-SOX era when the profession was self-regulated. This commenter stated that many areas of the PCAOB's existing QC standards have not been updated to reflect fundamental changes in the profession. Some commenters who supported the proposal also stated that they did not believe the requirements in the Amendments went far enough.

Other commenters stated that the Commission should not approve the Amendments. While several commenters stated that they supported the Board's efforts and goal to modernize quality control standards, they did not support certain aspects of the Amendments. For example, one commenter stated that it was concerned that the Amendments “could potentially have unintended negative consequences to the profession, including significant costs without notable improvement to audit quality.” One commenter expressed its “overall support for the project and the large majority of the provisions of the standard” but stated that the Commission should not approve the standard in its final form because the EQCF function “raises significant concerns,” including being inconsistent with SOX, and because, in the commenter's view, the PCAOB did not adequately address concerns it and others raised regarding the ability for small firms to comply with QC 1000, in particular the design-only requirement. Another commenter stated that “the SEC should reject the PCAOB's final QC 1000 standard because it contains fundamental failures and flaws.” Commenters also provided feedback on specific aspects of the Amendments as described below, which informed their general views discussed above.

We have considered the information contained in the Notice of Filing of Proposed Rules and the PCAOB's response letter as well as the comments received by the Commission. Having carefully weighed all of the information before us, we find that the Amendments are consistent with the requirements of Title I of SOX and the rules and regulations thereunder and are necessary or appropriate in the public interest or for the protection of investors. In particular, we believe the Amendments as a whole will further the Board's statutory mandate under SOX and enhance investor protection by creating an integrated, risk-based QC standard that can be applied by firms of varying sizes and complexities and is compatible with Other QC Standards that either have already been or are required to be implemented by the vast majority of registered public accounting firms. The Amendments will lead registered public accounting firms to significantly improve their quality control systems, thereby improving audit quality and investor protection. The existing interim QC standards—which were adopted on an interim basis in 2003 and were developed by the audit profession under an environment of self-regulation—do not adequately reflect the risks and requirements of the current auditing environment, overly focus on evaluating firms' compliance with their own internally-developed policies designed in a peer review environment, and do not require evaluation or reporting that ultimately enhances audit quality and investor protection.

The Amendments emphasize the importance of accountability and firm governance and a QC system that is proactive and responsive to risks. Replacing interim standards with permanent standards provides additional regulatory certainty that may have an incremental benefit of allowing audit firms to make long-term investments in their QC systems. Further, the Amendments will promote compliance by registered public accounting firms with applicable professional and legal requirements (including PCAOB auditing standards), which should help eliminate information asymmetries and expectation gaps for issuers, registered broker-dealers, and investors regarding whether audit firms are complying with such requirements. Improved compliance by registered public accounting firms with PCAOB auditing standards, among other professional and legal requirements, would result in improved financial reporting quality, which would further benefit investors.

In addition, the Amendments share a common framework with Other QC Standards that are widely implemented by auditing firms across the globe, with specific enhanced requirements for the U.S. regulatory environment, which allows firms to leverage costs already expended or that will be expended to comply with these standards. In addition to the overarching structure and the eight components being the same among QC 1000 and the Other Standards as noted above in Section II, the requirements within the components are also aligned. Specifically, the required quality objectives ( i.e., the outcomes specified by the standards that drive the firm's responses) generally are substantively similar although some of QC 1000's quality objectives contain additional prescriptive requirements that the Board considered to be relevant to the U.S. public company legal and regulatory environment as discussed in more detail below. Both QC 1000 and the Other QC Standards provide firms with flexibility to design responses to achieve these quality objectives taking into account the particular risks and circumstances faced by the firm. Further, there is overlap in the limited number of specified quality responses ( i.e., individual responses required by QC 1000 and the Other QC Standards). In other words, the quality objectives that firms establish (and their resulting responses) under QC 1000 are expected to be sufficiently responsive to those of the Other QC Standards.

QC 1000 does go beyond the Other QC Standards in that it contains relatively more prescriptive requirements than the Other QC Standards. The Board considered these requirements to be relevant to the U.S. regulatory environment and investors. Many of these additional requirements only apply to firms that issue audit reports for more than 100 issuers in the prior calendar year. Because QC 1000 provides more precise and prescriptive requirements that drive accountability, it will enhance the Board's ability to perform its inspections and to enforce its standards, which will further incentivize firms to design, implement, and operate effective QC systems. It is the Board's view that building on the well-understood basic framework of the Other QC Standards, appropriately tailored and strengthened to address the U.S. legal and regulatory environment and our investor protection mandate, will enable firms to implement and comply with QC 1000 more effectively. In designing, implementing, and operating their QC systems, firms that are subject to both PCAOB standards and the Other QC Standards, which the Commission estimates to be 88% of registered firms that have performed engagements under PCAOB standards for an issuer or registered broker-dealer (“PCAOB engagements”) in the past year and 72% of registered firms that have not, will be able to leverage the work they have already done and the investments they have already made to comply with such Other QC Standards. In support of this conclusion, neither the Commission staff nor commenters have identified aspects of QC 1000 that are incompatible with the Other QC Standards.

A. Requirements Related to the Design of QC System

As discussed above, QC 1000 includes a design-only requirement. The PCAOB stated in the Adopting Release that the design-only requirement may facilitate timely implementation and operation of a compliant QC system. The Board also stated that not requiring all registered public accounting firms to design their QC system would create a risk that firms could be unprepared to accept and perform such engagements in compliance with applicable professional and legal requirements. Finally, the PCAOB stated that because registering with the PCAOB enables a firm to issue audit reports or play a substantial role on audits performed under PCAOB standards for issuers and registered broker-dealers, and because investors and companies considering engaging the firm could reasonably expect that any firm that could pursue such an engagement would already have a PCAOB-compliant QC system designed and ready for implementation and operation, it believes that imposing a design requirement on all registered firms promotes its mission of protecting investors and promoting the public interest.

General

A number of commenters expressed concerns regarding the design-only requirement. Commenters stated that this requirement will increase the barriers to entry for small firms to take on audits of small publicly-held companies, including EGCs, or registered broker-dealers and will incentivize firms to de-register. A few commenters stated they agreed with concerns expressed by PCAOB Board Member Ho in her statement accompanying the adoption of QC 1000 indicating that the design-only requirement appears to be inconsistent with both the statutory text of SOX and a statement the PCAOB made to Congress in 2023, and that the requirement would impose undue burdens on competition. The PCAOB response letter responds to commenter feedback on the design-only requirement, including addressing why applying such a requirement to firms that do not presently have obligations with respect to PCAOB engagements is consistent with the PCAOB's statutory mandate.

While we acknowledge the concerns raised by commenters, we find that the design-only requirement is consistent with the requirements of Title I of SOX and the rules and regulations issued thereunder and is necessary or appropriate in the public interest or for the protection of investors. Allowing registered firms to design their QC system only upon entering into an audit engagement would create a risk that registered firms could be unprepared to accept and perform engagements in compliance with applicable professional and legal requirements, which in turn risks a reduction in audit quality to the detriment of investors. For example, one component of a well-designed QC system is policies and procedures around the acceptance of an engagement. Without having designed a QC system in advance, such firms would not be in a position to ensure that their QC system is effective in order to evaluate and take on a new PCAOB engagement.

Below we discuss the views of commenters with respect to specific aspects of QC 1000's design-only requirement, as well as the Commission's findings regarding those matters.

Statutory Authority

We have considered comments on the statutory authority questions raised in Board Member Ho's statement as well as the PCAOB's response letter and find that the Board has the authority to require that all registered firms design a QC system that complies with QC 1000. The Supreme Court has stated that, in cases of statutory construction, a court's analysis begins with “the language of the statute” and “where the statutory language provides a clear answer, it ends there as well.” SOX Section 103(a)(2)(B) refers to quality control standards that the Board adopts with respect to the issuance of audit reports. This section of SOX requires the PCAOB to include, in the quality control standards that it adopts with respect to the issuance of audit reports, seven requirements for every registered public accounting firm relating to: (i) monitoring of professional ethics and independence from issuers, brokers, and dealers on behalf of which the firm issues audit reports; (ii) consultation within such firm on accounting and auditing questions; (iii) supervision of audit work; (iv) hiring, professional development, and advancement of personnel; (v) the acceptance and continuation of engagements; (vi) internal inspections; and (vii) such other requirements as the Board may prescribe (subject to the general rulemaking authority provided to the PCAOB in SOX Section 103(a)(1)). QC 1000 is a quality control standard with respect to the issuance of audit reports that includes each of these seven statutory requirements. Moreover, the fact that one of the statutory requirements relates to the acceptance of engagements implies that the PCAOB's QC standards must address firms that have not yet accepted engagements and not just firms that currently issue audit reports.

Furthermore, we find the use of the term “every” in Section 103(a)(2)(B) significant, because it is the only place in SOX that uses that term. In other sections of SOX, such as Sections 101, 104 and 106, Congress used narrower language when it wanted to apply a particular regulation to a smaller universe of public accounting firms or registered public accounting firms. Further, requiring all registered public accounting firms to design a system of quality control that complies with QC 1000 is consistent with the Congressional directive in SOX Section 102, which requires applicant firms that want to register with the PCAOB to provide for review a description of “the quality control policies of the firm for its accounting and auditing practices.” We therefore find the Amendments are within PCAOB's authority under Title I of SOX.

Barriers to Entry

As noted above, several commenters expressed concerns that the design-only requirement will increase the barriers to entry for small firms to take on audits of smaller issuers or registered broker-dealers and incentivize firms to de-register. Some commenters suggested the requirement be revised to require the system to address only elements of QC covered by the professional QC standards the firm is currently subject to for the type of engagements they currently perform ( e.g., the Other QC Standards). Similarly, one commenter suggested the Commission defer the effective date of QC 1000 for inactive firms until they become active. In the PCAOB response letter, the Board reiterated that the design-only requirement would benefit investors and explained why it believed the alternatives proposed by commenters would not achieve the same level of investor protection as QC 1000. The Board further stated that the design-only requirement comports with its historical practice of requiring firms to provide a summary of the design of their QC system upon registration, regardless of whether such firms perform engagements under PCAOB standards.

