Public Company Accounting Oversight Board; Order Granting Approval of QC 1000, A Firm's System of Quality Control, and Related Amendments to PCAOB Standards, Rules, and Forms, 74324-74347 [2024-20714]

Agencies

• SECURITIES AND EXCHANGE COMMISSION

[Federal Register Volume 89, Number 177 (Thursday, September 12, 2024)]
[Notices]
[Pages 74324-74347]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: 2024-20714]


-----------------------------------------------------------------------

SECURITIES AND EXCHANGE COMMISSION

[Release No. 34-100968; File No. PCAOB-2024-002]


Public Company Accounting Oversight Board; Order Granting 
Approval of QC 1000, A Firm's System of Quality Control, and Related 
Amendments to PCAOB Standards, Rules, and Forms

September 9, 2024.

I. Introduction

    On May 24, 2024, the Public Company Accounting Oversight Board (the 
``Board'' or the ``PCAOB'') filed with the Securities and Exchange 
Commission (the ``Commission''), pursuant to Section 107(b) \1\ of the 
Sarbanes-Oxley Act of 2002 (``SOX'') and Section 19(b) \2\ of the 
Securities Exchange Act of 1934 (the ``Exchange Act''), a proposal to 
adopt Quality Control (``QC'') 1000, A Firm's System of Quality Control 
(``QC 1000''), and supersede existing PCAOB QC standards; adopt EI 
1000, Integrity and Objectivity, and supersede existing ET 102, 
Integrity and Objectivity; and amend several other related existing 
auditing standards, rules, and forms (collectively, the 
``Amendments'').\3\
---------------------------------------------------------------------------

    \1\ 15 U.S.C. 7217(b).
    \2\ 15 U.S.C. 78s(b).
    \3\ See Public Company Accounting Oversight Board; Notice of 
Filing of Proposed Rules on A Firm's System of Quality Control and 
Related Amendments to PCAOB Standards, Release No. 34-100277 (June 
5, 2024) [89 FR 49588 (June 11, 2024)] (``Notice of Filing of 
Proposed Rules''), available at https://www.sec.gov/files/rules/pcaob/2024/34-100277.pdf.
---------------------------------------------------------------------------

    The Amendments were published for comment in the Federal Register 
on June 11, 2024.\4\ On July 1, 2024, the Commission extended the 
public comment period until July 16, 2024, and extended the date by 
which the Commission shall either approve or disapprove, or institute 
proceedings to determine whether to approve or disapprove, the 
Amendments to August

[[Page 74325]]

25, 2024.\5\ On August 13, 2024, the Commission further extended the 
date by which the Commission shall either approve or disapprove, or 
institute proceedings to determine whether to approve or disapprove, 
the Amendments to September 9, 2024.\6\ The Commission received over 20 
comment letters from the public regarding the Amendments and one 
response to comments from the PCAOB (``PCAOB response letter'').\7\ 
This order approves the Amendments, which we find to be consistent with 
the requirements of Title I of SOX and the rules and regulations issued 
thereunder and necessary or appropriate in the public interest or for 
the protection of investors.\8\ The Amendments and the Commission's 
findings with respect thereto are discussed in further detail below.
---------------------------------------------------------------------------

    \4\ Id.
    \5\ See Public Company Accounting Oversight Board; Extension of 
Comment and Approval Periods for Proposed Rules on General 
Responsibilities of the Auditor in Conducting an Audit and 
Amendments to PCAOB Standards and A Firm's System of Quality Control 
and Related Amendments to PCAOB Standards, Release No. 34-100451 
(July 1, 2024) [89 FR 55993 (July 8, 2024)], available at https://www.sec.gov/files/rules/pcaob/2024/34-100451.pdf.
    \6\ See Public Company Accounting Oversight Board; Extension of 
Approval Periods for Proposed Rules on A Firm's System of Quality 
Control and Related Amendments to PCAOB Standards, Proposed Rules on 
Amendments Related to Aspects of Designing and Performing Audit 
Procedures that Involve Technology-Assisted Analysis of Information 
in Electronic Form, and Proposed Rules on Amendment to PCAOB Rule 
3502 Governing Contributory Liability, Release No. 34-100724 (Aug. 
13, 2024) [89 FR 67117 (Aug. 23, 2024)], available at https://www.sec.gov/files/rules/pcaob/2024/34-100724.pdf.
    \7\ Copies of the comment letters received on the Commission 
notice of the Amendments are available on the Commission's website 
at https://www.sec.gov/comments/pcaob-2024-02/pcaob202402.htm.
    \8\ See Section 107(b)(4)(A)-(B) of SOX, 15 U.S.C. 
7217(b)(4)(A)-(B).
---------------------------------------------------------------------------

II. Description of the Amendments

    On May 13, 2024, the Board adopted the Amendments.\9\ The 
Amendments were preceded by a 2019 concept release,\10\ a proposal in 
November 2022,\11\ and other outreach engaged in by the PCAOB.\12\ QC 
1000 would replace current PCAOB QC standards that were developed 
decades ago by the American Institute of Certified Public Accountants 
(``AICPA''), before the PCAOB was established, and which were adopted 
by the Board on an interim, transitional basis in 2003.\13\
---------------------------------------------------------------------------

    \9\ See A Firm's System of Quality Control and Other Amendments 
to PCAOB Standards, Rules, and Forms, PCAOB Release No. 2024-005 
(May 13, 2024) (``Adopting Release''), available at https://assets.pcaobus.org/pcaob-dev/docs/default-source/rulemaking/docket046/2024-005-qc1000.pdf?sfvrsn=355bf24_2.
    \10\ See PCAOB, Concept Release: Potential Approach to Revisions 
to PCAOB Quality Control Standards (Dec. 17, 2019) (``Concept 
Release''), available at https://assets.pcaobus.org/pcaob-dev/docs/default-source/rulemaking/docket046/2019-003-quality-control-concept-release.pdf?sfvrsn=5856398d_0.
    \11\ See Proposed Quality Control Standard--A Firm's System of 
Quality Control and Other Proposed Amendments to PCAOB Standards, 
Rules, and Forms, PCAOB Release No. 2022-006 (Nov. 18, 2022) 
(``Proposing Release''), available at https://assets.pcaobus.org/pcaob-dev/docs/default-source/rulemaking/docket046/2022-006-qc.pdf?sfvrsn=b89546e2_4.
    \12\ See, e.g., Briefing Paper for the Standard Advisory Group 
(``SAG''), Quality Control: Governance and Leadership (Nov. 29, 
2018). The materials for the November 29, 2018 SAG meeting are 
available at https://pcaobus.org/news-events/events/event-details/standing-advisory-group-meeting_1137.
    \13\ See Establishment of Interim Professional Auditing 
Standards, PCAOB Release No. 2003-006 (Apr. 18, 2003), available at 
https://assets.pcaobus.org/pcaob-dev/docs/default-source/rulemaking/interim_standards/release2003-006.pdf?sfvrsn=2424c91_0; Order 
Regarding Section 103(A)(3)(B) of the Sarbanes-Oxley Act of 2002, 
Release No. 33-8222 (Apr. 25, 2003) [68 FR 23335 (May 1, 2003)] 
(Commission order approving PCAOB's interim standards). See infra 
note 32 for a discussion of the AICPA's new quality control 
standard, which will become effective on December 15, 2025.
---------------------------------------------------------------------------

    In the Notice of Filing of Proposed Rules, the PCAOB stated that it 
was proposing a new QC standard that it believes will lead registered 
public accounting firms to significantly improve their QC systems and 
thereby protect investors by facilitating the consistent preparation 
and issuance of informative, accurate, and independent audit 
reports.\14\ As described by the Board, QC 1000 is an integrated, risk-
based standard that mandates quality objectives and key processes for 
all firms' QC systems.\15\ While QC 1000 requires all public accounting 
firms that are registered with the PCAOB to design a QC system that 
meets the requirements of QC 1000, firms are only required to implement 
and operate the QC system in compliance with QC 1000 when they lead an 
engagement under PCAOB standards, play a substantial role in the 
preparation or furnishing of an audit report (as defined in PCAOB 
rules),\16\ or have current responsibilities under ``applicable 
professional and legal requirements'' \17\ regarding any such 
engagement.\18\
---------------------------------------------------------------------------

    \14\ See Adopting Release, supra note 9, at 5.
    \15\ Id.
    \16\ See PCAOB Rule 1001(p)(ii) (defining the phrase ``play a 
substantial role in the preparation or furnishing of an audit 
report'') and Rule 2100 (requiring each public accounting firm that 
(a) prepares or issues any audit report with respect to any issuer, 
broker, or dealer; or (b) plays a substantial role in the 
preparation or furnishing of an audit report with respect to any 
issuer, broker, or dealer to be registered with the Board).
    \17\ QC 1000 defines ``applicable professional and legal 
requirements'' as ``(1) Professional standards, as defined in PCAOB 
Rule 1001(p)(vi); (2) Rules of the PCAOB that are not professional 
standards; and (3) To the extent related to the obligations and 
responsibilities of accountants or auditors in the conduct of 
engagements or in relation to the QC system, rules of the SEC, other 
provisions of U.S. federal securities law, ethics laws and 
regulations, and other applicable statutory, regulatory, and other 
legal requirements.'' See QC 1000, Appendix A, .A2.
    \18\ Adopting Release, supra note 9, at 10. Circumstances where 
firms are only required to design a QC system that meets the 
requirements of QC 1000, but not implement or operate it, are 
sometimes referred to as being subject to the ``design-only 
requirement'' or ``design-only firms.''
---------------------------------------------------------------------------

    According to the Board, QC 1000 provides a framework for a QC 
system that is grounded in the ongoing practice of proactively 
identifying and managing risks to audit quality, with a feedback loop 
from ongoing monitoring, an explicit focus on firm governance and 
leadership, firm culture, and individual accountability, and specific 
direction in a number of areas the current PCAOB standards do not 
address.\19\ QC 1000 consists of two process components: (1) the firm's 
risk assessment process and (2) the monitoring and remediation 
process.\20\ It also consists of six components that address aspects of 
the firm's organization and operations: (1) governance and leadership; 
(2) ethics and independence; (3) acceptance and continuation of 
engagements; (4) engagement performance; (5) resources; and (6) 
information and communication.\21\ The risk assessment process applies 
to these six components, requiring firms to: (i) establish outcome-
based ``quality objectives,'' including those specified throughout the 
standard (i.e., the desired outcomes to be achieved by the firm with 
respect to that component); (ii) identify and assess ``quality risks'' 
to the quality objectives; (iii) design and implement ``quality 
responses'' (i.e., policies and procedures to address the quality 
risks); and (iv) establish policies and procedures to monitor internal 
and external changes that may require modifications to the quality 
objectives, quality risks, or quality responses.\22\ The monitoring and 
remediation process applies to all of the components of the QC system, 
including monitoring and remediation itself (i.e., firms are required 
to identify and remediate deficiencies that are observed in their 
monitoring and remediation activities).\23\
---------------------------------------------------------------------------

    \19\ Id. at 8.
    \20\ Id.
    \21\ Id.
    \22\ Id. at 40.
    \23\ Id.

---------------------------------------------------------------------------

[[Page 74326]]

    QC 1000 also requires an annual evaluation of the effectiveness of 
the QC system and reporting to the PCAOB on the QC system evaluation by 
the registered public accounting firm for any period in which it is 
required to implement and operate a QC system.\24\ The standard 
includes requirements regarding individual roles and responsibilities 
in the QC system and documentation requirements.\25\
---------------------------------------------------------------------------

    \24\ Id.
    \25\ Id. at 8.
---------------------------------------------------------------------------

    As noted above, firms are required to design and implement quality 
responses as part of the risk assessment process. Although QC 1000 
requires firms to design and implement their own quality responses to 
respond to their particular assessed quality risks, QC 1000 also 
includes some specified quality responses, which are mandatory for the 
firms to which they apply.\26\ Some specified quality responses carry 
requirements from current PCAOB standards into QC 1000 or provide new 
requirements that the PCAOB stated were important to a firm's QC 
system.\27\
---------------------------------------------------------------------------

    \26\ Id. at 42 (stating that the ``specified quality responses 
are not intended to be comprehensive'' and ``alone will not be 
sufficient to enable the firm to achieve all established quality 
objectives'').
    \27\ Id.
---------------------------------------------------------------------------

    For example, with respect to the governance and leadership 
component, QC 1000 includes a specified quality response that requires 
firms with larger PCAOB audit practices (firms that issue audit reports 
for more than 100 issuers in the prior calendar year) to adopt and 
implement an external quality control function (``EQCF'') that is 
composed of one or more persons who are not principals or employees of 
the firm and do not otherwise have a relationship with the firm that 
would interfere with the exercise of independent judgment with regard 
to matters related to the QC system.\28\ The EQCF is required to 
evaluate the significant judgments made and related conclusions reached 
by the firm when evaluating and reporting on the effectiveness of its 
QC system. Firms have flexibility in how the role is structured, 
depending on their governance structure or other factors. In addition, 
firms may, at their discretion, assign additional responsibilities to 
the EQCF and those could vary across firms.\29\ As noted above, the 
EQCF requirement only applies to firms that issue audit reports for 
more than 100 issuers in the prior calendar year, which currently is 13 
out of the approximately 1,600 PCAOB-registered firms.\30\ A number of 
these firms have stated publicly that they have independent 
representation in their governance structure or plan to add such a role 
in the near term.\31\ The EQCF role is discussed and analyzed in 
greater detail in Section III.B, below.
---------------------------------------------------------------------------

    \28\ Id. at 10.
    \29\ Id.
    \30\ The PCAOB response letter states that, as of 2023, the EQCF 
requirement would apply to 14 firms. See PCAOB response letter (Aug. 
16, 2024) at 3 & n.7. However, one of these 14 firms has since filed 
an application for withdrawal from registration with the PCAOB. See 
PCAOB, Registered Public Accounting Firms--Withdrawal Request 
Pending (Aug. 15, 2024), available at https://assets.pcaobus.org/pcaob-dev/docs/default-source/registration/firms/documents/withdrawal-requests.pdf?sfvrsn=d30aab29_459 (listing BF Borgers CPA 
PC among the firms that have filed a request for withdrawal from 
registration).
    \31\ See EY, How Our Independent Audit Quality Committee 
Strengthens Our Focus on Audit Quality (Feb. 20, 2023) (stating that 
EY's Independent Audit Quality Committee consists of three external 
senior leaders and ``provides independent advice to EY US senior 
leadership on all matters related to the Firm's system of quality 
control that affect audit quality, including its business, 
operations, culture, talent strategy, governance, and risk 
management''), available at https://www.ey.com/en_us/insights/assurance/independent-audit-quality-committee-strengthens-our-focus-on-audit-quality; KPMG LLP (US), KPMG U.S. Appoints Katrina Helmkamp 
and Harit Talwar to Serve on its U.S. Board (Jan. 8, 2024) (stating 
that it has three independent directors on its U.S. Board of 
Directors), available at https://kpmg.com/us/en/media/news/helmkamp-talwar-us-board-2024.html; KPMG US Announces Formation of 
Independent Audit Quality Advisory Committee to Build on the Success 
of Quality Initiatives (Aug. 28, 2024) (stating that the committee 
is responsible for advising KPMG on matters including ``the firm's 
efforts to meet new quality standards from regulatory bodies and 
respond to PCAOB inspections, including root cause analysis, and the 
design, development, implementation and measurement of strategic 
audit quality initiatives''), available at https://kpmg.com/us/en/media/news/kpmg-announces-iaqac-2024.html; Chris Johnson, Deloitte 
follows PwC in search for independent board members, Riotact (Apr. 
9, 2024) (stating that PWC Australia has announced plans to increase 
the number of independent directors to three on its nine-person 
board), available at https://the-riotact.com/deloitte-follows-pwc-in-search-for-independent-board-members/758971; Deloitte, Leadership 
and Governance (stating that the Deloitte Global Chair and Deputy 
Chair receive input from the Deloitte Global Independent Non-
Executive (INE) Advisory Council, which provides advice and insights 
on a variety of matters, including strategy, planning, public 
policy, quality, risk and regulatory matters, and broader 
stakeholder engagement), available at https://www.deloitte.com/global/en/about/story/purpose-values/leadership-governance.html; 
Grant Thornton, Audit Quality & Transparency Report 2022 (stating 
that its audit quality advisory council includes two independent 
council members and its purpose is to advise the board regarding 
ways to maintain and improve the firm's system of quality control in 
accordance with applicable professional legal standards), available 
at https://www.grantthornton.com/content/dam/grantthornton/website/assets/content-page-files/audit/pdfs/2023/audit-quality-transparency-report-2022.pdf; and BDO USA P.C., 2023 Audit Quality 
Report (stating that it has an ``Audit Quality Advisory Council'' 
comprised of five (5) members that includes two (2) Independent 
Council Members), available at ASSR-BDO-2023-Audit-Quality-Report-
web.pdf. See also infra note 112.
---------------------------------------------------------------------------

    The Board described the QC 1000 framework as having commonalities 
with other international and domestic standards for firm QC systems, 
though it goes beyond those requirements in some areas.\32\ QC 1000, 
ISQM 1, and SQMS 1 (the latter two collectively, the ``Other QC 
Standards'') \33\ share the same basic framework, with the same eight 
components and risk-based approach to quality control.\34\ Both QC 1000 
and the Other QC Standards include requirements to design, implement, 
and operate specified quality objectives, risks, and responses on an 
annual basis; \35\ and specify structures of governance, including 
requiring the assignment of individuals to the same specified 
roles.\36\ A discussion of the similarities and differences between QC 
1000 and the Other QC Standards is included below in Section III.
---------------------------------------------------------------------------

    \32\ Adopting Release, supra note 9, at 7. The International 
Auditing and Assurance Standards Board (``IAASB'') released a suite 
of new quality management standards, including ISQM 1, which became 
effective on December 15, 2022. ISQM 1 is the international quality 
control standard and it applies to firms that perform audits of 
companies (non-SEC registrants) in jurisdictions that have adopted 
IAASB standards. See IAASB Fact Sheet, Introduction to ISQM 1, 
Quality Management for Firms that Perform Audits or Reviews of 
Financial Statements, or Other Assurance or Related Engagements 
(Dec. 2020) (``ISQM 1''), available at https://www.ifac.org/_flysystem/azure-private/publications/files/IAASB-ISQM-1-Fact-Sheet.pdf. In May 2022, the Auditing Standards Board of the AICPA 
adopted new quality management standards, including Statement of 
Quality Management Standards No. 1, A Firm's System of Quality 
Management (``SQMS 1''), which will become effective on December 15, 
2025. SQMS 1 applies to accounting firms in the United States that 
perform audits under generally accepted auditing standards 
(``GAAS'') for non-issuers. See AICPA Statement on Quality 
Management Standards No. 1 (June 2022), available at https://www.aicpa-cima.com/resources/download/aicpa-statement-on-quality-management-standards-no-1.
    \33\ ISQM 1 and SQMS 1 are substantially similar to each other.
    \34\ See, e.g., QC 1000.02-03; ISQM 1.06; and SQMS 1.07.
    \35\ Id.
    \36\ See, e.g., QC 1000.12; SQMS 1.21; and ISQM 1.20. All three 
standards require assignment of individuals to three roles of 
operational responsibility that are substantively the same. QC 
1000.12 requires assignment of operational responsibility for: (1) 
the QC system as a whole, (2) compliance with ethics and 
independence requirements, and (3) the monitoring and remediation 
process. SQMS 1.21 and ISQM 1.20 require assignment of operational 
responsibility for: (1) the system of quality management, (2) 
compliance with independence requirements, and (3) monitoring and 
remediation process.
---------------------------------------------------------------------------

    The Amendments also include expanding the auditor's responsibility 
to respond to deficiencies on completed engagements under an amended 
and retitled AS 2901, Responding to Engagement Deficiencies After 
Issuance of the Auditor's Report. These changes would extend the scope 
of AS 2901 to cover engagement deficiencies in audits

[[Page 74327]]

of internal control over financial reporting, incorporate the concepts 
and terminology introduced in QC 1000, and bring the standard into 
alignment with the auditor's existing responsibility to obtain 
sufficient appropriate audit evidence to support the opinion.\37\ The 
changes also include related amendments to AT No. 1, Examination 
Engagements Regarding Compliance Reports of Brokers and Dealers, and AT 
No. 2, Review Engagements Regarding Exemption Reports of Brokers and 
Dealers, which would prompt auditors of registered brokers-dealers to 
take appropriate action if they discover that the opinion or conclusion 
in a previously issued attestation report was not supported.\38\ 
Finally, the Amendments replace existing standard ET 102, Integrity and 
Objectivity, with a new standard, EI 1000, Integrity and Objectivity, 
to better align PCAOB ethics requirements with the scope, approach, and 
terminology of QC 1000.\39\
---------------------------------------------------------------------------

    \37\ See AS 2901, as amended.
    \38\ See AT No. 1 and AT No. 2, as amended.
    \39\ See EI 1000.
---------------------------------------------------------------------------

    The Amendments will be effective on December 15, 2025. The first 
annual evaluation period will cover the period beginning on the 
effective date of the standard (i.e., December 15, 2025) and ending on 
September 30, 2026. Subsequent evaluation periods will cover the 12-
month period ending on September 30. The PCAOB has proposed application 
of the Amendments to include audits of emerging growth companies 
(``EGCs''),\40\ as discussed in Section IV below.
---------------------------------------------------------------------------

