New PCAOB Standards for 2025–2026: What CFOs and Audit Committees Should Expect

The changes at a glance

The table below lists the rules most likely to affect a U.S. or Latin American issuer, in the order they became (or become) effective.

QC 1000: the firm's quality control system

The PCAOB adopted QC 1000 on May 13, 2024, and the SEC approved it on September 9, 2024. It replaces the interim QC standards of 2003 with an integrated, risk-based framework built on quality objectives, risk assessment, responses, and monitoring and remediation. The original effective date was December 15, 2025. In August 2025 the PCAOB postponed it, together with the related standards, rules and forms, to December 15, 2026.

Once a firm has been subject to QC 1000 for at least five consecutive months, it must evaluate its QC system every year and report the result to the PCAOB on Form QC within 60 days after its evaluation date. Form QC is not public.

The September 2026 amendments

On September 9, 2026, the Board adopted targeted amendments to QC 1000 (PCAOB Release No. 2026-007). The rule filing went to the SEC on September 10 and was amended on September 14, and the PCAOB docket shows the matter as adopted and pending SEC action. As adopted by the Board, the amendments would, among other things, remove the requirement for an external quality control function, allow firms to choose their own annual evaluation date instead of September 30, give more flexibility in assigning QC roles, narrow the look-back for similar deficiencies on other engagements to the more serious types, and shorten QC documentation retention from seven to five years.

What issuers are likely to notice

• More structured acceptance and continuance. Expect more thorough questions on management integrity, going concern, related parties and the firm's capacity to serve you before an engagement letter is signed or renewed.
• More internal monitoring of completed audits. A firm's own reviews of finished engagements can lead to follow-up questions about a year you considered closed (see AS 2901 below).

Our quality control page explains how our own system is organized and what a client can ask us about it.

New AS 2901: when a problem surfaces after the report

The current AS 2901 deals narrowly with auditing procedures that were omitted and discovered after the report date. The new standard, Responding to Engagement Deficiencies After Issuance of the Auditor's Report, replaces it in its entirety on December 15, 2026. It applies whenever an engagement deficiency is identified on a completed audit of financial statements or ICFR, unless it is probable that the report is no longer being relied upon. The standard treats inclusion of the report in the company's most recent SEC filing that requires it as evidence of reliance.

The response depends on the type of deficiency:

• If the auditor did not obtain sufficient appropriate evidence for its opinion, it must perform additional procedures to support the opinion. If it cannot, it must act to prevent future reliance on the report, following the steps in AS 2905.
• For other deficiencies, the firm takes action suited to their nature and severity.

For the issuer, the practical risk is timing. A deficiency found in an internal review or a PCAOB inspection can lead to requests for additional evidence on a prior year, sometimes during your next busy season or a pending registration statement. Keep prior-year support organized and accessible. If an inspection has already raised issues on your audit, our inspection remediation work describes what the follow-up typically involves.

AS 1000 and the 14-day documentation window

AS 1000, General Responsibilities of the Auditor in Conducting an Audit, combined four older foundational standards into one. It applies to audits of fiscal years beginning on or after December 15, 2024, and changes little on the surface for issuers.

One related amendment matters more. AS 1215.15 now requires the auditor to assemble the complete and final audit file no more than 14 days after the report release date, the date the auditor grants permission to use its report. The timing depends on the size of the firm:

• Firms that issued audit reports for more than 100 issuers in calendar 2024: audits of fiscal years beginning on or after December 15, 2024.
• All other registered firms, which includes most auditors of small-cap and OTC companies: audits of fiscal years beginning on or after December 15, 2025. For a calendar-year company, that is the fiscal 2026 audit.

The filing deadline does not move, and the standard already required all procedures and supervisory reviews to be finished before release. What disappears is the comfortable margin after sign-off. After the documentation completion date, nothing may be deleted from the file, and anything added must be dated and explained. Expect your auditor to insist that representation letters, legal letters, subsequent-events updates and filing tie-outs are final before release.

AS 2310: confirmations look different

The new AS 2310, The Auditor's Use of Confirmation, replaced the prior standard in full for audits of fiscal years ending on or after June 15, 2025, so calendar-year companies saw it in their 2025 audits. Three points matter most to finance teams:

• Cash. For cash and cash equivalents held by third parties, the auditor must perform confirmation procedures or obtain evidence by directly accessing information held by a knowledgeable external source. A PDF bank statement forwarded by the company is not a substitute.
• Accounts receivable. The same requirement applies to receivables from the sale of goods or services (and a financial institution's loans). If the auditor concludes, based on experience, that confirmation is not feasible, it must obtain external evidence another way and document that decision.
• Electronic channels. The standard expressly allows intermediaries that transmit requests and responses electronically, and requires the auditor to evaluate how reliable they are. Negative confirmations used alone are not enough.

The auditor must also tell the audit committee when, for significant risks involving cash or receivables, it did not confirm or directly access external information. For groups with banks in Latin America, identify every account and the correct bank contact before year-end. Our Latin America issuer practice handles these requests in English and Spanish.

Technology-assisted analysis: expect full-population data requests

Amendments to AS 1105, Audit Evidence, and AS 2301, The Auditor's Responses to the Risks of Material Misstatement, apply to audits of fiscal years beginning on or after December 15, 2025. They clarify what the auditor must do when it analyzes electronic information with technology-based tools, for example testing every journal entry.