We acknowledge concerns that the design-only requirement could create barriers to entry or otherwise impact the decision to either register, or remain registered, with the PCAOB for firms that do not perform PCAOB engagements, and as discussed more fully in Section III.C below, we have considered the overall competitive effects of the Amendments on the market for audit services. These concerns must be weighed against the investor protection benefits of the design-only requirement. In particular, as the Board noted in the Adopting Release, if a registered firm that has not led an engagement or played a substantial role on an engagement in the past anticipates the possibility of transitioning to performing engagements, the design-only requirement may facilitate timely implementation and operation of their QC 1000 compliant QC system. As would be the case in any profession or industry when quickly adopting business-wide quality control processes, allowing registered firms to design their QC system only upon entering into an audit engagement would create a risk that registered firms could be unprepared to accept and perform engagements in compliance with applicable professional and legal requirements, which in turn risks a reduction in audit quality.

We further considered the alternatives raised by commenters, including allowing for compliance with Other QC Standards, or delaying the effective date until firms accept an engagement under PCAOB standards. However, we do not believe that either of these alternatives sufficiently addresses the risks to investors of a firm entering into audit engagements with an issuer or registered broker-dealer without a QC system in place that provides reasonable assurance the firm could conduct the engagement in accordance with applicable professional and legal requirements. An audit firm's failure to conduct an engagement in accordance with applicable professional and legal standards undermines audit quality, puts at risk capital formation, and places investors and issuers at risk.

Further, there are reasons to believe that the design-only requirement will not be a significant barrier to entry or cause for smaller firms to deregister, primarily due to the expected costs to the majority of registered firms being substantially mitigated by investments made by those firms to comply with the Other QC Standards, which have already been adopted by the IAASB and AICPA and will be effective at or before the effective date of QC 1000. In the Adopting Release, the PCAOB stated that QC 1000 shares a basic structure and approach with the Other QC Standards, so designing for the incremental features unique to QC 1000 is not expected to be unduly burdensome for firms that are subject to either or both of those Other QC standards. The PCAOB also stated in the Adopting Release that it believes most audit firms will have either already implemented or be implementing one or both of the Other QC Standards when QC 1000 goes into effect on December 15, 2025. The Commission staff compared the requirements of QC 1000 with the requirements of the Other QC Standards and similarly concluded that there is significant overlap and did not identify anything that is incompatible with those other requirements. Further, no commenters identified any aspects of QC 1000 that are incompatible with these other requirements. Many of the specified requirements in QC 1000 that are not in the Other QC Standards are applicable only to firms issuing audit reports for more than 100 issuers. Therefore, with respect to these incremental requirements, any firms required to design but not implement a QC system under QC 1000 would not be required to adopt those specified requirements. Further, any other incremental requirements over Other QC Standard requirements that are applicable to such firms are not expected to be burdensome to design, especially given the inherent scalability of QC 1000. The Commission staff also performed an analysis of registered firms and determined, consistent with the PCAOB's evaluation, that most registered firms will be subject to the Other QC Standards by the time QC 1000 is effective. Based on the Commission staff's assessment, we believe that these existing standards are likely to mitigate compliance costs for a very substantial majority of registered firms.

Furthermore, other factors may serve to mitigate any adverse competitive effects from the design-only requirement for smaller firms. For example, some registered firms currently participate in PCAOB engagements at a level below that of a “substantial role,” with the level of involvement varying, with some of those firms participating at a level approaching a “substantial role.” Larger firms could have a greater incentive to use the work of registered public accounting firms that are currently participating at a level below that of a “substantial role,” or that are not participating in PCAOB engagements at all, if the larger firms knew that such firms had already designed a QC system in accordance with QC 1000. Therefore, such smaller firms may have more opportunity to participate in audits pursuant to PCAOB standards in the future. Other firms that would have been subject to the design-only requirement may indeed choose to deregister. Such deregistration may, nevertheless, not have an adverse competitive effect if such firms were only intending to continue to compete for work that does not require PCAOB registration, such as participating in an audit pursuant to PCAOB standards at a level below that of a “substantial role,” as their registration status would not impact their eligibility for this work. Accordingly, for these reasons and the reasons discussed in Section III.C, the Commission does not believe this aspect of the Amendments is likely to have a significant negative impact on the market for audit services or the pool of registered audit firms.

B. EQCF Role

As described above, QC 1000 includes a requirement for the small number of firms that issue audit reports for more than 100 issuers during the prior calendar year to implement an EQCF. Composed of one or more persons who are not principals or employees of the firm and do not otherwise have a commercial, familial or other relationship with the firm that would interfere with the exercise of independent judgment with regard to the matters related to the QC system, the EQCF is required to evaluate the significant judgments made and related conclusions reached by the firm when the firm is evaluating and reporting on the effectiveness of its QC system. The PCAOB stated in the Adopting Release that an external oversight function should enhance the discipline with which the firm carries out its own QC system evaluation. The PCAOB also stated that, based on comments it received on the Concept Release and the Proposing Release and experience with inspections of firms' systems of quality control, it believes that investors, audit committees, and other stakeholders will benefit from the EQCF's evaluation.

General

Some commenters stated that they specifically supported the EQCF role. One commenter emphasized the importance of the EQCF role. This commenter stated that it made sense to require firms that issue audit reports for more than 100 issuers per year to be subject to incremental requirements, such as the EQCF role, “given such firms' greater involvement in the U.S. capital markets and their impact on investors.” This commenter further stated that it appreciated that the Amendments stressed “the independence of the external oversight function.” Another commenter stated that the creation of the EQCF “is necessary in light of ongoing instances around the globe which suggest the firms suffer from a lack of ethics throughout the firms, including senior leadership.”

On the other hand, several commenters stated that they do not support the requirement to incorporate an EQCF within the QC system. Among other concerns, commenters asserted that the EQCF requirement included prescriptive elements that were not exposed for public comment; that the costs and benefits of the EQCF requirement had not been adequately considered; that the requirement could vitiate confidentiality protections under SOX; and that the requirement raised personal liability and other concerns that could render the requirement unworkable. Several commenters expressed the view that the requirement would necessitate disclosure of firm deficiency information included in Part II of PCAOB inspection reports to the person or persons serving in the EQCF role in conflict with SOX and PCAOB rules or Congressional intent. More generally, commenters stated that it was unclear “how the EQCF would function within a firm's system of quality control” and suggested that the standard the PCAOB adopted “expanded the professional obligations and responsibilities” of the EQCF role, which would impose additional liability costs for those professionals. Another commenter stated that the EQCF requirement is “neither realistic nor needed” given that the QC systems of firms are complex and involve a multitude of judgments and conclusions and the PCAOB already inspects large firms annually. One commenter stated that “[f]irms that are close to or just above the 100-issuer mark may feel compelled to consider reducing their issuer count below this threshold” as a result of the EQCF requirement. One commenter raised concerns about the EQCF role in its initial comment letter to the Commission and stated, in a subsequent supplemental comment letter, that the PCAOB response letter “provides additional clarity on several of our questions,” including with regard to the EQCF role, but stated the PCAOB response “did not address certain other key matters raised by commenters” and that the letter “raises additional questions.” Specifically, this commenter stated “it is not clear how to square the Board's stated belief that requiring the EQCF will `improve audit quality' and `drive improvement in a firm's QC system' with the view that EQCF members would only be considered `supervisory persons' if the EQCF had the `responsibility, ability, or authority to affect the conduct of . . . associated persons. . . .' ”

While we acknowledge the concerns raised by commenters about the EQCF requirement, the Commission finds that the EQCF role is consistent with the requirements of Title I of SOX and the rules and regulations issued thereunder and is necessary or appropriate in the public interest or for the protection of investors. We believe that an independent oversight function for the small number of firms subject to the requirement will enhance the effectiveness of a registered firm's QC system, ultimately leading to improvements in audit quality. In support of the EQCF requirement, one commenter pointed to the importance of independence to “high quality corporate governance in the United States” and stated that “as independence has been implemented, enhanced and monitored, it has led to investors relying to a greater extent on corporate boards.” We agree with this commenter's views on the benefits of independence to governance structures and concur with the PCAOB that adding an independent perspective to an annually inspected firm's QC system self-evaluation will promote a more rigorous evaluation process by those firms and drive improvements in audit quality. In fact, the PCAOB stated that, in connection with its oversight, “certain firms have acknowledged the limitations of internal QC functions led by non-independent firm employees and have touted the benefits of independent review.” The PCAOB further stated that some firms have already created leadership or advisory roles for independent third parties. We find this evidence persuasive and therefore conclude that requiring an external quality control function for registered firms will serve the public interest and the protection of investors.

One commenter expressed doubts that the EQCF would improve audit quality or drive improvements in a firm's QC system given the PCAOB's view that the EQCF would only be considered a supervisory person if it had responsibility, ability, or authority to affect the conduct of associated persons. We understand this commenter to be suggesting that the EQCF role will not result in improvements unless the EQCF has some control with respect to decision-making at the firm. To the extent the registered public accounting firms subject to the EQCF requirement share the concern raised by this commenter, the Amendments provide firms with flexibility to vest the EQCF with decision-making authority to the extent they see fit. However, even absent decision-making or other authority, we believe that the EQCF role will be able to drive improvements in audit quality and a firm's QC system. An independent perspective on the significant judgments made and conclusions reached by the firm during its annual evaluation will help firms identify areas of improvement in their QC systems that they can consider when operating their QC systems. It is not uncommon for businesses to seek external perspectives on a variety of topics or issues and the fact that the business is the ultimate decision-maker does not mean that the input provided is not valuable or beneficial to the process. In addition, as noted above, some audit firms have voluntarily added independent oversight to their governance structures, indicating that they see a benefit to having an independent perspective.

Relatedly, we do not believe that imposing an independent QC monitor or independent QC consultant for a prescribed period of time as remedial relief in a PCAOB enforcement action would serve as a viable substitute for the EQCF requirement for the small number of firms subject to the requirement, as suggested by one commenter. Based on our experience with Commission enforcement actions, audit quality and investor protection benefits are greater with a prophylactic requirement aimed at preventing such violations from occurring in the first place—before investors are potentially placed at risk—than with only remedial relief in a handful of enforcement actions for limited periods of time.

In addition to the overall benefits that an independent oversight function would provide, we find that the Board's approach to mandating this requirement in QC 1000 appropriately balances the need to enhance the effectiveness of registered firms' QC systems with an approach that provides flexibility in internal governance structures to minimize cost and disruption. As adopted by the Board, the EQCF requirement will provide significant flexibility for firms to design procedures that work best for their individual firm governance structure and requirements. QC 1000 does not specify where within the registered public accounting firm the EQCF must be housed or to whom the EQCF must report. These determinations are left to the discretion of the firm. This flexibility will allow an independent EQCF to also serve, for example, as an independent member of a firm's advisory committee or audit quality committee or governance body, including one that has a majority of non-independent members. Furthermore, to the extent that firms have existing QC advisory committees, nothing in the rule would prevent those committees, or independent members of those committees, from serving as EQCF, provided they meet the rule's independence standard and can discharge the assigned duties.

