QC 1000 Questions and Answers

August 17, 2026

The questions and answers below have been prepared by PCAOB staff to help firms implement QC 1000, A Firm’s System of Quality Control (“QC 1000” or the “standard”), and other related standards, rules, and forms. They reflect the staff’s views on issues related to the implementation of the rules and standards of the PCAOB. The answers do not constitute rules of the Board, nor have they been approved by the Board. For additional resources related to QC 1000, please refer to the Quality Control Implementation webpage.

On June 9, 2026, the PCAOB issued for public comment a set of proposed amendments to QC 1000 and related amendments to the QC reporting rule and PCAOB forms.¹ The questions and answers below do not address provisions that are the subject of those proposed or conforming amendments. The staff will continue to evaluate implementation questions and requests for clarification and may address additional matters through future updates to the QC 1000 Q&As or other implementation guidance.

Terms that are defined in QC 1000 are presented in bold, blue font the first time they appear in each answer; hover over the word or phrase to see its definition.

The parenthetical date associated with each question and answer represents the date the question or answer was added or last changed.

For further questions regarding the application of the requirements of QC 1000, please contact the Office of the Chief Auditor (OCA) at 202-591-4395 or by submitting a Standards-Related Questions Form. Registered public accounting firms may also request a consultation with OCA through the Firm Consultation Process on the interpretation and application of PCAOB standards, including QC 1000.

Table of Contents

• I. General
• II. Terminology
• III. Roles and Responsibilities [Reserved]
• IV. Governance and Leadership [Reserved]
• V. Firm Risk Assessment Process
• VI. Ethics and Independence
• VII. Resources
  • VII.A. People Resources
  • VII.B. Technological Resources
• VIII. Information and Communication
• IX. Monitoring and Remediation Process
  • IX.A. Monitoring of Monitoring and Remediation Process
  • IX.B. Engagement Monitoring Activities
  • IX.C. QC System-Level Monitoring Activities
  • IX.D. Engagement Deficiencies
• X. Evaluation and Reporting
• XI. Documentation
• Definitions
• Footnotes

I. General

Question I.1 (August 17, 2026)

Are the requirements of QC 1000 to be applied retrospectively?

No. All requirements of QC 1000 are to be applied prospectively upon the effective date of the standard, December 15, 2026. Consistent with QC 1000’s prospective application, if a firm first becomes subject to QC 1000 after the effective date, for example, because the firm becomes subject to applicable professional and legal requirements ^definition with respect to an engagement^definition, the requirements apply prospectively from the time the firm becomes subject to the standard. Firms are not precluded from early adopting aspects of QC 1000, with the exception of reporting on Form QC.

Question I.2 (August 17, 2026)

If a firm only plays a substantial role² in another firm’s engagement, is that firm required to design, implement, and operate a QC system compliant with QC 1000?

Yes. If the firm plays a substantial role in another firm’s engagement^definition, the firm is required to design, implement, and operate a QC 1000-compliant system because that engagement meets the definition of an engagement under QC 1000.

Question I.3 (August 17, 2026)

Is a firm required to operate its QC system over work performed at less than a substantial role in another firm’s PCAOB engagement?

It depends.

• If a firm is required to design, implement, and operate its QC system under QC 1000 because it performs one or more engagements ^definition as defined in QC 1000, then it is required to operate its QC system over all work performed by the firm under PCAOB standards, including work performed on another firm’s engagement at less than a substantial role.
• If the firm is not subject to applicable professional and legal requirements ^definition with respect to any engagements as defined in QC 1000, it is not required to operate a QC system over work performed at less than a substantial role.

II. Terminology

Question II.1 (August 17, 2026)

What is the scope of “other applicable statutory, regulatory, and other legal requirements” in the definition of applicable professional and legal requirements (QC 1000.A2)?

The full text of the provision in which the phrase appears is:

“To the extent related to the obligations and responsibilities of accountants or auditors in the conduct of engagements or in relation to the QC system, rules of the SEC, other provisions of U.S. federal securities law, ethics laws and regulations, and other applicable statutory, regulatory, and other legal requirements.”

Accordingly, the phrase refers only to applicable statutory, regulatory, and other legal requirements that relate to the obligations and responsibilities of accountants and auditors in the conduct of engagements ^definition or in relation to the QC system. These include legal obligations imposed by professional licensing authorities, such as client confidentiality rules, requirements for continuing professional education, and state-specific laws and rules governing accountants.

Question II.2 (August 17, 2026)

How should a firm determine whether external individuals used in a firm’s QC system are considered firm personnel or other participants?

The determination of whether external individuals are considered firm personnel ^definition or other participants ^definition is based on how they function.

As stated in the definition of firm personnel, professional staff include employees as well as individuals that function as the firm’s employees. The definition further provides that individuals, such as non-employee contractors and consultants, that work under the firm’s supervision or direction and control and function as employees of the firm are considered firm personnel. Not every non-employee contractor or consultant that works under the firm’s supervision or direction and control would function as the firm’s employee (see Question II.3). Individuals who do not meet the definition of firm personnel would be considered other participants under QC 1000.A7.