A new paragraph, AS 1105.10A, deals with external information the company hands to the auditor in electronic form, such as cash receipts, shipping documents and purchase orders. The auditor must understand where that information came from and how the company received, stored and processed it, and must either test whether it was modified or test the controls over it. A PCAOB policy statement from September 2025 says that separate testing may not be needed in some low-risk situations.

What to prepare:

• Complete, reconciled extracts of the general ledger, sub-ledgers and master files, with a description of how they were pulled.
• A short map of how third-party data (bank feeds, logistics platforms, payment processors) enters your systems and who can change it.
• Evidence of IT general controls over those systems. If you are building an ICFR program, our SOX 404 and ICFR support covers this.

Group audits and other auditors

Amendments on the supervision of other auditors, together with the new AS 1206, Dividing Responsibility for the Audit with Another Accounting Firm, apply to audits of fiscal years ending on or after December 15, 2024. They require a risk-based approach to the lead auditor's planning and supervision of other firms and individual accountants who work on the audit, and they set out how the lead auditor evaluates those firms' work.

For a holding company with subsidiaries in Latin America, this usually means earlier coordination and more direct review by the lead auditor. The participation of other firms is also disclosed publicly on Form AP. If your structure makes this coordination hard, it is a legitimate factor when you assess your current firm; our guide on how to change auditors and our change of auditor service explain the process.

Proposals that are not (or no longer) on the table

Several projects received attention but are not in force. According to the PCAOB rulemaking docket as of September 17, 2026:

• Noncompliance with laws and regulations (NOCLAR). Proposed in June 2023; the docket shows the comment period closed, with no final rule.
• Firm and engagement metrics, and firm reporting. Both were adopted by the Board in November 2024, but the SEC filings were withdrawn in February 2025, and the docket lists both as adopted and withdrawn.
• Substantive analytical procedures. A proposed new standard is listed with its comment period closed.

How to prepare: a timeline for calendar-year issuers

Applying the dates above to a company with a December 31 year-end:

• Fiscal 2025 audit (reports issued in early 2026): AS 1000, new AS 2310 and the other-auditor amendments already applied. The 14-day window applied only if your firm issued reports for more than 100 issuers in 2024.
• Fiscal 2026 audit (reports expected in early 2027): the technology-assisted analysis amendments and, for most smaller firms, the 14-day window apply for the first time. QC 1000, the new AS 2901 and AS 1310 take effect on December 15, 2026, before that audit's fieldwork finishes.
• Quarterly reviews in 2027: for firms in the smaller group, the 14-day window reaches interim reviews starting with the first quarter of 2027.

Use the fourth-quarter planning meeting to agree on a data request list, a confirmation plan and a firm cut-off before the report date. If you are comparing audit firms for a smaller public company, see how we approach small-cap audits and our quarterly reviews.

Questions the audit committee should ask its auditor

• Which of these standards apply to our next audit for the first time, and how will they change your request list and timeline?
• Is your firm in the "more than 100 issuers" group for the 14-day documentation rule? What must be finished before you release the report?
• How is your firm preparing for QC 1000 on December 15, 2026, and who is responsible for your quality control system?
• If your internal monitoring or a PCAOB inspection identifies a deficiency in our completed audit, how and when will you inform us, and what might you ask us for?
• Which banks and customers will you confirm, through which platforms, and what do you need from us to set them up?
• Which data sets do you plan to analyze in full, in what format, and how will you evaluate external data we provide?
• Which other firms or component teams will work on our audit, where, and how will the lead auditor supervise them?
• Will anything in these changes affect the fee or the timeline agreed in the engagement letter?

Sources

1. Quality Control implementation resources (updated September 9, 2026) — PCAOB
2. Docket 057: Amendments to QC 1000 and related Rule and Forms — PCAOB
3. PCAOB Release No. 2026-007, Amendments to QC 1000 (September 9, 2026) — PCAOB
4. Docket 046: Quality Control — PCAOB
5. Form 19b-4, File No. PCAOB-2025-01 (QC 1000 effective date postponement) — PCAOB
6. Release No. 34-103803, Notice of Filing and Immediate Effectiveness Postponing the Effective Date (August 28, 2025) — U.S. Securities and Exchange Commission
7. AS 2901, Responding to Engagement Deficiencies After Issuance of the Auditor's Report (effective December 15, 2026) — PCAOB
8. AS 2901, Consideration of Omitted Procedures After the Report Date (current) — PCAOB
9. General Responsibilities of the Auditor in Conducting an Audit (AS 1000) implementation resources — PCAOB
10. PCAOB Release No. 2024-004, General Responsibilities of the Auditor in Conducting an Audit (May 13, 2024) — PCAOB
11. AS 1215, Audit Documentation — PCAOB
12. Confirmation implementation resources — PCAOB
13. AS 2310, The Auditor's Use of Confirmation — PCAOB
14. Technology-Assisted Analysis amendments implementation resources — PCAOB
15. PCAOB Release No. 2025-004, Policy Statement Regarding Implementation of Paragraph .10A of AS 1105 — PCAOB
16. Supervision of Other Auditors implementation resources — PCAOB
17. Rulemaking Docket (status of dockets 041, 051, 055, 056) — PCAOB