    \40\ The term ``emerging growth company'' is defined in Section 
3(a)(80) of the Exchange Act (15 U.S.C. 78c(a)(80)). See also 
Inflation Adjustments under Titles I and III of the JOBS Act, 
Release No. 33-11098 (Sept. 9, 2022) [87 FR 57394 (Sept. 20, 2022)], 
available at https://www.sec.gov/files/rules/final/2022/33-11098.pdf.
---------------------------------------------------------------------------

III. Discussion and Commission Findings

    The Commission continues to observe concerning indications that 
registered firms' QC systems are inadequate to ensure the high level of 
audit quality necessary for investor protection. Recent PCAOB 
inspection reports indicate that inspection deficiency rates are 
continuing to rise, with 46% of the engagements reviewed in 2023 having 
at least one Part I.A deficiency,\41\ compared to 40% in 2022 and 34% 
in 2021.\42\ While PCAOB inspection deficiency rates are not the only 
measure of audit quality and cannot necessarily be generalized to all 
PCAOB audits, these high deficiency rates place investors in harm's 
way. Effective QC systems provide firms with reasonable assurance that 
their audit engagements will be performed in compliance with applicable 
legal and professional requirements. The continuing rise in deficiency 
rates supports the need for the Amendments as they would enhance 
registered audit firms' QC systems to help ensure firms are able to 
perform their gatekeeper function, which is critical to investor 
protection and the functioning of our capital markets.
---------------------------------------------------------------------------

    \41\ See PCAOB Posts 2023 Annual Inspection Reports Alongside 
Staff Observations and New Charts To Boost Transparency, available 
at https://pcaobus.org/news-events/news-releases/news-release-detail/pcaob-posts-2023-annual-inspection-reports-alongside-staff-observations-new-charts-to-boost-transparency.
    \42\ See Spotlight Staff Update and Preview of 2022 Inspection 
Observations (July 2023), available at https://assets.pcaobus.org/pcaob-dev/docs/default-source/documents/spotlight-staff-preview-2022-inspection-observations.pdf (pcaobus.org). Figures exclude 
registered broker-dealer audits in all periods.
---------------------------------------------------------------------------

    As noted above, in response to the Notice of Filing of Proposed 
Rules, to date the Commission has received over 20 comment letters from 
the public and one response to comments from the PCAOB.\43\ Several 
commenters expressed support for the Amendments, stating that they 
would improve upon existing standards and lead to better protection of 
investors.\44\ For example, one commenter stated that the Amendments 
``would better protect the interests of investors, consistent with the 
mandate set forth in SOX.'' \45\ Similarly, another commenter stated 
that it expected the Amendments ``will enhance the quality of audits, 
raising the level of trust and confidence investors can place in the 
accuracy and reliability of public company financial disclosures.'' 
\46\ This commenter also stated that ``[c]urrent quality control 
systems at many firms are not achieving an even minimally acceptable 
level of audit quality, let alone the high level of audit quality that 
investors have a right to expect and on which the reliability of our 
financial reporting system depends.'' \47\ Another commenter stated 
that ``the PCAOB has done a good job of articulating why the 
improvements to the Quality Control Standards are warranted.'' \48\ One 
commenter stated that it ``strongly supported'' the Amendments, 
highlighting requests by the investor community over the years to 
update ``outdated quality control standards'' that were written in a 
pre-SOX era when the profession was self-regulated.\49\ This commenter 
stated that many areas of the PCAOB's existing QC standards have not 
been updated to reflect fundamental changes in the profession.\50\ Some 
commenters who supported the proposal also stated that they did not 
believe the requirements in the Amendments went far enough.\51\
---------------------------------------------------------------------------

    \43\ See supra note 7.
    \44\ See, e.g., letters from American Federation of Labor and 
Congress of Industrial Organizations (July 1, 2024) (``AFL-CIO''); 
Better Markets (July 2, 2024) (``Better Markets''); Sherrod Brown, 
Chairman, U.S. Senate Committee on Banking, Housing, and Urban 
Affairs (Aug. 15, 2024) (``S. Brown''); CFA Institute (July 1, 2024) 
(``CFA Institute''); Jack Ciesielski, CPA (July 2, 2024) (``J. 
Ciesielski''); Consumer Federation of America (July 1, 2024) 
(``Consumer Federation of America''); Robert A. Conway, CPA (June 
26, 2024) (``R. Conway''); Council of Institutional Investors (June 
27, 2024) (``CII''); Members of the Investor Advisory Group (June 
28, 2024) (``Members of IAG''); and Lynn E. Turner (Aug. 20, 2024) 
(``L. Turner'') (discussing the history of quality control standards 
in the audit profession).
    \45\ See letter from CII. See also letter from Members of IAG 
(``We believe the Amendments, if approved by the SEC, would provide 
enhanced protections for investors, consistent with the mandate set 
forth in SOX.'').
    \46\ See letter from Consumer Federation of America.
    \47\ Id. See also letters from AFL-CIO (``The need for 
enforceable quality control standards is demonstrated by the fact 
that approximately 40 percent of audits inspected by the PCAOB in 
2022 contained deficiencies where the auditor failed to obtain 
sufficient appropriate audit evidence to support its opinion.''); 
Better Markets (stating that ``the PCAOB's recent Staff Inspection 
Briefs indicate that significant improvements to firms' quality 
control systems are necessary and long overdue'' and that ``the 
deficiencies that inspection staff describe do not simply involve 
arcane, highly technical issues that could trip up even the most 
experienced, ethical auditor--they involve foundational issues of 
critical importance to high quality audit'').
    \48\ See letter from R. Conway.
    \49\ See letter from L. Turner.
    \50\ Id. (listing fundamental changes such as the change from 
peer reviews by other audit firms to PCAOB inspections for audits of 
issuers, significant growth in the size of audit firms, expansion of 
consulting and other non-audit services, international expansion, 
increased efforts by partners and leadership to monetize their 
investment in an audit firm, and firms establishing external QC 
advisory committees).
    \51\ See, e.g., letters from Better Markets (stating that 
although ``it is pleased that the PCAOB has adopted improvements to 
auditing quality control standards'' that it is ``disappointed that 
the Proposal does not sufficiently ensure high-quality audits or 
adequate transparency and accountability''); Consumer Federation of 
America (stating ``while these amendments do not go as far as we 
would have liked, we nonetheless expect that they will benefit 
investors''); and L. Turner (recommending that the PCAOB adopt an 
approach of requiring an independent board of directors for audit 
firms as proposed by the U.S. Treasury Advisory Committee on the 
Auditing Profession (``ACAP'') and used by the U.K. Financial 
Reporting Council (``FRC'') and the Japan Financial Services 
Agency).
---------------------------------------------------------------------------

    Other commenters stated that the Commission should not approve the 
Amendments.\52\ While several

[[Page 74328]]

commenters stated that they supported the Board's efforts and goal to 
modernize quality control standards, they did not support certain 
aspects of the Amendments.\53\ For example, one commenter stated that 
it was concerned that the Amendments ``could potentially have 
unintended negative consequences to the profession, including 
significant costs without notable improvement to audit quality.'' \54\ 
One commenter expressed its ``overall support for the project and the 
large majority of the provisions of the standard'' but stated that the 
Commission should not approve the standard in its final form because 
the EQCF function ``raises significant concerns,'' including being 
inconsistent with SOX, and because, in the commenter's view, the PCAOB 
did not adequately address concerns it and others raised regarding the 
ability for small firms to comply with QC 1000, in particular the 
design-only requirement.\55\ Another commenter stated that ``the SEC 
should reject the PCAOB's final QC 1000 standard because it contains 
fundamental failures and flaws.'' \56\ Commenters also provided 
feedback on specific aspects of the Amendments as described below, 
which informed their general views discussed above.
---------------------------------------------------------------------------

    \52\ See, e.g., letters from BDO USA, P.C. (July 2, 2024) 
(``BDO''); Ernst & Young, LLP (Aug. 26, 2024) (``EY''); Forvis 
Mazars, LLP (July 2, 2024) (``Forvis Mazars''); Moss Adams, LLP 
(July 2, 2024) (``Moss Adams''); and Tom Quaadman, Executive Vice 
President, Center for Capital Markets Competitiveness, U.S. Chamber 
of Commerce (July 15, 2024) (``Chamber'').
    \53\ See, e.g., letters from BDO; EY; Forvis Mazars; Johnson 
Global Advisory (June 26, 2024) (``Johnson Global''); Moss Adams; 
Pennsylvania Institute of CPAs (June 24, 2024) (``PICPA''); 
PricewaterhouseCoopers LLP (July 1, 2024) (``PWC''); and RSM US LLP 
(July 16, 2024) (``RSM'').
    \54\ See letter from Forvis Mazars.
    \55\ See letter from PWC.
    \56\ See letter from Chamber.
---------------------------------------------------------------------------

    We have considered the information contained in the Notice of 
Filing of Proposed Rules and the PCAOB's response letter \57\ as well 
as the comments received by the Commission. Having carefully weighed 
all of the information before us, we find that the Amendments are 
consistent with the requirements of Title I of SOX and the rules and 
regulations thereunder and are necessary or appropriate in the public 
interest or for the protection of investors. In particular, we believe 
the Amendments as a whole will further the Board's statutory mandate 
under SOX and enhance investor protection by creating an integrated, 
risk-based QC standard that can be applied by firms of varying sizes 
and complexities and is compatible with Other QC Standards that either 
have already been or are required to be implemented by the vast 
majority of registered public accounting firms. The Amendments will 
lead registered public accounting firms to significantly improve their 
quality control systems, thereby improving audit quality and investor 
protection. The existing interim QC standards--which were adopted on an 
interim basis in 2003 and were developed by the audit profession under 
an environment of self-regulation--do not adequately reflect the risks 
and requirements of the current auditing environment, overly focus on 
evaluating firms' compliance with their own internally-developed 
policies designed in a peer review environment, and do not require 
evaluation or reporting that ultimately enhances audit quality and 
investor protection.
---------------------------------------------------------------------------

    \57\ As discussed below, the Commission views the statements in 
the PCAOB response letter as being on par with statements made by 
the Board in the Adopting Release about the scope and application of 
the QC 1000 requirements. See Section III.G.
---------------------------------------------------------------------------

    The Amendments emphasize the importance of accountability and firm 
governance and a QC system that is proactive and responsive to risks. 
Replacing interim standards with permanent standards provides 
additional regulatory certainty that may have an incremental benefit of 
allowing audit firms to make long-term investments in their QC systems. 
Further, the Amendments will promote compliance by registered public 
accounting firms with applicable professional and legal requirements 
(including PCAOB auditing standards), which should help eliminate 
information asymmetries and expectation gaps for issuers, registered 
broker-dealers, and investors regarding whether audit firms are 
complying with such requirements. Improved compliance by registered 
public accounting firms with PCAOB auditing standards, among other 
professional and legal requirements, would result in improved financial 
reporting quality, which would further benefit investors.
    In addition, the Amendments share a common framework with Other QC 
Standards that are widely implemented by auditing firms across the 
globe, with specific enhanced requirements for the U.S. regulatory 
environment, which allows firms to leverage costs already expended or 
that will be expended to comply with these standards. In addition to 
the overarching structure and the eight components being the same among 
QC 1000 and the Other Standards as noted above in Section II, the 
requirements within the components are also aligned. Specifically, the 
required quality objectives (i.e., the outcomes specified by the 
standards that drive the firm's responses) generally are substantively 
similar \58\ although some of QC 1000's quality objectives contain 
additional prescriptive requirements \59\ that the Board considered to 
be relevant to the U.S. public company legal and regulatory environment 
as discussed in more detail below.\60\ Both QC 1000 and the Other QC 
Standards provide firms with flexibility to design responses to achieve 
these quality objectives taking into account the particular risks and 
circumstances faced by the firm. Further, there is overlap in the 
limited number of specified quality responses (i.e., individual 
responses required by QC 1000 and the Other QC Standards). In other 
words, the quality objectives that firms establish (and their resulting 
responses) under QC 1000 are expected to be sufficiently responsive to 
those of the Other QC Standards.\61\
---------------------------------------------------------------------------

    \58\ We note that QC 1000's quality objectives may use different 
terminology from the Other QC standards to align with other PCAOB 
standards and requirements (e.g., using the term ``QC system'' 
instead of ``system of quality management'').
    \59\ For example, in establishing quality objectives in the 
Governance and Leadership component, QC 1000.25.e requires firms to 
establish an objective that ``The firm's organizational and 
governance structure and the assignment of roles, responsibilities, 
and authority enable the design, implementation, and operation of 
the firm's QC system and support performance of the firm's 
engagements in accordance with applicable professional and legal 
requirements'' (emphasis added). ISQM 1.28 requires firms to 
establish an objective that ``The organizational structure and 
assignment of roles, responsibilities and authority is appropriate 
to enable the design, implementation and operation of the firm's 
system of quality management.'' These objectives are substantively 
the same, but QC 1000 places more emphasis on supporting the firm's 
engagements, which is inherent in the operation of the firm's QC 
system, and therefore implicitly included in both standards. The 
additional specificity in QC 1000 is not expected to result in 
substantively different responses (i.e., policies and procedures) 
between the two standards.
    \60\ See Adopting Release, supra note 9, at 38. Many of the 
prescriptive requirements in QC 1000 that are incremental to those 
that are in the Other QC Standards relate to existing PCAOB 
standards that the PCAOB determined were still relevant. See, e.g., 
QC 20.10, .13a, .13b, and .15a.
    \61\ For example, the specified responses to determine the 
nature, timing, and extent of monitoring in the Monitoring and 
Remediation Processes (see QC 1000.64 and ISQM 1.37) are 
substantively similar, except QC 1000.64(d) and (f) specifically 
require firms to consider characteristics of particular engagements 
and partners. When a firm designs its monitoring process, as long as 
a firm considers the characteristics of particular engagements and 
partners, the same policies and procedures would likely be suitable 
for both QC 1000 and ISQM 1.
---------------------------------------------------------------------------

    QC 1000 does go beyond the Other QC Standards in that it contains 
relatively more prescriptive requirements than the Other QC 
Standards.\62\ The Board

[[Page 74329]]

considered these requirements to be relevant to the U.S. regulatory 
environment and investors.\63\ Many of these additional requirements 
only apply to firms that issue audit reports for more than 100 issuers 
in the prior calendar year.\64\ Because QC 1000 provides more precise 
and prescriptive requirements that drive accountability, it will 
enhance the Board's ability to perform its inspections and to enforce 
its standards, which will further incentivize firms to design, 
implement, and operate effective QC systems.\65\ It is the Board's view 
that building on the well-understood basic framework of the Other QC 
Standards, appropriately tailored and strengthened to address the U.S. 
legal and regulatory environment and our investor protection mandate, 
will enable firms to implement and comply with QC 1000 more 
effectively.\66\ In designing, implementing, and operating their QC 
systems, firms that are subject to both PCAOB standards and the Other 
QC Standards, which the Commission estimates to be 88% of registered 
firms that have performed engagements under PCAOB standards for an 
issuer or registered broker-dealer (``PCAOB engagements'') in the past 
year and 72% of registered firms that have not,\67\ will be able to 
leverage the work they have already done and the investments they have 
already made to comply with such Other QC Standards.\68\ In support of 
this conclusion, neither the Commission staff nor commenters have 
identified aspects of QC 1000 that are incompatible with the Other QC 
Standards.
---------------------------------------------------------------------------

    \62\ For example, QC 1000.33.a and ISQM 1.34(a)(i) both require 
firms to establish policies and procedures to identify threats to 
independence; however, QC 1000.34 provides specific procedures the 
firm should establish in order to do so, including, for example, 
maintaining and making available the list of restricted entities. 
While maintaining a list of restricted entities is likely a common 
way of complying with ISQM 1.34(a)(i), it is not explicitly 
required.
    \63\ See supra note 60.
    \64\ See, e.g., QC 1000.28.
    \65\ See, e.g., QC 1000.14(d) (requiring a firm's principal 
executive officer to certify the firm's report to the PCAOB on its 
annual evaluation of the QC system).
    \66\ Adopting Release, supra note 9, at 7.
    \67\ See details of Commission staff analysis in Section III.C.
    \68\ See Adopting Release, supra note 9, at 7.
---------------------------------------------------------------------------

A. Requirements Related to the Design of QC System

    As discussed above, QC 1000 includes a design-only requirement. The 
PCAOB stated in the Adopting Release that the design-only requirement 
may facilitate timely implementation and operation of a compliant QC 
system.\69\ The Board also stated that not requiring all registered 
public accounting firms to design their QC system would create a risk 
that firms could be unprepared to accept and perform such engagements 
in compliance with applicable professional and legal requirements.\70\ 
Finally, the PCAOB stated that because registering with the PCAOB 
enables a firm to issue audit reports or play a substantial role on 
audits performed under PCAOB standards for issuers and registered 
broker-dealers, and because investors and companies considering 
engaging the firm could reasonably expect that any firm that could 
pursue such an engagement would already have a PCAOB-compliant QC 
system designed and ready for implementation and operation, it believes 
that imposing a design requirement on all registered firms promotes its 
mission of protecting investors and promoting the public interest.\71\
---------------------------------------------------------------------------

    \69\ Id. at 60-61.
    \70\ Id. at 368.
    \71\ See PCAOB response letter at 25-26.
---------------------------------------------------------------------------

General
    A number of commenters expressed concerns regarding the design-only 
requirement.\72\ Commenters stated that this requirement will increase 
the barriers to entry for small firms to take on audits of small 
publicly-held companies, including EGCs, or registered broker-dealers 
and will incentivize firms to de-register.\73\ A few commenters stated 
they agreed with concerns expressed by PCAOB Board Member Ho in her 
statement accompanying the adoption of QC 1000 indicating that the 
design-only requirement appears to be inconsistent with both the 
statutory text of SOX and a statement the PCAOB made to Congress in 
2023, and that the requirement would impose undue burdens on 
competition.\74\ The PCAOB response letter responds to commenter 
feedback on the design-only requirement, including addressing why 
applying such a requirement to firms that do not presently have 
obligations with respect to PCAOB engagements is consistent with the 
PCAOB's statutory mandate.\75\
---------------------------------------------------------------------------

    \72\ See, e.g., letters from BDO; Chamber; Forvis Mazars; PICPA; 
and PWC.
    \73\ See, e.g., letters from BDO; Chamber; PICPA; and PWC.
    \74\ See letters from BDO and PICPA (citing Board Member Ho, 
Statement on the QC 1000 Adoption--Demise to Audit Competition (May 
13, 2024) (``C. Ho Statement''), available at https://pcaobus.org/news-events/speeches/speech-detail/statement-on-the-qc-1000-adoption---demise-to-audit-competition). See also letters from 
Chamber (``The Chamber urges the Commission to heed the serious 
concerns raised by Board Member Ho's statement.'') and RSM (same).
    \75\ See PCAOB response letter at 25-27.
---------------------------------------------------------------------------

    While we acknowledge the concerns raised by commenters, we find 
that the design-only requirement is consistent with the requirements of 
Title I of SOX and the rules and regulations issued thereunder and is 
necessary or appropriate in the public interest or for the protection 
of investors. Allowing registered firms to design their QC system only 
upon entering into an audit engagement would create a risk that 
registered firms could be unprepared to accept and perform engagements 
in compliance with applicable professional and legal requirements, 
which in turn risks a reduction in audit quality to the detriment of 
investors. For example, one component of a well-designed QC system is 
policies and procedures around the acceptance of an engagement. Without 
having designed a QC system in advance, such firms would not be in a 
position to ensure that their QC system is effective in order to 
evaluate and take on a new PCAOB engagement.
    Below we discuss the views of commenters with respect to specific 
aspects of QC 1000's design-only requirement, as well as the 
Commission's findings regarding those matters.
Statutory Authority
    We have considered comments on the statutory authority questions 
raised in Board Member Ho's statement as well as the PCAOB's response 
letter and find that the Board has the authority to require that all 
registered firms design a QC system that complies with QC 1000. The 
Supreme Court has stated that, in cases of statutory construction, a 
court's analysis begins with ``the language of the statute'' and 
``where the statutory language provides a clear answer, it ends there 
as well.'' \76\ SOX Section 103(a)(2)(B) refers to quality control 
standards that the Board adopts with respect to the issuance of audit 
reports.\77\ This section of SOX requires the PCAOB to include, in the 
quality control standards that it adopts with respect to the issuance 
of audit reports, seven requirements for every registered public 
accounting firm relating to: (i) monitoring of professional ethics and 
independence from issuers, brokers, and dealers on behalf of which the 
firm issues audit reports; (ii) consultation within such firm on 
accounting and auditing questions; (iii) supervision of audit work; 
(iv) hiring, professional development, and advancement of personnel; 
(v) the acceptance and continuation of engagements; (vi)

[[Page 74330]]

internal inspections; and (vii) such other requirements as the Board 
may prescribe (subject to the general rulemaking authority provided to 
the PCAOB in SOX Section 103(a)(1)).\78\ QC 1000 is a quality control 
standard with respect to the issuance of audit reports that includes 
each of these seven statutory requirements. Moreover, the fact that one 
of the statutory requirements relates to the acceptance of engagements 
implies that the PCAOB's QC standards must address firms that have not 
yet accepted engagements and not just firms that currently issue audit 
reports.
---------------------------------------------------------------------------

