Highlights of Recent PCAOB Standard-Setting and Rulemaking Activities (June 18, 2024)

Highlights of Recent PCAOB Standard-Setting and Rulemaking Activities

Introduction

This Heads Up discusses recent PCAOB standard-setting and rulemaking activities, including Deloitte’s perspectives on those activities. The status of various PCAOB projects is summarized in the appendix.

PCAOB Advances Its Standard-Setting, Research, and Rulemaking Agendas

The PCAOB continues to actively pursue its mission to protect investors and further the public interest as it advances its standard-setting, research, and rulemaking agendas. Last month, the PCAOB adopted QC 1000 1 and AS 1000.2 Earlier this month, the PCAOB adopted (1) amendments to AS 11053 and AS 23014 related to aspects of designing and performing audit procedures that involve technology-assisted analysis (TAA) of information in electronic form (the “TAA Amendments”) and (2) amendments to the PCAOB’s rule on contributory liability, Rule 3502.5 This activity brings the total number of standard-setting and rulemaking projects completed by the Board in the past two years to six, the largest number of completed PCAOB projects in a two-year period since 2003. The Board’s revised agenda indicates that the PCAOB is planning to complete its project on noncompliance with laws and regulations (NOCLAR) in 2024. Other recent changes to its agenda include the addition of a new short-term Other Reporting project and a new midterm Internal Audit project, as well as moving the Inventory project from a midterm project to a short-term project with a proposal anticipated in 2025. The changes are aligned with the PCAOB’s continued progress toward its strategic goal of modernizing its standards and rules. The revised agenda also reveals the removal of the Follow-Up Disciplinary Proceedings project from the rulemaking agenda.

Continuing the Focus on Fraud

The PCAOB’s Fraud and NOCLAR standard-setting projects reflect the Board’s keen interest in the auditor’s detection of fraud, part of its stated goal to protect investors. This has also been a theme of recent meetings of the PCAOB Investor Advisory Group (IAG). For example, at the April 24, 2024, IAG meeting, it was noted that the Board highlighted fraud as a priority during its 2023 inspection cycle of 2022 year-end audits.

Deloitte’s December 10, 2023, Heads Up shares insights on the PCAOB’s inspection priorities. In addition, Deloitte’s November 10, 2023, Heads Up highlights the PCAOB’s focus on fraud.

The PCAOB’s focus on fraud was further highlighted at the May 9, 2024, meeting of the PCAOB Standards and Emerging Issues Advisory Group (SEIAG). At the meeting, PCAOB Chair Erica Williams emphasized the importance of standard setting with respect to fraud, reminding participants that fraud is what spurred the PCAOB’s formation in the wake of the Enron and WorldCom bankruptcies. Through panels and breakout sessions, members of the SEIAG explored ideas for enhancing auditor detection of fraud through standards or other means, including additional tools.

NOCLAR Roundtable

On June 6, 2023, the PCAOB issued its proposed standard 6 related to NOCLAR. Given the significant public interest in the proposal, including the recommendation from commenters for additional public outreach, the PCAOB staff held a virtual public roundtable on March 6, 2024. Deloitte participated in the roundtable, which was also attended by representatives from other firms and various other stakeholders. The roundtable included three panels and focused on (1) the proposed requirements related to the auditor’s identification of laws and regulations, (2) the proposed requirements related to the auditor’s assessment of those laws and regulations, and (3) the costs and benefits of the proposal. The roundtable highlighted a diversity of views and interpretations related to the proposal, which suggested, at a minimum, that clarity is needed on what the PCAOB intends the scope of the auditor’s responsibility to be. Once that scope is clarified, a revised economic analysis of the proposal may be required.

In conjunction with the roundtable, the PCAOB reopened the public comment period on the proposal from February 26, 2024, through March 18, 2024. As of June 18, 2024, Deloitte was one of 49 stakeholders that submitted a comment letter after the comment period was reopened. In a manner consistent with the feedback in the comment letters submitted during the initial comment period, about 80 percent of respondents expressed that they were not in favor of the proposal. In addition, many commenters explicitly recommended the issuance of a reproposal given the breadth of changes being requested in the comment letters.

