Smaller Audit Engagements, Significant Impact: Audit Quality, Investor Protection, and the Future of the Profession

Remarks as prepared for delivery

Good morning, and thank you, Evann [Berry], for the kind introduction. I am delighted to welcome you to today’s forum. It was a pleasure to talk with many of you earlier this morning, and I look forward to continuing the engagement throughout the day. First, I want to express my gratitude to the University of San Francisco for graciously hosting today's event on this wonderful campus. It has been over 10 years since the PCAOB last held a forum like this in San Francisco. Given the seemingly never-ending economic activity and innovation that the Bay Area is known for, I believe it is vitally important for the PCAOB to hear from auditors who are at the heart of what some would call America’s economic engine and the birthplace of so many well-known public companies—companies that initially started small and grew, in some cases rapidly, went public, and became leading global enterprises, all with the assistance of our vibrant capital markets.

Before I continue, please know that although my remarks this morning are provided in my official capacity as a PCAOB Board member, the views I express are my own and do not necessarily reflect the views of the full Board, my fellow Board members, or the PCAOB’s dedicated staff.

Although the setting may resemble a lecture, my hope is that today feels more like a conversation. We call this event a forum for good reason: we benefit from hearing directly from auditors who work with smaller businesses and broker-dealers. These are special events for us. Your practical experience helps the Board and staff understand how our standard-setting and other oversight activities operate in the real world—and how we can promote audit quality through our rules and standards in ways that are both effective and scalable. The overarching goal of these forums is to provide an opportunity for us to listen, learn, and ensure our oversight activities reflect both the imperative of investor protection and the realities of practice. Today you will hear from a number of staff members from across the PCAOB. The presenters represent the best of the PCAOB, and I consider it a true privilege to be a part of such an experienced, knowledgeable, and dedicated group of professionals. I learn from them every day.

I want to use my remaining time this morning to focus on three themes: the essential role financial statement auditors of smaller businesses and broker-dealers play in the capital markets; recent PCAOB developments; and the opportunities and risks that arise as technology and artificial intelligence (AI) become more and more embedded in auditors’ work.

Auditors, Trust, and the Capital Markets

I often speak about the vital role financial statement auditors play in the financial reporting ecosystem and about why auditing is such a noble, vibrant, and resilient profession. Your audit engagements may be smaller, but their importance is not. Smaller audit engagements can involve complex risks, complicated related-party transactions, sophisticated debt and equity instruments, and revenue recognition challenges. Addressing those challenges requires a deep understanding of the public company’s underlying business and strategies, as well as exercising professional skepticism. Your work supports trust in the capital markets and is relied upon by investors, customers, counterparties, and regulators. And because many small companies become larger companies, your work also supports economic growth, job creation, and the innovation that fuels the overall economy.

That responsibility to support trust and growth remains an important constant even as the landscape of the accounting profession evolves. The market for accounting firms that audit smaller businesses and broker-dealers is currently experiencing unprecedented consolidation—through both traditional mergers and acquisitions and transactions funded by private equity. That change creates challenges and opportunities that I know are on your minds as you manage your practices. A former auditor who is now a member of the academic community recently put the central principle this way: in an audit, only one decision point can be a business decision—whether to accept or continue the engagement. Every decision after that must be governed by the objective of audit quality, whatever the business consequences. I could not agree more, and I have been reflecting on this principle. Throughout an audit, independence, professional skepticism, judgment, integrity, and the auditor’s obligation to the public interest must guide the work.

This notion is embraced in Article II of the American Institute of Certified Public Accountants (AICPA) Code of Professional Conduct, which states “[m]embers should accept the obligation to act in a way that will serve the public interest, honor the public trust, and demonstrate commitment to professionalism.”¹ Maintaining fidelity to those principles can be challenging, but doing so is the hallmark of our profession.

PCAOB Updates

We designed today’s agenda to provide practical information and illustrative examples that can be used as you perform your audits. You will hear updates on our broker-dealer and public company inspection programs, including resources for smaller firms, as well as updates on our quality control remediation process, standard-setting efforts, and enforcement program. In addition, there will be presentations from staff members of the U.S. Securities and Exchange Commission and the Financial Industry Regulatory Authority, or FINRA.