    \76\ See Hughes Aircraft Co. v. Jacobson, 525 U.S. 432, 438 
(1999); see also Loper Bright Enter. v. Raimondo, 144 S. Ct. 2244 
(June 28, 2024) (``Courts interpret statutes, no matter the context, 
based on the traditional tools of statutory construction, not 
individual policy preferences.'').
    \77\ See 15 U.S.C. 7213(a)(2)(B).
    \78\ See 15 U.S.C. 7213(a)(2)(B).
---------------------------------------------------------------------------

    Furthermore, we find the use of the term ``every'' in Section 
103(a)(2)(B) significant, because it is the only place in SOX that uses 
that term. In other sections of SOX, such as Sections 101, 104 and 106, 
Congress used narrower language when it wanted to apply a particular 
regulation to a smaller universe of public accounting firms or 
registered public accounting firms.\79\ Further, requiring all 
registered public accounting firms to design a system of quality 
control that complies with QC 1000 is consistent with the Congressional 
directive in SOX Section 102, which requires applicant firms that want 
to register with the PCAOB to provide for review a description of ``the 
quality control policies of the firm for its accounting and auditing 
practices.'' \80\ We therefore find the Amendments are within PCAOB's 
authority under Title I of SOX.
---------------------------------------------------------------------------

    \79\ See 15 U.S.C. 7211(c)(1) (``. . . register public 
accounting firms that prepare audit reports for issuers, in 
accordance with section 102. . . '') (emphasis added); 15 U.S.C. 
7214(a)(2)((A) (``The Board may, by rule, conduct and require a 
program of inspection in accordance with paragraph (1), on a basis 
to be determined by the Board, of registered public accounting firms 
that provide one or more audit reports for a broker or dealer.'') 
(emphasis added); 15 U.S.C. 7216 (``Any foreign public accounting 
firm that prepares or furnishes an audit report with respect to any 
issuer, broker, or dealer shall be subject to this Act . . .'') 
(emphasis added).
    \80\ 15 U.S.C. 7212. We also disagree that the design-only 
requirement is contrary to the statements in the PCAOB's February 
2023 letter to Senators Warren and Wyden. See C. Ho Statement 
(citing https://www.warren.senate.gov/imo/media/doc/2023-02-08%20PCAOB%20Chair%20Erica%20Williams%20response%20letter%20to%20Senators%20Warren%20and%20Wyden.pdf). The PCAOB's letter specifically 
addressed the PCAOB's statutory authority as it relates to the 
cryptocurrency industry and stated, among other things, that ``[a]s 
a general matter, audit firms registered with the PCAOB must follow 
PCAOB standards and rules specifically in connection with their 
audits of SEC-registered issuers, brokers or dealers only.'' The 
letter does not specifically address whether an accounting firm that 
does not perform audits for issuers, brokers, or dealers that 
chooses to register with the PCAOB must comply with statutory 
requirements related to systems of quality control.
---------------------------------------------------------------------------

Barriers to Entry
    As noted above, several commenters expressed concerns that the 
design-only requirement will increase the barriers to entry for small 
firms to take on audits of smaller issuers or registered broker-dealers 
and incentivize firms to de-register. Some commenters suggested the 
requirement be revised to require the system to address only elements 
of QC covered by the professional QC standards the firm is currently 
subject to for the type of engagements they currently perform (e.g., 
the Other QC Standards).\81\ Similarly, one commenter suggested the 
Commission defer the effective date of QC 1000 for inactive firms until 
they become active.\82\ In the PCAOB response letter, the Board 
reiterated that the design-only requirement would benefit investors and 
explained why it believed the alternatives proposed by commenters would 
not achieve the same level of investor protection as QC 1000.\83\ The 
Board further stated that the design-only requirement comports with its 
historical practice of requiring firms to provide a summary of the 
design of their QC system upon registration, regardless of whether such 
firms perform engagements under PCAOB standards.\84\
---------------------------------------------------------------------------

    \81\ See letters from Chamber and Forvis Mazars.
    \82\ See letter from PWC. See also letters from PICPA 
(recommending that an ``inactive firm . . . not have to design its 
quality control system until after it decided to accept an 
engagement with a public company, broker, or dealer''); RSM 
(recommending that firms be required to design, implement, and test 
the effectiveness of their system of quality control in compliance 
with QC 1000 prior to being engaged to issue public company audit 
reports rather than upon registration).
    \83\ See PCAOB response letter at 26-27.
    \84\ Id. at 26.
---------------------------------------------------------------------------

    We acknowledge concerns that the design-only requirement could 
create barriers to entry or otherwise impact the decision to either 
register, or remain registered, with the PCAOB for firms that do not 
perform PCAOB engagements, and as discussed more fully in Section III.C 
below, we have considered the overall competitive effects of the 
Amendments on the market for audit services. These concerns must be 
weighed against the investor protection benefits of the design-only 
requirement. In particular, as the Board noted in the Adopting Release, 
if a registered firm that has not led an engagement or played a 
substantial role on an engagement in the past anticipates the 
possibility of transitioning to performing engagements, the design-only 
requirement may facilitate timely implementation and operation of their 
QC 1000 compliant QC system.\85\ As would be the case in any profession 
or industry when quickly adopting business-wide quality control 
processes, allowing registered firms to design their QC system only 
upon entering into an audit engagement would create a risk that 
registered firms could be unprepared to accept and perform engagements 
in compliance with applicable professional and legal requirements, 
which in turn risks a reduction in audit quality.\86\
---------------------------------------------------------------------------

    \85\ See Adopting Release, supra note 9, at 60-61.
    \86\ Id. at 368.
---------------------------------------------------------------------------

    We further considered the alternatives raised by commenters, 
including allowing for compliance with Other QC Standards, or delaying 
the effective date until firms accept an engagement under PCAOB 
standards. However, we do not believe that either of these alternatives 
sufficiently addresses the risks to investors of a firm entering into 
audit engagements with an issuer or registered broker-dealer without a 
QC system in place that provides reasonable assurance the firm could 
conduct the engagement in accordance with applicable professional and 
legal requirements. An audit firm's failure to conduct an engagement in 
accordance with applicable professional and legal standards undermines 
audit quality, puts at risk capital formation, and places investors and 
issuers at risk.
    Further, there are reasons to believe that the design-only 
requirement will not be a significant barrier to entry or cause for 
smaller firms to deregister, primarily due to the expected costs to the 
majority of registered firms being substantially mitigated by 
investments made by those firms to comply with the Other QC Standards, 
which have already been adopted by the IAASB and AICPA and will be 
effective at or before the effective date of QC 1000. In the Adopting 
Release, the PCAOB stated that QC 1000 shares a basic structure and 
approach with the Other QC Standards, so designing for the incremental 
features unique to QC 1000 is not expected to be unduly burdensome for 
firms that are subject to either or both of those Other QC 
standards.\87\ The PCAOB also stated in the Adopting Release that it 
believes most audit firms will have either already implemented or be 
implementing one or both of the Other QC Standards when QC 1000 goes 
into effect on December 15, 2025.\88\ The Commission staff compared the

[[Page 74331]]

requirements of QC 1000 with the requirements of the Other QC Standards 
and similarly concluded that there is significant overlap and did not 
identify anything that is incompatible with those other requirements. 
Further, no commenters identified any aspects of QC 1000 that are 
incompatible with these other requirements. Many of the specified 
requirements in QC 1000 that are not in the Other QC Standards are 
applicable only to firms issuing audit reports for more than 100 
issuers. Therefore, with respect to these incremental requirements, any 
firms required to design but not implement a QC system under QC 1000 
would not be required to adopt those specified requirements. Further, 
any other incremental requirements over Other QC Standard requirements 
that are applicable to such firms are not expected to be burdensome to 
design, especially given the inherent scalability of QC 1000. The 
Commission staff also performed an analysis of registered firms and 
determined, consistent with the PCAOB's evaluation, that most 
registered firms will be subject to the Other QC Standards by the time 
QC 1000 is effective.\89\ Based on the Commission staff's assessment, 
we believe that these existing standards are likely to mitigate 
compliance costs for a very substantial majority of registered firms.
---------------------------------------------------------------------------

    \87\ Id. at 61.
    \88\ See, e.g., id. at 330-31.
    \89\ Commission staff estimate that approximately 77% of 
registered firms are subject to the requirements of one or both of 
the Other QC Standards. Details on this analysis can be found in 
Section III.C.
---------------------------------------------------------------------------

    Furthermore, other factors may serve to mitigate any adverse 
competitive effects from the design-only requirement for smaller firms. 
For example, some registered firms currently participate in PCAOB 
engagements at a level below that of a ``substantial role,'' with the 
level of involvement varying, with some of those firms participating at 
a level approaching a ``substantial role.'' \90\ Larger firms could 
have a greater incentive to use the work of registered public 
accounting firms that are currently participating at a level below that 
of a ``substantial role,'' or that are not participating in PCAOB 
engagements at all, if the larger firms knew that such firms had 
already designed a QC system in accordance with QC 1000. Therefore, 
such smaller firms may have more opportunity to participate in audits 
pursuant to PCAOB standards in the future. Other firms that would have 
been subject to the design-only requirement may indeed choose to 
deregister. Such deregistration may, nevertheless, not have an adverse 
competitive effect if such firms were only intending to continue to 
compete for work that does not require PCAOB registration, such as 
participating in an audit pursuant to PCAOB standards at a level below 
that of a ``substantial role,'' as their registration status would not 
impact their eligibility for this work. Accordingly, for these reasons 
and the reasons discussed in Section III.C, the Commission does not 
believe this aspect of the Amendments is likely to have a significant 
negative impact on the market for audit services or the pool of 
registered audit firms.
---------------------------------------------------------------------------

    \90\ Commission staff reviewed the publicly available PCAOB Form 
AP database, ``FirmFilings,'' and filtered for Forms AP with an 
``Audit Report Date'' between April 1, 2022 to March 31, 2023 to 
identify ``other participant'' firms listed in column ``Audit Not 
Divided Percent Information,'' available at https://pcaobus.org/resources/auditorsearch. For purposes of this analysis, staff 
assumed that only ``other participant'' firms with a ``Firm ID'' in 
the database were registered. Staff then compared this information 
to the corresponding publicly available Form 2 data related to audit 
reports filed between April 1, 2022 to March 31, 2023 to identify 
firms that did not perform issuer audits, broker-dealer audits, or 
perform any substantial role work based on responses to questions in 
Part III, indicating that while not required to register, these 
firms are registered. Staff then filtered the Form AP data to 
isolate these firms, noting their roles are at less than a 
``substantial role'' to varying degrees from 5-10% to 20-30% of 
total audit hours in many cases.
---------------------------------------------------------------------------

B. EQCF Role

    As described above, QC 1000 includes a requirement for the small 
number of firms that issue audit reports for more than 100 issuers 
during the prior calendar year to implement an EQCF. Composed of one or 
more persons who are not principals or employees of the firm and do not 
otherwise have a commercial, familial or other relationship with the 
firm that would interfere with the exercise of independent judgment 
with regard to the matters related to the QC system, the EQCF is 
required to evaluate the significant judgments made and related 
conclusions reached by the firm when the firm is evaluating and 
reporting on the effectiveness of its QC system.\91\ The PCAOB stated 
in the Adopting Release that an external oversight function should 
enhance the discipline with which the firm carries out its own QC 
system evaluation.\92\ The PCAOB also stated that, based on comments it 
received on the Concept Release and the Proposing Release and 
experience with inspections of firms' systems of quality control, it 
believes that investors, audit committees, and other stakeholders will 
benefit from the EQCF's evaluation.\93\
---------------------------------------------------------------------------

    \91\ See Adopting Release, supra note 9, at 118.
    \92\ Id. at 124.
    \93\ Id.
---------------------------------------------------------------------------

General
    Some commenters stated that they specifically supported the EQCF 
role.\94\ One commenter emphasized the importance of the EQCF role.\95\ 
This commenter stated that it made sense to require firms that issue 
audit reports for more than 100 issuers per year to be subject to 
incremental requirements, such as the EQCF role, ``given such firms' 
greater involvement in the U.S. capital markets and their impact on 
investors.'' \96\ This commenter further stated that it appreciated 
that the Amendments stressed ``the independence of the external 
oversight function.'' \97\ Another commenter stated that the creation 
of the EQCF ``is necessary in light of ongoing instances around the 
globe which suggest the firms suffer from a lack of ethics throughout 
the firms, including senior leadership.'' \98\
---------------------------------------------------------------------------

    \94\ See letters from Consumer Federation of America and L. 
Turner.
    \95\ See letter from Consumer Federation of America.
    \96\ Id.
    \97\ Id.
    \98\ See letter from L. Turner.
---------------------------------------------------------------------------

    On the other hand, several commenters stated that they do not 
support the requirement to incorporate an EQCF within the QC 
system.\99\ Among other concerns, commenters asserted that the EQCF 
requirement included prescriptive elements that were not exposed for 
public comment; that the costs and benefits of the EQCF requirement had 
not been adequately considered; that the requirement could vitiate 
confidentiality protections under SOX; and that the requirement raised 
personal liability and other concerns that could render the requirement 
unworkable. Several commenters expressed the view that the requirement 
would necessitate disclosure of firm deficiency information included in 
Part II of PCAOB inspection reports to the person or persons serving in 
the EQCF role in conflict with SOX and PCAOB rules or Congressional 
intent.\100\ More

[[Page 74332]]

generally, commenters stated that it was unclear ``how the EQCF would 
function within a firm's system of quality control'' \101\ and 
suggested that the standard the PCAOB adopted ``expanded the 
professional obligations and responsibilities'' of the EQCF role, which 
would impose additional liability costs for those professionals.\102\ 
Another commenter stated that the EQCF requirement is ``neither 
realistic nor needed'' given that the QC systems of firms are complex 
and involve a multitude of judgments and conclusions and the PCAOB 
already inspects large firms annually.\103\ One commenter stated that 
``[f]irms that are close to or just above the 100-issuer mark may feel 
compelled to consider reducing their issuer count below this 
threshold'' as a result of the EQCF requirement.\104\ One commenter 
raised concerns about the EQCF role in its initial comment letter to 
the Commission and stated, in a subsequent supplemental comment letter, 
that the PCAOB response letter ``provides additional clarity on several 
of our questions,'' including with regard to the EQCF role,\105\ but 
stated the PCAOB response ``did not address certain other key matters 
raised by commenters'' \106\ and that the letter ``raises additional 
questions.'' \107\ Specifically, this commenter stated ``it is not 
clear how to square the Board's stated belief that requiring the EQCF 
will `improve audit quality' and `drive improvement in a firm's QC 
system' with the view that EQCF members would only be considered 
`supervisory persons' if the EQCF had the `responsibility, ability, or 
authority to affect the conduct of . . . associated persons. . . .' '' 
\108\
---------------------------------------------------------------------------

    \99\ See, e.g., letters from BDO; CAQ; Chamber; EY; Forvis 
Mazars; Moss Adams; PICPA; and PWC.
    \100\ See, e.g., letters from BDO; CAQ; Chamber; Forvis Mazars; 
and PWC. See also letter from the Center for Audit Quality (Aug. 29, 
2024) (``CAQ Supplemental Letter'') (stating that the PCAOB response 
letter did not address ``certain other key matters'' raised by 
commenters, such as ``the PCAOB's authority to compel disclosure of 
information afforded confidential and privileged by The Sarbanes-
Oxley Act (e.g., Part II of PCAOB Inspection Reports)''); letter 
from PICPA (expressing the view that the EQCF ``presents concerns 
regarding the confidentiality of PCAOB Part II inspection 
findings''); letter from RSM (``The SEC should consider whether SOX 
restrictions on public disclosure of Part II inspection findings and 
confidentiality of communications with inspection teams create 
complexities for effectuating the PCAOB's intention with respect to 
the EQCF's role.'').
    \101\ See letter from Forvis Mazars.
    \102\ See letter from BDO.
    \103\ See letter from Chamber. See also letter from PWC (stating 
``[w]e do not believe that firms should be viewed as incapable of 
performing their own evaluations and conclusions on their QC systems 
with full transparency to the PCAOB through its inspections process 
but without third-party involvement'').
    \104\ See letter from Moss Adams.
    \105\ This commenter stated that, for example, the PCAOB comment 
letter clarified the Board's belief that those serving in an EQCF 
role would meet the definition of an ``associated person.'' See CAQ 
Supplemental Letter.
    \106\ This commenter stated that, for example, the PCAOB 
response letter did not address the point raised in several comment 
letters that the Amendments would require firms to disclose 
confidential and privileged information to ``individuals a firm is 
not otherwise even required to employ or contract.'' Id. In 
addition, the commenter stated that the Board ``does not address 
concerns raised by commenters about the new EQCF requirements being 
stated by the Board to be analogous in some ways to an Engagement 
Quality Reviewer.'' Id.
    \107\ Id. The commenter asked the Commission to clarify whether 
the PCAOB response letter ``can be viewed as equally authoritative 
as the Final Standard and Adopting Release.'' We respond to this 
comment in Section III.G below.
    \108\ Id.
---------------------------------------------------------------------------

    While we acknowledge the concerns raised by commenters about the 
EQCF requirement, the Commission finds that the EQCF role is consistent 
with the requirements of Title I of SOX and the rules and regulations 
issued thereunder and is necessary or appropriate in the public 
interest or for the protection of investors. We believe that an 
independent oversight function for the small number of firms subject to 
the requirement will enhance the effectiveness of a registered firm's 
QC system, ultimately leading to improvements in audit quality. In 
support of the EQCF requirement, one commenter pointed to the 
importance of independence to ``high quality corporate governance in 
the United States'' and stated that ``as independence has been 
implemented, enhanced and monitored, it has led to investors relying to 
a greater extent on corporate boards.'' \109\ We agree with this 
commenter's views on the benefits of independence to governance 
structures and concur with the PCAOB that adding an independent 
perspective to an annually inspected firm's QC system self-evaluation 
will promote a more rigorous evaluation process by those firms and 
drive improvements in audit quality.\110\ In fact, the PCAOB stated 
that, in connection with its oversight, ``certain firms have 
acknowledged the limitations of internal QC functions led by non-
independent firm employees and have touted the benefits of independent 
review.'' \111\ The PCAOB further stated that some firms have already 
created leadership or advisory roles for independent third 
parties.\112\ We find this evidence persuasive and therefore conclude 
that requiring an external quality control function for registered 
firms will serve the public interest and the protection of investors.
---------------------------------------------------------------------------

    \109\ See letter from L. Turner.
    \110\ See PCAOB response letter at 3, 9. In 2008, one of ACAP's 
recommendations was to urge the PCAOB and the SEC, in consultation 
with others, to ``analyze, explore, and enable, as appropriate, the 
possibility and feasibility of firms appointing independent members 
with full voting power to firm boards and/or advisory boards with 
meaningful governance responsibilities to improve governance and 
transparency of audit firms.'' See letter from L. Turner (citing and 
quoting from ACAP recommendations).
    \111\ See PCAOB response letter at 3.
    \112\ Id. (including, for example, one firm that disclosed it 
had ``robust discussions'' regarding its initial QC system 
evaluation under ISQM 1 with its external quality advisors and 
another firm that indicated its audit advisory council, which 
includes two independent members, addresses matters related to the 
QC system, including inspection results and remediation efforts). 
See also PWC, 2023 Audit Quality Report, at 31 (describing its 
``independent Assurance Quality Advisory Committee'' as providing 
advice ``on aspects of the business, operations, culture, 
governance, and risk management approach that are reasonably 
expected to impact audit and assurance quality'' and stating that 
such committee ``made us the first firm with both a Board that 
includes external members and an independent advisory committee 
focused on quality''), available at https://www.pwc.com/us/en/services/audit-assurance/library/audit-quality-report.html.
---------------------------------------------------------------------------

    One commenter expressed doubts that the EQCF would improve audit 
quality or drive improvements in a firm's QC system given the PCAOB's 
view that the EQCF would only be considered a supervisory person if it 
had responsibility, ability, or authority to affect the conduct of 
associated persons.\113\ We understand this commenter to be suggesting 
that the EQCF role will not result in improvements unless the EQCF has 
some control with respect to decision-making at the firm. To the extent 
the registered public accounting firms subject to the EQCF requirement 
share the concern raised by this commenter, the Amendments provide 
firms with flexibility to vest the EQCF with decision-making authority 
to the extent they see fit. However, even absent decision-making or 
other authority, we believe that the EQCF role will be able to drive 
improvements in audit quality and a firm's QC system. An independent 
perspective on the significant judgments made and conclusions reached 
by the firm during its annual evaluation will help firms identify areas 
of improvement in their QC systems that they can consider when 
operating their QC systems. It is not uncommon for businesses to seek 
external perspectives on a variety of topics or issues and the fact 
that the business is the ultimate decision-maker does not mean that the 
input provided is not valuable or beneficial to the process. In 
addition, as noted above, some audit firms have voluntarily added 
independent oversight to their governance structures, indicating that 
they see a benefit to having an independent perspective.
---------------------------------------------------------------------------

    \113\ See CAQ Supplemental Letter.
---------------------------------------------------------------------------