The Amendments also do not prescribe specific procedures to be followed by the EQCF and require only one EQCF activity. The EQCF must evaluate “the significant judgments made and the related conclusions reached by the firm when evaluating and reporting on the effectiveness of the QC system.” Notably, the EQCF's responsibility does not extend to all of the firm's QC-related judgments and conclusions, but only to significant ones made in connection with the firm's annual QC-system evaluation and reporting. Firms may, but are not required to, consider additional oversight functions for the EQCF, such as reviewing the firm's remediation actions and monitoring plan, or identifying and monitoring emerging risks or trends that could potentially affect the firm's QC system. Similar to the flexibility provided to audit firms in determining how the EQCF will perform its responsibilities, audit firms would have flexibility to consider, based on their individual firm needs, what other functions, if any, would be beneficial. Along these lines, one commenter noted that the PCAOB has pointed out the flexibility of its approach and how a firm implementing it can apply that flexibility. The commenter further stated that, based on the commenter's experience with the auditing profession, the commenter believes that the PCAOB is correct and that the approach the PCAOB took with respect to the EQCF “should, and will ultimately, allay the concerns of audit firm commenters.” Below we discuss the views of commenters with respect to specific aspects of QC 1000's EQCF requirement, as well as the Commission's findings regarding those matters.

Notice and Comment

Several commenters expressed the view that the EQCF requirement was not included in the Proposing Release and therefore was not properly exposed for public comment before being adopted by the Board. One commenter stated that the change from requiring an “oversight function for the audit practice” in the Proposing Release to requiring an “oversight function for the QC system” in the Adopting Release represents a significant change that “effectively deprives us of an opportunity for public input into the revised requirement.” Another commenter stated that the requirement for the EQCF to evaluate all “significant judgments” introduces “prescriptive elements not included in the original proposal.” Conversely, one commenter stated that “[c]learly anyone who read and responded to the Concept Release and exposure draft were aware that the PCAOB was moving to adopt such a function in its final rule.”

As a threshold matter, we find that the public had a meaningful opportunity to comment on the Amendments both as they were being developed by the PCAOB and after they were filed with the Commission for approval. The PCAOB received and considered comments in connection with both the 2019 Concept Release and 2022 Proposing Release. The comment period for the Proposing Release was open for 75 days, but the PCAOB continued to accept comments up until its adoption of the Amendments. The PCAOB considered all comments it received. After the Amendments were filed with the Commission for approval, the Commission published a notice to solicit comment on the Amendments with comments due 21 days after the Notice of Filing of Proposed Rules was published in the Federal Register . To provide additional time for consideration of the Amendments and the issues raised therein, the Commission twice extended the date by which it must act on the Amendments. During this time, the Commission received additional input from both the Board and public commenters. We have considered all of these comments in deciding to approve the Amendments.

The Commission finds that the Board's process for approving the Amendments complied with all applicable requirements. Although the Board is not “an agency or establishment of the United States Government,” for statutory purposes and therefore is not subject to the requirements of the Administrative Procedure Act (“APA”), the Board as a matter of policy has adopted a notice-and-comment process to inform its decision-making. The Board followed that process here. The PCAOB response letter details the standard-setting history relating to the EQCF requirement, beginning with the 2008 recommendations from ACAP and including the Concept Release, Proposing Release, consideration of comments received to each, and Adopting Release. The Board describes the outreach it performed and the input it received from a variety of stakeholders over the course of that multi-year process. The Board's analysis demonstrates that the core tenets of “independent oversight over firm's QC systems” were introduced in the Concept Release, and were refined through the Board's stakeholder engagement, including in response to comments received on their Concept Release and Proposing Release. Accordingly, we find the Board's process for approving the Amendments reasonable and appropriate.

As proposed, consistent with the Concept Release, the PCAOB contemplated an independent QC oversight function within the governance structure of an audit firm. Specifically, the PCAOB proposed to require an “oversight function for the audit practice” writ large that included at least one individual who was not a principal or employee of the firm and who did not have a relationship with the firm “that would interfere with the exercise of independent judgment with regard to matters related to the QC system ” (emphasis added). The PCAOB explained in the Proposing Release that the proposed requirements “would not specify how the firm would establish its governance structure or assign authority, other than having one person in an oversight role who would be in a position to exercise independent judgment with regard to QC matters ” (emphasis added). The proposed oversight function, coupled with the general requirement relating to the “exercise of independent judgment with regard to matters related to the QC system,” reasonably could have been read to include, for example, oversight over all aspects of the QC system including design, sufficiency, judgment, and overall effectiveness.

In response to the Proposing Release, commenters requested specificity regarding the function and scope of the responsibilities such an independent QC governance role would entail. After taking such comments into consideration, the Board adopted an amended QC standard that clarified the EQCF's status and role. Specifically, the PCAOB narrowed the focus of the role from the proposal which, as explained above, would have required an “oversight function for the audit practice” to require an “oversight function for the QC system” and specified a single responsibility for the EQCF: “evaluating the significant judgments made and the related conclusions reached by the firm when evaluating and reporting on the effectiveness of the QC system.”

One commenter specifically stated that the change from an “oversight function for the audit practice” to an “oversight function for the QC system” was a significant change that was not adequately explained or proposed for public comment. We disagree with this commenter. The QC system is the process by which a firm manages and improves its audit practice and therefore is an integral and significant part of the audit practice, so that a role overseeing the audit practice would necessarily also oversee the QC system in addition to other aspects of a firm's audit operations. Therefore, an “oversight function for the QC system” is a subcomponent of an “oversight function for the audit practice” ( e.g., a narrower version of what was proposed). Moreover, the EQCF role was proposed in the context of the PCAOB's new quality control standard and both the PCAOB's proposed and adopted formulations of the oversight requirement required that the individual or individuals who fill the role not have any relationships with the firm “that could interfere with the exercise of independent judgment with regard to matters related to the QC system ” (emphasis added). In our view, these explicit references to the individual's responsibilities as they relate to the “QC system” weigh against commenters' claims that the EQCF role could not have been anticipated from the proposal.

Moreover, many aspects of the Amendments related to the EQCF role remain unchanged from the proposal. For example, the EQCF requirement only applies to firms that issue audit reports with respect to more than 100 issuers during the prior calendar year. The requirement for independence remained the same with the exception of changing the terminology from the singular to plural form ( i.e., a grammatical change). Although the Amendments describe the EQCF role as an “ external oversight function,” the PCAOB response letter explains that it used the phrase “external” to “underscore that the function is to be carried out by one or more persons who are independent and, necessarily, external to the firm” rather than imposing a separate requirement. The proposal required the EQCF role to be composed of “at least one person” while the Amendments require the EQCF role to be composed of “one or more persons.” In either case, only one individual is required but a firm can choose to assign more than one individual to the role. As discussed in greater detail below, the individual or individuals who fill the EQCF role will be “associated persons of a registered public accounting firm,” and the same would have been true under the proposal. Finally, the Amendments state that the “EQCF should have the experience, competence, authority, and time necessary to enable them to carry out the responsibilities assigned to the EQCF by the firm.” The PCAOB explained in the Adopting Release that this change was made to “conform[ ] the provision to the descriptions in QC 1000.12 of other specified QC system roles” that require the same qualifications to perform their responsibilities.

Therefore, having considered the standard-setting process preceding the EQCF requirement, we find that the public had considerable opportunity to comment on the function and responsibilities of the EQCF role included in the Amendments as well as on the similar, but more broadly focused, independent oversight function in the Proposing Release, on which the EQCF is based. Moreover, we find the changes made to that role in the Adopting Release to be responsive to comments received by the PCAOB from a variety of stakeholders. We also agree with the Board that the only prescriptive requirement of the function—the requirement to evaluate the significant judgments made and the related conclusions reached by the firm when evaluating and reporting on the effectiveness of the firm's QC system —is both responsive to requests for greater clarity and specificity and would benefit investors by enhancing the discipline with which a firm carries out its own QC system evaluation. Overall, we believe the changes described above addressed feedback on the role that the Board received on the Concept Release and Proposing Release, including that the role did not go far enough; that the role's undefined authority made it likely to be ineffective; and that more specificity and prescription was needed to avoid overly broad interpretations of the requirements; while maintaining a principles-based approach to allow firms to design the EQCF as appropriate for their audit practice.

In addition, the public had the opportunity to provide comments to the Commission on the Amendments adopted by the PCAOB. One commenter stated that the “time-period for providing comments to the SEC” was “constrained.” As discussed above, however, the Commission provided an initial comment period of 21 days, followed by an extension of 14 days. The Commission also extended its period to consider the Amendments two times, for a total of a 90-day period. Over the course of the 90 total days during which the Amendments were under consideration by the Commission, the public was able to continue to submit comment letters. The Commission received over 20 letters in total, several of which addressed the EQCF role in particular. The Commission has considered the concerns raised by commenters and addresses them below.

Alternatives to the EQCF Role

One commenter stated that it was concerned that the EQCF may not achieve the effectiveness and accountability that is necessary because of the flexibility provided to firms, and questioned whether a single person would be able to fulfill the EQCF's responsibilities inside the largest accounting firms. The commenter believed that a preferable approach would be to require the creation of an independent board as proposed by the ACAP and used by the FRC and the Japan Financial Services Agency. As the PCAOB states in the Adopting Release, the EQCF role may be carried out by “one or more persons” and therefore larger firms will be able to determine whether it would be appropriate to assign more than one person to the role given their size and complexity. We note that the firms that will be subject to the Amendments are of varying sizes and complexities and we therefore agree with the PCAOB that a “one size fits all” approach is unwarranted. Furthermore, we note that the PCAOB has stated that it intends to monitor the implementation of QC 1000 through its inspections program and outreach activities and “will remain vigilant” for any information regarding the standard's effectiveness or implementation challenges. With respect to the commenter's preferred approach of creating an independent board, although we agree with the commenter that experience has indicated that independent boards of issuers can be very effective, such a requirement is not part of the Amendments and therefore it is beyond the scope of this Order. In addition, we believe that consideration would need to be given to how an independent board requirement would interact with any applicable corporate governance laws, particularly for those registered public accounting firms located outside of the United States.

Disclosure, Confidentiality and Liability

Several commenters stated that the EQCF requirement conflicts with SOX Sections 104(g)(2) or 105(b)(5)(A) because it would compel audit firms to share non-public QC criticisms with the EQCF, who is external to the firm. One commenter stated that the EQCF (or members of the EQCF) would not be an associated person, given the definition of associated persons in PCAOB Rule 1001(p)(i), and considering that the EQCF consists of one or more independent third-parties. This commenter further stated that discussions in the Adopting Release “cloud this issue,” including the discussion of whether the EQCF would be subject to supervisory liability under SOX Section 105(c)(6). One commenter responded to the PCAOB response letter stating that their “objection is in the PCAOB requiring disclosure to individuals a firm is not otherwise even required to employ or contract.”

