A PDF version of the full publication is attached here: PCAOB adopts foundational and quality control standards (PDF kb)

On May 13, the PCAOB adopted two new standards and related amendments to PCAOB standards, rules, and forms.

AS 1000 emphasizes the auditor’s fundamental obligation to protect investors through the preparation and issuance of an informative, accurate, and independent auditor’s report. The standard states in its first paragraph that this responsibility transcends the auditor’s relationship with management and the audit committee, providing the foundation for an objective and independent audit.

AS 1000 and related amendments modernize, clarify, and streamline the general principles and responsibilities of auditors. They replace and reorganize five standards adopted by the Board on an interim basis in 2003. The new standard and amendments:

The changes to AS 2810 are not intended to change the auditor’s existing responsibilities for the evaluation of whether the financial statements are presented in conformity with the applicable financial reporting framework.

Amendments to AS 1215, Audit Documentation, accelerate the requirement for documentation completion from 45 days to 14 days.

Effective QC systems are crucial for supporting the consistent performance of quality audits and other engagements under PCAOB standards. The Board’s existing QC standards were issued by the AICPA before the PCAOB was established. The auditing environment has changed significantly since that time, including evolving and greater use of technology, and increasing auditor use of outside resources, including other firms and providers of support services. Firms themselves have also changed significantly, as has the role of firm networks.

QC 1000 is a risk-based standard that includes establishing quality objectives, identifying and assessing quality risks, designing and implementing quality responses to address the quality risks, and monitoring the firm’s QC system. It encourages an ongoing feedback loop to drive continuous improvement of the QC system.

All registered firms will be required to design a compliant QC system, including those that do not currently perform engagements under PCAOB standards. Firms that perform or have responsibilities with respect to engagements under PCAOB standards – for example, audits of issuers or broker-dealers – will be required to implement and operate their QC systems.

The adopting release highlights the following improvements from existing QC standards:

QC 1000 designates the firm’s principal executive officer as ultimately responsible and accountable for the QC system as a whole. The firm must also assign other roles and responsibilities, including one individual who is operationally responsible and accountable. The individuals responsible and accountable are required to certify the firm’s evaluation of the effectiveness of the QC system on a confidential report to the PCAOB annually.

The firm will be required to conclude whether its QC system is: (1) effective with no unremediated deficiencies; (2) effective, except for one or more unremediated QC deficiencies that are not major QC deficiencies; or (3) not effective (i.e., one or more major QC deficiencies exist). If unremediated QC deficiencies exist, the firm would be required to describe them and summarize remedial actions taken or planned to be taken.

The PCAOB notes the data will inform its inspections process, including decisions about the selection of firms, engagements, and focus areas, to focus on firms and engagements with the greatest risk.

QC 1000 takes a principles-based approach to firm communications about matters of audit quality. Public reporting requirements, including in relation to firm and engagement level metrics, have been separately proposed. ¹

QC 1000 includes a requirement for larger audit firms (those that issue more than 100 issuer reports annually) to incorporate an external oversight function in their governance structures. Referred to as the “external quality control function” (EQCF), it is required to be composed of one or more persons who are not principals or employees of the firm and do not otherwise have a relationship with the firm that would interfere with the exercise of independent judgment on the QC system. The EQCF should have the experience, competence, authority, and time necessary to carry out its responsibilities. At a minimum, these responsibilities include evaluating significant judgments made and related conclusions reached by the firm when evaluating and reporting on the effectiveness of its QC system. The specificity of this role goes beyond what was proposed during the PCAOB’s notice and comment process. For example, the nature and expectations for the role relative to the firm’s QC system is new as are statements about the individuals in this role being subject to supervisory liability under SOX. We observe that these new requirements seemingly create conflicts with provisions in SOX that, for example, afford confidentiality to information that would necessarily be part of any review and conclusions about the effectiveness of a firm’s QC system.

Although QC 1000 has commonalities with other international ² and domestic ³ standards for firm QC systems that allow for leveraging work performed to comply with those standards, it goes beyond those standards in certain areas (for example, evaluation and reporting requirements, roles and responsibilities).

The PCAOB filed the adopted standards with the SEC. They will then be published in the Federal Register for notice and comment for 21 days, after which time the SEC determines whether to approve or disapprove.

Commenters will have the opportunity to consider and address the requirements (including the new requirements for an EQCF) during the SEC’s notice and comment process as part of the SEC’s consideration of whether to approve the PCAOB’s new standard. PwC expects to issue comment letters to the SEC with questions and concerns regarding certain elements of the final standards.

Subject to approval by the SEC:

The PCAOB also recently updated its standard setting, research, and rulemaking agendas to reflect its recent progress and continued drive toward its strategic goal of modernizing its standards and rules.