Question II.3 (August 17, 2026)

What are example considerations that could apply when determining if an individual works under a firm’s supervision or direction and control and functions as the firm’s employee?

The determination of whether an individual works under the firm’s supervision or direction and control and functions as the firm’s employee (i.e., firm personnel ^definition) would be based on the facts and circumstances of the relationship between the individual and the firm, reflecting an assessment of the individual’s functional role, rather than the legal form of the relationship. When determining whether the individual works under the firm’s supervision or direction and control and functions as the firm’s employee, relevant considerations could include, for example:

• Whether the firm controls or has the right to control what work the individual does for the firm and directs how the individual performs this work;
• Whether the firm controls what assignments the individual works on;
• The duration of the arrangement with the individual to perform work;
• Whether the individual only performs work on a discrete assignment or on multiple assignments for the firm;
• Whether the firm directs or controls the financial and business aspects of the individual’s work (i.e., how the individual is paid, what expenses are reimbursed, providing tools/supplies, etc.);
• Whether there are written contracts or employee-type benefits such as insurance or vacation pay; and
• Whether the individual spends a significant portion of their time (e.g., percentage of hours worked) performing work for the firm relative to other firms or organizations.

For example, an individual who works limited hours during a week on a discrete project – and who may concurrently undertake multiple other discrete projects for other firms during the week – would likely not be viewed as functioning as the firm’s employee (and would be classified as an other participant^definition). In this example, the individual would be less likely to be integrated into the firm’s day-to-day operations in a manner comparable to an employee. Alternatively, an individual whose projects and schedules are set by the firm, whose performance reviews are performed by the firm, and whose business time is substantially devoted to the firm’s projects is likely to function as a firm employee (and would be classified as firm personnel).

Question II.4 (August 17, 2026)

QC 1000 defines quality responses as policies and procedures designed and implemented by the firm to address quality risks. Based on the definition, is a quality response required to include both a policy and a procedure?

No. A quality response ^definition may, but is not required to, include both policies and procedures. It may be appropriate for a quality response to consist of a policy only or a procedure only. For example, a firm may identify a quality risk ^definition that firm personnel ^definition might not act with integrity, objectivity, and due professional care. To address that quality risk, the firm could establish a code of ethics that prohibits certain behaviors. The code of ethics itself may constitute a quality response, even if it does not prescribe detailed procedures, provided it appropriately addresses the quality risk.

III. Roles and Responsibilities [Reserved]

IV. Governance and Leadership [Reserved]

V. Firm Risk Assessment Process

Question V.1 (August 17, 2026)

Is every quality risk required to have at least one quality response?

Yes. Each quality risk ^definition identified and assessed by the firm must have at least one corresponding quality response^definition that addresses that quality risk. The standard does not specify the number of quality responses that must be identified for each quality risk. Depending on the quality risk, the firm may only need to design and implement a single quality response. For other quality risks, the firm may need to design and implement multiple quality responses in order to appropriately address the quality risk. A quality response may also address multiple quality risks related to one or more QC components.

Question V.2 (August 17, 2026)

In addressing quality risks, are specified quality responses more important than the firm’s own quality responses?

No. QC 1000 establishes no hierarchy between specified and firm-designed quality responses^definition; both are important to an effective QC system and operate together. It should also be noted that specified quality responses alone will not be sufficient to enable the firm to achieve all established quality objectives^definition.

Question V.3 (August 17, 2026)

Under what circumstances would a firm need to design and implement quality responses in addition to the specified quality responses to address a quality objective?

It depends on the quality risks ^definition identified by the firm. QC 1000 requires the firm to design and implement quality responses ^definition to address its quality risks, including certain specified quality responses that are required for all firms to which they apply.

If a specified quality response does not sufficiently address all identified quality risks to the achievement of the quality objective^definition, the firm is required to design, implement, and operate additional quality responses. However, if the specified quality response sufficiently addresses the identified quality risks to the achievement of the quality objective, additional quality responses may not be necessary.

Question V.4 (August 17, 2026)

Does a firm have to identify a risk of intentional misconduct by firm personnel or other participants for every quality objective?

No. There is no specific requirement that a firm identify a quality risk ^definition related to intentional misconduct for every quality objective^definition. The concept of intentional misconduct would be incorporated and evaluated the same as any other risk; specifically, a quality risk exists when an outcome has at least a reasonable possibility of occurring and a reasonable possibility of adversely affecting the firm’s achievement of one or more quality objectives.

For example, if a firm is aware of misconduct at other firms through news reporting or enforcement cases, it may want to consider whether such misconduct could also be present at the firm and what quality objectives could be affected, and then modify its quality risks accordingly.

Question V.5 (August 17, 2026)

Under QC 1000, is a firm expected to evaluate the relevance and reliability of information used in the operation of a quality response pursuant to AS 1105, Audit Evidence?