SOX Section 104(g)(2) provides that “no portions of [a PCAOB] inspection report that deal with criticisms of or potential defects in the quality control systems of the firm under inspection shall be made public if those criticisms or defects are addressed by the firm, to the satisfaction of the Board, not later than 12 months after the date of the inspection report.” SOX Section 105(b)(5)(A) provides that, with certain exceptions, “all documents and information prepared or received by or specifically for the Board, and deliberations of the Board and its employees and agents, in connection with an inspection . . . or with an investigation . . . shall be confidential and privileged as an evidentiary matter . . . in any proceeding in any Federal or State court or administrative agency, and shall be exempt from disclosure . . . under the Freedom of Information Act . . . or otherwise.”

The Commission finds that the disclosure of information to the EQCF would not be a public disclosure under Section 104(g)(2) or inconsistent with the confidentiality protections provided by Section 105(b)(5)(A) because those serving in the EQCF role would be associated persons and therefore subject to the same confidentiality requirements as the firm's partners, employees, and other associated persons. Under SOX Section 2(a)(9), an “associated person of a public accounting firm” includes any “independent contractor” who, “in connection with the preparation or issuance of any audit report,” receives compensation from the firm or “participates as agent or otherwise on behalf of” the firm “in any activity of that firm.” For reasons the PCAOB explained, because individuals serving in an EQCF role cannot be partners, shareholders, members, other principals, or employees of the firm, they are likely to be engaged as independent contractors. And those independent contractors would meet the definition of an “associated person” under SOX Section 2(a)(9) because they are likely to be compensated for their work and, in any event, would participate in the firm's activities—at least the firm's evaluation and reporting process—on behalf of the firm.

Like all associated persons, such independent contractors are part of the PCAOB inspection or investigation process, not strangers to it. They must cooperate with PCAOB inspections and investigations, comply with related PCAOB requests, and prepare inspection- or investigation-related documents for the PCAOB. Accordingly, such independent contractors are not part of the public, and their involvement in Board inspections and investigations and awareness of information related thereto would not vitiate confidentiality protections. Indeed, as the PCAOB observed, some firms currently share confidential information with external advisors, including those serving in audit quality advisory roles.

QC 1000 does not specify what information affected firms must share with the EQCF, giving firms flexibility in determining the responsibilities of the EQCF and what information is needed for the EQCF to fulfill its role, as long as the EQCF complies with the minimum requirement to evaluate all significant judgments made by the firm with respect to its QC system. Also, firms may enter other types of independent-contractor arrangements, including with individuals at an affiliated firm within a global network or personnel at shared services centers outside of the firm. A determination that the EQCF is not an associated person would have significant consequences for those arrangements. Finally, a firm would be free to impose confidentiality or non-disclosure requirements on the EQCF to the same extent a firm is able to impose such requirements on its other independent contractors.

Although their status as associated persons could result in potential personal liability for individuals that take on the EQCF role, we believe this is appropriate given that the EQCF, like any other associated person, should exercise due professional care when fulfilling their responsibilities—responsibilities that, as we have explained above, serve an important investor protection role. We note that the significant flexibility afforded to firms under the Amendments to design procedures for the EQCF that work best for their individual firm governance structure may help to mitigate concerns that the attendant personal liability could discourage qualified individuals from taking on such a role.

Commenters also raised concerns about the potential liability exposure of the EQCF if the individual serving in that role was considered not only an associated person of the firm, but also a supervisory person. Under SOX Section 105(c)(6), the Board may impose sanctions on a “supervisory person” who “fail[s] reasonably to supervise an associated person” and “such associated person commits a violation” of a relevant law, rule, or standard. The Commission agrees with the PCAOB that the minimum requirements of the EQCF would not, on their own, make the individual or individuals “supervisory persons,” and that the assessment of whether any particular individual serving in the EQCF role is a supervisory person would need to consider any additional responsibilities or authorities the audit firm assigned to them. Again, however, the flexibility afforded to firms under the Amendments to determine what additional functions, if any, would be performed by EQCF should serve to mitigate concerns.

Relatedly, several commenters raised concerns that potential liability under Section 105(c)(6) of SOX for the person or persons fulfilling the EQCF role could limit the pool of candidates for this role. However, we do not believe that any potential liability will significantly impact the pool of candidates, given the flexibility afforded to firms in the structuring of the role and the impact of such flexibility on liability considerations, as well as the fact that the requirement only applies, as the PCAOB observed, to the small number of firms meeting the 100-issuer threshold and that several of those firms already have independent members of their firm governance or audit quality structure whose responsibilities, in some cases, may already meet the requirements of the EQCF, or who otherwise may be willing to expand such responsibilities.

Other

One commenter stated that firms that are close to or just above the annual 100-issuer audit report threshold may feel compelled to consider reducing their issuer count below this threshold to avoid the EQCF requirement and that such exits would undermine competition. However, we believe such an effect is unlikely to be significant given that, as the Board observed in the Adopting Release and in the PCAOB response letter, very few firms are close to the 100-issuer threshold. Specifically, PCAOB staff analysis of audit reports included in Commission filings during the 2022 calendar year indicated that two registered public accounting firms audited between 80 and 100 issuers and two registered public accounting firms audited between 100 and 120 issuers. In addition, we expect that the minimum requirements for the EQCF role and the flexibility provided to firms to implement the role would reduce the likelihood that firms would be motivated to stay below the 100-issuer threshold to avoid the requirement. Furthermore, we agree that using the 100-issuer threshold is a reasonable approach because, as the PCAOB noted in the Adopting Release, firms are already familiar with this statutory threshold in the PCAOB inspection context and because we agree with the commenter who stated that the 100-issuer threshold was appropriate “given such firms' greater involvement in the U.S. capital markets and their impact on investors.” SOX provides that firms that provide audit reports for more than 100 issuers are subject to annual inspection by the PCAOB and firms that provide audit reports for 100 issuers or fewer are subject to inspection triennially. Therefore, not only are firms familiar with the threshold, we believe firms monitor the size of their issuer practice for purposes of monitoring their inspection requirements and using the same threshold would avoid requiring the small number of firms that are close to or above the 100-issuer threshold to track a different threshold for purposes of compliance with QC 1000.

Some commenters raised questions about the Board's analogy of the EQCF to the Engagement Quality Reviewer (“EQR”). One commenter stated that the analogy the PCAOB made between the EQCF and the EQR was “not well analogized” because the EQR is required to perform a review under specific requirements that are the subject of an auditing standard while the PCAOB has not provided such specific requirements for the performance of the EQCF's evaluation.

The analogy the PCAOB drew between the EQCF and the EQR in the Adopting Release noted certain similarities between the two roles, but also identified important differences between the requirements for the roles, including that the EQCF is not required to provide concurring approval, as is required of an EQR. The EQR's concurrence instills responsibility and authority over the activities of the audit engagement team and places the EQR in a supervisory position in an audit engagement. On the other hand, as the PCAOB has made clear, the EQCF is not required to approve the firm's conclusions regarding its significant judgments for the firm to make a conclusion on the effectiveness of the QC system. As explained above, the requirement to evaluate the significant judgments and conclusions reached does not, by itself, impose supervisory responsibilities on the EQCF nor is the EQCF's concurrence with the firm's conclusions required. The EQCF's evaluation is an input into the firm's assessment of its QC system and while it may inform the actions of individuals, it does not direct such actions.

Another commenter who addressed the PCAOB's comparison of the EQCF and EQR roles stated that, unlike the EQR who is governed by the requirements in the PCAOB's engagement quality review standard, the Amendments do not prescribe certain details regarding the EQCF's role and responsibilities. Specifically, the commenter stated that the final standard does not, among other things: (1) specify the procedures the EQCF should perform to evaluate the significant judgments made and related conclusions reached; (2) address the nature, timing, and extent of the EQCF's review; or (3) address how differing judgments made by the EQCF and the firm should be resolved or documented. This commenter stated that this creates uncertainty regarding the application of the responsibilities specified in the standard and raises questions about the potential liability of the EQCF. We disagree with the views expressed by the commenters discussed above. The PCAOB adequately explained this comparison in the Adopting Release, noting similarities between the two roles, but also explaining important differences, which we have highlighted, above. In our view, the referenced discussion sought to clarify aspects of the EQCF without imposing any new requirements on registered public accounting firms or changing the requirements for the EQCF as set forth in the Amendments.

With respect to the commenter's concerns about the lack of prescriptiveness of the EQCF requirement, the PCAOB explained its decision to provide firms with flexibility to design the EQCF role to fit their particular circumstances and firm governance structure in both the Adopting Release and the response letter. As discussed above, we find that the Board's approach to the EQCF requirement in QC 1000 appropriately balances enhancing the effectiveness of audit firm QC systems with flexibility that allows for effective scaling and customization for firms of varying sizes, structures, and risk profiles, as well as minimizing cost and disruption. Regarding the question on resolution of differences, the Amendments provide audit firms with broad flexibility with respect to the implementation of the EQCF role, including applicable internal procedures. As the Amendments do not require that the EQCF have any specific decision-making responsibility or other authority, firms are generally free to determine an approach to any such differing judgments between the EQCF and the firm in the manner that they deem most appropriate for their firm.

To the extent that firms have questions about the implementation of the EQCF role, the PCAOB stated that it anticipates that, consistent with its historical practice, its staff will issue implementation guidance and will engage in other activities to support firms' implementation efforts. We encourage the PCAOB to provide this implementation guidance and other support, which could be useful to firms, with respect to the Amendments generally and in particular for the EQCF role.

Two commenters suggested that the EQCF is unnecessary because a firm's annual self-evaluation of its QC system, coupled with the PCAOB's annual inspections of that QC system, should suffice. We are persuaded, however, that the EQCF requirement will provide meaningful additional safeguards beyond those realized from self-evaluations and inspections. The EQCF's evaluation should provide the firm with real time, independent feedback, enabling the firm to enhance its quality control system on an ongoing basis whereas any response it receives from the PCAOB during its inspections process occurs at a later point in time. In this way, the EQCF role is consistent with the objective of a quality control standard that fosters continuous improvement—one of the PCAOB's express aims in adopting QC 1000.