While today’s sessions will delve deeper, I want to provide a brief overview of certain initiatives that we have been working on this year.

Earlier this month, the Board approved nine amendments to QC 1000, A Firm's System of Quality Control (QC 1000).² The two most significant provisions rescinded by the amendments—the design-only requirement³ and the External Quality Control Function or EQCF—likely did not apply to the majority of firms in the room. As I noted in the PCAOB’s open meeting, I am disappointed that the amendments to QC 1000 eliminated the EQCF requirement and I intend to encourage public dialogue, study, and debate about how best to design a requirement that avoids some of the concerns that were raised about the original requirement.⁴

Other amendments, however, will affect your firms, including changes that provide latitude in selecting the firm’s annual evaluation date, greater flexibility in filling certain specified roles in the quality control (QC) system, and revisions to the definition of a QC deficiency. All these amendments will be discussed during this afternoon’s standard-setting update. Before moving away from QC 1000, I do want to highlight that in August we provided a series of questions and answers on our website to assist firms’ implementation efforts.⁵

As some of your practices include auditing broker-dealers, you are already familiar with the interim inspection program we put in place in 2011. We are now developing a rule to establish a permanent program and expect to issue a proposal for public comment by the end of the year. I especially encourage the broker-dealer auditors here today to review it and share your views when the Board seeks comment on a proposed draft rule.⁶ Your experience can help us determine whether the proposed program takes the right path.

Turning to activity in our Office of the Chief Auditor (OCA), OCA staff are working on a data and technology project to assess whether the increased use of technology-based tools by auditors and preparers warrants guidance, changes to our standards, or other action. As part of this project, OCA staff will evaluate the role that technological innovation, including the use of AI, plays in driving audit quality. I frequently contemplate the impact of advances in technology and AI on both financial statement preparation and auditing, and I will speak about them in a few moments.

The Board is also developing an updated five-year strategic plan covering the 2026 to 2030 period. The draft strategic plan is organized around three overarching objectives: advancing audit quality and investor protection; communicating our expectations and decisions clearly and consistently; and transforming our operations through strategic investments in technology and other improvements. Those objectives support six goals covering the PCAOB’s core functions—standard setting, registration, inspections, and enforcement—as well as stakeholder engagement, technology and data, and organizational effectiveness. The comment period closed earlier this month, and we are now evaluating the feedback we received.

In addition to inviting public comment on our draft strategic plan, the Board this year sought—for the first time—feedback on our standard-setting process and our standard-setting and research agendas.⁷ We are taking into account the 34 responses we received as we consider how to update those agendas. Two audit practitioner fellows—also a first at the PCAOB—are assisting in that effort. During their two-year terms in OCA, they will bring recent audit experience to a broad range of the work of our standard setters. 

Finally, I am pleased to highlight our new Firm Consultation Process, launched in June. Through this process, auditors can ask OCA staff for informal views on implementing new standards and applying existing ones. I encourage you to take advantage of the consultation process when questions arise about PCAOB auditing, attestation, or quality control standards; related rules and forms; or ethics and independence requirements. Instructions for initiating a consultation through an intake form⁸ are available on our website. Although OCA staff do not plan to publish individual consultations, they may issue public guidance when the same questions arise frequently.

Expanding Use of Technology in Audits

Taken together, these PCAOB initiatives reflect a broader effort to seek stakeholder input, increase the transparency of our work, and keep pace with a changing audit environment. Few changes are moving faster—or presenting more consequential opportunities and risks—than the growing use of technology and AI in audits. I recently read an article that observed, “everyone in AI is racing: bigger models, faster chips, the next release. The assumption underneath is so universal almost no one says it aloud: Whoever moves the fastest wins. Experience shows the opposite; trust, not speed, is the true ingredient of success.”⁹ That insight is especially relevant to auditing: responsible adoption requires firms to pair innovation with disciplined governance.

