On November 21, the Public Company Accounting Oversight Board adopted rules that will require registered accounting firms to disclose performance metrics regarding their larger audit engagements. The Board also adopted expanded firm operational and financial condition reporting. The Board proposed these new requirements in April 2024 (see PCAOB Proposes Engagement Metrics and Audit Firm Operational and Financial Reporting, April 2024 Update) but they attracted critical comments from accounting firms and audit committees. In response to the comments, the Board eliminated some aspects of the proposals from the final requirements and modified others, although the fundamentals of the new disclosure regimes were not changed.
In the press release announcing the adoption of the new disclosures, PCAOB Chair Erica Y. Williams said: “The new requirements we are adopting today will make PCAOB oversight more effective and equip investors, audit committees, and others with clear, consistent, and actionable data related to audit firms and the engagements they perform.” As Chair Williams’s statement indicates, one of the Board’s main justifications for both sets of new requirements is that the disclosures will provide audit committees with useful additional information to aid in their oversight and evaluation of the auditor.
Firm and Engagement Metrics
The new rules will require PCAOB-registered public accounting firms that audit accelerated filers or large accelerated filers to publicly report eight metrics relating to specific audit engagements or to the firm’s audit practice. (In general, accelerated filers are companies with a public float between $75 and $700 million, while large accelerated filers are companies with a public float of $700 million or more.) Most of the metrics call for information at both a firm level and an engagement level, while several require only firm-level reporting. These eight metrics are:
Partner and Manager Involvement. Hours worked by senior professionals relative to more junior staff across all of the firm’s large accelerated and accelerated filer engagements and on the audited company’s engagement.
Workload (firm level only). For senior professionals who incurred hours on large accelerated or accelerated filer engagements, average weekly hours worked on a quarterly basis, including time attributable to all engagements, administrative tasks, training, and all other matters.
Training Hours for Audit Personnel. Average annual training hours for partners, managers, and staff of the firm, combined, across the firm and on the audited company’s engagement.
Experience of Audit Personnel. Average number of years worked at a public accounting firm (whether or not PCAOB-registered) by senior professionals across the firm and on the audited company’s engagement.
Industry Experience. Average years of experience of senior professionals in key industries audited by the firm at the firm level and in the audited company’s primary industry at the engagement level.
Retention of Audit Personnel (firm-level only). Continuity of senior professionals (e.g., the impact of departures and reassignments) across the firm.
Allocation of Audit Hours. Percentage of hours incurred prior to and following an issuer’s year-end across the firm’s large accelerated and accelerated filer engagements and on the audited company’s engagement.
Restatement History (firm-level only). Restatements of financial statements and management reports on internal control over financial reporting that were audited by the firm over the past three years.
Firms that serve as the lead auditor for at least one accelerated filer or large accelerated filer will be required to report the firm-level metrics annually on a new Form FM. For individual accelerated filer and large accelerated filer engagements, the engagement-level metrics must be reported on Form AP. Form AP, which must be filed for each public company engagement, will be renamed "Audit Participants and Metrics." In addition to the required metrics, firms will be allowed (but not required) to include a narrative discussion to provide context and explanation for the metrics on both Form FM and Form AP. This narrative may not exceed 1000 characters (roughly 175 words) for each metric.
The final firm and engagement metrics differ from the April 2024 proposal in several respects. Among other things, proposed metrics relating to the use of specialists and shared service centers, quality performance ratings, internal monitoring, and audit hours devoted to risk areas were eliminated. The metric in the final rules related to training hours was added. In addition, the Board revised the terms of several of the metrics (e.g., the firm’s restatement history was reduced from five to three years) and increased the length of the optional narrative explanation of metrics from 500 characters to 1000.
Firm Reporting
The Board also expanded the information that PCAOB-registered accounting firms must provide in their public annual reports (PCAOB Form 2) and in special reports (PCAOB Form 3) that must be filed when certain events occur (e.g., a change in the firm’s name or criminal or regulatory proceedings against a partner or principal). Firm reporting will increase in six areas:
Financial Information.
a. Registered firms will be required to include additional fee information in their annual report on Form 2. Firms will be required to report (1) the dollar amount (not just percentages, as currently required) of fees billed to issuer audit clients for audit services, other accounting services, tax services, and non-audit services; (2) fees billed to all clients for services; and (3) fees billed to broker-dealer audit clients. The Board retained the existing provision allowing firms to indicate if they have estimated fee amounts and to describe the reasons for doing so.
b. The largest registered firms will also be required to confidentially submit financial statements to the PCAOB, although those statements will not be required to be prepared in accordance with generally accepted accounting principles (GAAP). The financial statement requirement will apply to firms that issue audit reports for more than 200 public companies and have more than 1,000 personnel.
Governance Information. Registered firms will be required to report additional information regarding their leadership, legal structure, ownership, and other governance information in their annual report on Form 2. For example, firms will be required to report the names of their principal executive officer, of the individuals responsible for various components of the firm’s system of quality control, and of the members of the firm’s governing board or management committee.
Network Relationships. Registered firm annual reports will be required to include information about any network arrangement to which the firm is subject. This information includes (1) a brief description of the network relationship (e.g., the network structure and the relationship of the registered firm to the network); (2) whether the firm shares information with the network regarding its audits; (3) whether the firm is subject to inspection by the network; and (4) any other information the firm considers relevant to understanding how the network relationship relates to its conduct of audits.