Some commenters stated the requirements for the EQCF are unclear ( e.g., requirements around documentation of EQCF's evaluation). The PCAOB response letter addresses the documentation requirements as they relate to the EQCF. The PCAOB response letter states that, under QC 1000, it is the firm that bears responsibility for complying with documentation requirements related to the EQCF role not the individual or individuals who comprise the EQCF. Indeed, the EQCF could provide its evaluation orally because there is no requirement in QC 1000 that the EQCF must document or provide its evaluation in writing. Further, QC 1000 does not prescribe to whom the EQCF must report, giving firms flexibility to develop the form of reporting and the line of reporting by the EQCF. We note, moreover, that it is typical for implementation questions to arise around new accounting or auditing requirements. To the extent additional clarity on specific requirements related to EQCF is necessary, we believe PCAOB staff implementation or other guidance would sufficiently assist firms with interpreting the requirement. As noted above, the PCAOB stated that it anticipates that, consistent with its historical practice, its staff will issue implementation guidance and will engage in other activities to support firms' implementation efforts.

C. Economic Implications of the Amendments

Commenters expressed concerns that the costs arising from QC 1000 and certain of its requirements are not appropriately described and that a more rigorous economic analysis is necessary before the Amendments can be approved. One commenter stated that the economic analysis conducted by the PCAOB in the Adopting Release was deficient because it did not discuss any plans for post-implementation review or details on how such a review will be conducted. By contrast, another commenter observed that the PCAOB issued a staff white paper in November 2022 identifying research that suggests the PCAOB's proposed QC standard could lead to greater compliance with professional standards and improve financial reporting quality. This commenter also stated that the “costs of deficient failed audits, can and have been significant and even catastrophic to investors, employees, and the U.S. economy.”

The PCAOB response letter addresses commenter feedback on its economic analysis. The Board stated that, where possible, quantitative data was used and that, when this data was not available, the Board used qualitative factors in its analysis. The Board also stated that available data and methods do not permit them to fully quantify all of the benefits and costs of QC 1000 and that commenters on this topic did not provide studies or data that permitted complete quantification of the benefits or costs of QC 1000. When commenters did suggest relevant data or research, the Board stated that it considered it and incorporated that data or research into its economic analysis as appropriate.

As part of our assessment of the Amendments, we have considered the economic analysis conducted by the PCAOB in the Adopting Release as well as the comments received on this point and the additional information provided in the PCAOB response letter. Below we evaluate the PCAOB's analysis in order to reach our own conclusion about the economic implications of the Amendments. On many points, we find the PCAOB's analysis reasonable; however, where appropriate, we have expanded upon that analysis. Moreover, we have considered the specific concerns raised by commenters about the unintended consequences of the Amendments and, as discussed in more detail below, have concluded that the Amendments are unlikely to have a significant adverse effect on efficiency and competition within the market for audit services.

The PCAOB's economic analysis addresses the benefits and costs associated with the Amendments, including, but not limited to, the design requirement, which applies to all registered firms, and the EQCF requirement, which applies to a small number of firms. The PCAOB's analysis explains the expected benefits to investors and other financial statement users that will be realized by improving compliance with applicable professional and legal requirements and thereby improving financial reporting quality. In addition, the PCAOB's analysis addresses unintended consequences of the Amendments, such as potential effects on human capital, competition concerns, including the concern raised by some commenters that the requirements could diminish the availability of global network resources and that smaller firms around the world could decline to assist U.S. firms with global audits, and the potential negative consequences related to increased accountability or liability. Finally, the Board stated in the PCAOB response letter that it intends to follow its normal practice under which staff in its Office of Economic and Risk Analysis will conduct an analysis and make a recommendation to the Board as to whether to conduct a post-implementation review of the Amendments. We encourage the Board to conduct such a post-implementation review.

Below we examine the individual elements of the Board's economic analysis, including its consideration of the effects on efficiency, competition, and capital formation.

Consistent with best practice when conducting an economic analysis, the Board includes a baseline assessment of existing audit requirements and practices against which the potential effects of the Amendments can be considered. The Board presents analyses of quantitative proxies for the level of compliance with existing professional standards, including information on Part I.A deficiencies, QC deficiencies related to audit performance, and broker-dealer engagement deficiencies, from the audits or engagements inspected by the PCAOB. Overall, these analyses suggest that some firms' QC systems may not be providing the required reasonable assurance. The Board's analysis indicates that broker-dealer engagements and issuer audits performed by firms other than the U.S. global network firms (“GNFs”) appear to have more room for improvement on average based on the period examined. The Board also presents research that it conducted on existing policies and procedures at U.S GNFs. This research finds that U.S. GNFs are already devoting extensive resources to the design, implementation, and operation of QC policies and procedures related to the ISQM 1 requirements. Further, the Board observes that commenters on the Proposing Release indicated that non-GNFs have been devoting resources to the design, implementation, and operation of QC policies and procedures related to ISQM 1 and/or SQMS 1 requirements, though some of these firms may have more narrowly focused their resources on the design component and may not yet be spending resources to operate QC policies in line with SQMS 1. Lastly, the Board's baseline assessment provides information on the evolution of firms' QC policies and procedures and discusses academic research on behaviors that suggest certain weaknesses in QC systems in practice.

Several commenters on the Proposing Release suggested that some firms have already designed and implemented, or are in the process of designing and implementing, QC policies and procedures consistent with the requirements of Other QC Standards. The Board supported that view, but many commenters on the Proposing Release disagreed with this characterization of the baseline and stated that QC 1000 will impose significant costs. The Commission staff independently examined the number of PCAOB-registered audit firms that will be affected by QC 1000, including the extent to which they may be affected.

There are 1554 audit firms registered with the PCAOB as of August 2024. Among these, 659 firms performed an engagement under PCAOB standards for an issuer or registered broker-dealer. These firms will have to fully implement QC 1000. Out of these 659 firms, 323 are U.S. firms that issued opinions under AICPA standards and, should they continue to do so, will have to implement SQMS 1; 199 are non-U.S. firms that are GNFs and are therefore likely to implement ISQM 1; and another 60 are non-U.S. firms that have an audit-related membership, affiliation, or similar arrangement. We believe that non-U.S. firms that have an audit-related membership, affiliation, or similar arrangement, especially GNFs, are likely to have implemented ISQM 1 due either to their own issuance of audit reports under International Auditing Standards, or as a recommendation or requirement due to its audit-related membership, affiliation, or similar arrangement. Hence, in total, we believe that 582 of the 659 firms ( i.e., 88%), by the effective date of QC 1000, will already be subject to quality control requirements that share a basic structure with the requirements in QC 1000. This overlap significantly reduces the cost and benefits of the Amendments, to the extent that these firms in fact comply with the Other QC Standards. Recognizing that the Amendments are likely to increase compliance with these shared quality control requirements ( i.e., as a result of PCAOB inspections and enforcement of QC 1000), firms may incur costs relative to the baseline, and there may be corresponding benefits to investors stemming from audit quality improvement.

Another 845 firms of the 1,554 firms registered with the PCAOB have not performed an engagement under PCAOB standards for an issuer or registered broker-dealer within the past year and thus would only be subject to the design-only requirement. Out of these 845 firms, 259 are U.S. firms that issued opinions under AICPA standards and, should they continue to do so, will have to implement SQMS 1; 98 are non-U.S. firms that are GNFs and are therefore likely to implement ISQM 1; and another 255 are non-U.S. firms that have an audit-related membership, affiliation, or similar arrangement. As discussed above, we believe having an audit-related membership, affiliation, or similar arrangement indicates these firms will likely have implemented ISQM 1. Hence, in total, we believe that 612 of the 845 firms that have not performed an engagement under PCAOB standards for an issuer or registered broker-dealer within the past year ( i.e., 72%), by the effective date of QC 1000, will already be subject to quality control requirements that share a basic structure with the design-only requirements in QC 1000. This significantly reduces both the costs and benefits of the Amendments to these firms, as discussed above. Taken together, 1,194 of the 1,554 ( i.e., 77%) firms registered with the PCAOB are unlikely to incur significant incremental costs under QC 1000.

One commenter stated that the Board did not adequately consider the extent to which the Amendments could impact entities other than issuers and registered broker-dealers in its assessment of the Amendments' economic effects. We agree that QC 1000 will indirectly affect parties other than issuers and registered broker-dealers, as the Commission has promulgated rules requiring the use of PCAOB-registered or PCAOB-registered and inspected audit firms by other entities, including, but not limited to, certain investment advisers, pooled investment vehicles, security-based swap data repositories, and clearing agencies. For example, Rule 206(4)-2 under the Investment Advisers Act of 1940 requires that (1) advisers using a related person as custodian must obtain their surprise examination and internal control report from a PCAOB-registered and inspected auditor, and (2) advisers relying on the audit exception from the surprise examination requirement with respect to a pooled investment vehicle must have the pooled investment vehicle audited by a PCAOB-registered and inspected auditor. Below we discuss some of the potential effects of the Amendments on these other regulated entities.

One commenter on the Proposing Release asserted that audit firms' financial incentives to operate too lean undermine audit quality. The Board agreed and, more generally, identified market failures and thus a need for regulatory action. As a general matter, the Board explained that there are information asymmetries between auditors and investors and other financial statement users regarding the services performed by auditors. Also there are positive externalities in the audit market. Specifically, while the services of an auditor provide benefits to a variety of investors and financial statement users, auditors do not bargain with all of these parties, but, rather, are appointed, compensated, and retained by the audit committee. The Board stated that some beneficiaries of the auditor's work ( e.g., the investing public generally, who benefit from overall confidence in the quality of financial information provided to the market) may have no influence on the auditor at all.

We agree that the information submitted by the PCAOB demonstrates that these market failures exist in the market for audit services. Information asymmetries could create a risk that auditors may under-perform and gather insufficient audit evidence to support their opinion or may otherwise depart from applicable requirements unbeknownst to market participants who rely on financial statements. This risk could be exacerbated as auditors directly contract with issuers (through the audit committee), not investors and financial statement users. The principal-agent relationship between audit firms and issuers could exacerbate the risk that auditors may not be incentivized to gather sufficient audit evidence to support their opinion or otherwise depart from applicable requirements, potentially harming financial statement users or market participants generally. As a result, we agree with the Board that the audit market may not provide sufficient economic incentives for all firms to design, implement, and operate QC systems that provide reasonable assurance. Additionally, the Board explains that current PCAOB QC standards do not directly address recent QC developments, so that the current regulatory baseline is not rigorous enough to sufficiently support the Board's ability to address audit performance deficiencies through PCAOB inspection and enforcement activities related to firms' QC systems.

