Receive our
Monthly JGA Advisor

Introduction For many audit firms, obtaining registration with the Public Company Accounting Oversight Board (PCAOB) is viewed as a milestone that opens the door for firms to audit public companies (SEC registrants) and broker-dealers. While firms often focus heavily on completing the registration form, paying the registration fee, and obtaining PCAOB approval, many underestimate the significant ongoing responsibilities and risks that accompany registration.  The result is that some newly registered firms quickly discover that PCAOB registration is not simply a licensing exercise and gateway to additional audit revenue. Rather, it subjects the firm to a comprehensive oversight regime involving inspections, reporting requirements, quality control expectations, disciplinary authority and enforcement which results may be made public, and heightened scrutiny from regulators, investors, and audit committees. This article highlights several pitfalls that firms frequently fail to consider before becoming PCAOB registered. Registration Is Merely the Beginning, Not the End Many firms approach PCAOB registration as a compliance hurdle. In reality, registration represents the starting point of an ongoing regulatory relationship. Once registered, firms become subject to PCAOB inspection authority, reporting obligations, investigations, and disciplinary proceedings. Registered firms must take on recurring PCAOB filing requirements, including annual reporting and special reporting when specified events occur. Failure to comply can lead to sanctions, revocation proceedings, and reputational damage. Firms that register solely because a potential client requests the firm to do so often underestimate the resources required to maintain compliance year after year. PCAOB Inspections Can Be Far More Demanding Than Peer Review One of the most common misconceptions is that a firm with a successful AICPA peer review is well-positioned for PCAOB inspection. Although both peer reviews and PCAOB inspections evaluate audit quality, they are fundamentally different. PCAOB inspectors focus intensely on audit execution, documentation, professional skepticism, risk assessment, internal controls, and overall compliance with PCAOB standards and rules. Inspection findings can be severe even when a firm has received a clean peer review. Firms entering the public company audit space frequently discover that methodologies and documentation practices acceptable in the private-company environment may not withstand PCAOB inspection scrutiny. Thus, firms should be factoring into their decision-making that they will need to subscribe to modules within their current methodology that include PCAOB procedures to be performed for an audit and/or supplement their audit methodology with certain tools and templates. This would be specifically applicable for areas such as auditing estimates, testing internal controls over financial reporting, and evaluation of critical audit matters. JGA has seen situations where even though a firm has subscribed to a PCAOB-standards module in an auditing platform, the firm still had to supplement this with additional templates. Quality Control Systems Often Need Significant Enhancement Many firms register before fully assessing whether their quality control system can support PCAOB engagements. Areas commonly underestimated include: Engagement quality reviews – does the firm have sufficient EQR resources? Are the EQRs proficient in the requirements of AS 1220? Independence monitoring – does the firm have a well-established platform/repository to track its audit professionals’ investments and relationships as well as track and keep up to date the affiliate relationships of its audit clients? Consultation processes – are there appropriate experts within the firm that can be consulted on when questions arise related to SEC independence rules or PCAOB auditing standards? Or will the firm need to consult externally? Monitoring and remediation activities – does the firm have the appropriate experienced resources to maintain an effective monitoring program? Evaluation of technical competency of professionals working on PCAOB audits Training programs – will the firm have to call on external experts who are experienced in PCAOB standards to upskill its audit professionals in proper understanding of the requirements of the PCAOB auditing standards? Client acceptance procedures – does the firm have the appropriate access to affiliate and related party information to make informed client acceptance decisions? Audit methodology governance A firm may technically qualify for registration yet lack the infrastructure needed to execute PCAOB audits consistently. We have seen all-to-often this gap becoming visible during the firm's first PCAOB inspection with criticism of the firm’s technical competency cited as a pervasive deficiency in the first PCAOB inspection report. Independence Requirements Become More Complex Another overlooked challenge involves auditor independence. Firms accustomed to serving privately held businesses may not fully appreciate the complexity of SEC and PCAOB independence requirements. Relationships, services, and financial interests that may be permissible in other environments can create independence violations for issuer audits under SEC and PCAOB independence rules which would include: Providing bookkeeping assistance Valuation services Tax consulting arrangements Business relationships with audit clients Family and employment relationships Financial interests held by firm personnel Even inadvertent violations can have significant consequences, potentially requiring audits to be re-issued or resulting in regulatory scrutiny or enforcement repercussions. Public Company Audits Require Specialized Expertise Many firms assume experienced