In its March 18, 2024, comment letter on the NOCLAR proposal, Deloitte highlighted certain key points, reiterated the recommendations made in its 2023 comment letter, and provided additional support for the views it shared during the virtual roundtable. In addition, Deloitte provided new recommendations, including:

An explicit recommendation to leverage ISA 250 (Revised)7 to formulate amendments to existing AS 2405 related to the auditor’s enhanced risk assessment while maintaining the distinction between direct and indirect illegal acts.
A recommendation to provide staff implementation guidance as part of the final standard to help ensure consistent application and interpretation of the final standard.

As it had done during the roundtable, Deloitte emphasized in its March 18, 2024, comment letter that after making amendments to proposed AS 2405 on the basis of the feedback received from stakeholders, the PCAOB should consider reproposing AS 2405 to allow for a full and transparent vetting of the implications of changes made. Comment letters are being analyzed, and the PCAOB has indicated that it expects to issue a final standard in 2024.

PCAOB Completes Four Standard-Setting and Rulemaking Projects and Issues Four Proposals

Completed Projects

Standard on Quality Control

On May 13, 2024, the PCAOB adopted QC 1000, which provides a framework for a firm’s quality control (QC) system. The new standard, which replaces the PCAOB’s current interim QC standards in their entirety, requires all PCAOB-registered firms to (1) identify risks to achieving the required quality objectives and (2) design a QC system that includes policies and procedures to address those risks. It also requires annual reporting on the QC system evaluation to the PCAOB and expands the responsibility of auditors to correct deficiencies identified during engagements under an amended and retitled AS 2901.8 The applicability of certain requirements in the standard is based on the size of the firm; while the largest firms are subject to the standard’s more stringent requirements, smaller firms are expected to comply with the standard’s core requirements in ways that take into account the size of those firms and the complexity of the audits they perform. In addition, the final standard introduces the role of the external quality control function (EQCF), which is an outgrowth of the independent oversight role included in the proposed standard. The EQCF is required to be composed of one or more persons who do not otherwise have a relationship with the firm and, at a minimum, are required to evaluate the significant judgments made and the related conclusions reached by the firm when evaluating and reporting on the effectiveness of its QC system.

In her statement on QC 1000, Chair Williams remarked that “[w]hen QC systems operate ineffectively, investors are put at risk. But, when QC systems operate effectively, quality audits performed in accordance with applicable professional and legal requirements are likely to follow — leaving investors better protected.”

Four Board members voted in favor of adopting the new standard (and other conforming changes to standards, rules, and forms). Board Member Christina Ho cast a dissenting vote, citing undue burden on smaller firms among other significant concerns in her statement. If approved by the SEC, the final standard and related amendments to auditing standards, rules, and forms will take effect on December 15, 2025, requiring performance of the initial evaluation of the QC system as of September 30, 2026, and initial reporting to the PCAOB by November 30, 2026.

On May 24, 2024, the PCAOB submitted to the SEC a proposed rule to implement the Board’s new standard and related amendments. Interested parties are encouraged to submit comments to provide their views on the proposed rule by July 2, 2024.

Standard on Modernizing the Auditor’s Core Auditing Responsibilities

On May 13, 2024, the PCAOB adopted AS 1000, which reorganizes, consolidates, modernizes, and streamlines several of the interim standards9 that address the general principles and responsibilities of the auditor related to conducting an audit. In addition, the Board amended other auditing standards, including AS 1201,10 AS 1215,11 and AS 2101,12 to address the engagement partner’s responsibility of supervision and review of an audit engagement. The amendments to AS 1201 specifically provide that the engagement partner has primary responsibility for the engagement and must review, at minimum, sufficient documentation of specific audit areas that are deemed important to support the auditor’s opinion as well as documentation required to be reviewed by the engagement quality reviewer. Further, the amendments to AS 1215 clarify the requirements for audit documentation and accelerate the period for the auditor to assemble a complete and final set of audit documentation for retention from 45 days to 14 days.

The Board members voted unanimously to adopt AS 1000, along with other amendments to PCAOB rules and standards. Subject to SEC approval, the new standard will be effective for audits of fiscal years beginning on or after December 15, 2024. For registered firms with less than 100 issuer audits, the 14-day documentation completion date is effective for audits of financial statements for fiscal years beginning on or after December 15, 2025.