Having established the regulatory baseline and need for regulatory action, the PCAOB's analysis then discusses the anticipated economic benefits of the Amendments. With respect to benefits, the Board states that the QC 1000 requirements provide substantial additional direction to firms regarding the design, implementation, and operation of their QC systems. The Board identifies three overarching beneficial features of these requirements. The first feature pertains to the mandate for a more integrated, proactive, and risk-based QC system. The second pertains to the enhancements to accountability within the firm to achieve the reasonable assurance objective. The third pertains to more precise language and more prescriptive requirements in several key areas.

We agree with the Board that the QC 1000 requirements will benefit investors and other financial statement users by improving compliance, including through PCAOB inspections and enforcement, with applicable professional and legal requirements via a more risk-based, accountable, and detailed QC standard. Such a QC standard will help improve audit quality resulting in more accurate and more reliable financial statements regarding the financial position and operating results of companies. Investors may, in turn, use this information to improve the efficiency of their capital allocation decisions ( e.g., investors may more accurately identify companies with the strongest prospects for generating future risk-adjusted returns and allocate their capital accordingly), thereby also improving market efficiency. Investors may also perceive reduced risk in capital markets generally, promoting capital formation. The magnitude of these effects will depend on the degree to which auditors improve their QC systems and the degree to which the incremental improvements lead to higher audit quality.

The PCAOB's analysis also discusses the anticipated economic costs of the Amendments. The Board stated that it expects the QC 1000 requirements will result in direct and indirect costs to auditors and, potentially, indirect costs to the companies that they audit. The Board also noted that the extent of these costs will depend on the degree to which firms otherwise have QC systems in place designed to comply with Other QC Standards and the specific policies and procedures adopted by the firm. We agree that audit firms will incur compliance costs, both one-time implementation costs and ongoing operating costs (at the firm level and at the engagement level), associated with the QC 1000 requirements. To the extent that audit firms pass on these cost increases to their clients, these clients would incur indirect costs such as in the form of higher audit fees.

As the Adopting Release acknowledges, the Board received a number of comments stating there will be costs and challenges to implement and operate features of QC 1000 that are incremental to the systems firms have established to comply with Other QC Standards. Several commenters also asserted that firms that audit between 100 and 500 issuers will be significantly impacted by costs associated with some or all of QC 1000's incremental requirements for firms that issue audit reports for more than 100 issuers, and some of the commenters noted resource differences between GNFs and annually-inspected NAFs. Other commenters stated that smaller firms may be especially affected by the new QC requirements, including requirements incremental or alternative to ISQM 1 and SQMS 1 standards.

Similarly, the Commission received a number of comments about the potential costs of the Amendments. One commenter stated that the requirements mean that PCAOB-registered, but not inspected, audit firms must comply with the design-only requirement, although these firms do not render audit reports on issuer or broker-dealer engagements or play a substantial role in such engagements. The same commenter stated that firms that are registered, but not inspected, are smaller audit firms that serve market segments for entities that become smaller issuers and broker-dealers, including emerging growth companies. Another commenter similarly stated the adopting release's design-only requirement for firms that do not issue audit reports for issuers imposes undue burdens on competition that will hurt smaller issuers (including emerging growth companies), investors, and the competitiveness of the audit marketplace. One commenter expressed concerns over the significant costs of designing a system of QC in accordance with QC 1000 on a hypothetical basis, also stating that even for firms that are performing a small number of engagements under PCAOB standards, the requirement to comply with two standards ( i.e., either ISQM 1 or SQMS 1 and QC 1000) with two different sets of deficiency definitions and conclusion frameworks could present similar cost constraints. The same commenter requested that the effective date of QC 1000 implementation for these firms be deferred until such time as they determine they intend to perform engagements in accordance with PCAOB standards and consider whether explicit guidance could be developed that would explain that a registered accounting firm is essentially prohibited from undertaking PCAOB engagements until a system of QC that complies with QC 1000 is in place.

We agree with the Board's assessment that there are costs to designing and implementing a QC system. As discussed above, as of August 2024, 845 firms of the 1,554 firms ( i.e., 54%) registered with the PCAOB have not performed an engagement under PCAOB standards for an issuer or registered broker-dealer within the past year and would therefore not bear the costs to implement and operate the QC system. QC systems are resource- intensive, and audit firms could incur significant costs to respond to certain provisions in QC 1000 or to otherwise adapt the QC system to the auditing environment for issuers and registered broker-dealers. Furthermore, as noted above, these costs would extend to PCAOB-registered firms providing audits to entities other than issuers and broker-dealers pursuant to SEC rules (including, but not limited to, certain investment advisers, pooled investment vehicles, security-based swap data repositories, and clearing agencies), which may have an indirect impact on such other entities.

The Board also acknowledges that the Amendments could disproportionately affect smaller firms and cause some firms to exit the public company audit market or deter other firms from future entry. Entry deterrence could be exacerbated by the fact that being registered with the PCAOB will subject firms to certain QC requirements even if they do not perform engagements. Nevertheless, the Board states that it does not expect the effects on smaller firms to be significant. The Board expressed the view that QC 1000 shares a basic structure and approach with ISQM 1 and SQMS 1, so designing for the incremental features unique to QC 1000 should not be unduly burdensome for firms that are subject to either or both of those Other QC standards.

We agree that implementation costs could be disproportionately greater for smaller audit firms than for larger audit firms. The cost of implementing QC 1000 depends in significant part on the degree to which auditors' existing QC systems already comply with QC 1000 requirements. PCAOB-registered, but not inspected, audit firms that decide to comply with the design portions of QC 1000 will incur the design costs. This could, as discussed above in Section III.A, place these firms in a better position to compete for work participating in audits of issuers or registered broker-dealers at a level below that of a “substantial role.” This could also position these firms to expand their business into audits of SEC-registered issuers and broker-dealers, but these firms would incur additional implementation and operation costs to do so. Alternatively, these firms could choose to avoid the design costs by withdrawing from PCAOB registration given that they are not required to be registered with the PCAOB; however, we note that this withdrawal would not impact these firms' eligibility to compete for work participating in audits of issuers or registered broker-dealers at a level below that of a “substantial role.” The impact of QC 1000 implementation and operation costs on an audit firm will also depend on the audit firm's ability to absorb those costs or pass them onto their clients ( i.e., higher audit fees). Smaller audit firms may be disproportionally vulnerable to implementation costs, because smaller firms will distribute their fixed implementation costs over a smaller number of engagements, thus resulting in a higher average implementation cost per engagement. By contrast, larger PCAOB audit firms, especially those that already have extensive QC systems in place, may benefit from economies of scale or scope when incorporating the new requirements into their existing systems, which would in turn reduce their cost of implementing and operating QC 1000 per engagement. Conversely, larger audit firms are likely to have more complex clients and more diverse client portfolios, which could require higher implementation costs for an effective QC system.

The Commission also received several comments expressing concern that the EQCF requirement, in particular, would be costly or difficult to fulfill, especially for firms that audit between 100 and 500 issuers. One commenter stated that the proposed EQCF role is “vastly different” from the role that the PCAOB proposed in 2022 and asserted that the economic analysis in the Adopting Release “does not provide substantive analysis to justify the costs, benefits and unintended consequences.” Another commenter stated the EQCF requirement would involve “significant additional internal and external costs arising from (1) entering into a new arrangements [sic] with the same or other individuals who are determined to have sufficient competence for the specific role and who satisfy the rule as adopted, (2) sufficiently compensating individuals fulfilling the EQCF role for their time and potential liability, and (3) the additional resources needed for the firm to enable the EQCF to perform the required duties.” This commenter added that these costs would be passed on to issuers (and ultimately investors).

The PCAOB's economic analysis considered the economic implications of the EQCF requirement. The Board states that all U.S. GNFs indicate, as of the 2020 inspection cycle, they already have a governance structure that includes a non-employee, suggesting that, in contrast to commenters' assertions, the costs (as well as the benefits) of this requirement could be attenuated. In addition, in response to comments critiquing the Board's analysis of the EQCF requirement, the Board provided in the PCAOB response letter additional data from the U.K., as the independent non-executive (“INE”) role for audit firms in the U.K. is partially analogous to the EQCF. The Board reports that, according to transparency reports from six large U.K. audit firms, total per firm compensation for individual INEs ranged from roughly $80,000 to $400,000 in 2023.

The Board has scaled the EQCF requirement to apply to only 13 of the PCAOB-registered firms, namely those that issued audit reports for more than 100 issuers as of 2023. Scaling the EQCF requirement in this way, while reducing the benefits, significantly mitigates concerns regarding competition in the audit market. Further, the incremental demand for qualified individuals would be relatively small compared to the available supply, further limiting potential costs to compensate individuals performing the EQCF role.

In addition, as discussed in Section III.B above, the Amendments provide firms with significant flexibility to implement the EQCF requirement in a manner that suits their particular needs and circumstances. For example, the Amendments do not prescribe specific qualifications for the EQCF. Aside from the responsibility of evaluating the significant judgments made and the related conclusions reached by the firm on the effectiveness of its QC system, firms can determine the appropriate scope, responsibilities, and qualifications for the EQCF based on their existing governance structures and the complexity of their QC systems. This flexibility will allow firms to integrate the EQCF into their current practices without the need for significant restructuring or additional resources, thereby minimizing the financial and operational burden of compliance. In addition, the flexibility of the QC 1000 standard will allow firms to focus on addressing their unique risks and challenges, reducing the potential for duplicative efforts or unnecessary expenditures.

Relatedly, some commenters noted that, because certain provisions of the Amendments, such as the EQCF requirement, have a 100-issuer threshold, this threshold could deter triennially inspected firms from accepting new public company audit engagements or cause firms to feel compelled to consider reducing their issuer count to avoid crossing the 100-issuer threshold. We acknowledge this possibility, but for the reasons discussed below, we believe its economic effect is likely modest, as there is a limited number of firms near the 100-issuer threshold. PCAOB staff analysis of audit reports included in SEC filings identified that, during the 2022 calendar year, only two NAFs audited between 80 and 100 issuers and only two NAFs audited between 100 and 120 issuers. In addition, as discussed above, the Amendments provide firms with significant flexibility to implement the EQCF requirement, which should help to mitigate costs associated with this requirement and thus any potential incentives for firms near the 100-issuer threshold to alter their audit engagement practices.

Several commenters on the Proposing Release expressed the concern that competition in the audit market will be adversely impacted by the requirements. One commenter stated that the incremental requirements of QC 1000 relative to Other QC Standards could lead smaller high-quality firms to exit the market. One commenter said that the certification requirement would be an especially significant driver of exit, particularly for smaller firms. Some commenters suggested that the design-only requirement could lead those firms to deregister with the PCAOB or create a barrier to entry. One commenter added that the design-only requirement could impact audit markets beyond the United States by creating a disincentive for foreign firms to serve specific audit markets. One commenter also noted that QC 1000 requirements may serve as an impediment to audit firm mergers and acquisitions and otherwise perturb market activity.