    Relatedly, we do not believe that imposing an independent QC 
monitor or independent QC consultant for a prescribed period of time as 
remedial relief in a PCAOB enforcement action would serve as a viable 
substitute for the EQCF requirement for the small number of firms 
subject to the requirement, as suggested by one commenter.\114\ Based 
on our experience with Commission enforcement actions,

[[Page 74333]]

audit quality and investor protection benefits are greater with a 
prophylactic requirement aimed at preventing such violations from 
occurring in the first place--before investors are potentially placed 
at risk--than with only remedial relief in a handful of enforcement 
actions for limited periods of time.\115\
---------------------------------------------------------------------------

    \114\ See letter from PWC.
    \115\ See PCAOB response letter at 10.
---------------------------------------------------------------------------

    In addition to the overall benefits that an independent oversight 
function would provide, we find that the Board's approach to mandating 
this requirement in QC 1000 appropriately balances the need to enhance 
the effectiveness of registered firms' QC systems with an approach that 
provides flexibility in internal governance structures to minimize cost 
and disruption. As adopted by the Board, the EQCF requirement will 
provide significant flexibility for firms to design procedures that 
work best for their individual firm governance structure and 
requirements. QC 1000 does not specify where within the registered 
public accounting firm the EQCF must be housed or to whom the EQCF must 
report.\116\ These determinations are left to the discretion of the 
firm. This flexibility will allow an independent EQCF \117\ to also 
serve, for example, as an independent member of a firm's advisory 
committee or audit quality committee or governance body, including one 
that has a majority of non-independent members.\118\ Furthermore, to 
the extent that firms have existing QC advisory committees, nothing in 
the rule would prevent those committees, or independent members of 
those committees, from serving as EQCF, provided they meet the rule's 
independence standard and can discharge the assigned duties.
---------------------------------------------------------------------------

    \116\ See QC 1000.28.
    \117\ The EQCF must be independent in accordance with the 
requirements in QC 1000.28. See Adopting Release, supra note 9, at 
122 (stressing the importance of the independence requirement but 
otherwise providing firms with discretion to determine the specific 
credentials the EQCF must have as long as they have the experience, 
competence, authority, and time necessary to carry out their 
assigned responsibilities); PCAOB response letter at 8 (``As long as 
the firm incorporates into its governance structure an EQCF that can 
appropriately discharge its single prescribed responsibility (and 
any additional responsibilities the firm might voluntarily assign to 
it) in accordance with the QC 1000 standard, the firm would have 
wide latitude to decide--in its discretion and based on its 
particular circumstances--how best to design its EQCF.'').
    \118\ A number of the audit firms that would be subject to the 
EQCF requirement have stated publicly that they have independent 
representation in their governance structure or plan to add such a 
role in the near-term. See supra notes 31 and 112.
---------------------------------------------------------------------------

    The Amendments also do not prescribe specific procedures to be 
followed by the EQCF and require only one EQCF activity.\119\ The EQCF 
must evaluate ``the significant judgments made and the related 
conclusions reached by the firm when evaluating and reporting on the 
effectiveness of the QC system.'' \120\ Notably, the EQCF's 
responsibility does not extend to all of the firm's QC-related 
judgments and conclusions, but only to significant ones made in 
connection with the firm's annual QC-system evaluation and 
reporting.\121\ Firms may, but are not required to, consider additional 
oversight functions for the EQCF, such as reviewing the firm's 
remediation actions and monitoring plan, or identifying and monitoring 
emerging risks or trends that could potentially affect the firm's QC 
system.\122\ Similar to the flexibility provided to audit firms in 
determining how the EQCF will perform its responsibilities, audit firms 
would have flexibility to consider, based on their individual firm 
needs, what other functions, if any, would be beneficial. Along these 
lines, one commenter noted that the PCAOB has pointed out the 
flexibility of its approach and how a firm implementing it can apply 
that flexibility. The commenter further stated that, based on the 
commenter's experience with the auditing profession, the commenter 
believes that the PCAOB is correct and that the approach the PCAOB took 
with respect to the EQCF ``should, and will ultimately, allay the 
concerns of audit firm commenters.'' \123\ Below we discuss the views 
of commenters with respect to specific aspects of QC 1000's EQCF 
requirement, as well as the Commission's findings regarding those 
matters.
---------------------------------------------------------------------------

    \119\ See QC 1000.28.
    \120\ Id.
    \121\ See PCAOB response letter at 7.
    \122\ See Adopting Release, supra note 9, at 119-24.
    \123\ See letter from L. Turner.
---------------------------------------------------------------------------

Notice and Comment
    Several commenters expressed the view that the EQCF requirement was 
not included in the Proposing Release and therefore was not properly 
exposed for public comment before being adopted by the Board.\124\ One 
commenter stated that the change from requiring an ``oversight function 
for the audit practice'' in the Proposing Release to requiring an 
``oversight function for the QC system'' in the Adopting Release 
represents a significant change that ``effectively deprives us of an 
opportunity for public input into the revised requirement.'' \125\ 
Another commenter stated that the requirement for the EQCF to evaluate 
all ``significant judgments'' introduces ``prescriptive elements not 
included in the original proposal.'' \126\ Conversely, one commenter 
stated that ``[c]learly anyone who read and responded to the Concept 
Release and exposure draft were aware that the PCAOB was moving to 
adopt such a function in its final rule.'' \127\
---------------------------------------------------------------------------

    \124\ See, e.g., letters from CAQ; Chamber; EY; Forvis Mazars; 
Moss Adams; and PWC.
    \125\ See letter from PWC.
    \126\ See letter from Grant Thornton LLP (July 16, 2024) 
(``GT'') (explaining that although the firm has an Audit Quality 
Advisory Counsel, it does not meet the EQCF requirements in QC 1000, 
particularly regarding the necessary authority and review of all 
``significant judgments'').
    \127\ See letter from L. Turner (discussing the relevant history 
of the proposed QC standard, including the 2008 ACAP recommendation, 
2019 Concept Release, and 2022 Proposing Release, and stating that 
the PCAOB has gone through an ``extensive process of outreach'' to 
both its Investor Advisory Groups and Standards Advisory Groups with 
respect to quality control standards and noting that members of the 
Standards Advisory Groups include members of the ``Big Four'' as 
well as smaller firms).
---------------------------------------------------------------------------

    As a threshold matter, we find that the public had a meaningful 
opportunity to comment on the Amendments both as they were being 
developed by the PCAOB and after they were filed with the Commission 
for approval. The PCAOB received and considered comments in connection 
with both the 2019 Concept Release and 2022 Proposing Release. The 
comment period for the Proposing Release was open for 75 days, but the 
PCAOB continued to accept comments up until its adoption of the 
Amendments. The PCAOB considered all comments it received. After the 
Amendments were filed with the Commission for approval, the Commission 
published a notice to solicit comment on the Amendments with comments 
due 21 days after the Notice of Filing of Proposed Rules was published 
in the Federal Register. To provide additional time for consideration 
of the Amendments and the issues raised therein, the Commission twice 
extended the date by which it must act on the Amendments. During this 
time, the Commission received additional input from both the Board and 
public commenters. We have considered all of these comments in deciding 
to approve the Amendments.
    The Commission finds that the Board's process for approving the 
Amendments complied with all applicable requirements. Although the 
Board is not ``an agency or establishment of the United States 
Government,'' \128\ for statutory purposes and therefore is not subject 
to the requirements of the Administrative Procedure Act (``APA''),\129\ 
the Board as

[[Page 74334]]

a matter of policy has adopted a notice-and-comment process to inform 
its decision-making.\130\ The Board followed that process here. The 
PCAOB response letter details the standard-setting history relating to 
the EQCF requirement, beginning with the 2008 recommendations from ACAP 
and including the Concept Release, Proposing Release, consideration of 
comments received to each, and Adopting Release.\131\ The Board 
describes the outreach it performed and the input it received from a 
variety of stakeholders over the course of that multi-year 
process.\132\ The Board's analysis demonstrates that the core tenets of 
``independent oversight over firm's QC systems'' were introduced in the 
Concept Release,\133\ and were refined through the Board's stakeholder 
engagement, including in response to comments received on their Concept 
Release and Proposing Release.\134\ Accordingly, we find the Board's 
process for approving the Amendments reasonable and appropriate.
---------------------------------------------------------------------------

    \128\ 15 U.S.C. 7211(b).
    \129\ See 5 U.S.C. 551(1) (defining an ``agency'' as ``each 
authority of the Government of the United States''); id. Sec.  
551(5) (defining ``rule making'' as ``agency process for 
formulating, amending, or repealing a rule''); id. Sec.  553 
(setting forth the requirements for agency rule making).
    \130\ See PCAOB Staff Guidance on Economic Analysis in PCAOB 
Standard Setting (2014), available at https://pcaobus.org/oversight/standards/economic-analysis/05152014_guidance.
    \131\ See PCAOB response letter at 3-5.
    \132\ Id.
    \133\ Id. (noting that the Concept Release included a request 
for comment asking, ``Should a future PCAOB QC standard incorporate 
mechanisms for independent oversight over firms' QC systems (e.g., 
boards with independent directors or equivalent)?'').
    \134\ Id. (stating that in response to the Proposing Release 
``[m]any commenters called for more clarity and specificity about 
the role of the oversight function'').
---------------------------------------------------------------------------

    As proposed, consistent with the Concept Release,\135\ the PCAOB 
contemplated an independent QC oversight function within the governance 
structure of an audit firm.\136\ Specifically, the PCAOB proposed to 
require an ``oversight function for the audit practice'' writ large 
that included at least one individual who was not a principal or 
employee of the firm and who did not have a relationship with the firm 
``that would interfere with the exercise of independent judgment with 
regard to matters related to the QC system'' (emphasis added).\137\ The 
PCAOB explained in the Proposing Release that the proposed requirements 
``would not specify how the firm would establish its governance 
structure or assign authority, other than having one person in an 
oversight role who would be in a position to exercise independent 
judgment with regard to QC matters'' (emphasis added).\138\ The 
proposed oversight function, coupled with the general requirement 
relating to the ``exercise of independent judgment with regard to 
matters related to the QC system,'' reasonably could have been read to 
include, for example, oversight over all aspects of the QC system 
including design, sufficiency, judgment, and overall effectiveness.
---------------------------------------------------------------------------

    \135\ See Concept Release, supra note 10 (``We are considering 
whether a future PCAOB QC standard should address mechanisms for 
independent oversight over firms' QC systems.'') (emphasis added).
    \136\ See Proposing Release, supra note 11, at 97 (``[T]he 
firm's governance structure should incorporate an oversight function 
for the audit practice that includes at least one person who is not 
a partner, shareholder, member, other principal, or employee of the 
firm and does not otherwise have a commercial, familial, or other 
relationship with the firm that would interfere with the exercise of 
independent judgment with regard to matters related to the QC 
system.'').
    \137\ Id. at 97 (``If the firm issued audit reports with respect 
to more than 100 issuers during the prior calendar year, the firm's 
governance structure should incorporate an oversight function for 
the audit practice that includes at least one person who is not a 
partner, shareholder, member, other principal, or employee of the 
firm and does not otherwise have a commercial, familial, or other 
relationship with the firm that would interfere with the exercise of 
independent judgment with regard to matters related to the QC 
system.'').
    \138\ Id.
---------------------------------------------------------------------------

    In response to the Proposing Release, commenters requested 
specificity regarding the function and scope of the responsibilities 
such an independent QC governance role would entail.\139\ After taking 
such comments into consideration, the Board adopted an amended QC 
standard that clarified the EQCF's status and role. Specifically, the 
PCAOB narrowed the focus of the role from the proposal which, as 
explained above, would have required an ``oversight function for the 
audit practice'' to require an ``oversight function for the QC system'' 
and specified a single responsibility for the EQCF: ``evaluating the 
significant judgments made and the related conclusions reached by the 
firm when evaluating and reporting on the effectiveness of the QC 
system.'' \140\
---------------------------------------------------------------------------

    \139\ See Adopting Release, supra note 9, at 119-20 (citing 
relevant commenter feedback on the Proposing Release).
    \140\ Id. at 118.
---------------------------------------------------------------------------

    One commenter specifically stated that the change from an 
``oversight function for the audit practice'' to an ``oversight 
function for the QC system'' was a significant change that was not 
adequately explained or proposed for public comment.\141\ We disagree 
with this commenter. The QC system is the process by which a firm 
manages and improves its audit practice and therefore is an integral 
and significant part of the audit practice, so that a role overseeing 
the audit practice would necessarily also oversee the QC system in 
addition to other aspects of a firm's audit operations. Therefore, an 
``oversight function for the QC system'' is a subcomponent of an 
``oversight function for the audit practice'' (e.g., a narrower version 
of what was proposed). Moreover, the EQCF role was proposed in the 
context of the PCAOB's new quality control standard and both the 
PCAOB's proposed and adopted formulations of the oversight requirement 
required that the individual or individuals who fill the role not have 
any relationships with the firm ``that could interfere with the 
exercise of independent judgment with regard to matters related to the 
QC system'' (emphasis added).\142\ In our view, these explicit 
references to the individual's responsibilities as they relate to the 
``QC system'' weigh against commenters' claims that the EQCF role could 
not have been anticipated from the proposal.\143\
---------------------------------------------------------------------------

    \141\ See letter from PWC.
    \142\ See Proposing Release, supra note 11, at 97.
    \143\ See letters from CAQ and Chamber.
---------------------------------------------------------------------------

    Moreover, many aspects of the Amendments related to the EQCF role 
remain unchanged from the proposal. For example, the EQCF requirement 
only applies to firms that issue audit reports with respect to more 
than 100 issuers during the prior calendar year.\144\ The requirement 
for independence remained the same with the exception of changing the 
terminology from the singular to plural form (i.e., a grammatical 
change).\145\ Although the Amendments describe the EQCF role as an 
``external oversight function,'' the PCAOB response letter explains 
that it used the phrase ``external'' to ``underscore that the function 
is to be carried out by one or more persons who are independent and, 
necessarily, external to the firm'' rather than imposing a separate 
requirement.\146\ The proposal required the EQCF role to be composed of 
``at least one person'' while the Amendments require the EQCF role to 
be composed of ``one or more persons.'' In either case, only one 
individual is required but a firm can choose to assign

[[Page 74335]]

more than one individual to the role.\147\ As discussed in greater 
detail below, the individual or individuals who fill the EQCF role will 
be ``associated persons of a registered public accounting firm,'' and 
the same would have been true under the proposal. Finally, the 
Amendments state that the ``EQCF should have the experience, 
competence, authority, and time necessary to enable them to carry out 
the responsibilities assigned to the EQCF by the firm.'' The PCAOB 
explained in the Adopting Release that this change was made to 
``conform[ ] the provision to the descriptions in QC 1000.12 of other 
specified QC system roles'' that require the same qualifications to 
perform their responsibilities.\148\
---------------------------------------------------------------------------

    \144\ See Adopting Release, supra note 9, at 118-20.
    \145\ Compare Proposing Release, supra note 11, at 97 (``. . . 
includes at least one person who is not a partner, shareholder, 
member, other principal, or employee of the firm and does not 
otherwise have a commercial, familial, or other relationship with 
the firm. . .'') and Adopting Release, supra note 9, at 118 (``. . 
.composed of one or more persons who are not partners, shareholders, 
members, other principals, or employees of the firm and do not 
otherwise have a commercial, familial, or other relationship with 
the firm. . .'').
    \146\ See PCAOB response letter at 6.
    \147\ See Adopting Release, supra note 9, at 118-20.
    \148\ Id. at 120. Both the PCAOB's proposed and adopted versions 
of QC 1000.12 stated, ``[t]he firm must assign other roles and 
responsibilities with respect to the QC system to firm personnel who 
have the experience, competence, authority, and time to enable them 
to carry out their responsibilities.'' See Proposing Release, supra 
note 11, at 68; Adopting Release, supra note 9, at 82. The EQCF is a 
role with respect to the QC system, which is further clarified 
through the conforming change described above.
---------------------------------------------------------------------------

    Therefore, having considered the standard-setting process preceding 
the EQCF requirement, we find that the public had considerable 
opportunity to comment on the function and responsibilities of the EQCF 
role included in the Amendments as well as on the similar, but more 
broadly focused, independent oversight function in the Proposing 
Release, on which the EQCF is based. Moreover, we find the changes made 
to that role in the Adopting Release to be responsive to comments 
received by the PCAOB from a variety of stakeholders. We also agree 
with the Board that the only prescriptive requirement of the function--
the requirement to evaluate the significant judgments made and the 
related conclusions reached by the firm when evaluating and reporting 
on the effectiveness of the firm's QC system \149\--is both responsive 
to requests for greater clarity and specificity and would benefit 
investors by enhancing the discipline with which a firm carries out its 
own QC system evaluation.\150\ Overall, we believe the changes 
described above addressed feedback on the role that the Board received 
on the Concept Release and Proposing Release, including that the role 
did not go far enough; that the role's undefined authority made it 
likely to be ineffective; and that more specificity and prescription 
was needed to avoid overly broad interpretations of the requirements; 
while maintaining a principles-based approach to allow firms to design 
the EQCF as appropriate for their audit practice.
---------------------------------------------------------------------------

    \149\ QC 1000.28 (``Responsibilities of the EQCF should include, 
at a minimum, evaluating the significant judgments made and the 
related conclusions reached by the firm when evaluating and 
reporting on the effectiveness of the firm's QC system.'').
    \150\ See PCAOB response letter at 6.
---------------------------------------------------------------------------

    In addition, the public had the opportunity to provide comments to 
the Commission on the Amendments adopted by the PCAOB. One commenter 
stated that the ``time-period for providing comments to the SEC'' was 
``constrained.'' \151\ As discussed above, however, the Commission 
provided an initial comment period of 21 days, followed by an extension 
of 14 days. The Commission also extended its period to consider the 
Amendments two times, for a total of a 90-day period. Over the course 
of the 90 total days during which the Amendments were under 
consideration by the Commission, the public was able to continue to 
submit comment letters. The Commission received over 20 letters in 
total, several of which addressed the EQCF role in particular.\152\ The 
Commission has considered the concerns raised by commenters and 
addresses them below.
---------------------------------------------------------------------------

    \151\ See Chamber letter.
    \152\ See, e.g., letters from BDO; CAQ; Consumer Federation of 
America; Chamber; EY; Forvis Mazars; Moss Adams; PICPA; PWC; and L. 
Turner.
---------------------------------------------------------------------------

Alternatives to the EQCF Role
    One commenter stated that it was concerned that the EQCF may not 
achieve the effectiveness and accountability that is necessary because 
of the flexibility provided to firms, and questioned whether a single 
person would be able to fulfill the EQCF's responsibilities inside the 
largest accounting firms.\153\ The commenter believed that a preferable 
approach would be to require the creation of an independent board as 
proposed by the ACAP and used by the FRC and the Japan Financial 
Services Agency.\154\ As the PCAOB states in the Adopting Release, the 
EQCF role may be carried out by ``one or more persons'' and therefore 
larger firms will be able to determine whether it would be appropriate 
to assign more than one person to the role given their size and 
complexity.\155\ We note that the firms that will be subject to the 
Amendments are of varying sizes and complexities and we therefore agree 
with the PCAOB that a ``one size fits all'' approach is unwarranted. 
Furthermore, we note that the PCAOB has stated that it intends to 
monitor the implementation of QC 1000 through its inspections program 
and outreach activities and ``will remain vigilant'' for any 
information regarding the standard's effectiveness or implementation 
challenges.\156\ With respect to the commenter's preferred approach of 
creating an independent board, although we agree with the commenter 
that experience has indicated that independent boards of issuers can be 
very effective, such a requirement is not part of the Amendments and 
therefore it is beyond the scope of this Order. In addition, we believe 
that consideration would need to be given to how an independent board 
requirement would interact with any applicable corporate governance 
laws, particularly for those registered public accounting firms located 
outside of the United States.
---------------------------------------------------------------------------

    \153\ See letter from L. Turner.
    \154\ Id.
    \155\ See Adopting Release, supra note 9, at 121.
    \156\ See PCAOB response letter at 24-25.
---------------------------------------------------------------------------

Disclosure, Confidentiality and Liability
    Several commenters stated that the EQCF requirement conflicts with 
SOX Sections 104(g)(2) or 105(b)(5)(A) \157\ because it would compel 
audit firms to share non-public QC criticisms with the EQCF, who is 
external to the firm.\158\ One commenter stated that the EQCF (or 
members of the EQCF) would not be an associated person, given the 
definition of associated persons in PCAOB Rule 1001(p)(i), and 
considering that the EQCF consists of one or more independent third-
parties.\159\ This commenter further stated that discussions in the 
Adopting Release ``cloud this issue,'' including the discussion of 
whether the EQCF would be subject to supervisory liability under SOX 
Section 105(c)(6).\160\ One commenter responded to the PCAOB response 
letter stating that their ``objection is in the PCAOB requiring 
disclosure to individuals a firm is not otherwise even required to 
employ or contract.'' \161\
---------------------------------------------------------------------------

    \157\ See 15 U.S.C. 7214(g)(2); 15 U.S.C. 7215(b)(5)(A).
    \158\ See, e.g., letters from BDO; CAQ; Chamber; Forvis Mazars; 
PICPA; and PWC.
    \159\ See letter from Chamber. The CAQ Supplemental Letter 
stated that the PCAOB response letter provided clarity on whether 
the EQCF would be considered an associated person.
    \160\ Id. See also letter from PWC (stating that the ``adopting 
release raises the possibility that individuals filling this role 
could be subject to liability under Section 105(c)(6) of SOX'').
    \161\ See CAQ Supplemental Letter.
---------------------------------------------------------------------------

