PCAOB Adopts New Audit Firm Reporting Standards

“Sound and consistent information strengthens investor confidence and can drive audit quality,” PCAOB Chair Erica Williams said in a statement on Nov. 21. “The new requirements we are adopting today will make PCAOB oversight more effective and equip investors, audit committees, and others with clear, consistent, and actionable data related to audit firms and the engagements they perform.”

Firm and Engagement Metrics Requirements

With the firm and engagement metrics requirements adopted by the board on Nov. 21, PCAOB-registered public accounting firms that audit one or more issuers that qualify as an accelerated filer or large accelerated filer will be required to publicly report specified metrics relating to such audits and their audit practices. These metrics—which will further PCAOB oversight activities and which can be used by investors, audit committees, and other stakeholders—cover the following eight areas:

1. Partner and manager involvement
2. Workload
3. Training hours for audit personnel
4. Experience of audit personnel
5. Industry experience
6. Retention of audit personnel (firm-level only)
7. Allocation of audit hours
8. Restatement history (firm-level only)

Reporting of firm-level metrics will be required annually on a new Form FM, for firms that serve as the lead auditor for at least one accelerated filer or large accelerated filer. Reporting of engagement-level metrics for audits of accelerated filers and large accelerated filers will be required via a revised Form AP, which will be renamed “Audit Participants and Metrics.” Finally, limited narrative disclosures will be allowed—but not required—on both Form FM and Form AP to provide context and explanation for the required metrics.

Following its April 2024 proposal on firm and engagement metrics, the PCAOB received input from a wide range of commenters, which helped inform the amendments as adopted. Among other changes made in response to stakeholder input since these amendments were first proposed, the PCAOB:

• Reduced the metric areas to eight (from 11);
• Refined the metrics to simplify and clarify the calculations;
• Increased the ability to provide optional narrative disclosure (from 500 to 1,000 characters); and
• Updated the effective date.

If approved by the Securities and Exchange Commission (SEC), the earliest effective date of the firm-level metrics will be Oct. 1, 2027, with the first reporting as of Sept. 30, 2028, and engagement-level metrics for the audits of companies with fiscal years beginning on or after Oct. 1, 2027.

For these new requirements, the PCAOB has established a phased-in implementation to provide smaller accounting firms with more time. The requirements will take effect for firms that audit more than 100 issuers first, and for other firms, the requirements will take effect the following year.

Amendments Adopted Related to Firm Reporting

Regarding firm reporting, the amendments adopted on Nov. 21 will modernize the PCAOB’s annual and special reporting requirements to facilitate the disclosure of more complete, standardized, and timely information by registered public accounting firms. Consistent with current practice, much of the information will be disclosed publicly, such as enhanced fee, governance, and network information. Other information that is potentially proprietary, sensitive, or developing will be available to the PCAOB only for oversight.

The amendments enhance the required current reporting of information by registered firms on the PCAOB’s public Annual Report Form, also known as Form 2, and the Special Reporting Form, also known as Form 3, in several key areas:

• Financial information: On Form 2, all registered firms will report additional fee information. The largest firms will also be required to confidentially submit financial statements to the PCAOB.
• Governance information: On Form 2, all registered firms will be required to report additional information regarding their leadership, legal structure, ownership, and other governance information, including reporting on certain key quality control operational and oversight roles.
• Network relationships: Registered firms will be required to report a more detailed description of any network arrangement to which a registered firm is subject. This includes describing the network’s structure, the registered entity’s access to resources such as audit methodologies and training, and whether the firm shares information with the network regarding its audits, including whether the firm is subject to inspection by the network.
• Special reporting: For annually inspected firms, the amendments include a new confidential special reporting requirement for events material to a firm’s organization, operations, liquidity or financial resources, such that they affect the provision of audit services.
• Cybersecurity: On Form 3, confidentially, registered firms will be required to promptly report significant cybersecurity events to the PCAOB. On Form 2, registered firms will also be required to periodically and publicly report a brief description of any policies and procedures to identify and manage cybersecurity risks.
• Updated description of quality control policies and procedures: A new form will require any firm that registered with the board prior to Dec. 15, 2025—the date that the PCAOB’s new quality control standard becomes effective—to submit an updated statement of the firm’s quality control policies and procedures pursuant to the quality control standard.

Following last April’s proposal on firm reporting, the board received input that helped with refining and tailoring the requirements to focus on specific disclosures that should be most useful to PCAOB staff, investors, audit committees, and others. Among other changes made since these amendments were first proposed, the PCAOB:

• Streamlined fee disclosure requirements;
• Eliminated the proposed requirement that financial statements conform to an applicable financial reporting framework, such as GAAP, and instead prescribed certain minimum financial statement reporting requirements;
• Streamlined requirements related to firm governance and network arrangements;
• Maintained the Form 3 reporting timeframe of 30 days for existing special reporting items to ease potential burden—particularly for smaller firms—while still requiring more timely reporting of events of sufficient significance and urgency (e.g., cybersecurity); and
• Modified the material event reporting requirement to better focus on information relevant to a firm’s audit practice—and limited the material event reporting requirement to firms that are annually inspected.

The amendments are subject to approval by the SEC and, if approved, will become effective in stages thereafter. Given the phased-in nature of effective dates, firms and others are encouraged to carefully review the “Effective Date” sections in both adopting release documents. The PCAOB plans to issue resources to assist firms with implementation of these requirements.