We agree that the compliance costs associated with the QC 1000 requirements could lead some firms to exit the public company audit market, thereby lessening competition in that market. However, as discussed above, many firms already are, or will be, subject to comparable standards and are unlikely to incur costs so substantial that they exit the public company audit market. Moreover, as also described above, the Amendments are targeted so that the largest firms, which would be less likely to exit the market, are the ones likely to incur the most significant costs. These factors considerably lessen the potential adverse impact on competition in the audit market.

D. Form QC Confidentiality

QC 1000 provides that a firm must report annually to the PCAOB on nonpublic Form QC, in accordance with the instructions to that form, the results of the evaluation of its QC system. The PCAOB explained in the Adopting Release that, although it recognized the desire of investors and other stakeholders for information related to audit quality and the effectiveness of QC systems, the Board's ability to require firms to publicly disclose their QC deficiencies is subject to certain legal constraints imposed by SOX as discussed in greater detail below.

One commenter stated that they are concerned that the confidentiality protections of Section 105(b)(5)(A) of SOX related to information provided to the PCAOB through inspection does not appear to apply to information reported through Form QC and stated that the PCAOB's response to this issue in the Adopting Release appears to acknowledge that it cannot guarantee the confidentiality it promised under the proposed rule. This commenter also suggested that any information required by QC 1000 should be submitted by firms to the PCAOB only through the inspections process to ensure that it would receive confidential treatment under SOX Section 105(b)(5)(A).

We believe these concerns are largely misplaced. Certain information contained within a Form QC may be subject to the protections of SOX Section 105(b)(5)(A), which addresses documents and information prepared or received by or specifically for the Board in connection with an inspection or investigation. Furthermore, in certain circumstances, remedial actions reported in Form QC may be subject to laws relating to the confidentiality of proprietary, personal, or other information, and in such a scenario, the Board, in accordance with SOX Section 102(e) would need to honor a firm's properly substantiated request for confidential treatment of such information. The PCAOB also adopted Rule 2203A(c), which provides that Form QC will be non-public, in light of the confidentiality provision that applies to quality control criticisms and potential defects identified during a PCAOB inspection in SOX Section 104(g)(2). To the extent that certain information contained within a Form QC meets the requirements of the statutory confidentiality protections described above, such protections would apply to that information to the same extent as any other information submitted to the PCAOB. We find such an approach to be appropriate in that it aligns the extent of the confidentiality of information in Form QC with the broader statutory framework created by Congress in SOX.

In response to this commenter's suggestion that any information required by QC 1000 should be submitted by firms to the PCAOB only through the inspections process, we believe that the information provided by Form QC, which in some cases would be provided more frequently than firms are inspected, would provide important information that could inform improvements in the PCAOB's standard-setting, economic and risk analysis, and registration program—separate and apart from the benefits of the PCAOB's inspection program which is focused on audit engagements. These improvements, in our view, would have concomitant benefits to audit quality and investors.

E. Evaluation Date

The Amendments require firms to evaluate their QC system annually as of September 30 and conclude whether any unremediated QC deficiencies exist as of that date. The PCAOB stated it believed an evaluation date of September 30 would provide firms with enough time to identify and potentially remediate any QC deficiencies identified from the most recent calendar year-end engagements, which might not be possible if an earlier date were selected. In addition, the PCAOB adjusted the specified evaluation date from the initially proposed date of November 30th to September 30th to address commenter concerns that the November 30th date would have caused potential resource limitations during the traditional busy period for many firms.

Commenters raised concerns with the specified quality control evaluation date of September 30th, citing concerns including that a fixed evaluation date may misalign the assessment of quality with employee or partner compensation to the extent firms have established compensation cycles that do not align with the September 30th date, as well as concerns regarding the timing of the inspection cycle potentially limiting the firms' ability to fully assess the impact of inspections in their QC evaluation. One commenter additionally raised a concern that a firm that already chose its evaluation date under ISQM 1 would be required to either change its ISQM 1 evaluation date or perform two QC system evaluations per year.

We agree with the PCAOB's conclusion that an evaluation date of September 30th would provide the audit firm with sufficient time to identify and potentially remediate QC deficiencies identified from the most recent calendar year-end engagements before the evaluation date. Given the ongoing nature of audits, which are driven by issuers' fiscal year-ends, firms' inspections cycles, and remediation activities, any fixed evaluation date will necessarily result in certain activities being split between QC evaluation years. The PCAOB's selected evaluation date of September 30 addressed the comments the PCAOB received on the proposal, as noted above, and we believe should provide time for a majority of inspections to be completed and considered in the same QC evaluation year. Moreover, including a specified evaluation date across firms provides for consistency and comparability of the firms' quality control reporting, which enhances the PCAOB's ability to assess and respond to firms' QC evaluations and thereby increases investor protection. We do not believe that firms that have already selected an evaluation date under Other QC standards would be required to perform two evaluations. First, QC 1000 allows firms to build on work already done, to the extent applicable, for the purpose of complying with the requirements of Other QC Standards. Second, firms are permitted to change their evaluation date under Other QC Standards so that the evaluation dates coincide.

F. Effective Date

As stated in the PCAOB's Adopting Release, QC 1000 and related amendments to auditing standards, rules, and forms will take effect on December 15, 2025. The PCAOB stated that it believes an effective date of December 15, 2025 strikes an appropriate balance between the benefits to investors of having QC 1000 take effect as promptly as practicable, and allowing sufficient time for firms to design and implement robust, QC 1000-compliant QC systems.

General

Commenters expressed concerns that the effective date would not provide firms with sufficient time to implement the new standard, with one commenter suggesting the Commission require the PCAOB to extend the implementation deadline. Another commenter stated that the PCAOB should have reopened the comment period for the Amendments to allow for additional comments on a reasonable effective date in light of the PCAOB's other recently proposed or adopted standards and rules.

The PCAOB response letter reaffirms the Board's view stated above that the effective date of December 31, 2025 strikes a reasonable balance between providing firms with sufficient time and promptly delivering the benefits to investors. The PCAOB acknowledged that, subject to adoption by the PCAOB and approval by the Commission, several PCAOB standards and rules could come into effect over the next few years, and that the relevant audit labor market may be relatively inelastic in the short run. However, the PCAOB explained that implementing multiple PCAOB standards and rules in quick succession could potentially reduce the incremental costs attributable to each change in requirements, if, for example, firms were able to more efficiently implement certain systems or training on an integrated basis, addressing multiple new requirements simultaneously. We understand that the PCAOB took into consideration its full standard-setting and rulemaking agenda when selecting the effective date.

In our view, December 15, 2025, is a reasonable effective date for the Amendments. Commenters on the Proposing Release, which specified an effective date of December 31, 2024, suggested a variety of alternatives, including several that suggested December 31, 2025 or 12 to 18 months after SEC approval. The PCAOB took this feedback into consideration when it revised the effective date to December 15, 2025. Significantly, this date aligns with the implementation date of the AICPA's SQMS 1 QC standard, which will be required for all U.S. audit firms that issue reports under AICPA standards, and which shares a basic structure with QC 1000. As a consequence, aligning the effective date of QC 1000 with SQMS 1 may reduce implementation costs for U.S. firms that are required to implement both. With respect to the commenter's concerns about the effective date as it relates to the EQCF requirement, we note that the PCAOB considered the implementation requirements of the EQCF in determining the appropriate effective date for QC 1000. Finally, with respect to the commenter's concerns about sufficient time being provided for the general implementation of other recently proposed and effective PCAOB standards, we acknowledge there are instances where more than one standard becomes effective within a six-month period; however, we think the effective dates are sufficiently staggered such that audit firms will have either already implemented, or largely implemented, some of the standards referenced by the commenter or will have sufficient time to do so before compliance with the Amendments is required.

EQCF Considerations

One commenter raised concerns with the effective date specific to the EQCF requirement, stating that the approximately 18-month time period would not provide sufficient time to identify, vet, contract and onboard an EQCF.

The external oversight requirement was included in the standard that the PCAOB proposed for comment. While the PCAOB made some changes to the proposed requirement in response to commenters, such as providing additional specificity and clarity about the role, the changes made did not impact many of the fundamental requirements for the role such as the requirement for the individual or individuals filling the role to be able to exercise independent judgment with regard to matters related to the QC system, the requirement for one or more individuals to fill the role, and the significant flexibility provided to audit firms to design procedures that work best for their individual firm governance structure and requirements. We believe such changes should not have a significant impact on the timeline for firms to complete the hiring process for an EQCF, such that an extended effective date would be necessary (nor does the commenter explain why this would be so). We thus conclude the effective date as adopted is appropriate.

G. Other Comments

One commenter stated that the PCAOB's comment period for the Amendments was inadequate, or should have been reopened, in light of other Board proposals. A few commenters stated that if the Amendments are approved, PCAOB engagement with firms during the implementation period is necessary. Several commenters encouraged the PCAOB to undertake a post-implementation review of the Amendments or provide implementation guidance.

We acknowledge the importance of monitoring the implementation of the Amendments, prior and subsequent to their effective date. The PCAOB response letter states that the Board anticipates its staff will issue implementation guidance and will engage in other activities to support firms' implementation efforts. Further, the Commission staff works closely with the PCAOB as part of our general oversight mandate. As part of that oversight, Commission staff will keep apprised of the PCAOB's activities for monitoring the implementation of the Amendments, prior and subsequent to the effective date, and update the Commission, as necessary and appropriate. Finally, as discussed above regarding notice and comment considerations around the EQCF requirement, we believe 75 days was an appropriate period for commenters to provide feedback on the Proposing Release and note that, consistent with typical practice, the Board did not limit its consideration of comments to those received during its designated comment period but effectively provided for a longer comment period by considering all comments it received prior to the date of adoption.

Some commenters reiterated comments made on the Concept Release and Proposing Release, including: concerns regarding the requirement that only one person be assigned operational responsibility for the firm's compliance with ethics and independence requirements; a belief that the Amendments are too prescriptive, especially in regards to the specified quality responses; disagreement that all engagement deficiencies require remediation; concerns that the Amendments differ from Other QC Standards and will require firms to have multiple QC systems; and a request that smaller firms ( e.g., triennially inspected firms that issue 100 or fewer issuer audit reports) be provided with the option to comply with ISQM 1 or SQMS 1 as an acceptable alternative to QC 1000.