    SOX Section 104(g)(2) provides that ``no portions of [a PCAOB] 
inspection report that deal with criticisms of or potential defects in 
the quality control systems of the firm under inspection

[[Page 74336]]

shall be made public if those criticisms or defects are addressed by 
the firm, to the satisfaction of the Board, not later than 12 months 
after the date of the inspection report.'' \162\ SOX Section 
105(b)(5)(A) provides that, with certain exceptions, ``all documents 
and information prepared or received by or specifically for the Board, 
and deliberations of the Board and its employees and agents, in 
connection with an inspection . . . or with an investigation . . . 
shall be confidential and privileged as an evidentiary matter . . . in 
any proceeding in any Federal or State court or administrative agency, 
and shall be exempt from disclosure . . . under the Freedom of 
Information Act . . . or otherwise.'' \163\
---------------------------------------------------------------------------

    \162\ 15 U.S.C. 7214(g)(2).
    \163\ 15 U.S.C. 7215(b)(5)(A).
---------------------------------------------------------------------------

    The Commission finds that the disclosure of information to the EQCF 
would not be a public disclosure under Section 104(g)(2) or 
inconsistent with the confidentiality protections provided by Section 
105(b)(5)(A) because those serving in the EQCF role would be associated 
persons and therefore subject to the same confidentiality requirements 
as the firm's partners, employees, and other associated persons.\164\ 
Under SOX Section 2(a)(9), an ``associated person of a public 
accounting firm'' includes any ``independent contractor'' who, ``in 
connection with the preparation or issuance of any audit report,'' 
receives compensation from the firm or ``participates as agent or 
otherwise on behalf of'' the firm ``in any activity of that firm.'' 
\165\ For reasons the PCAOB explained, because individuals serving in 
an EQCF role cannot be partners, shareholders, members, other 
principals, or employees of the firm, they are likely to be engaged as 
independent contractors.\166\ And those independent contractors would 
meet the definition of an ``associated person'' under SOX Section 
2(a)(9) because they are likely to be compensated for their work and, 
in any event, would participate in the firm's activities--at least the 
firm's evaluation and reporting process--on behalf of the firm.\167\
---------------------------------------------------------------------------

    \164\ We note that the external oversight role as described in 
the Proposing Release similarly would have met the definition of 
associated person of a public accounting firm.
    \165\ 15 U.S.C. 7201(a)(9). PCAOB Rule 1001(p)(i) provides a 
substantially similar definition of ``person associated with a 
public accounting firm.''
    \166\ PCAOB response letter at 10.
    \167\ One commenter suggested that its concerns about the 
disclosure of confidential and privileged information to the EQCF 
stem from the fact the PCAOB is ``requiring disclosure to 
individuals a firm is not otherwise even required to employ or 
contract.'' See CAQ Supplemental Letter. However, the Amendments 
require the largest firms to establish and maintain an EQCF. As 
explained above, we believe that such individual or individuals 
serving in the EQCF would be associated persons--likely independent 
contractors--and therefore, we expect that firms will enter into 
contracts to set forth the terms and conditions of the role, 
including non-disclosure agreements, just as with their other 
independent contractors.
---------------------------------------------------------------------------

    Like all associated persons, such independent contractors are part 
of the PCAOB inspection or investigation process, not strangers to it. 
They must cooperate with PCAOB inspections and investigations, comply 
with related PCAOB requests, and prepare inspection- or investigation-
related documents for the PCAOB.\168\ Accordingly, such independent 
contractors are not part of the public, and their involvement in Board 
inspections and investigations and awareness of information related 
thereto would not vitiate confidentiality protections.\169\ Indeed, as 
the PCAOB observed, some firms currently share confidential information 
with external advisors, including those serving in audit quality 
advisory roles.\170\
---------------------------------------------------------------------------

    \168\ 15 U.S.C. 7212(b)(3); 15 U.S.C. 7215(b)(5)(A).
    \169\ See PCAOB response letter at 13 n.55 (citing In re Bieter 
Co., 16 F.3d 929, 940 (8th Cir. 1994) (addressing the waiver of 
attorney-client privilege in the context of disclosure to an 
independent contractor); In re Flonase Antitrust Litig., 879 F. 
Supp. 2d 454, 459 (E.D. Pa. 2012) (same); In re Copper Mkt. 
Antitrust Litig., 200 FRD. 213, 219 (S.D.N.Y. 2001) (same); Am. S.S. 
Owners Mut. Protection & Indem. Ass'n v. Alcoa S.S. Co., 232 FRD. 
191, 198 (S.D.N.Y. 2005) (addressing the waiver of attorney-client 
privilege in the context of disclosure to corporate directors); 
Strougo v. BEA Assocs., 199 FRD. 515, 525 (S.D.N.Y. 2001) (same, 
with respect to outside directors)); see also letter from L. Turner 
(stating that the legislative history of the SOX Section 104(g)(2) 
indicates that it was intended to prohibit the PCAOB from disclosing 
information it obtained regarding quality control deficiencies but 
that the firms could disclose that information to their audit 
committee if they chose to).
    \170\ See PCAOB response letter at 12 (citing the 2023 Audit 
Quality Report of BDO, which states that its audit advisory council 
addresses matters related to its QC system, including inspection 
results and remediation efforts, and the 2022 Audit Quality and 
Transparency Report of Grant Thornton, which states that it grants 
its audit quality advisory council full access to firm information 
to help them fully understand the system of quality control). We 
note that BDO states in its 2023 Audit Quality Report that two 
members of its audit advisory council are independent and Grant 
Thornton states in its 2022 Audit Quality and Transparency Report 
that two members of its audit quality advisory council are 
independent.
---------------------------------------------------------------------------

    QC 1000 does not specify what information affected firms must share 
with the EQCF, giving firms flexibility in determining the 
responsibilities of the EQCF and what information is needed for the 
EQCF to fulfill its role, as long as the EQCF complies with the minimum 
requirement to evaluate all significant judgments made by the firm with 
respect to its QC system. Also, firms may enter other types of 
independent-contractor arrangements, including with individuals at an 
affiliated firm within a global network or personnel at shared services 
centers outside of the firm.\171\ A determination that the EQCF is not 
an associated person would have significant consequences for those 
arrangements. Finally, a firm would be free to impose confidentiality 
or non-disclosure requirements on the EQCF to the same extent a firm is 
able to impose such requirements on its other independent contractors.
---------------------------------------------------------------------------

    \171\ See PCAOB response letter at 13-14.
---------------------------------------------------------------------------

    Although their status as associated persons could result in 
potential personal liability for individuals that take on the EQCF 
role, we believe this is appropriate given that the EQCF, like any 
other associated person, should exercise due professional care when 
fulfilling their responsibilities--responsibilities that, as we have 
explained above, serve an important investor protection role. We note 
that the significant flexibility afforded to firms under the Amendments 
to design procedures for the EQCF that work best for their individual 
firm governance structure may help to mitigate concerns that the 
attendant personal liability could discourage qualified individuals 
from taking on such a role.
    Commenters also raised concerns about the potential liability 
exposure of the EQCF if the individual serving in that role was 
considered not only an associated person of the firm, but also a 
supervisory person. Under SOX Section 105(c)(6), the Board may impose 
sanctions on a ``supervisory person'' who ``fail[s] reasonably to 
supervise an associated person'' and ``such associated person commits a 
violation'' of a relevant law, rule, or standard.\172\ The Commission 
agrees with the PCAOB that the minimum requirements of the EQCF would 
not, on their own, make the individual or individuals ``supervisory 
persons,'' and that the assessment of whether any particular individual 
serving in the EQCF role is a supervisory person would need to consider 
any additional responsibilities or authorities the audit firm assigned 
to them.\173\ Again, however, the flexibility

[[Page 74337]]

afforded to firms under the Amendments to determine what additional 
functions, if any, would be performed by EQCF should serve to mitigate 
concerns.
---------------------------------------------------------------------------

    \172\ 15 U.S.C. 7215(c)(6).
    \173\ Section 105(c)(6) addresses supervision in terms that are 
``similar to those that apply to broker-dealers under section 
15(b)(4) of the Securities Exchange Act of 1934.'' S. Rep. No. 107-
205 at 11, 49. Exchange Act Sections 15(b)(4)(E) and 15(b)(6) 
provide a theory of liability for broker-dealers and their 
associated persons that have failed reasonably to supervise, with a 
view to preventing violations of the federal securities laws and the 
rules thereunder, another person who commits such a violation, if 
such other person is subject to the broker-dealer or associated 
person's supervision. 15 U.S.C. 78o(b)(4)(E) and (b)(6). In that 
context, the Commission has explained that ``determining if a 
particular person is a `supervisor' depends on whether, under the 
facts and circumstances of a particular case, that person has a 
requisite degree of responsibility, ability or authority to affect 
the conduct of the employee whose behavior is at issue.'' John H. 
Gutfreund, Rel. No. 34-31554, 51 SEC 93, 113 (Dec. 3, 1992) (settled 
order and Exchange Act 21(a) Report). See also, e.g., SEC v. Yu, 231 
F.Supp.2d 16 (D.D.C. 2002) (court found individual violated 
supervisory bar by retaining involvement in hiring and firing, and 
supervising compliance staff); Steven E. Muth, Rel. No. 34-52551, 
2005 WL 2428336 (Oct. 3, 2005) (Commission opinion) (individual had 
requisite degree of control where he participated in decision to 
hire and later to suspend registered representative).
---------------------------------------------------------------------------

    Relatedly, several commenters raised concerns that potential 
liability under Section 105(c)(6) of SOX for the person or persons 
fulfilling the EQCF role could limit the pool of candidates for this 
role.\174\ However, we do not believe that any potential liability will 
significantly impact the pool of candidates, given the flexibility 
afforded to firms in the structuring of the role and the impact of such 
flexibility on liability considerations, as well as the fact that the 
requirement only applies, as the PCAOB observed, to the small number of 
firms meeting the 100-issuer threshold \175\ and that several of those 
firms already have independent members of their firm governance or 
audit quality structure whose responsibilities, in some cases, may 
already meet the requirements of the EQCF, or who otherwise may be 
willing to expand such responsibilities.
---------------------------------------------------------------------------

    \174\ See, e.g., letters from BDO; CAQ; and PWC.
    \175\ See PCAOB response letter at 17-21. See also supra note 30 
(only 14 of the approximately 1,600 PCAOB-registered firms issued 
audit reports to more than 100 issuers as of 2023 but one of those 
firms has since filed an application for withdrawal from 
registration).
---------------------------------------------------------------------------

Other
    One commenter stated that firms that are close to or just above the 
annual 100-issuer audit report threshold may feel compelled to consider 
reducing their issuer count below this threshold to avoid the EQCF 
requirement and that such exits would undermine competition.\176\ 
However, we believe such an effect is unlikely to be significant given 
that, as the Board observed in the Adopting Release and in the PCAOB 
response letter, very few firms are close to the 100-issuer threshold. 
Specifically, PCAOB staff analysis of audit reports included in 
Commission filings during the 2022 calendar year indicated that two 
registered public accounting firms audited between 80 and 100 issuers 
and two registered public accounting firms audited between 100 and 120 
issuers.\177\ In addition, we expect that the minimum requirements for 
the EQCF role and the flexibility provided to firms to implement the 
role would reduce the likelihood that firms would be motivated to stay 
below the 100-issuer threshold to avoid the requirement. Furthermore, 
we agree that using the 100-issuer threshold is a reasonable approach 
because, as the PCAOB noted in the Adopting Release, firms are already 
familiar with this statutory threshold in the PCAOB inspection context 
and because we agree with the commenter who stated that the 100-issuer 
threshold was appropriate ``given such firms' greater involvement in 
the U.S. capital markets and their impact on investors.'' \178\ SOX 
provides that firms that provide audit reports for more than 100 
issuers are subject to annual inspection by the PCAOB and firms that 
provide audit reports for 100 issuers or fewer are subject to 
inspection triennially.\179\ Therefore, not only are firms familiar 
with the threshold, we believe firms monitor the size of their issuer 
practice for purposes of monitoring their inspection requirements and 
using the same threshold would avoid requiring the small number of 
firms that are close to or above the 100-issuer threshold to track a 
different threshold for purposes of compliance with QC 1000.
---------------------------------------------------------------------------

    \176\ See letter from Moss Adams (stating ``[f]rom the 
standpoint of a firm that is subject to annual inspection and 
marginally exceeds the 100-issuer threshold, the disparity in scale, 
operational scope, and complexity when compared to other firms under 
similar scrutiny is substantial. Thus, we encourage the Board 
conduct a more in-depth economic analysis of the EQCF role, along 
with qualitative analysis of the proposed impact to audit quality 
and the interplay with the PCAOB's annual inspection of firms' 
systems of quality.'').
    \177\ See Adopting Release, supra note 9, at 362; PCAOB response 
letter at 17 n. 72.
    \178\ See Adopting Release, supra note 9, at 67; letter from 
Consumer Federation of America. See also,15 U.S.C. 7214(b)(1)(A).
    \179\ See 15 U.S.C. 7214(b)(1)(A).
---------------------------------------------------------------------------

    Some commenters raised questions about the Board's analogy of the 
EQCF to the Engagement Quality Reviewer (``EQR'').\180\ One commenter 
stated that the analogy the PCAOB made between the EQCF and the EQR was 
``not well analogized'' because the EQR is required to perform a review 
under specific requirements that are the subject of an auditing 
standard while the PCAOB has not provided such specific requirements 
for the performance of the EQCF's evaluation.\181\
---------------------------------------------------------------------------

    \180\ See, e.g., letters from EY; CAQ Supplemental Letter; and 
PWC.
    \181\ See letter from PWC.
---------------------------------------------------------------------------

    The analogy the PCAOB drew between the EQCF and the EQR in the 
Adopting Release noted certain similarities between the two roles, but 
also identified important differences between the requirements for the 
roles, including that the EQCF is not required to provide concurring 
approval, as is required of an EQR.\182\ The EQR's concurrence instills 
responsibility and authority over the activities of the audit 
engagement team and places the EQR in a supervisory position in an 
audit engagement. On the other hand, as the PCAOB has made clear, the 
EQCF is not required to approve the firm's conclusions regarding its 
significant judgments for the firm to make a conclusion on the 
effectiveness of the QC system.\183\ As explained above, the 
requirement to evaluate the significant judgments and conclusions 
reached does not, by itself, impose supervisory responsibilities on the 
EQCF nor is the EQCF's concurrence with the firm's conclusions 
required. The EQCF's evaluation is an input into the firm's assessment 
of its QC system and while it may inform the actions of individuals, it 
does not direct such actions.
---------------------------------------------------------------------------

    \182\ See Adopting Release, supra note 9, at 121.
    \183\ Id.; PCAOB response letter at 7.
---------------------------------------------------------------------------

    Another commenter who addressed the PCAOB's comparison of the EQCF 
and EQR roles stated that, unlike the EQR who is governed by the 
requirements in the PCAOB's engagement quality review standard, the 
Amendments do not prescribe certain details regarding the EQCF's role 
and responsibilities.\184\ Specifically, the commenter stated that the 
final standard does not, among other things: (1) specify the procedures 
the EQCF should perform to evaluate the significant judgments made and 
related conclusions reached; (2) address the nature, timing, and extent 
of the EQCF's review; or (3) address how differing judgments made by 
the EQCF and the firm should be resolved or documented.\185\ This 
commenter stated that this creates uncertainty regarding the 
application of the responsibilities specified in the standard and 
raises questions about the potential liability of the EQCF.\186\ We 
disagree with the views expressed by the commenters discussed above. 
The PCAOB adequately explained this comparison in the Adopting Release, 
noting

[[Page 74338]]

similarities between the two roles, but also explaining important 
differences, which we have highlighted, above.\187\ In our view, the 
referenced discussion sought to clarify aspects of the EQCF without 
imposing any new requirements on registered public accounting firms or 
changing the requirements for the EQCF as set forth in the Amendments.
---------------------------------------------------------------------------

    \184\ See letter from EY.
    \185\ Id.
    \186\ Id. We addressed the liability concerns related to the 
EQCF role earlier in this Order.
    \187\ See Adopting Release, supra note 9, at 121.
---------------------------------------------------------------------------

    With respect to the commenter's concerns about the lack of 
prescriptiveness of the EQCF requirement, the PCAOB explained its 
decision to provide firms with flexibility to design the EQCF role to 
fit their particular circumstances and firm governance structure in 
both the Adopting Release and the response letter.\188\ As discussed 
above, we find that the Board's approach to the EQCF requirement in QC 
1000 appropriately balances enhancing the effectiveness of audit firm 
QC systems with flexibility that allows for effective scaling and 
customization for firms of varying sizes, structures, and risk 
profiles, as well as minimizing cost and disruption. Regarding the 
question on resolution of differences, the Amendments provide audit 
firms with broad flexibility with respect to the implementation of the 
EQCF role, including applicable internal procedures. As the Amendments 
do not require that the EQCF have any specific decision-making 
responsibility or other authority, firms are generally free to 
determine an approach to any such differing judgments between the EQCF 
and the firm in the manner that they deem most appropriate for their 
firm.
---------------------------------------------------------------------------

    \188\ Id. at 122; PCAOB response letter at 7.
---------------------------------------------------------------------------

    To the extent that firms have questions about the implementation of 
the EQCF role, the PCAOB stated that it anticipates that, consistent 
with its historical practice, its staff will issue implementation 
guidance and will engage in other activities to support firms' 
implementation efforts.\189\ We encourage the PCAOB to provide this 
implementation guidance and other support, which could be useful to 
firms, with respect to the Amendments generally and in particular for 
the EQCF role.
---------------------------------------------------------------------------

    \189\ PCAOB response letter at 28.
---------------------------------------------------------------------------

    Two commenters suggested that the EQCF is unnecessary because a 
firm's annual self-evaluation of its QC system, coupled with the 
PCAOB's annual inspections of that QC system, should suffice.\190\ We 
are persuaded, however, that the EQCF requirement will provide 
meaningful additional safeguards beyond those realized from self-
evaluations and inspections. The EQCF's evaluation should provide the 
firm with real time, independent feedback, enabling the firm to enhance 
its quality control system on an ongoing basis whereas any response it 
receives from the PCAOB during its inspections process occurs at a 
later point in time. In this way, the EQCF role is consistent with the 
objective of a quality control standard that fosters continuous 
improvement--one of the PCAOB's express aims in adopting QC 1000.\191\
---------------------------------------------------------------------------

    \190\ See letters from PWC and Chamber.
    \191\ See Adopting Release, supra note 9, at 5 (``We are 
adopting an integrated, risk-based standard, QC 1000, A Firm's 
System of Quality Control, that mandates quality objectives and key 
processes for all firms' QC systems, with a focus on accountability 
and continuous improvement.).
---------------------------------------------------------------------------

    Some commenters stated the requirements for the EQCF are unclear 
(e.g., requirements around documentation of EQCF's evaluation).\192\ 
The PCAOB response letter addresses the documentation requirements as 
they relate to the EQCF.\193\ The PCAOB response letter states that, 
under QC 1000, it is the firm that bears responsibility for complying 
with documentation requirements related to the EQCF role not the 
individual or individuals who comprise the EQCF.\194\ Indeed, the EQCF 
could provide its evaluation orally because there is no requirement in 
QC 1000 that the EQCF must document or provide its evaluation in 
writing.\195\ Further, QC 1000 does not prescribe to whom the EQCF must 
report, giving firms flexibility to develop the form of reporting and 
the line of reporting by the EQCF. We note, moreover, that it is 
typical for implementation questions to arise around new accounting or 
auditing requirements. To the extent additional clarity on specific 
requirements related to EQCF is necessary, we believe PCAOB staff 
implementation or other guidance would sufficiently assist firms with 
interpreting the requirement. As noted above, the PCAOB stated that it 
anticipates that, consistent with its historical practice, its staff 
will issue implementation guidance and will engage in other activities 
to support firms' implementation efforts.\196\
---------------------------------------------------------------------------

    \192\ See, e.g., letters from CAQ; Forvis Mazars; and GT. See 
also letter from EY (stating ``it is unclear how firms will 
understand and document the EQCF's identification of and conclusion 
about the firm's significant judgments'').
    \193\ See PCAOB response letter at 14-15.
    \194\ Id. at 14.
    \195\ Id. at 15 (stating ``QC 1000 imposes a documentation 
requirement regarding the EQCF's operation on the firm, not on the 
individuals who comprise the EQCF--though the firm's EQCF policies 
could provide guidance to those individuals about what they should 
or should not do to facilitate the firm's retention of appropriate 
documentation about the EQCF's operation'' (emphasis added)) and 14 
(stating that all of the firm's documentation under QC 1000 must be 
documented ``in sufficient detail to enable an experienced auditor 
who understands QC systems but has no experience with the firm's QC 
system to understand how the EQCF is designed'').
    \196\ Id. at 28. One commenter stated that subsequent PCAOB 
staff guidance is an insufficient alternative to or remedy for the 
lack of notice and comment for the EQCF requirement. See letter from 
Chamber. However, as explained above, the Board followed its own 
notice-and-comment process and the EQCF requirement included in the 
Amendments was the result of changes made in light of commenter 
feedback on the PCAOB's proposed external oversight function.
---------------------------------------------------------------------------