Material Events Reporting. Registered firms that issue audit reports with respect to more than 100 public companies will be required to report the occurrence of certain events that pose a material risk, or represent a material change, to the firm’s organization, operations, liquidity, or financial resources, in a manner that it will affect its audit services. These events must be reported on Form 3, but, unlike existing Form 3 reporting, will be nonpublic. The rule includes a non-exclusive list of reportable material events, such as a determination that there is substantial doubt about the firm's ability to continue as a going concern; entering into a financial arrangement that would materially affect the firm's liquidity; or entering into an agreement that would cause a material change to the firm’s ownership or operations, such as “spinning off consulting business or severing a portion of the business for private equity involvement.” Material events must be reported within 14 days of their occurrence or “more promptly as warranted.”
Cybersecurity. The new rules also require registered firms to report “significant cybersecurity events” on Form 3. A “significant cybersecurity event” is defined as an event that significantly disrupted or degraded firm operations critical to the functioning of the audit practice or led to unauthorized access to information systems and networks in a way that resulted in substantial harm to critical audit-related operations. Significant cybersecurity events must be reported within five business days of the firm’s determination that the event is significant. Like material events disclosure, cybersecurity events disclosure will be nonpublic.
Updated description of quality control policies and procedures. Any firm that registered with the Board before December 15, 2025 (the date that the PCAOB’s new quality control standard, QC 1000, becomes effective) will be required to submit a statement of the firm’s quality control policies and procedures to update the statement in their original, pre-QC 1000, registration application. This statement must be filed with the Board on a new form, Form QCPP. Firms that register after December 15, 2025, will be required to indicate in their registration application whether the firm has designed a quality control system in accordance with QC 1000. The purpose of Form QCPP is to require firms that registered prior to the QC 1000 effective date to make a similar statement.
The final firm reporting rules differ from the April proposal in several respects. Among other things, the Board eliminated the proposed requirement that large firm financial statements be prepared under either GAAP or the International Financial Reporting Standards; eliminated the proposed requirement that firms report the names of all persons who report directly to the firm’s principal executive officer; retained the current 30-day deadline of filing Form 3 (except for the new the material events and cybersecurity disclosures); and limited material events disclosure to firms that audit more than 100 public companies.
Effective Dates
Firms that audit more than 100 public companies will be required to begin firm and engagement metrics reporting for periods beginning on October 1, 2027. Other firms will begin reporting one year later.
Firms that audit more than 200 public companies and have more than 1,000 personnel will be required to comply with the new firm reporting requirements (except for Form QCPP) beginning on March 31, 2027. Other firms will begin reporting one year later. Form QCPP will become effective on December 15, 2025, with a filing deadline of January 14, 2026.
Dissent
Board Member Christina Ho dissented from the adoption of both the firm and engagement metrics requirements and the firm reporting rules. See Statement on the Firm & Engagement Metrics Adopting Release - Will This Unusually Rushed Auditing Standard Suffer the Same Fate of the Auditing Standard 2? (November 21, 2024) and Statement on the Firm Reporting Adopting Release – Extremism in the Name of Investor Protection (November 21, 2024). Board Member Ho described the Board votes on these two matters as “unprecedented” because “[n]ever in the history of the PCAOB has the Board rushed to adopt new standards and rules in the middle of a historic transition to new SEC leadership, let alone adopt standards and rules that are not ready.” She added, “Political expediency is not evidence-based policymaking. Haste naturally harms work product quality, which will not escape any keen eyes.”
Among other criticisms, her statements point to the CAQ’s audit committee and investor surveys which found that most audit committee members and investors believe that the information already available to assess audit quality meets their needs. See CAQ Surveys Audit Committee Members and Investors on Engagement Performance Metrics, September-October 2024 Update. For example, as to the performance metrics rules, she characterizes the Board majority as “blithely ignoring, or at best, downplaying audit committee and investor commenters, who are among the intended users, of which more than a super-majority have stated that they have all or most of the information they need to assess audit quality.” Ms. Ho also expressed concern about the pace of Board standard-setting, which she described as “continuing to force feed the auditing profession with a voluminous number of standards within the limited funnel of a couple years,” and predicted that the result would be to increase audit fees, reduce capital formation, reduce competition, and intensify the accounting talent shortage. She also contended that the new requirements would “add tremendous strain on personnel and financial resources of small firms” and that “the collective implementation of all the new PCAOB standards will detract focus from audit quality.”
Audit Committee Takeaways
The PCAOB releases adopting these new disclosure requirements make clear that they are intended to benefit audit committees by providing them with additional information to support their oversight of the company’s auditor. However, as Ms. Ho’s statement describes, the comments submitted to the Board on the proposals are mixed, at best, as to whether audit committee members think the added information will be useful. As she suggests, it appears that these projects could have benefitted from further study and input. Of course, because of the upcoming changes in SEC membership – and quite possibly in the make-up of the PCAOB – as a result of the Presidential election, any delay would likely have been fatal to these controversial proposals.
Whatever views audit committee members may hold now, it is certainly possible that, once performance metrics reporting begins, most committees will find the new information useful, at least as fodder for discussion with their engagement partner. Understanding the relevance of the metrics to the performance of a specific audit engagement will require a sophisticated understanding of the full context of the audit and how particular metrics relate to that audit. Mandatory performance metric reporting will not begin until 2027. Audit firms and audit committees should use the next three years to gain a better understanding of the metrics and the significance of each to the company’s audit.
Commentaires