A Candid Conversation with a PCAOB Board Member

We welcomed board member George Botic from the Public Company Accounting Oversight Board (PCAOB) to discuss the vision for the organization, the evolving inspection framework, AI's growing role on both sides of the audit equation, and how audit committees can ensure meaningful oversight of their auditors.

KEY TAKEAWAYS

The PCAOB Inspection Framework

• PCAOB inspections of registered accounting firms operate on a two-part model: a review of the firm’s system-of-quality-control (including tone at the top, independence, client acceptance and continuance, and training) and targeted reviews of selected audit engagements. Both components are scaled to firm size, with the largest firms reviewed continuously throughout the year. Historically, the big four accounting firms have between 50 and 60 files, and second-tier firms around 30 per year.
• Audit engagement selection is primarily risk-based rather than statistical. Inspectors draw on economic analysis, industry trends, and issuer-level outliers to prioritize files, then apply a random component. This means audit committees should expect that complex transactions, recent M&A, impairment analyses, and sectors experiencing systemic stress may draw scrutiny.
• The most persistent high-finding areas across inspections have remained largely consistent over time: revenue recognition, inventory, acquisition accounting, impairment analysis, credit losses in financial institutions, and the design and operating effectiveness of internal controls. Audit committees should use this list as a standing agenda item when engaging with their auditors.
• Overall inspection findings have trended downward from post-pandemic-era highs, as firms rebuilt in-person collaboration and training. However, areas tied to internal control testing and the review-control linkage remain active sources of findings.

QC1000 and the Evolving Balance Between Quality Control and File Review

• PCAOB is considering rebalancing the extent of inspection work focused on a firm’s system of quality control and the extent of inspection work devoted to file reviews, which assess audit quality in selected audits. That rebalancing requires consideration of whether reducing the file reviews would sacrifice important benefits of an inspection.
• QC1000, “A Firm’s System of Quality Control”, approved but not yet effective, has faced implementation delays and a supplemental amendment process. Boards should ask their auditors specifically what QC1000 readiness looks like at their firm and what gaps remain.

AI in the Audit

• Audit firms are deploying AI tools across their engagements. The board has issued a public comment request that includes questions as to whether AI warrants new audit standards, updated documentation requirements, enhanced risk-assessment guidance, or simply guidance given how quickly the technology is evolving.
• CFO offices are increasingly exploring AI agents for bookkeeping and financial reporting. Audit committees should understand both sides of this equation: what their auditors are using AI for, and what governance their own finance team has in place over AI-generated outputs.

The Feedback Loop Between Audit Firms and PCAOB

• An audit committee chair observed that audit firms operate under an inherent disincentive to push back on PCAOB findings. A firm that disputes an inspection comment faces a multi-step escalation process, and any firm under active scrutiny is unlikely to provide candid feedback to the same body that inspects it. George responded that the PCAOB has multiple levels of internal review before a finding is included in an inspection report, and the PCAOB supports a firm’s right to disagree with inspection findings. A firm’s response to a draft inspection report is taken seriously and reviewed by the inspection staff and the Board.

Questions Audit Committees Should Bring Back to Their Auditors

• Has our audit been inspected by PCAOB in the past cycle? What focus areas were reviewed, and were there any findings related to our audit? Even if our audit was not inspected, were there any inspection findings relating to our audit firm’s audits of other companies in our industry?
• What AI tools is the firm currently using on our audit, and what quality-control processes govern their use? How is the firm documenting AI-assisted judgments in a way that would satisfy PCAOB auditing standards?
• How is our finance team's use of AI being assessed as part of the audit risk evaluation? Is our controller organization ahead of, in line with, or behind peers in the firm's view?
• Where does our audit firm stand on QC1000 implementation readiness? What changes to their quality system are underway, and are there any gaps the audit committee should be monitoring?
• Given PCAOB's identified high-finding areas (e.g., revenue recognition, impairment, internal controls, transaction accounting), which of these are most relevant to our company this cycle, and what specific procedures is the firm performing in those areas?

Resources

• Inspection Information for Audit Committees about the PCAOB Inspection Process
• Resources for Audit Committees | PCAOB

Thank you to Louis Lehot and Kelly Boyd at Foley & Lardner for hosting, to Ellen Graper from the PCAOB, and Marcel Bucsescu from NACD for their support.