C. Economic Implications of the Amendments

    Commenters expressed concerns that the costs arising from QC 1000 
and certain of its requirements are not appropriately described and 
that a more rigorous economic analysis is necessary before the 
Amendments can be approved.\197\ One commenter stated that the economic 
analysis conducted by the PCAOB in the Adopting Release was deficient 
because it did not discuss any plans for post-implementation review or 
details on how such a review will be conducted.\198\ By contrast, 
another commenter observed that the PCAOB issued a staff white paper in 
November 2022 identifying research that suggests the PCAOB's proposed 
QC standard could lead to greater compliance with professional 
standards and improve financial reporting quality.\199\ This commenter 
also stated that the ``costs of deficient failed audits, can and have 
been significant and even catastrophic to investors, employees, and the 
U.S. economy.'' \200\
---------------------------------------------------------------------------

    \197\ See, e.g., letters from BDO; Chamber; PICPA; and PWC.
    \198\ See letter from Chamber.
    \199\ See letter from L. Turner (citing Public Company 
Accounting Oversight Board, Staff White Paper, The Impact of Quality 
Control System Remediation on Audit Performance and Financial 
Reporting Quality (Nov. 2022), available at https://assets.pcaobus.org/pcaob-dev/docs/default-source/rulemaking/docket046/qc-staff-white-paper-november-2022.pdf?sfvrsn=ddb22504_4).
    \200\ Id.
---------------------------------------------------------------------------

    The PCAOB response letter addresses commenter feedback on its 
economic analysis.\201\ The Board stated that, where possible, 
quantitative data was used and that, when this data was not available, 
the Board used qualitative factors in its analysis.\202\ The Board also 
stated that available data and methods do not permit them to fully 
quantify all of the benefits and costs of QC 1000 and that commenters 
on this topic did not provide studies or data that permitted complete 
quantification of the benefits or costs of QC 1000.\203\ When 
commenters did suggest relevant data or research, the Board stated that 
it

[[Page 74339]]

considered it and incorporated that data or research into its economic 
analysis as appropriate.\204\
---------------------------------------------------------------------------

    \201\ See PCAOB response letter at 21-22.
    \202\ Id.
    \203\ Id.
    \204\ Id.
---------------------------------------------------------------------------

    As part of our assessment of the Amendments, we have considered the 
economic analysis conducted by the PCAOB in the Adopting Release as 
well as the comments received on this point and the additional 
information provided in the PCAOB response letter. Below we evaluate 
the PCAOB's analysis in order to reach our own conclusion about the 
economic implications of the Amendments. On many points, we find the 
PCAOB's analysis reasonable; however, where appropriate, we have 
expanded upon that analysis. Moreover, we have considered the specific 
concerns raised by commenters about the unintended consequences of the 
Amendments and, as discussed in more detail below, have concluded that 
the Amendments are unlikely to have a significant adverse effect on 
efficiency and competition within the market for audit services.\205\
---------------------------------------------------------------------------

    \205\ One commenter stated that Exchange Act Section 3(f), 15 
U.S.C. 78c(f), requires the Commission to consider the economic 
implications of the Amendments before approving or disapproving 
them. See letter from Chamber. Regardless of whether Section 3(f) 
applies in Commission review of PCAOB rules, because the PCAOB 
addressed the economic implications of the Amendments and commenters 
have raised concerns about that analysis, the Commission has 
likewise considered the economic implications of the Amendments and 
addresses those implications here. See Bloomberg, L.P. v. SEC, 45 
F.4th 462, 476 (D.C. Cir. 2022) (APA requires the Commission to 
``respond adequately'' to ``relevant concerns about the direct and 
indirect costs of'' a proposal raised by commenters, regardless of 
what Section 3(f) requires).
---------------------------------------------------------------------------

    The PCAOB's economic analysis addresses the benefits and costs 
associated with the Amendments, including, but not limited to, the 
design requirement, which applies to all registered firms, and the EQCF 
requirement, which applies to a small number of firms. The PCAOB's 
analysis explains the expected benefits to investors and other 
financial statement users that will be realized by improving compliance 
with applicable professional and legal requirements and thereby 
improving financial reporting quality.\206\ In addition, the PCAOB's 
analysis addresses unintended consequences of the Amendments, such as 
potential effects on human capital, competition concerns, including the 
concern raised by some commenters that the requirements could diminish 
the availability of global network resources and that smaller firms 
around the world could decline to assist U.S. firms with global audits, 
and the potential negative consequences related to increased 
accountability or liability.\207\ Finally, the Board stated in the 
PCAOB response letter that it intends to follow its normal practice 
under which staff in its Office of Economic and Risk Analysis will 
conduct an analysis and make a recommendation to the Board as to 
whether to conduct a post-implementation review of the Amendments.\208\ 
We encourage the Board to conduct such a post-implementation review.
---------------------------------------------------------------------------

    \206\ See Adopting Release, supra note 9, at 341-43.
    \207\ Id. at 358-66; see also letter from BDO (``There should be 
further consideration of the potential impacts of this standard on 
the competitive landscape of firms outside the U.S. where 
possible.'').
    \208\ See PCAOB response letter at 24.
---------------------------------------------------------------------------

    Below we examine the individual elements of the Board's economic 
analysis, including its consideration of the effects on efficiency, 
competition, and capital formation.
    Consistent with best practice when conducting an economic 
analysis,\209\ the Board includes a baseline assessment of existing 
audit requirements and practices against which the potential effects of 
the Amendments can be considered. The Board presents analyses of 
quantitative proxies for the level of compliance with existing 
professional standards, including information on Part I.A deficiencies, 
QC deficiencies related to audit performance, and broker-dealer 
engagement deficiencies, from the audits or engagements inspected by 
the PCAOB. Overall, these analyses suggest that some firms' QC systems 
may not be providing the required reasonable assurance. The Board's 
analysis indicates that broker-dealer engagements and issuer audits 
performed by firms other than the U.S. global network firms (``GNFs'') 
\210\ appear to have more room for improvement on average based on the 
period examined. The Board also presents research that it conducted on 
existing policies and procedures at U.S GNFs. This research finds that 
U.S. GNFs are already devoting extensive resources to the design, 
implementation, and operation of QC policies and procedures related to 
the ISQM 1 requirements.\211\ Further, the Board observes that 
commenters on the Proposing Release indicated that non-GNFs have been 
devoting resources to the design, implementation, and operation of QC 
policies and procedures related to ISQM 1 and/or SQMS 1 requirements, 
though some of these firms may have more narrowly focused their 
resources on the design component and may not yet be spending resources 
to operate QC policies in line with SQMS 1. Lastly, the Board's 
baseline assessment provides information on the evolution of firms' QC 
policies and procedures and discusses academic research on behaviors 
that suggest certain weaknesses in QC systems in practice.
---------------------------------------------------------------------------

    \209\ See SEC Staff, Current Guidance on Economic Analysis in 
SEC Rulemaking (Mar. 16, 2012), available at https://www.sec.gov/divisions/riskfin/rsfi_guidance_econ_analy_secrulemaking.pdf; PCAOB 
Staff, Staff Guidance on Economic Analysis in PCAOB Standard-Setting 
(Feb. 14, 2014), available at https://pcaobus.org/oversight/standards/economic-analysis/05152014_guidance.
    \210\ See Adopting Release, supra note 9, at 54. The six global 
networks that contain the largest number of registered, non-U.S. 
firms as reported on Form 2s filed in 2023 are: BDO International 
Limited, Deloitte Touche Tohmatsu Limited, Ernst & Young Global 
Limited, Grant Thornton International Limited, KPMG International 
Cooperative, and PricewaterhouseCoopers International Limited (the 
member firms of these networks are collectively referred to herein 
as ``GNFs''). The non-affiliated firms (``NAFs'') include registered 
public accounting firms that are not members of global network 
firms.
    \211\ See Adopting Release, supra note 9, at 318-23.
---------------------------------------------------------------------------

    Several commenters on the Proposing Release suggested that some 
firms have already designed and implemented, or are in the process of 
designing and implementing, QC policies and procedures consistent with 
the requirements of Other QC Standards.\212\ The Board supported that 
view, but many commenters on the Proposing Release disagreed with this 
characterization of the baseline and stated that QC 1000 will impose 
significant costs.\213\ The Commission staff independently examined the 
number of PCAOB-registered audit firms that will be affected by QC 
1000, including the extent to which they may be affected.
---------------------------------------------------------------------------

    \212\ Id. at 331.
    \213\ Id. at 351-60.
---------------------------------------------------------------------------

    There are 1554 audit firms registered with the PCAOB as of August 
2024.\214\

[[Page 74340]]

Among these, 659 firms performed an engagement under PCAOB standards 
for an issuer or registered broker-dealer. These firms will have to 
fully implement QC 1000. Out of these 659 firms, 323 are U.S. firms 
that issued opinions under AICPA standards and, should they continue to 
do so, will have to implement SQMS 1; 199 are non-U.S. firms that are 
GNFs and are therefore likely to implement ISQM 1; and another 60 are 
non-U.S. firms that have an audit-related membership, affiliation, or 
similar arrangement. We believe that non-U.S. firms that have an audit-
related membership, affiliation, or similar arrangement, especially 
GNFs, are likely to have implemented ISQM 1 due either to their own 
issuance of audit reports under International Auditing Standards, or as 
a recommendation or requirement due to its audit-related membership, 
affiliation, or similar arrangement.\215\ Hence, in total, we believe 
that 582 of the 659 firms (i.e., 88%), by the effective date of QC 
1000, will already be subject to quality control requirements that 
share a basic structure with the requirements in QC 1000. This overlap 
significantly reduces the cost and benefits of the Amendments, to the 
extent that these firms in fact comply with the Other QC Standards. 
Recognizing that the Amendments are likely to increase compliance with 
these shared quality control requirements (i.e., as a result of PCAOB 
inspections and enforcement of QC 1000), firms may incur costs relative 
to the baseline, and there may be corresponding benefits to investors 
stemming from audit quality improvement.
---------------------------------------------------------------------------

    \214\ Based on Commission staff analysis. Data on firms 
registered with the PCAOB come from the PCAOB's website: Registered 
Firms, PCAOB, https://pcaobus.org/oversight/registration/registered-firms. We identify whether an audit firm has performed an engagement 
under PCAOB standards for an issuer or registered broker-dealer 
using the ``Audit Report Activity'' filter. Staff identified U.S. 
and non-U.S. firms by using the country variable in the PCAOB data. 
U.S. firms include those in the United States and Puerto Rico. To 
identify firms that participate in the AICPA peer review program, 
staff extracted a list of participating firms from the following 
website: Public File Search, AICPA Peer Review Web Program, https://peerreview.aicpa.org/public_file_search.html. Staff manually matched 
those firms by auditor name and, if necessary, city and state to the 
PCAOB data. Staff identified non-U.S. firms that were part of the 
GNF by collecting data listed at Global Network Firms, PCAOB, 
https://pcaobus.org/oversight/registration/global-network-firms, and 
matching it to the PCAOB data by auditor name, city, state, and 
manually reviewing the firm summaries to compare Firm IDs. Finally, 
for non-US firms that were non-GNF, staff determined whether they 
were members of or affiliated with some other network, arrangement, 
alliance, partnership, or association using Form 2 (i.e., any audit 
firm that answered ``Yes'' for either Item 5.2a.1 or Item 5.2a.2 has 
an ``audit-related membership, affiliation, or similar 
arrangement'').
    \215\ For example, each of the following transparency reports 
state that global network policies require compliance with ISQM 1. 
See, e.g., EY Global Audit Quality Report (June 2024), available at 
https://www.ey.com/content/dam/ey-unified-site/ey-com/en-gl/insights/assurance/documents/ey-global-audit-quality-report-06-2024.pdf; BDO Transparency Report (June 2023), available at https://www.bdo.global/en-gb/about/global-network/transparency-report-2023; 
Crowe Global Transparency Report (2024), available at https://www.crowe.com/global/-/media/crowe/international/files/about-us/crowe_global_transparency_report.pdf?rev=015641ea64c9491983ed47106226ddcf&hash=492F11006140712E365E07C80FF9CD5E.
---------------------------------------------------------------------------

    Another 845 firms of the 1,554 firms registered with the PCAOB have 
not performed an engagement under PCAOB standards for an issuer or 
registered broker-dealer within the past year and thus would only be 
subject to the design-only requirement.\216\ Out of these 845 firms, 
259 are U.S. firms that issued opinions under AICPA standards and, 
should they continue to do so, will have to implement SQMS 1; 98 are 
non-U.S. firms that are GNFs and are therefore likely to implement ISQM 
1; and another 255 are non-U.S. firms that have an audit-related 
membership, affiliation, or similar arrangement. As discussed above, we 
believe having an audit-related membership, affiliation, or similar 
arrangement indicates these firms will likely have implemented ISQM 1. 
Hence, in total, we believe that 612 of the 845 firms that have not 
performed an engagement under PCAOB standards for an issuer or 
registered broker-dealer within the past year (i.e., 72%), by the 
effective date of QC 1000, will already be subject to quality control 
requirements that share a basic structure with the design-only 
requirements in QC 1000. This significantly reduces both the costs and 
benefits of the Amendments to these firms, as discussed above. Taken 
together, 1,194 of the 1,554 (i.e., 77%) firms registered with the 
PCAOB are unlikely to incur significant incremental costs under QC 
1000.
---------------------------------------------------------------------------

    \216\ Lastly, 50 of the 1554 firms have not yet filed a Form 2; 
thus, staff could not determine which of these firms had an audit 
report or played a substantial role for the audit of at least one 
issuer or registered broker-dealer. Staff were also unable to 
determine how many of these 50 firms will already be subject to 
quality control requirements that share a basic structure with the 
requirements in QC 1000.
---------------------------------------------------------------------------

    One commenter stated that the Board did not adequately consider the 
extent to which the Amendments could impact entities other than issuers 
and registered broker-dealers in its assessment of the Amendments' 
economic effects.\217\ We agree that QC 1000 will indirectly affect 
parties other than issuers and registered broker-dealers, as the 
Commission has promulgated rules requiring the use of PCAOB-registered 
or PCAOB-registered and inspected audit firms by other entities, 
including, but not limited to, certain investment advisers, pooled 
investment vehicles, security-based swap data repositories, and 
clearing agencies.\218\ For example, Rule 206(4)-2 under the Investment 
Advisers Act of 1940 requires that (1) advisers using a related person 
as custodian must obtain their surprise examination and internal 
control report from a PCAOB-registered and inspected auditor, and (2) 
advisers relying on the audit exception from the surprise examination 
requirement with respect to a pooled investment vehicle must have the 
pooled investment vehicle audited by a PCAOB-registered and inspected 
auditor.\219\ Below we discuss some of the potential effects of the 
Amendments on these other regulated entities.
---------------------------------------------------------------------------

    \217\ See letter from Chamber.
    \218\ See, e.g., 17 CFR 275.206(4)-2 (custody of funds or 
securities of clients by investment advisers); 17 CFR 240.13n-11 
(chief compliance officer of security-based swap data repository; 
compliance reports and financial reports); 17 CFR 240.17ad-22 
(standards for clearing agencies); 17 CFR 240.15c3-1g (conditions 
for ultimate holding companies of certain brokers or dealers, 
Appendix G to 17 CFR 240.15c3-1); and 17 CFR 240.18a-1 (net capital 
requirements for security-based swap dealers for which there is not 
a prudential regulator).
    \219\ See 17 CFR 275.206(4)-2.
---------------------------------------------------------------------------

    One commenter on the Proposing Release asserted that audit firms' 
financial incentives to operate too lean undermine audit quality.\220\ 
The Board agreed and, more generally, identified market failures and 
thus a need for regulatory action. As a general matter, the Board 
explained that there are information asymmetries between auditors and 
investors and other financial statement users regarding the services 
performed by auditors.\221\ Also there are positive externalities in 
the audit market. Specifically, while the services of an auditor 
provide benefits to a variety of investors and financial statement 
users, auditors do not bargain with all of these parties, but, rather, 
are appointed, compensated, and retained by the audit committee.\222\ 
The Board stated that some beneficiaries of the auditor's work (e.g., 
the investing public generally, who benefit from overall confidence in 
the quality of financial information provided to the market) may have 
no influence on the auditor at all.\223\
---------------------------------------------------------------------------

    \220\ See Adopting Release, supra note 9, at 335.
    \221\ Id. at 333.
    \222\ Id.
    \223\ Id. at 334.
---------------------------------------------------------------------------

    We agree that the information submitted by the PCAOB demonstrates 
that these market failures exist in the market for audit services. 
Information asymmetries could create a risk that auditors may under-
perform and gather insufficient audit evidence to support their opinion 
or may otherwise depart from applicable requirements unbeknownst to 
market participants who rely on financial statements. This risk could 
be exacerbated as auditors directly contract with issuers (through the 
audit committee), not investors and financial statement users. The 
principal-agent relationship between audit firms and issuers could 
exacerbate the risk that auditors may not be incentivized to gather 
sufficient audit evidence to support their opinion or otherwise depart 
from applicable requirements, potentially harming financial statement 
users or market participants generally.

[[Page 74341]]

As a result, we agree with the Board that the audit market may not 
provide sufficient economic incentives for all firms to design, 
implement, and operate QC systems that provide reasonable assurance. 
Additionally, the Board explains that current PCAOB QC standards do not 
directly address recent QC developments, so that the current regulatory 
baseline is not rigorous enough to sufficiently support the Board's 
ability to address audit performance deficiencies through PCAOB 
inspection and enforcement activities related to firms' QC 
systems.\224\
---------------------------------------------------------------------------

    \224\ Id. at 336-37.
---------------------------------------------------------------------------

    Having established the regulatory baseline and need for regulatory 
action, the PCAOB's analysis then discusses the anticipated economic 
benefits of the Amendments. With respect to benefits, the Board states 
that the QC 1000 requirements provide substantial additional direction 
to firms regarding the design, implementation, and operation of their 
QC systems. The Board identifies three overarching beneficial features 
of these requirements. The first feature pertains to the mandate for a 
more integrated, proactive, and risk-based QC system. The second 
pertains to the enhancements to accountability within the firm to 
achieve the reasonable assurance objective. The third pertains to more 
precise language and more prescriptive requirements in several key 
areas.\225\
---------------------------------------------------------------------------

    \225\ Id. at 338.
---------------------------------------------------------------------------

    We agree with the Board that the QC 1000 requirements will benefit 
investors and other financial statement users by improving compliance, 
including through PCAOB inspections and enforcement, with applicable 
professional and legal requirements via a more risk-based, accountable, 
and detailed QC standard.\226\ Such a QC standard will help improve 
audit quality resulting in more accurate and more reliable financial 
statements regarding the financial position and operating results of 
companies.\227\ Investors may, in turn, use this information to improve 
the efficiency of their capital allocation decisions (e.g., investors 
may more accurately identify companies with the strongest prospects for 
generating future risk-adjusted returns and allocate their capital 
accordingly), thereby also improving market efficiency.\228\ Investors 
may also perceive reduced risk in capital markets generally, promoting 
capital formation.\229\ The magnitude of these effects will depend on 
the degree to which auditors improve their QC systems and the degree to 
which the incremental improvements lead to higher audit quality.
---------------------------------------------------------------------------

    \226\ Id. at 341-43.
    \227\ See id. at 343.
    \228\ See id. at 343-45.
    \229\ See id. at 344.
---------------------------------------------------------------------------

    The PCAOB's analysis also discusses the anticipated economic costs 
of the Amendments. The Board stated that it expects the QC 1000 
requirements will result in direct and indirect costs to auditors and, 
potentially, indirect costs to the companies that they audit. The Board 
also noted that the extent of these costs will depend on the degree to 
which firms otherwise have QC systems in place designed to comply with 
Other QC Standards and the specific policies and procedures adopted by 
the firm. We agree that audit firms will incur compliance costs, both 
one-time implementation costs and ongoing operating costs (at the firm 
level and at the engagement level), associated with the QC 1000 
requirements. To the extent that audit firms pass on these cost 
increases to their clients, these clients would incur indirect costs 
such as in the form of higher audit fees.
    As the Adopting Release acknowledges, the Board received a number 
of comments stating there will be costs and challenges to implement and 
operate features of QC 1000 that are incremental to the systems firms 
have established to comply with Other QC Standards.\230\ Several 
commenters also asserted that firms that audit between 100 and 500 
issuers will be significantly impacted by costs associated with some or 
all of QC 1000's incremental requirements for firms that issue audit 
reports for more than 100 issuers, and some of the commenters noted 
resource differences between GNFs and annually-inspected NAFs.\231\ 
Other commenters stated that smaller firms may be especially affected 
by the new QC requirements, including requirements incremental or 
alternative to ISQM 1 and SQMS 1 standards.\232\
---------------------------------------------------------------------------

    \230\ See id. at 44.
    \231\ See id. at 66.
    \232\ See id. at 58.
---------------------------------------------------------------------------