Technology advances audit quality only when it operates within a strong governance structure and an audit process that preserves professional skepticism, judgment, and accountability. Effective governance should align a firm’s AI strategy and operating model with clear oversight throughout each tool’s life cycle—from approval and implementation through performance monitoring, training, periodic reassessment, and retirement. It should also include maintaining an inventory of AI tools and calibrating the rigor of these processes to the risks posed by the particular technology, audit objective, and circumstances of use. I recognize that firms auditing smaller businesses and broker-dealers do not have the same investment resources as the largest firms. Even so, the relevant question is not whether a firm can adopt every new tool. It is whether the technology can address a real audit need and be governed effectively. Options include AI-enabled audit methodologies, platforms that work with an existing methodology, and discrete tools designed for a specific audit task.

Based on the demonstrations I have seen, technology can advance audit quality in at least three ways. It can broaden coverage through full-population testing and data analysis. It can sharpen risk assessment by identifying anomalies and supporting a more critical evaluation of risk judgments.¹⁰ And it can make knowledge-intensive work more efficient through accounting research, disclosure and contract review, and document summarization. The value, however, does not come from using AI for its own sake. It comes from using the right tool, whether developed internally or purchased, for a well-defined audit objective.

Those opportunities come with risks, and governance is what transforms experimentation into responsible audit practice. Before deploying a tool, a firm should understand how it was certified for use, what audit objective it serves, how its performance was validated, what data it relies on, who may use it, and how its continued performance will be monitored. In his book “What’s the Point?”, Tom Rath states that “AI automates data entry and transaction categorization. Accountants provide judgement on financial strategy, interpret regulatory nuances, detect fraud patterns, and advise on complex decisions. Algorithms process numbers; accountants understand the story behind them and the human consequences of every financial decision.”¹¹ A tool developed for one set of circumstances should not be transferred to another without assessing whether the new use is appropriate. In short, firms need a comprehensive governance structure that includes policies, procedures, controls, and monitoring across the tool’s full life cycle.

A central question is whether the output of a technology-assisted procedure is reliable enough for its intended audit purpose. The familiar principle “garbage in, garbage out” still applies: poorly designed prompts, inappropriate tests, or data that have not been evaluated for reliability, completeness, and relevance can produce unreliable results. Auditors therefore need to understand these inputs, test the tool’s performance, investigate exceptions, and document how the output supports the conclusion reached. Whatever occurs within the algorithm, PCAOB requirements still apply: the work papers must contain sufficient information to enable an experienced auditor to understand the nature, timing, extent, and results of the procedures performed, the evidence obtained, and the conclusions reached.

Ultimately, responsibility for the audit remains with the individual auditor. AI can extend an auditor’s reach, but it cannot assume the auditor’s obligation to exercise judgment and professional skepticism. Auditors must evaluate contradictory evidence, challenge AI-generated outputs, and resist the temptation to treat a confident answer as a reliable one. Overreliance on technology can weaken the critical-thinking skills on which audit quality depends. Used well, however, technology can create more capacity for the work that only people can do: asking better questions, nuanced evaluation of audit evidence, and making difficult judgments with integrity.

Conclusion

As I close, I want to reflect on the statement made by former Secretary of the Treasury Henry Paulson when he announced the members of the Advisory Committee on the Auditing Profession in 2007. He said, “[i]nvestor trust in the integrity of our capital markets is vital to the strength of the U.S. economy. Investor trust is based on accurate and transparent financial reporting, and a vibrant auditing profession is essential for a well-functioning financial reporting system.”¹²

Your work is fundamental to that trust. It occupies the unique position at the intersection of investor protection, market integrity, and public confidence. Audits of smaller businesses and broker-dealers present distinct challenges, and your independence, professional skepticism, and sound judgment are critical to the audit quality necessary for the protection of investors.

Lastly, as we go through the day, I encourage you to ask questions, offer comments, and make suggestions. Challenge us. Our goal is to make the day as interactive as possible. We will all benefit from the engagement.

Thank you for your attendance, for the work you do, and for the perspective you will bring to today’s conversation. I now welcome your questions and comments in our remaining time.