In a news release accompanying the new standard, Chair Williams stated that “I am pleased to be here with you today as I and my fellow Board Members are presented with the adopting release for this project, which reaffirms the general principles and responsibilities of the auditor and solidifies the foundation of every audit, leading to investor protection and informative, accurate, and independent audit reports.”

The TAA Amendments

On June 12, 2024, the PCAOB adopted the TAA Amendments. These amendments to AS 1105 and AS 2301 are designed to improve audit quality and enhance investor protection by addressing the growing use of technology in audits. They include provisions that:

Emphasize the importance of controls over information technology, and of appropriate disaggregation or detail of information, to the relevance of audit evidence.
Clarify (1) the description and responsibilities for a test of details and (2) requirements for when an audit procedure is used for more than one purpose.
Specify the auditor’s responsibilities for evaluating the reliability of external information provided by the company in electronic form and used as audit evidence.
Update terminology to reflect the greater availability of information in electronic form.

The Board members voted unanimously to adopt the TAA Amendments. Subject to SEC approval, the TAA Amendments will be effective for audits of fiscal years beginning on or after December 15, 2025.

The PCAOB will submit to the SEC a proposed rule to implement the TAA Amendments. As part of the SEC approval process, the SEC will then publish a notice in the Federal Register soliciting comments on the proposed rule. Once the SEC publishes notice on its PCAOB rulemaking Web page and publishes a notice of comment in the Federal Register, interested parties will be encouraged to submit comments on the proposed rule by the deadline the SEC specifies.

Amendments to Rule on Contributory Liability

On June 12, 2024, the Board adopted amendments to PCAOB Rule 3502 on contributory liability. The amendments change the rule’s liability standard from recklessness to negligence but maintains the rule’s existing requirement that an associated person of an accounting firm must have contributed to the firm’s violation both “directly and substantially” to be held liable. The Board members voted unanimously to adopt the amendments, which will be effective 60 days after SEC approval.

The PCAOB will submit to the SEC a proposed rule to implement the amendments to PCAOB Rule 3502. As part of the SEC approval process, the SEC will then publish a notice in the Federal Register soliciting comments on the proposed rule. Once the SEC publishes notice on its PCAOB rulemaking Web page and publishes a notice of comment in the Federal Register, interested parties will be encouraged to submit comments on the proposed rule by the deadline the SEC specifies.

Proposals

Registration Proposal

On February 27, 2024, the PCAOB issued for public comment PCAOB Proposed Rule 2400 13 and a proposed new paragraph (h), “Constructive Withdrawal Requests,”14 of existing PCAOB Rule 210715 (collectively, the “registration proposal”). The registration proposal’s comment period ended on April 12, 2024. In a comment letter to the PCAOB, Deloitte expressed support for the Board’s registration proposal in a manner consistent with the firm’s commitment to protecting investors through the independent audit process and the vital role the audit plays in maintaining the integrity of the financial reporting process and preserving the public’s trust in the capital markets. In the letter, Deloitte also asked the PCAOB to consider the following in more detail to enhance clarity and transparency:

Clarify that proposed Rule 2400 would not apply to statements regarding PCAOB registration made in auditors’ reports for audits listed in paragraph 4110.5 16 of the SEC Division of Corporation Finance Financial Reporting Manual (i.e., where the SEC requires a registered firm to refer to PCAOB standards).
Confirm that representations required to be made when services other than an audit of an issuer, broker, or dealer must be performed by a PCAOB-registered firm would be excluded from the rule.
Clarify that it would be permissible to tailor any disclaimer language to fit particular facts and circumstances.
Instead of amending Form 3, consider alternatives that would make this information easier for investors and other users of audit reports to find (e.g., in a firm’s annual report or on a firm’s profile page on the PCAOB’s Web site).

Proposal on Firm- and Engagement-Level Metrics

On April 9, 2024, the PCAOB issued for public comment a proposal 17 on firm- and engagement-level metrics. In the proposal, the PCAOB states that in its view, “the proposed metrics would provide valuable additional information, context, and perspective on auditors and audit engagements, which could be used by investors, audit committees, and other stakeholders. This would advance investor protection and promote the public interest by enabling stakeholders to make better-informed decisions, promoting auditor accountability and ultimately enhancing capital allocation and confidence in our capital markets.”