auditors can transition easily into issuer audits. Public company audits involve unique requirements related to areas such as: SEC reporting Internal control over financial reporting (ICFR) Critical audit matters (CAMs) Fraud considerations, including journal entry testing Related-party transactions PCAOB auditing standards such as testing estimates and audit committee communications Form AP reporting Without personnel who possess sufficient public company experience, firms may struggle to perform audits that meet PCAOB expectations. Our experience has been that firms need to invest in education and training programs/curriculum for its audit professionals so that they can obtain the necessary understanding of the PCAOB standards. The Cost of Compliance Is Often Underestimated Firms typically budget for registration fees but fail to appreciate the broader financial commitment. Costs frequently include: Upgrades required to firm’s audit methodology Costs to attract and retain experienced personnel Specialized training focused on PCAOB standards Technical accounting resources External consultations Internal inspection programs, that in many instances are outsourced to external consultants with PCAOB inspection experience Quality control enhancements Additional engagement quality reviewers Legal and regulatory support For smaller firms with only a handful of SEC clients, compliance costs can exceed initial expectations and significantly affect profitability. A firm should not ‘dabble’ in the PCAOB arena but should target to grow into this space. Increased Litigation and Regulatory Exposure Becoming a PCAOB-registered firm increases visibility and risk. Public company audits frequently attract: SEC scrutiny PCAOB investigations should a firm have poor inspection results Shareholder litigation when fraud or restatements arise Class-action lawsuits Audit committee scrutiny. Many firms focus on revenue opportunities without fully evaluating whether their risk management framework, insurance coverage, and legal resources are sufficient to support a public-company practice. PCAOB Reporting Requirements Can Be Overlooked Some firms do not recognize the extent of ongoing reporting obligations after registration. Registered firms must file annual reports and timely special reports for specified events. Certain changes which may inadvertently get overlooked involve things like changes to firm ownership, legal proceedings, disciplinary actions against partners, governance matters, or firm leadership may trigger reporting obligations within prescribed deadlines. Failure to maintain accurate and timely reporting can become a regulatory issue independent of audit quality concerns. Audit Committees Expect More Than Technical Compliance Public company audit committees increasingly perform due diligence when selecting auditors and they may consider factors such as: PCAOB inspection history Industry specialization of the firm Staffing models, leverage plans, and the appropriate use of overseas resources Technical resources of the audit professionals Enforcement history Audit quality indicators. A newly registered firm may discover that obtaining registration does not automatically establish credibility in the marketplace. Building a reputation among audit committees can take years. Exit Strategies Are Rarely Considered Few firms consider what happens if they later decide to leave the public company audit market. Exiting the PCAOB environment can also require planning because withdrawal is subject to PCAOB approval and may be affected by pending oversight matters. The PCAOB maintains procedures governing withdrawal requests, and the Board may delay withdrawal while inspections, investigations, or disciplinary matters remain pending. Firms should understand these obligations before entering the regulated environment including if your SEC client needs a consent letter up to 2 years after the firm may have discontinued the relationship with that client. Cybersecurity and Governance Expectations Are Growing Regulatory expectations continue to evolve. Recent PCAOB initiatives, including QC 1000, reflect a more formalized focus on firm governance, risk assessment, monitoring, remediation, and reporting around the quality control system. Firms that view registration as a static compliance exercise may be surprised by expanding disclosure and oversight expectations. As firms become more reliant on technology and external service providers, weaknesses in cybersecurity, data governance, and vendor oversight can become significant regulatory and business risks. Conclusion PCAOB registration can create valuable growth opportunities and enhance a firm's market position. However, registration is only one step in a much broader commitment to audit quality, regulatory compliance, and public accountability. With that being said, most firms do succeed in the PCAOB environment. Typically, it is those firms that evaluate the full lifecycle implications of registration at the outset of their registration. They invest in quality control infrastructure, specialized personnel, independence monitoring, technical training, and governance processes well before accepting their first public company engagement. JGA, with its team of established PCAOB experts, has been able to successfully help many of its clients navigate the risks and shortcomings of firms as they enter the PCAOB space. We can help firms transform their risk profile, operational expectations, and regulatory responsibilities, so that they can gain the reputation and stature of leading audit quality in the PCAOB arena. Note that sources consulted include PCAOB registration and reporting guidance, including Form 1, Form 1-WD, Form 2, Form 3, Form AP, PCAOB inspection priorities and audit committee resources, and PCAOB QC 1000 implementation materials.