    Similarly, the Commission received a number of comments about the 
potential costs of the Amendments.\233\ One commenter stated that the 
requirements mean that PCAOB-registered, but not inspected, audit firms 
must comply with the design-only requirement, although these firms do 
not render audit reports on issuer or broker-dealer engagements or play 
a substantial role in such engagements.\234\ The same commenter stated 
that firms that are registered, but not inspected, are smaller audit 
firms that serve market segments for entities that become smaller 
issuers and broker-dealers, including emerging growth companies. 
Another commenter similarly stated the adopting release's design-only 
requirement for firms that do not issue audit reports for issuers 
imposes undue burdens on competition that will hurt smaller issuers 
(including emerging growth companies), investors, and the 
competitiveness of the audit marketplace.\235\ One commenter expressed 
concerns over the significant costs of designing a system of QC in 
accordance with QC 1000 on a hypothetical basis, also stating that even 
for firms that are performing a small number of engagements under PCAOB 
standards, the requirement to comply with two standards (i.e., either 
ISQM 1 or SQMS 1 and QC 1000) with two different sets of deficiency 
definitions and conclusion frameworks could present similar cost 
constraints.\236\ The same commenter requested that the effective date 
of QC 1000 implementation for these firms be deferred until such time 
as they determine they intend to perform engagements in accordance with 
PCAOB standards and consider whether explicit guidance could be 
developed that would explain that a registered accounting firm is 
essentially prohibited from undertaking PCAOB engagements until a 
system of QC that complies with QC 1000 is in place.
---------------------------------------------------------------------------

    \233\ See, e.g., letters from BDO; Chamber; PIPCA; and PWC.
    \234\ See letter from Chamber.
    \235\ See letter from PICPA. See also, e.g., letters from BDO 
and Chamber.
    \236\ See letter from PWC.
---------------------------------------------------------------------------

    We agree with the Board's assessment that there are costs to 
designing and implementing a QC system. As discussed above, as of 
August 2024, 845 firms of the 1,554 firms (i.e., 54%) registered with 
the PCAOB have not performed an engagement under PCAOB standards for an 
issuer or registered broker-dealer within the past year and would 
therefore not bear the costs to implement and operate the QC 
system.\237\ QC systems are resource-

[[Page 74342]]

intensive, and audit firms could incur significant costs to respond to 
certain provisions in QC 1000 or to otherwise adapt the QC system to 
the auditing environment for issuers and registered broker-dealers. 
Furthermore, as noted above, these costs would extend to PCAOB-
registered firms providing audits to entities other than issuers and 
broker-dealers pursuant to SEC rules (including, but not limited to, 
certain investment advisers, pooled investment vehicles, security-based 
swap data repositories, and clearing agencies), which may have an 
indirect impact on such other entities.\238\
---------------------------------------------------------------------------

    \237\ This count does not account for the 50 firms out of 1,554 
that have not yet filed a Form 2, as Commission staff could not 
determine which of these 50 firms issued an audit report or played a 
substantial role for the audit of at least one issuer or registered 
broker-dealer. See supra note 216. The PCAOB made similar findings 
in 2023. See Adopting Release, supra note 9, at 345 (stating that, 
based on Form 2 reporting as of June 30, 2023, approximately 60% of 
registered firms reported that they had not issued an audit report 
for an audit of an issuer or broker-dealer or played a substantial 
role in such an engagement during the preceding 12 months).
    \238\ See supra note 218.
---------------------------------------------------------------------------

    The Board also acknowledges that the Amendments could 
disproportionately affect smaller firms and cause some firms to exit 
the public company audit market or deter other firms from future entry. 
Entry deterrence could be exacerbated by the fact that being registered 
with the PCAOB will subject firms to certain QC requirements even if 
they do not perform engagements. Nevertheless, the Board states that it 
does not expect the effects on smaller firms to be significant.\239\ 
The Board expressed the view that QC 1000 shares a basic structure and 
approach with ISQM 1 and SQMS 1,\240\ so designing for the incremental 
features unique to QC 1000 should not be unduly burdensome for firms 
that are subject to either or both of those Other QC standards.
---------------------------------------------------------------------------

    \239\ See Adopting Release, supra note 9, at 354; see also PCAOB 
response letter at 23.
    \240\ As discussed in Section III above, Commission staff 
compared QC 1000 with the requirements of ISQM 1 and SQMS 1 and 
similarly concluded that there is significant overlap.
---------------------------------------------------------------------------

    We agree that implementation costs could be disproportionately 
greater for smaller audit firms than for larger audit firms. The cost 
of implementing QC 1000 depends in significant part on the degree to 
which auditors' existing QC systems already comply with QC 1000 
requirements. PCAOB-registered, but not inspected, audit firms that 
decide to comply with the design portions of QC 1000 will incur the 
design costs. This could, as discussed above in Section III.A, place 
these firms in a better position to compete for work participating in 
audits of issuers or registered broker-dealers at a level below that of 
a ``substantial role.'' This could also position these firms to expand 
their business into audits of SEC-registered issuers and broker-
dealers, but these firms would incur additional implementation and 
operation costs to do so. Alternatively, these firms could choose to 
avoid the design costs by withdrawing from PCAOB registration given 
that they are not required to be registered with the PCAOB; however, we 
note that this withdrawal would not impact these firms' eligibility to 
compete for work participating in audits of issuers or registered 
broker-dealers at a level below that of a ``substantial role.'' The 
impact of QC 1000 implementation and operation costs on an audit firm 
will also depend on the audit firm's ability to absorb those costs or 
pass them onto their clients (i.e., higher audit fees). Smaller audit 
firms may be disproportionally vulnerable to implementation costs, 
because smaller firms will distribute their fixed implementation costs 
over a smaller number of engagements, thus resulting in a higher 
average implementation cost per engagement. By contrast, larger PCAOB 
audit firms, especially those that already have extensive QC systems in 
place, may benefit from economies of scale or scope when incorporating 
the new requirements into their existing systems, which would in turn 
reduce their cost of implementing and operating QC 1000 per engagement. 
Conversely, larger audit firms are likely to have more complex clients 
and more diverse client portfolios, which could require higher 
implementation costs for an effective QC system.
    The Commission also received several comments expressing concern 
that the EQCF requirement, in particular, would be costly or difficult 
to fulfill, especially for firms that audit between 100 and 500 
issuers.\241\ One commenter stated that the proposed EQCF role is 
``vastly different'' from the role that the PCAOB proposed in 2022 and 
asserted that the economic analysis in the Adopting Release ``does not 
provide substantive analysis to justify the costs, benefits and 
unintended consequences.'' \242\ Another commenter stated the EQCF 
requirement would involve ``significant additional internal and 
external costs arising from (1) entering into a new arrangements [sic] 
with the same or other individuals who are determined to have 
sufficient competence for the specific role and who satisfy the rule as 
adopted, (2) sufficiently compensating individuals fulfilling the EQCF 
role for their time and potential liability, and (3) the additional 
resources needed for the firm to enable the EQCF to perform the 
required duties.'' \243\ This commenter added that these costs would be 
passed on to issuers (and ultimately investors).
---------------------------------------------------------------------------

    \241\ See, e.g., letters from BDO; Chamber; PICPA; and PWC.
    \242\ See letter from BDO.
    \243\ See letter from PWC; see also, e.g., letters from BDO and 
PICPA.
---------------------------------------------------------------------------

    The PCAOB's economic analysis considered the economic implications 
of the EQCF requirement. The Board states that all U.S. GNFs indicate, 
as of the 2020 inspection cycle, they already have a governance 
structure that includes a non-employee, suggesting that, in contrast to 
commenters' assertions, the costs (as well as the benefits) of this 
requirement could be attenuated.\244\ In addition, in response to 
comments critiquing the Board's analysis of the EQCF requirement, the 
Board provided in the PCAOB response letter additional data from the 
U.K., as the independent non-executive (``INE'') role for audit firms 
in the U.K. is partially analogous to the EQCF. The Board reports that, 
according to transparency reports from six large U.K. audit firms, 
total per firm compensation for individual INEs ranged from roughly 
$80,000 to $400,000 in 2023.\245\
---------------------------------------------------------------------------

    \244\ See Adopting Release, supra note 9, at 356-57.
    \245\ See PCAOB response letter at 19-20.
---------------------------------------------------------------------------

    The Board has scaled the EQCF requirement to apply to only 13 of 
the PCAOB-registered firms, namely those that issued audit reports for 
more than 100 issuers as of 2023.\246\ Scaling the EQCF requirement in 
this way, while reducing the benefits, significantly mitigates concerns 
regarding competition in the audit market. Further, the incremental 
demand for qualified individuals would be relatively small compared to 
the available supply, further limiting potential costs to compensate 
individuals performing the EQCF role.
---------------------------------------------------------------------------

    \246\ See supra note 30.
---------------------------------------------------------------------------

    In addition, as discussed in Section III.B above, the Amendments 
provide firms with significant flexibility to implement the EQCF 
requirement in a manner that suits their particular needs and 
circumstances. For example, the Amendments do not prescribe specific 
qualifications for the EQCF. Aside from the responsibility of 
evaluating the significant judgments made and the related conclusions 
reached by the firm on the effectiveness of its QC system, firms can 
determine the appropriate scope, responsibilities, and qualifications 
for the EQCF based on their existing governance structures and the 
complexity of their QC systems. This flexibility will allow firms to 
integrate the EQCF into their current practices without the need for 
significant restructuring or additional resources, thereby minimizing 
the financial and operational burden of compliance. In addition, the 
flexibility of the QC 1000 standard will allow firms to focus on 
addressing their

[[Page 74343]]

unique risks and challenges, reducing the potential for duplicative 
efforts or unnecessary expenditures.
    Relatedly, some commenters noted that, because certain provisions 
of the Amendments, such as the EQCF requirement, have a 100-issuer 
threshold, this threshold could deter triennially inspected firms from 
accepting new public company audit engagements or cause firms to feel 
compelled to consider reducing their issuer count to avoid crossing the 
100-issuer threshold.\247\ We acknowledge this possibility, but for the 
reasons discussed below, we believe its economic effect is likely 
modest, as there is a limited number of firms near the 100-issuer 
threshold. PCAOB staff analysis of audit reports included in SEC 
filings identified that, during the 2022 calendar year, only two NAFs 
audited between 80 and 100 issuers and only two NAFs audited between 
100 and 120 issuers. In addition, as discussed above, the Amendments 
provide firms with significant flexibility to implement the EQCF 
requirement, which should help to mitigate costs associated with this 
requirement and thus any potential incentives for firms near the 100-
issuer threshold to alter their audit engagement practices.
---------------------------------------------------------------------------

    \247\ See, e.g., letter from Moss Adams.
---------------------------------------------------------------------------

    Several commenters on the Proposing Release expressed the concern 
that competition in the audit market will be adversely impacted by the 
requirements.\248\ One commenter stated that the incremental 
requirements of QC 1000 relative to Other QC Standards could lead 
smaller high-quality firms to exit the market. One commenter said that 
the certification requirement would be an especially significant driver 
of exit, particularly for smaller firms. Some commenters suggested that 
the design-only requirement could lead those firms to deregister with 
the PCAOB or create a barrier to entry. One commenter added that the 
design-only requirement could impact audit markets beyond the United 
States by creating a disincentive for foreign firms to serve specific 
audit markets. One commenter also noted that QC 1000 requirements may 
serve as an impediment to audit firm mergers and acquisitions and 
otherwise perturb market activity.
---------------------------------------------------------------------------

    \248\ See Adopting Release, supra note 9, at 361-62.
---------------------------------------------------------------------------

    We agree that the compliance costs associated with the QC 1000 
requirements could lead some firms to exit the public company audit 
market, thereby lessening competition in that market. However, as 
discussed above, many firms already are, or will be, subject to 
comparable standards and are unlikely to incur costs so substantial 
that they exit the public company audit market. Moreover, as also 
described above, the Amendments are targeted so that the largest firms, 
which would be less likely to exit the market, are the ones likely to 
incur the most significant costs. These factors considerably lessen the 
potential adverse impact on competition in the audit market.

D. Form QC Confidentiality

    QC 1000 provides that a firm must report annually to the PCAOB on 
nonpublic Form QC, in accordance with the instructions to that form, 
the results of the evaluation of its QC system.\249\ The PCAOB 
explained in the Adopting Release that, although it recognized the 
desire of investors and other stakeholders for information related to 
audit quality and the effectiveness of QC systems, the Board's ability 
to require firms to publicly disclose their QC deficiencies is subject 
to certain legal constraints imposed by SOX as discussed in greater 
detail below.\250\
---------------------------------------------------------------------------

    \249\ Id. at 258.
    \250\ Id.
---------------------------------------------------------------------------

    One commenter stated that they are concerned that the 
confidentiality protections of Section 105(b)(5)(A) of SOX related to 
information provided to the PCAOB through inspection does not appear to 
apply to information reported through Form QC and stated that the 
PCAOB's response to this issue in the Adopting Release appears to 
acknowledge that it cannot guarantee the confidentiality it promised 
under the proposed rule.\251\ This commenter also suggested that any 
information required by QC 1000 should be submitted by firms to the 
PCAOB only through the inspections process to ensure that it would 
receive confidential treatment under SOX Section 105(b)(5)(A).\252\
---------------------------------------------------------------------------

    \251\ See letter from BDO.
    \252\ Id.
---------------------------------------------------------------------------

    We believe these concerns are largely misplaced. Certain 
information contained within a Form QC may be subject to the 
protections of SOX Section 105(b)(5)(A), which addresses documents and 
information prepared or received by or specifically for the Board in 
connection with an inspection or investigation. Furthermore, in certain 
circumstances, remedial actions reported in Form QC may be subject to 
laws relating to the confidentiality of proprietary, personal, or other 
information, and in such a scenario, the Board, in accordance with SOX 
Section 102(e) would need to honor a firm's properly substantiated 
request for confidential treatment of such information.\253\ The PCAOB 
also adopted Rule 2203A(c), which provides that Form QC will be non-
public, in light of the confidentiality provision that applies to 
quality control criticisms and potential defects identified during a 
PCAOB inspection in SOX Section 104(g)(2).\254\ To the extent that 
certain information contained within a Form QC meets the requirements 
of the statutory confidentiality protections described above, such 
protections would apply to that information to the same extent as any 
other information submitted to the PCAOB. We find such an approach to 
be appropriate in that it aligns the extent of the confidentiality of 
information in Form QC with the broader statutory framework created by 
Congress in SOX.
---------------------------------------------------------------------------

    \253\ See 15 U.S.C. 7212(e); PCAOB Rule 2300(b). We understand 
that firms are accustomed to requesting and receiving confidential 
treatment from the Board.
    \254\ See PCAOB Rule 2203A(c) as adopted.
---------------------------------------------------------------------------

    In response to this commenter's suggestion that any information 
required by QC 1000 should be submitted by firms to the PCAOB only 
through the inspections process, we believe that the information 
provided by Form QC, which in some cases would be provided more 
frequently than firms are inspected, would provide important 
information that could inform improvements in the PCAOB's standard-
setting, economic and risk analysis, and registration program--separate 
and apart from the benefits of the PCAOB's inspection program which is 
focused on audit engagements.\255\ These improvements, in our view, 
would have concomitant benefits to audit quality and investors.
---------------------------------------------------------------------------

    \255\ See Adopting Release, supra note 9, at 263-64.
---------------------------------------------------------------------------

E. Evaluation Date

    The Amendments require firms to evaluate their QC system annually 
as of September 30 and conclude whether any unremediated QC 
deficiencies exist as of that date.\256\ The PCAOB stated it believed 
an evaluation date of September 30 would provide firms with enough time 
to identify and potentially remediate any QC deficiencies identified 
from the most recent calendar year-end engagements, which might not be 
possible if an earlier date were selected.\257\ In addition, the PCAOB 
adjusted the specified evaluation date from the initially proposed date 
of November 30th to September 30th to address commenter concerns that 
the November 30th date would have caused

[[Page 74344]]

potential resource limitations during the traditional busy period for 
many firms.\258\
---------------------------------------------------------------------------

    \256\ Id. at 245.
    \257\ Id. at 246.
    \258\ Id.
---------------------------------------------------------------------------

    Commenters raised concerns with the specified quality control 
evaluation date of September 30th, citing concerns including that a 
fixed evaluation date may misalign the assessment of quality with 
employee or partner compensation to the extent firms have established 
compensation cycles that do not align with the September 30th date, as 
well as concerns regarding the timing of the inspection cycle 
potentially limiting the firms' ability to fully assess the impact of 
inspections in their QC evaluation.\259\ One commenter additionally 
raised a concern that a firm that already chose its evaluation date 
under ISQM 1 would be required to either change its ISQM 1 evaluation 
date or perform two QC system evaluations per year.\260\
---------------------------------------------------------------------------

    \259\ See, e.g., letters from BDO; Forvis Mazars; GT; Moss 
Adams; PICPA; and RSM.
    \260\ See letter from BDO.
---------------------------------------------------------------------------

    We agree with the PCAOB's conclusion that an evaluation date of 
September 30th would provide the audit firm with sufficient time to 
identify and potentially remediate QC deficiencies identified from the 
most recent calendar year-end engagements before the evaluation date. 
Given the ongoing nature of audits, which are driven by issuers' fiscal 
year-ends, firms' inspections cycles, and remediation activities, any 
fixed evaluation date will necessarily result in certain activities 
being split between QC evaluation years. The PCAOB's selected 
evaluation date of September 30 addressed the comments the PCAOB 
received on the proposal, as noted above, and we believe should provide 
time for a majority of inspections to be completed and considered in 
the same QC evaluation year. Moreover, including a specified evaluation 
date across firms provides for consistency and comparability of the 
firms' quality control reporting, which enhances the PCAOB's ability to 
assess and respond to firms' QC evaluations and thereby increases 
investor protection. We do not believe that firms that have already 
selected an evaluation date under Other QC standards would be required 
to perform two evaluations. First, QC 1000 allows firms to build on 
work already done, to the extent applicable, for the purpose of 
complying with the requirements of Other QC Standards. Second, firms 
are permitted to change their evaluation date under Other QC Standards 
so that the evaluation dates coincide.

F. Effective Date

    As stated in the PCAOB's Adopting Release, QC 1000 and related 
amendments to auditing standards, rules, and forms will take effect on 
December 15, 2025.\261\ The PCAOB stated that it believes an effective 
date of December 15, 2025 strikes an appropriate balance between the 
benefits to investors of having QC 1000 take effect as promptly as 
practicable, and allowing sufficient time for firms to design and 
implement robust, QC 1000-compliant QC systems.\262\
---------------------------------------------------------------------------

    \261\ See Adopting Release, supra note 9, at 378.
    \262\ Id.
---------------------------------------------------------------------------

General
    Commenters expressed concerns that the effective date would not 
provide firms with sufficient time to implement the new standard,\263\ 
with one commenter suggesting the Commission require the PCAOB to 
extend the implementation deadline.\264\ Another commenter stated that 
the PCAOB should have reopened the comment period for the Amendments to 
allow for additional comments on a reasonable effective date in light 
of the PCAOB's other recently proposed or adopted standards and 
rules.\265\
---------------------------------------------------------------------------

    \263\ See, e.g., letters from Forvis Mazars; Johnson Global; 
Moss Adams; and PICPA.
    \264\ See letter from Moss Adams.
    \265\ See letter from Chamber.
---------------------------------------------------------------------------

    The PCAOB response letter reaffirms the Board's view stated above 
that the effective date of December 31, 2025 strikes a reasonable 
balance between providing firms with sufficient time and promptly 
delivering the benefits to investors.\266\ The PCAOB acknowledged that, 
subject to adoption by the PCAOB and approval by the Commission, 
several PCAOB standards and rules could come into effect over the next 
few years, and that the relevant audit labor market may be relatively 
inelastic in the short run. However, the PCAOB explained that 
implementing multiple PCAOB standards and rules in quick succession 
could potentially reduce the incremental costs attributable to each 
change in requirements, if, for example, firms were able to more 
efficiently implement certain systems or training on an integrated 
basis, addressing multiple new requirements simultaneously.\267\ We 
understand that the PCAOB took into consideration its full standard-
setting and rulemaking agenda when selecting the effective date.\268\
---------------------------------------------------------------------------

    \266\ See PCAOB response letter at 21-22.
    \267\ Id. at 27-28.
    \268\ See PCAOB response letter at 27-28.
---------------------------------------------------------------------------

    In our view, December 15, 2025, is a reasonable effective date for 
the Amendments. Commenters on the Proposing Release, which specified an 
effective date of December 31, 2024, suggested a variety of 
alternatives, including several that suggested December 31, 2025 or 12 
to 18 months after SEC approval. The PCAOB took this feedback into 
consideration when it revised the effective date to December 15, 2025. 
Significantly, this date aligns with the implementation date of the 
AICPA's SQMS 1 QC standard, which will be required for all U.S. audit 
firms that issue reports under AICPA standards, and which shares a 
basic structure with QC 1000. As a consequence, aligning the effective 
date of QC 1000 with SQMS 1 may reduce implementation costs for U.S. 
firms that are required to implement both. With respect to the 
commenter's concerns about the effective date as it relates to the EQCF 
requirement, we note that the PCAOB considered the implementation 
requirements of the EQCF in determining the appropriate effective date 
for QC 1000.\269\ Finally, with respect to the commenter's concerns 
about sufficient time being provided for the general implementation of 
other recently proposed and effective PCAOB standards, we acknowledge 
there are instances where more than one standard becomes effective 
within a six-month period; however, we think the effective dates are 
sufficiently staggered such that audit firms will have either already 
implemented, or largely implemented, some of the standards referenced 
by the commenter or will have sufficient time to do so before 
compliance with the Amendments is required.\270\
---------------------------------------------------------------------------

    \269\ See Adopting Release, supra note 9, at 378.
    \270\ For example, implementation efforts are expected to be 
largely completed for recently adopted PCAOB standards relating to 
the Supervision of Audits Involving Other Auditors and Dividing 
Responsibility for the Audit with Another Accounting Firm (effective 
for audits of financial statements for fiscal years ending on or 
after December 15, 2024), available at https://www.sec.gov/files/rules/pcaob/2022/34-95488.pdf and Auditor's Use of Confirmation 
(effective for audits of financial statements for fiscal years 
ending on or after June 15, 2025), available at https://www.sec.gov/files/rules/pcaob/2023/34-99060.pdf, as the fiscal years for which 
the standards apply have already begun. Certain other recently 
adopted rules and standards, for example Auditing Standard 1000, 
General Responsibilities of the Auditor in Conducting an Audit, 
available at https://www.sec.gov/files/rules/pcaob/2024/34-100773.pdf and Amendment to PCAOB Rule 3502 Governing Contributory 
Liability, available at https://www.sec.gov/files/rules/pcaob/2024/34-100772.pdf, are not expected to require significant 
implementation efforts due to minimal changes to performance 
requirements.