In her statement on the proposal, Chair Williams asserted, “Trust is essential to our capital markets. And transparency fuels trust. Consistent, comparable information about audit firms and the issuers they audit bolsters confidence, strengthens oversight, and empowers investors and audit committees to make more informed decisions and help drive audit quality forward.”

The proposal delineates standardized firm- and engagement-level metrics that the PCAOB staff believes would create a useful dataset available to investors and other stakeholders, including audit committees and the PCAOB, for analysis and comparison. The PCAOB proposes 11 metrics, of which 8 would be reported on both a firm-level and an engagement-level basis, 2 would be reported on a firm-level basis only, and 1 would be reported on an engagement-level basis only. The proposed firm-level metrics would be reported on new Form FM, “Firm Metrics,” and the proposed engagement-level metrics would be reported on an amended and renamed Form AP, “Audit Participants and Metrics.” The comment period closed on June 7, 2024.

In a comment letter to the PCAOB on the proposal, Deloitte supported the increased transparency into the audit process and the firm through providing consistent, comparable, and meaningful information about the auditor and the auditor’s work. Deloitte also supported some of the proposed firm-level metrics, but it raised concerns about other proposed firm-level metrics that it believes are unlikely to provide useful information and achieve the objectives of the proposal. The letter further highlighted concerns about the public disclosure of any engagement-level metrics. In lieu of such public disclosure, the letter provided an alternative of disclosing engagement-level information to the audit committee given the need to have appropriate context since audits are unique and tailored to the facts and circumstances of each issuer.

Firm Reporting Proposal

On April 9, 2024, the PCAOB issued a rulemaking proposal 18 on firm reporting, which would amend annual and special reporting requirements for registered public accounting firms to facilitate the firms’ disclosure of more complete, standardized, and timely information. The proposed changes include enhanced reporting of firm financial, governance, and network information; timelier and expanded special reporting; and cybersecurity reporting, among other topics. The comment period closed on June 7, 2024.

In her statement on the firm reporting proposal, Chair Williams noted that the proposal “would modernize the PCAOB’s framework for collecting information from audit firms by amending the annual and special reporting requirements which have not been substantively updated since 2008.”

In a comment letter to the PCAOB on the proposal, Deloitte supported transparency in the general areas described above, noting that firms currently voluntarily provide information in these areas. The letter also raised concerns about certain specific aspects of the proposal, including those regarding which Deloitte believes that more principles-based requirements may provide more useful information about the firms.

Proposed Amendments to Substantive Analytical Procedures

On June 12, 2024, the PCAOB issued a proposal 19 to strengthen and clarify existing requirements for an auditor’s use of substantive analytical procedures. The proposal includes replacing existing AS 230520 with a new and retitled AS 230521 to:

Strengthen and clarify the requirements for determining whether the relationship(s) to be used in the substantive analytical procedure is (are) sufficiently plausible and predictable.
Specify that the auditor may not develop its expectation by using the company’s amount or information that is based on the company’s amount (so-called circular auditing).
Strengthen and clarify existing requirements for determining when the difference between the auditor’s expectation and the company’s amount requires further evaluation.
Strengthen and clarify existing requirements for evaluating the difference described above and determining whether a misstatement exists, including specifying requirements in certain situations that the auditor may encounter when evaluating a difference.
Clarify the factors that affect the persuasiveness of audit evidence obtained from a substantive analytical procedure.
Clarify the elements of a substantive analytical procedure, including the distinction between substantive analytical procedures and other types of analytical procedures.
Modernize existing AS 2305 by reorganizing the requirements and more explicitly integrating the standard with other Board-issued standards.

Interested parties are encouraged to submit comments to the PCAOB on the proposal, including feedback on whether the proposal, if adopted by the Board and approved by the SEC, should be effective for audits of fiscal years beginning on or after December 15 of the year of SEC approval. Comments are due by August 12, 2024.

Appendix — Summary of PCAOB Standard-Setting, Research, and Rulemaking Projects

The PCAOB’s standard-setting, research, and rulemaking projects are outlined on the PCAOB’s Web site and summarized briefly below.

In his statement on the substantive analytical procedures proposal, Board Member Anthony Thompson noted, “In the last two and half years, this Board has convincingly executed its commitment to modernize standards. Since 2022, this Board has issued ten proposals, including this one today. This is the largest number of proposals in any two-year period since the inception of the PCAOB. These efforts demonstrate our continued commitment to ensure our standards, many of which haven’t been updated since 2003, are fit for purpose.”

