Statement On The PCAOB’s Quality Control Standard — QC 1000, SEC Commissioner Mark T. Uyeda, Sept. 9, 2024

Thank you, Chair Gensler. Today, the Commission considers whether to approve an updated standard of the Public Company Accounting Oversight Board (the “PCAOB” or the “Board”) governing audit firms’ quality control (“QC”) systems.

Process for Approving QC Standard Calls into Question the Commission’s Effective Oversight of the PCAOB

When Congress gave the Commission oversight of the PCAOB, it provided a process for approving the PCAOB’s rules and standards that was similar to other self-regulatory organizations such as FINRA and the national securities exchanges.[1] This process provides for a notice and comment period and gives the Commission 90 days[2] to approve or disapprove the rule.[3] If the Commission needs more time to consider the rule, then it can extend the period for an additional 90 to 150 days.

Today is the end of the initial 90-day period for the updated QC standard. During this period, several commenters raised concerns that the PCAOB had not provided the public with an opportunity to consider the requirement for certain firms to adopt and implement an external quality control function (“EQCF”) during its rulemaking process and that the final requirement was not a logical outgrowth from the Board’s proposal.[4]

On August 16, 2024, the PCAOB filed a 28 page letter, with nearly 19 pages dedicated to the EQCF requirement, in an attempt to respond to the commenters’ concerns.[5] This explanation was significantly more expansive than PCAOB’s QC standard adopting release, which only spent five and one-half pages on the EQCF requirement.[6] In response to the PCAOB’s letter, the Commission received two letters shortly before the Labor Day weekend calling for additional information and guidance.[7]

Given the flurry of new feedback, it would have been prudent for the Commission to extend the process to allow for a thoughtful consideration of the standard, particularly the EQCF requirement. These comment letters are an important part of the process for considering whether to approve or disapprove the updated QC standard. This is especially the case when the PCAOB’s letter provided additional justifications for the EQCF requirement that were not part of the adopting release. To properly exercise its oversight responsibilities, the Commission should take the time to consider concerns raised by market participants and the PCAOB’s responses.

Unfortunately, the Commission did not do that. Two weeks after receiving the PCAOB’s August 16 letter and one day after receiving a market participant’s letter calling for additional information, the Commission issued the notice for today’s meeting,[8] indicating its intention to not extend the consideration period beyond the initial 90-day period.[9]

The Commission could have used more time to allow more market participants to express their views on the PCAOB’s letter and for the PCAOB to provide additional guidance. This could have resulted in a better standard that would benefit the PCAOB, audit firms, audit clients, and most importantly, investors. It is unfortunate that the Commission has chosen not to do so. This decision is puzzling when the Commission has routinely used the extension for rules of FINRA and the national securities exchanges,[10] upon which the Commission’s process for approval of PCAOB standards is based.

Design-Only Requirement Imposes Unnecessary Costs and Demonstrates a Paternalistic Approach to Regulation

In addition, I am concerned with the standard’s requirement that every PCAOB-registered firm, even those without a current audit engagement subject to PCAOB standards, must design a compliant QC system. While the requirement to implement and operate an effective QC system applies only to firms performing engagements, the standard’s “design-only” requirement imposes costs without attendant benefits. This requirement may disproportionately burden smaller audit firms that do not have current engagements but may be seeking smaller public companies, broker-dealers, and others[11] as clients.

Several commenters expressed similar concerns.[12] In dismissing these concerns, the Commission states that, without the design-only requirement, there would be a risk that “firms could be unprepared to accept and perform engagements.”[13] However, neither the Commission nor the PCAOB has presented data to demonstrate that firms cannot design, implement, and operate a compliant QC system upon starting an engagement. In defending the design-only requirement, the Commission demonstrates its paternalism by implying that public companies and broker-dealers engaging an audit firm cannot make their own judgments on the preparedness of a firm, simply because the firm had not designed a QC system before the engagement. In a competitive market for audit services, firms that are unable to successfully perform engagements will not receive engagements.

The PCAOB’s rationale is equally unpersuasive. The Board states that the design-only requirement “is consistent with our investor protection mandate.”[14] But if a firm does not have any engagements, exactly which investors are being protected? The PCAOB states that “investors and companies considering engaging the firm could reasonably expect that any firm that could pursue such an engagement would already have a PCAOB-compliant QC system designed and ready for implementation and operation.”[15] However, if investors are adequately protected by having the implementation and operation requirements apply only upon an engagement, why are they not similarly protected if the design requirement also applies at that time? The idea that firms that have not designed a QC system pre-engagement are incapable of doing so upon engagement is not supported in the record.

Conclusion

“Fast and furious” might be a good theme for summer movies, but not for agency rulemaking. To be clear, my concern is not about whether there should be strong quality control requirements; there should be. The question is when. Having quality controls when there are no engagements provides little benefits. Because of the unnecessary costs and paternalistic approach of the updated QC standard’s design-only requirement, as well as my concerns with the process, I do not support today’s action, which I find arbitrary and capricious. However, I thank the PCAOB’s members and staff and the Commission staff, especially those from the Office of the Chief Accountant, the Office of the General Counsel, and the Division of Economic and Risk Analysis, for their work on the recommendation.