We acknowledge commenters concerns with these specific aspects of the Amendments and note that the PCAOB considered and addressed all of these matters in the Adopting Release. On balance, we find that the Amendments strike an appropriate balance between specified mandates to enhance the effectiveness of its QC systems and to ensure they are designed and operated with an appropriate level of rigor, and providing appropriate flexibility to tailor such systems to the specific risks associated with the firm's practice or organizational structure. Further, we do not believe that the Amendments will require firms to maintain multiple systems of quality control. We find that QC 1000 shares the same basic structure as and is consistent with Other QC Standards and firms are able to build upon the work performed for Other QC Standards to implement incremental requirements from QC 1000. Neither we nor any commenters identified anything in QC 1000 that is incompatible with ISQM 1 or SQMS1. At least one registered public accounting firm has recently noted that the evolution of its system of quality management and its implementation of ISQM 1 has positioned the firm well to adapt to future regulatory developments, such as the quality control standard proposed by the PCAOB in November 2022.

One commenter stated that the PCAOB response letter “addresses and provides additional clarity” on several of the questions it raised in the comment letter it submitted to the Commission, and the commenter asked the Commission to clarify whether the PCAOB response letter “can be viewed as equally authoritative as the Final Standard and Adopting Release.” We view the statements in the PCAOB response letter as being on par with statements made by the Board in the Adopting Release about the scope and application of the QC 1000 requirements.

Additionally, there were requests for clarification regarding the definitions of “applicable professional and legal requirements,” “other participants,” “QC deficiency,” and “firm personnel” and how various requirements of the Amendments apply to non-employee professionals and organizations. These definitions and the question about non-employee professionals and organizations were addressed in the Adopting Release, and to the extent additional clarity is needed, we note that the Board stated in the PCAOB response letter that it anticipates that its staff will issue implementation guidance and will engage in other activities to support firms' implementation efforts.

IV. Effect on Emerging Growth Companies

In the Notice of Filing of Proposed Rules, the Board recommended that the Commission determine that the Amendments apply to audits of EGCs. Section 103(a)(3)(C) of SOX requires that any rules of the Board requiring mandatory audit firm rotation or a supplement to the auditor's report in which the auditor would be required to provide additional information about the audit and the financial statements of the issuer (auditor discussion and analysis) shall not apply to an audit of an EGC. The provisions of the Amendments do not fall into these categories.

Section 103(a)(3)(C) further provides that “[a]ny additional rules” adopted by the PCAOB after April 5, 2012 do not apply to audits of EGCs “unless the Commission determines that the application of such additional requirements is necessary or appropriate in the public interest, after considering the protection of investors and whether the action will promote efficiency, competition, and capital formation.” The Amendments fall within this category. Having considered those statutory factors, we find that applying the Amendments to the audits of EGCs is necessary or appropriate in the public interest.

With respect to the Commission's determination of whether the Amendments will apply to audits of EGCs, the PCAOB provided data and analysis of EGCs identified by the Board's staff from public sources that sets forth its views as to why the Amendments should apply to audits of EGCs.

The Board states that the discussion of economic impacts of the QC 1000 requirements is generally applicable to the audits of EGCs. The benefits to financial reporting quality, including improved efficiency of capital allocation, lower cost of capital, and enhanced capital formation, are also pertinent to EGCs. The Board states that EGCs tend to be smaller and have a shorter SEC financial reporting history than the broader population of issuers. The Board cites to academic research that suggests that, for several reasons, smaller issuers tend to exhibit greater information asymmetry between management and investors. Also, PCAOB staff gathered information on Part I.A deficiencies for the audits of EGCs between 2013 and 2022, and these data suggest that Part I.A deficiencies are more common among audits of EGCs, raising questions about whether QC systems of firms that audit EGCs are effective in preventing audit deficiencies for these types of audit engagements. We agree that the benefits of the QC 1000 requirements are also relevant to EGCs.

The Board acknowledges that to the extent the compliance costs associated with the QC 1000 requirements lead some smaller audit firms, such as some NAFs, to exit the public company audit market, then EGCs could be adversely impacted. PCAOB staff analysis indicates that, compared to exchange-listed non-EGCs, exchange-listed EGCs are approximately 2.6 times as likely to be audited by an NAF.

The Board presents evidence that a large number of audit firms, including smaller audit firms, serve EGCs. PCAOB staff analysis indicates that, as of November 15, 2022, there were 3,031 companies that self-identified as EGCs and filed audited financial statements with the Commission between May 16, 2021, and November 15, 2022. Of the 263 registered firms that audited EGCs, 227 firms (or 86%) performed audits for both EGC and non-EGC issuers. Approximately 98% of EGCs were audited by these 227 firms. These data suggest that the impact on EGCs of any exit by some smaller audit firms, as a result of the requirements, would likely be limited. For this reason, we expect that any potential adverse impact on EGCs and their ability to be competitive in their product markets will be modest.

In addition, the Board sought public input on the application of the Amendments to the audits of EGCs. Those commenters that responded to the Board agreed the Amendments should apply to the audits of EGCs. In the Adopting Release, the Board explained that, in general, any new PCAOB standards and amendments to existing standards determined not to apply to the audits of EGCs would require auditors to address differing requirements within their methodologies or policies and procedures with respect to audits of EGCs and non-EGCs, which would create the potential for confusion. The Board further stated this may not be practical in the context of the QC standards because while some components of the QC system (such as engagement monitoring) may enable different approaches for audits of EGCs compared to audits of other companies, other elements (for example, resources and governance and leadership) are necessarily firm-wide and cannot easily be differentiated for different types of audits. The Board further stated that even where differentiation is possible, maintaining separate components for EGC and non-EGC audits may add cost or lead to confusion, and could run counter to the objective of integrating QC practices into a single continuous cycle of risk assessment, monitoring, and remediation.

In addition, the Board stated that the benefits of the higher audit quality resulting from the Amendments may be more pertinent for EGCs than for non-EGCs, including improved efficiency of market capital allocation, lower cost of capital, and enhanced capital formation. The Amendments are expected to enhance audit quality and contribute to an increase in the credibility of financial reporting by EGCs, which are newer to the capital markets than typical non-EGCs.

We agree with the Board's analysis and further emphasize the benefits discussed by the PCAOB, including higher audit quality leading to improved efficiency of capital allocation, lower cost of capital, and enhanced capital formation with respect to EGCs. As noted above, these improvements in the quality of the audit may be more pronounced on the audits of EGCs. While improvements in audit quality benefit all investors, such improvements may particularly benefit investors in EGCs by increasing the credibility of their financial reporting given that they are typically newer to the capital markets and feature a higher degree of information asymmetry between management and investors. Improvements in audit quality provide investors with more accurate information, which helps them make more informed investment decisions. More accurate information in financial statements may also increase investors' confidence and, in turn, facilitate capital formation.

To the extent that an EGC's auditor's existing quality control standards do not meet the requirements under QC 1000 and the changes that auditors make to their quality control system impact the performance of audit engagements, this could lead to a spillover externality effect whereby EGCs themselves may have to incur additional costs. For example, an EGC could have to allocate more resources to its own internal control systems or to additional requests for more extensive or additional evidence from audit firms. While this could be costly to the EGC, enhanced internal control over financial reporting at the EGC and audits that are performed in compliance with applicable professional standards are expected to also benefit investors. Audit firms may also raise audit fees for EGCs as a result of implementing QC 1000. Higher audit-related costs, in the form of EGCs' costs to support the audit and/or in fees paid to auditors, would in turn raise EGCs' overall costs and possibly adversely impact their ability to be competitive in the product markets that they operate. These potential costs to EGCs will be reduced to the extent EGC auditors will already be required to comply with the Other QC Standards or may choose not to pass on their incremental costs arising from the QC 1000 requirements in the form of higher audit fees. As discussed above, Commission analysis shows that approximately 88% of registered firms performing PCAOB engagements will, by the effective date of QC 1000, already be subject to quality control requirements that share a basic structure with the requirements in QC 1000. PCAOB staff analysis also shows that approximately 98% of EGCs were audited by firms that performed audits for both EGC and non-EGC issuers. Therefore, for 98% of EGCs being audited, there likely would be minimal incremental costs for QC 1000 to apply to EGCs, either due to their auditor implementing QC 1000, as required to audit its other issuers, or implementing the Other QC Standards.

Accordingly, after considering the protection of investors and whether the action will promote efficiency, competition, and capital formation, we believe there is a sufficient basis to determine that applying the Amendments to the audits of EGCs is necessary or appropriate in the public interest.

V. Conclusion

The Commission has reviewed and considered the Amendments, the information submitted therewith by the PCAOB, the comment letters received, and the recommendation of the Commission's staff. The Commission concludes that the determinations made by the PCAOB as described in the Adopting Release are reasonable. Generally, the Amendments establish an integrated, risk-based quality control standard that can be applied by firms of varying sizes and complexities and that will lead registered public accounting firms to significantly improve their quality control systems, thereby improving audit quality and investor protection. Specifically, the Amendments make the following important changes, among others, to the existing quality control standards, which will advance the Board's investor protection mandate under SOX:

• Replace the current standards, which: (i) were developed by the AICPA, a professional organization for certified public accountants; (ii) were last updated in 1997; (iii) focus on evaluating firms' compliance with their own policies; (iv) do not require evaluation or reporting; and (v) do not contain express obligations for firms to perform any specific monitoring;
• Incorporate a risk-based approach to quality control, driving firms to proactively identify and manage the specific risks associated with their practices, along with a set of mandates, tailored to the size of the audit practice, which should assure that the quality control system is designed, implemented, and operated with an appropriate level of rigor;
• Emphasize the importance of accountability and firm governance through requirements around roles and responsibilities, assigning operational responsibility to individuals for particular aspects of the QC system, and the introduction of a certification by certain responsible individuals; and
• Create a framework for evaluation and reporting to the PCOAB which will be consistently applied across all firms operating a QC system under QC 1000.

Therefore, in connection with the PCAOB's filing and the Commission's review,

A. The Commission finds that the Amendments are consistent with the requirements of Title I of SOX and the rules and regulations thereunder and are necessary or appropriate in the public interest or for the protection of investors; and

B. Separately, the Commission finds that the application of the Amendments to the audits of EGCs is necessary or appropriate in the public interest, after considering the protection of investors and whether the action will promote efficiency, competition, and capital formation.

It is therefore ordered, pursuant to section 107 of SOX and section 19(b)(2) of the Exchange Act, that the Amendments (File No. PCAOB-2024-02) be and hereby are approved.

[FR Doc. 2024-20714 Filed 9-11-24; 8:45 am]

BILLING CODE 8011-01-P