Standard-Setting Projects

Recently Completed Projects

The Board continues to execute on its agenda. The table below, which is adapted from the PCAOB’s Web site, lists the five most recently completed standard-setting projects.

Project	Effective Date	Date of Board Adoption
Other Auditors	Effective for audits of fiscal years ending on or after December 15, 2024.	June 21, 2022
Confirmation	Effective for audits of fiscal years ending on or after June 15, 2025.	September 28, 2023
Quality Control	Subject to approval by the SEC, effective on December 15, 2025.	Adopted on May 13, 2024, pending SEC approval
General Responsibilities of the Auditor in Conducting an Audit (AS 1000)	Subject to approval by the SEC, effective for audits of fiscal years beginning on or after December 15, 2024, with an exception for smaller firms described above.	Adopted on May 13, 2024, pending SEC approval
Amendments Related to Aspects of Designing and Performing Audit Procedures That Involve Technology-Assisted Analysis of Information in Electronic Form	Subject to approval by the SEC, effective for audits of fiscal years beginning on or after December 15, 2025.	Adopted on June 12, 2024, pending SEC approval

Short-Term Projects

The table below, which is adapted from the PCAOB’s Web site, lists the eight short-term standard-setting projects on the PCAOB’s agenda, many of which address updates to the interim auditing standards that the Board adopted in 2003. Each project is under active development by the PCAOB (i.e., action, such as the issuance of a proposed or final standard, is expected within 12 months).

Project	Next Board Action
Noncompliance With Laws and Regulations	Adoption expected in 2024
Attestation Standards Update	Proposal expected in 2025
Going Concern	Proposal expected in 2024
Firm and Engagement Metrics	To be determined (TBD) pending analysis of comment letters on April 9, 2024, proposal
Substantive Analytical Procedures	TBD pending analysis of comment letters on June 12, 2024, proposal
Inventory	Proposal expected in 2025
Other Reporting	Proposal expected in 2024

Midterm Projects

The PCAOB’s midterm standard-setting projects are efforts in which “the staff is actively engaged but Board action is not anticipated in the next 12 months.”22 The following six midterm projects also focus on continuing to update the interim standards:

Fraud.
Interim Ethics and Independence Standards.
Use of a Service Organization.
Interim Financial Information Reviews.
Internal Audit.
Interim Standards.

Research Projects

While the Board’s research projects are not aimed at updating the interim standards, they help the PCAOB identify “whether there is a need for changes to [existing] standards or other regulatory responses.”23 The Board’s current research projects are as follows:

Data and Technology.
Communication of Critical Audit Matters.

Rulemaking Projects

The PCAOB also continues to make progress on its rulemaking projects, which focus on “enhancing investor transparency and enforcement of PCAOB rules.”24 The tables below, which are adapted from the PCAOB’s Web site, summarize these projects.

Recently Completed Project

Project	Effective Date	Date of Board Adoption
Contributory Liability	Effective 60 days after SEC approval	June 12, 2024, pending SEC approval

Projects in Progress

Project	Next Board Action
Registration	TBD pending analysis of comment letters on February 27, 2024, proposal
Firm Reporting	TBD pending analysis of comment letters on April 9, 2024, proposal

Contacts

Emily Fitts

Audit & Assurance

Partner

Deloitte & Touche LLP

+1 203 423 4455

efitts@deloitte.com

Christina Baker

Audit & Assurance

Senior Manager

Deloitte & Touche LLP

+1 203 761 3133

chbaker@deloitte.com

Footnotes

PCAOB Quality Control (QC) No. 1000, A Firm’s System of Quality Control, which is included in Appendix 1 of PCAOB Release No. 2024-005, A Firm’s System of Quality Control and Other Amendments to PCAOB Standards, Rules, and Forms.

PCAOB Auditing Standard (AS) No. 1000, General Responsibilities of the Auditor in Conducting an Audit, which is included in Appendix 1 of PCAOB Release No. 2024-004, General Responsibilities of the Auditor in Conducting an Audit and Amendments to PCAOB Standards.

The amendments to PCAOB Auditing Standard No. 1105, Audit Evidence, are included in Appendix 1 of PCAOB Release No. 2024-007, Amendments Related to Aspects of Designing and Performing Audit Procedures That Involve Technology-Assisted Analysis of Information in Electronic Form.