---------------------------------------------------------------------------

[[Page 74345]]

EQCF Considerations
    One commenter raised concerns with the effective date specific to 
the EQCF requirement, stating that the approximately 18-month time 
period would not provide sufficient time to identify, vet, contract and 
onboard an EQCF.\271\
---------------------------------------------------------------------------

    \271\ See letter from Moss Adams.
---------------------------------------------------------------------------

    The external oversight requirement was included in the standard 
that the PCAOB proposed for comment. While the PCAOB made some changes 
to the proposed requirement in response to commenters, such as 
providing additional specificity and clarity about the role, the 
changes made did not impact many of the fundamental requirements for 
the role such as the requirement for the individual or individuals 
filling the role to be able to exercise independent judgment with 
regard to matters related to the QC system, the requirement for one or 
more individuals to fill the role, and the significant flexibility 
provided to audit firms to design procedures that work best for their 
individual firm governance structure and requirements. We believe such 
changes should not have a significant impact on the timeline for firms 
to complete the hiring process for an EQCF, such that an extended 
effective date would be necessary (nor does the commenter explain why 
this would be so). We thus conclude the effective date as adopted is 
appropriate.

G. Other Comments

    One commenter stated that the PCAOB's comment period for the 
Amendments was inadequate, or should have been reopened, in light of 
other Board proposals.\272\ A few commenters stated that if the 
Amendments are approved, PCAOB engagement with firms during the 
implementation period is necessary.\273\ Several commenters encouraged 
the PCAOB to undertake a post-implementation review of the Amendments 
\274\ or provide implementation guidance.\275\
---------------------------------------------------------------------------

    \272\ See letter from Chamber.
    \273\ See, e.g., letters from CAQ and PWC.
    \274\ See, e.g., letters from CII; Consumer Federation of 
America; L. Turner (stating that the SEC should instruct the PCAOB 
to conduct a post-implementation review); and Members of the IAG.
    \275\ See letters from GT and RSM.
---------------------------------------------------------------------------

    We acknowledge the importance of monitoring the implementation of 
the Amendments, prior and subsequent to their effective date. The PCAOB 
response letter states that the Board anticipates its staff will issue 
implementation guidance and will engage in other activities to support 
firms' implementation efforts.\276\ Further, the Commission staff works 
closely with the PCAOB as part of our general oversight mandate. As 
part of that oversight, Commission staff will keep apprised of the 
PCAOB's activities for monitoring the implementation of the Amendments, 
prior and subsequent to the effective date, and update the Commission, 
as necessary and appropriate. Finally, as discussed above regarding 
notice and comment considerations around the EQCF requirement, we 
believe 75 days was an appropriate period for commenters to provide 
feedback on the Proposing Release and note that, consistent with 
typical practice, the Board did not limit its consideration of comments 
to those received during its designated comment period but effectively 
provided for a longer comment period by considering all comments it 
received prior to the date of adoption.\277\
---------------------------------------------------------------------------

    \276\ See PCAOB response letter at 28.
    \277\ The Proposing Release was issued on November 18, 2022, and 
it requested comments by February 1, 2023. See supra note 11. The 
comment file includes comments that were submitted through March 6, 
2023, and the PCAOB stated in the Adopting Release that it 
considered all forty-two (42) comments it received. See Adopting 
Release, supra note 9, at 35.
---------------------------------------------------------------------------

    Some commenters reiterated comments made on the Concept Release and 
Proposing Release, including: concerns regarding the requirement that 
only one person be assigned operational responsibility for the firm's 
compliance with ethics and independence requirements; \278\ a belief 
that the Amendments are too prescriptive, especially in regards to the 
specified quality responses; \279\ disagreement that all engagement 
deficiencies require remediation; \280\ concerns that the Amendments 
differ from Other QC Standards and will require firms to have multiple 
QC systems; \281\ and a request that smaller firms (e.g., triennially 
inspected firms that issue 100 or fewer issuer audit reports) be 
provided with the option to comply with ISQM 1 or SQMS 1 as an 
acceptable alternative to QC 1000.\282\
---------------------------------------------------------------------------

    \278\ See letter from BDO.
    \279\ See letter from PICPA (recommending that the standard 
instead include more specified quality objectives, which would 
reduce barriers to entry by promoting scalability).
    \280\ See letter from Forvis Mazars.
    \281\ See letters from Johnson Global and PICPA.
    \282\ See letter from Johnson Global.
---------------------------------------------------------------------------

    We acknowledge commenters concerns with these specific aspects of 
the Amendments and note that the PCAOB considered and addressed all of 
these matters in the Adopting Release.\283\ On balance, we find that 
the Amendments strike an appropriate balance between specified mandates 
to enhance the effectiveness of its QC systems and to ensure they are 
designed and operated with an appropriate level of rigor, and providing 
appropriate flexibility to tailor such systems to the specific risks 
associated with the firm's practice or organizational structure. 
Further, we do not believe that the Amendments will require firms to 
maintain multiple systems of quality control. We find that QC 1000 
shares the same basic structure as and is consistent with Other QC 
Standards and firms are able to build upon the work performed for Other 
QC Standards to implement incremental requirements from QC 1000. 
Neither we nor any commenters identified anything in QC 1000 that is 
incompatible with ISQM 1 or SQMS1. At least one registered public 
accounting firm has recently noted that the evolution of its system of 
quality management and its implementation of ISQM 1 has positioned the 
firm well to adapt to future regulatory developments, such as the 
quality control standard proposed by the PCAOB in November 2022.\284\
---------------------------------------------------------------------------

    \283\ See, e.g., Adopting Release, supra note 9, at 83, 42, 63-
64, 246, 295, 60, and A1-43.
    \284\ See PWC, 2023 Audit Quality Report at 49, available at 
https://www.pwc.com/us/en/services/trust-solutions/library/pdfs/pwc-2023-audit-quality-report.pdf.
---------------------------------------------------------------------------

    One commenter stated that the PCAOB response letter ``addresses and 
provides additional clarity'' on several of the questions it raised in 
the comment letter it submitted to the Commission, and the commenter 
asked the Commission to clarify whether the PCAOB response letter ``can 
be viewed as equally authoritative as the Final Standard and Adopting 
Release.'' \285\ We view the statements in the PCAOB response letter as 
being on par with statements made by the Board in the Adopting Release 
about the scope and application of the QC 1000 requirements.
---------------------------------------------------------------------------

    \285\ See CAQ Supplemental Letter.
---------------------------------------------------------------------------

    Additionally, there were requests for clarification regarding the 
definitions of ``applicable professional and legal requirements,'' 
\286\ ``other participants,'' \287\ ``QC deficiency,'' \288\ and ``firm 
personnel'' \289\ and how various requirements of the Amendments apply 
to non-employee professionals and organizations.\290\ These definitions 
and the question about non-employee professionals and organizations 
were addressed in the

[[Page 74346]]

Adopting Release,\291\ and to the extent additional clarity is needed, 
we note that the Board stated in the PCAOB response letter that it 
anticipates that its staff will issue implementation guidance and will 
engage in other activities to support firms' implementation 
efforts.\292\
---------------------------------------------------------------------------

    \286\ See letter from PICPA.
    \287\ See letter from Johnson Global.
    \288\ See letter from PICPA (stating that it disagrees that all 
engagement deficiencies are QC deficiencies and that a root cause 
analysis is required for a firm to assess whether a simple mistake 
is in fact a quality control deficiency).
    \289\ See letter from Forvis Mazars.
    \290\ Id.
    \291\ See, e.g., Adopting Release, supra note 9, at A1-43, A1-
42, A1-43, A1-42, and 47-48.
    \292\ See PCAOB response letter at 28.
---------------------------------------------------------------------------

IV. Effect on Emerging Growth Companies

    In the Notice of Filing of Proposed Rules, the Board recommended 
that the Commission determine that the Amendments apply to audits of 
EGCs.\293\ Section 103(a)(3)(C) of SOX requires that any rules of the 
Board requiring mandatory audit firm rotation or a supplement to the 
auditor's report in which the auditor would be required to provide 
additional information about the audit and the financial statements of 
the issuer (auditor discussion and analysis) shall not apply to an 
audit of an EGC.\294\ The provisions of the Amendments do not fall into 
these categories.
---------------------------------------------------------------------------

    \293\ See Notice of Filing of Proposed Rules, supra note 3.
    \294\ 15 U.S.C. 7213(a)(3)(C).
---------------------------------------------------------------------------

    Section 103(a)(3)(C) further provides that ``[a]ny additional 
rules'' adopted by the PCAOB after April 5, 2012 do not apply to audits 
of EGCs ``unless the Commission determines that the application of such 
additional requirements is necessary or appropriate in the public 
interest, after considering the protection of investors and whether the 
action will promote efficiency, competition, and capital formation.'' 
\295\ The Amendments fall within this category. Having considered those 
statutory factors, we find that applying the Amendments to the audits 
of EGCs is necessary or appropriate in the public interest.
---------------------------------------------------------------------------

    \295\ Id.
---------------------------------------------------------------------------

    With respect to the Commission's determination of whether the 
Amendments will apply to audits of EGCs, the PCAOB provided data and 
analysis of EGCs identified by the Board's staff from public sources 
that sets forth its views as to why the Amendments should apply to 
audits of EGCs.\296\
---------------------------------------------------------------------------

    \296\ See Adopting Release, supra note 9, at 374-77.
---------------------------------------------------------------------------

    The Board states that the discussion of economic impacts of the QC 
1000 requirements is generally applicable to the audits of EGCs. The 
benefits to financial reporting quality, including improved efficiency 
of capital allocation, lower cost of capital, and enhanced capital 
formation, are also pertinent to EGCs. The Board states that EGCs tend 
to be smaller and have a shorter SEC financial reporting history than 
the broader population of issuers. The Board cites to academic research 
that suggests that, for several reasons, smaller issuers tend to 
exhibit greater information asymmetry between management and investors. 
Also, PCAOB staff gathered information on Part I.A deficiencies for the 
audits of EGCs between 2013 and 2022, and these data suggest that Part 
I.A deficiencies are more common among audits of EGCs, raising 
questions about whether QC systems of firms that audit EGCs are 
effective in preventing audit deficiencies for these types of audit 
engagements. We agree that the benefits of the QC 1000 requirements are 
also relevant to EGCs.
    The Board acknowledges that to the extent the compliance costs 
associated with the QC 1000 requirements lead some smaller audit firms, 
such as some NAFs, to exit the public company audit market, then EGCs 
could be adversely impacted. PCAOB staff analysis indicates that, 
compared to exchange-listed non-EGCs, exchange-listed EGCs are 
approximately 2.6 times as likely to be audited by an NAF.
    The Board presents evidence that a large number of audit firms, 
including smaller audit firms, serve EGCs. PCAOB staff analysis 
indicates that, as of November 15, 2022, there were 3,031 companies 
that self-identified as EGCs and filed audited financial statements 
with the Commission between May 16, 2021, and November 15, 2022. Of the 
263 registered firms that audited EGCs, 227 firms (or 86%) performed 
audits for both EGC and non-EGC issuers. Approximately 98% of EGCs were 
audited by these 227 firms. These data suggest that the impact on EGCs 
of any exit by some smaller audit firms, as a result of the 
requirements, would likely be limited. For this reason, we expect that 
any potential adverse impact on EGCs and their ability to be 
competitive in their product markets will be modest.
    In addition, the Board sought public input on the application of 
the Amendments to the audits of EGCs. Those commenters that responded 
to the Board agreed the Amendments should apply to the audits of 
EGCs.\297\ In the Adopting Release, the Board explained that, in 
general, any new PCAOB standards and amendments to existing standards 
determined not to apply to the audits of EGCs would require auditors to 
address differing requirements within their methodologies or policies 
and procedures with respect to audits of EGCs and non-EGCs, which would 
create the potential for confusion.\298\ The Board further stated this 
may not be practical in the context of the QC standards because while 
some components of the QC system (such as engagement monitoring) may 
enable different approaches for audits of EGCs compared to audits of 
other companies, other elements (for example, resources and governance 
and leadership) are necessarily firm-wide and cannot easily be 
differentiated for different types of audits.\299\ The Board further 
stated that even where differentiation is possible, maintaining 
separate components for EGC and non-EGC audits may add cost or lead to 
confusion, and could run counter to the objective of integrating QC 
practices into a single continuous cycle of risk assessment, 
monitoring, and remediation.\300\
---------------------------------------------------------------------------

    \297\ See, e.g., letter received by the PCAOB on the Proposing 
Release from Ernst and Young, LLP (Feb. 1, 2023) (stating ``[w]e 
believe the proposal should apply to the audits of both emerging 
growth companies (EGCs) and non-EGC issuers.''), available at 
https://assets.pcaobus.org/pcaob-dev/docs/default-source/rulemaking/docket046/30_ey.pdf?sfvrsn=34762808_4.
    \298\ See Adopting Release, supra note 9, at 376.
    \299\ Id.
    \300\ Id.
---------------------------------------------------------------------------

    In addition, the Board stated that the benefits of the higher audit 
quality resulting from the Amendments may be more pertinent for EGCs 
than for non-EGCs, including improved efficiency of market capital 
allocation, lower cost of capital, and enhanced capital formation.\301\ 
The Amendments are expected to enhance audit quality and contribute to 
an increase in the credibility of financial reporting by EGCs, which 
are newer to the capital markets than typical non-EGCs.\302\
---------------------------------------------------------------------------

    \301\ Id. at 376-77. Also, PCAOB staff gathered information on 
Part I.A deficiencies for the audits of EGCs between 2013 and 2022, 
analyzing the percentage of inspected EGC and non-EGC issuer audits 
having at least one Part I.A deficiency. These data suggest that 
Part I.A deficiencies are even more common among audits of EGCs, 
raising questions about whether QC systems of firms that audit EGCs 
are effective in preventing audit deficiencies for these types of 
audit engagements. Id. at 375.
    \302\ Id. at 377.
---------------------------------------------------------------------------

    We agree with the Board's analysis and further emphasize the 
benefits discussed by the PCAOB, including higher audit quality leading 
to improved efficiency of capital allocation, lower cost of capital, 
and enhanced capital formation with respect to EGCs. As noted above, 
these improvements in the quality of the audit may be more pronounced 
on the audits of EGCs. While improvements in audit quality benefit all 
investors, such improvements may particularly benefit investors in

[[Page 74347]]

EGCs by increasing the credibility of their financial reporting given 
that they are typically newer to the capital markets and feature a 
higher degree of information asymmetry between management and 
investors. Improvements in audit quality provide investors with more 
accurate information, which helps them make more informed investment 
decisions. More accurate information in financial statements may also 
increase investors' confidence and, in turn, facilitate capital 
formation.
    To the extent that an EGC's auditor's existing quality control 
standards do not meet the requirements under QC 1000 and the changes 
that auditors make to their quality control system impact the 
performance of audit engagements, this could lead to a spillover 
externality effect whereby EGCs themselves may have to incur additional 
costs. For example, an EGC could have to allocate more resources to its 
own internal control systems or to additional requests for more 
extensive or additional evidence from audit firms.\303\ While this 
could be costly to the EGC, enhanced internal control over financial 
reporting at the EGC and audits that are performed in compliance with 
applicable professional standards are expected to also benefit 
investors. Audit firms may also raise audit fees for EGCs as a result 
of implementing QC 1000. Higher audit-related costs, in the form of 
EGCs' costs to support the audit and/or in fees paid to auditors, would 
in turn raise EGCs' overall costs and possibly adversely impact their 
ability to be competitive in the product markets that they operate. 
These potential costs to EGCs will be reduced to the extent EGC 
auditors will already be required to comply with the Other QC Standards 
or may choose not to pass on their incremental costs arising from the 
QC 1000 requirements in the form of higher audit fees. As discussed 
above, Commission analysis shows that approximately 88% of registered 
firms performing PCAOB engagements will, by the effective date of QC 
1000, already be subject to quality control requirements that share a 
basic structure with the requirements in QC 1000. PCAOB staff analysis 
also shows that approximately 98% of EGCs were audited by firms that 
performed audits for both EGC and non-EGC issuers.\304\ Therefore, for 
98% of EGCs being audited, there likely would be minimal incremental 
costs for QC 1000 to apply to EGCs, either due to their auditor 
implementing QC 1000, as required to audit its other issuers, or 
implementing the Other QC Standards.
---------------------------------------------------------------------------

    \303\ See Alexander, C, S. Bauguess, G. Bernile, Y. A. Lee, and 
J. Marietta-Westberg (2013) ``Economic Effect of SOX Section 404 
Compliance: A Corporate Insider Perspective,'' Journal of Accounting 
and Economics, at 56, 267-290. Based on a survey data, this paper 
shows the compliance costs of SOX 404 weigh disproportionately on 
smaller firms.
    \304\ See Adopting Release, supra note 9, at 375.
---------------------------------------------------------------------------

    Accordingly, after considering the protection of investors and 
whether the action will promote efficiency, competition, and capital 
formation, we believe there is a sufficient basis to determine that 
applying the Amendments to the audits of EGCs is necessary or 
appropriate in the public interest.\305\
---------------------------------------------------------------------------

    \305\ As noted above, during the Commission's comment period, 
two commenters raised concerns that the design-only requirement 
would burden smaller firms, which could impact smaller issuers and 
broker-dealers, including emerging growth companies. See letters 
from Chamber and PICPA. Although these commenters mentioned EGCs in 
the context of commenting on the design-only requirement, neither 
suggested that firms should be required to apply different quality 
control standards to the audits of EGCs versus non-EGCs. For the 
reasons stated above, we agree with the Board that QC 1000 should 
apply to all registered public accounting firms, including with 
respect to the audits of EGCs, because of the firm-wide nature of QC 
systems.
---------------------------------------------------------------------------

V. Conclusion

    The Commission has reviewed and considered the Amendments, the 
information submitted therewith by the PCAOB, the comment letters 
received, and the recommendation of the Commission's staff. The 
Commission concludes that the determinations made by the PCAOB as 
described in the Adopting Release are reasonable. Generally, the 
Amendments establish an integrated, risk-based quality control standard 
that can be applied by firms of varying sizes and complexities and that 
will lead registered public accounting firms to significantly improve 
their quality control systems, thereby improving audit quality and 
investor protection. Specifically, the Amendments make the following 
important changes, among others, to the existing quality control 
standards, which will advance the Board's investor protection mandate 
under SOX:
     Replace the current standards, which: (i) were developed 
by the AICPA, a professional organization for certified public 
accountants; (ii) were last updated in 1997; (iii) focus on evaluating 
firms' compliance with their own policies; (iv) do not require 
evaluation or reporting; and (v) do not contain express obligations for 
firms to perform any specific monitoring;
     Incorporate a risk-based approach to quality control, 
driving firms to proactively identify and manage the specific risks 
associated with their practices, along with a set of mandates, tailored 
to the size of the audit practice, which should assure that the quality 
control system is designed, implemented, and operated with an 
appropriate level of rigor;
     Emphasize the importance of accountability and firm 
governance through requirements around roles and responsibilities, 
assigning operational responsibility to individuals for particular 
aspects of the QC system, and the introduction of a certification by 
certain responsible individuals; and
     Create a framework for evaluation and reporting to the 
PCOAB which will be consistently applied across all firms operating a 
QC system under QC 1000.
    Therefore, in connection with the PCAOB's filing and the 
Commission's review,
    A. The Commission finds that the Amendments are consistent with the 
requirements of Title I of SOX and the rules and regulations thereunder 
and are necessary or appropriate in the public interest or for the 
protection of investors; and
    B. Separately, the Commission finds that the application of the 
Amendments to the audits of EGCs is necessary or appropriate in the 
public interest, after considering the protection of investors and 
whether the action will promote efficiency, competition, and capital 
formation.
    It is therefore ordered, pursuant to section 107 of SOX and section 
19(b)(2) of the Exchange Act, that the Amendments (File No. PCAOB-2024-
02) be and hereby are approved.

    By the Commission.
Vanessa A. Countryman,
Secretary.
[FR Doc. 2024-20714 Filed 9-11-24; 8:45 am]
BILLING CODE 8011-01-P