The amendments to PCAOB Auditing Standard No. 2301, The Auditor’s Responses to the Risks of Material Misstatement, are included in Appendix 2 of PCAOB Release No. 2024-007, Amendments Related to Aspects of Designing and Performing Audit Procedures That Involve Technology-Assisted Analysis of Information in Electronic Form.

The amendments to PCAOB Rule 3502, “Responsibility Not to Knowingly or Recklessly Contribute to Violations,” are included in PCAOB Release No. 2024-008, Amendment to PCAOB Rule 3502 Governing Contributory Liability.

PCAOB Proposed Auditing Standard No. 2405, A Company’s Noncompliance With Laws and Regulations, which is included in Appendix 1 of PCAOB Release No. 2023-003, Amendments to PCAOB Auditing Standards Related to a Company’s Noncompliance With Laws and Regulations and Other Related Amendments.

International Standard on Auditing (ISA) 250 (Revised), Consideration of Laws and Regulations in an Audit of Financial Statements.

PCAOB Auditing Standard No. 2901, Responding to Engagement Deficiencies After Issuance of the Auditor’s Report.

PCAOB Auditing Standard Nos. 1001, Responsibilities and Functions of the Independent Auditor; 1005, Independence; 1010, Training and Proficiency of the Independent Auditor; and 1015, Due Professional Care in the Performance of Work.

PCAOB Auditing Standard No. 1201, Supervision of the Audit Engagement.

PCAOB Auditing Standard No. 1215, Audit Documentation.

PCAOB Auditing Standard No. 2101, Audit Planning.

PCAOB Proposed Rule 2400, “False or Misleading Statements Concerning PCAOB Registration and Oversight,” which is included in the appendix of PCAOB Release No. 2024-001, Proposals Regarding False or Misleading Statements Concerning PCAOB Registration and Oversight and Constructive Requests to Withdraw From Registration.

The text of paragraph (h) of Rule 2107 is also included in PCAOB Proposed Rule 2400.

PCAOB Rule 2107, “Withdrawal From Registration.”

SEC Division of Corporation Finance Financial Reporting Manual Section 4110, “Independent Accountants’ Involvement; Qualifications of Accountants; PCAOB Registration.”

PCAOB Release No. 2024-002, Firm and Engagement Metrics.

PCAOB Release No. 2024-003, Proposing Release: Firm Reporting.

PCAOB Release No. 2024-006, Proposed Auditing Standard — Designing and Performing Substantive Analytical Procedures and Amendments to Other PCAOB Standards.

PCAOB Auditing Standard No. 2305, Substantive Analytical Procedures.

PCAOB Proposed Auditing Standard No. 2305, Designing and Performing Substantive Analytical Procedures.

Quoted text is from the Standard-Setting, Research, and Rulemaking Projects page on the PCAOB’s Web site.

See footnote 21.

Heads Up is prepared by members of Deloitte's National Office as developments warrant. This publication contains general information only and Deloitte is not, by means of this publication, rendering accounting, business, financial, investment, legal, tax, or other professional advice or services. This publication is not a substitute for such professional advice or services, nor should it be used as a basis for any decision or action that may affect your business. Before making any decision or taking any action that may affect your business, you should consult a qualified professional advisor. Deloitte shall not be responsible for any loss sustained by any person who relies on this publication.

The services described herein are illustrative in nature and are intended to demonstrate our experience and capabilities in these areas; however, due to independence restrictions that may apply to audit clients (including affiliates) of Deloitte & Touche LLP, we may be unable to provide certain services based on individual facts and circumstances.

Deloitte refers to one or more of Deloitte Touche Tohmatsu Limited, a UK private company limited by guarantee (“DTTL”), its network of member firms, and their related entities. DTTL and each of its member firms are legally separate and independent entities. DTTL (also referred to as “Deloitte Global”) does not provide services to clients. In the United States, Deloitte refers to one or more of the US member firms of DTTL, their related entities that operate using the “Deloitte” name in the United States and their respective affiliates. Certain services may not be available to attest clients under the rules and regulations of public accounting. Please see www.deloitte.com/us/about to learn more about our global network of member firms. Copyright © 2024 Deloitte Development LLC. All rights reserved.