No. AS 1105 is an auditing standard that, by its terms, applies to audit evidence used to support an auditor's opinion on the financial statements or internal control over financial reporting. QC 1000 requires firms to design, implement, and operate quality responses ^definition that provide reasonable assurance that the firm’s quality objectives ^definition are being achieved. In addition, QC 1000.59 requires the monitoring and remediation process to provide relevant, reliable, and timely information about the design, implementation, and operation of the QC system. In this context, a firm determines what information is needed, and how reliable that information needs to be, to operate a quality response that provides reasonable assurance that relevant quality objectives are achieved, taking into account the nature of the quality risk ^definition being addressed, and the potential consequences if the information is not relevant or reliable.

For example, a firm may use a report to monitor whether firm personnel ^definition have completed required training. In this circumstance, the firm may determine that minor omissions, such as a small number of firm personnel missing from the report due to timing differences, would not impair the firm’s ability to assess overall training compliance.

In contrast, when evaluating whether to accept a new engagement^definition, a firm may rely on information such as independence information, engagement risk profiles, and resource availability. In this context, the firm may determine that certain information, particularly independence information, is fundamental to the operation of the quality response and needs to be reliable, because unreliable information could result in the firm accepting an engagement that it should not.

Question V.6 (August 17, 2026)

Does the firm need to document potential quality risks that were not determined to be quality risks?

No. The firm is not required to document potential quality risks that were considered during its risk assessment process but ultimately determined not to be quality risks^definition. However, this information may be useful in the future if the firm needs to revisit those potential quality risks as circumstances change.

VI. Ethics and Independence

Question VI.1 (August 17, 2026)

When a violation of independence rules³ is identified, does it always result in an engagement deficiency, a QC deficiency, or both?

A violation of the independence rules is always an engagement deficiency^definition. However, whether it is also a QC deficiency ^definition depends on the nature of the violation. An engagement deficiency is a QC observation ^definition under QC 1000.A9. The firm is required to evaluate that QC observation in accordance with QC 1000.72 to determine whether it also represents a QC deficiency.

Question VI.2 (August 17, 2026)

How should a firm approach the “at least monthly” communication of additions to the restricted entity list pursuant to the note in QC 1000.34b?

QC 1000 does not prescribe a specific process for communicating additions to the restricted entity list.⁴ For example, a firm may send a monthly email that includes the additions to the restricted entity list since the previous month. As another example, a firm might communicate that there have been additions to the restricted entity list via email and include within the email a link to an accessible website-hosted list of additions. For periods where there were no additions, no such communication would be required.

In certain circumstances, this communication could be made through an automated process. For example, a firm may use a direct broker feed that uploads personal security holdings and configure the system to compare those holdings against the restricted entity list. When a new entity is added to the restricted entity list, the system automatically notifies affected firm personnel^definition included in the automated independence system of the need to divest applicable holdings. The firm might determine that, based on the relevant facts and circumstances, such a process is an appropriate method for updating and communicating additions to the restricted entity list as described within the note to QC 1000.34b. However, the firm may still need to communicate changes to others subject to independence requirements, if those individuals are not included in the automated independence process.

Question VI.3 (August 17, 2026)

Is the firm expected to communicate additions to the restricted entity list pursuant to QC 1000.34b to every firm participating in a multi-tiered audit?

Yes. The firm is required to communicate additions to the restricted entity list to others performing work on behalf of the firm whose relationships and arrangements may reasonably be thought to bear on the independence of the firm, which includes the firm’s network of affiliated firms as well as every non-affiliated firm that participates in a multi-tiered audit. However, QC 1000 does not prescribe any particular manner through which additions to the restricted entity list are communicated to other firms. Therefore, in communicating to other firms, a firm may design and implement policies and procedures under which the firm communicates to the first other auditor that, under the terms of the engagement^definition, the first other auditor is responsible for communicating the restricted entity list (and any additions thereto) to any second other auditors that they choose to engage (more specifically, those at the second other auditor that are performing work on behalf of the firm and are subject to the independence requirements). While a firm may use other auditors to carry out communications under QC 1000.34b, ultimately the firm retains responsibility for its QC system and for the communications and information needed to support compliance with the standard.

Question VI.4 (August 17, 2026)

In the Ethics and Independence component, do the specified quality responses apply to all firm personnel or only certain firm personnel?

QC 1000 distinguishes between ethics requirements, which apply broadly to all firm personnel ^definition, and independence requirements, which apply only to firm personnel subject to independence rules (e.g., Regulation S-X Rule 2-01). The Board has stated in the adopting release that QC 1000 does not create new requirements regarding auditor independence or impose ethics and independence requirements on individuals who are not currently subject to them;⁵ instead, it operationalizes existing obligations through the firm’s QC system. However, firms may choose to implement broader policies that impose requirements on firm personnel who are not subject to the ethics and independence rules of the PCAOB and the independence rule of the SEC.

Not all specified quality responses ^definition in the Ethics and Independence component apply to the same individuals.

VII. Resources

A. People Resources

Question VII.A.1 (August 17, 2026)

Are all firm personnel, including those in human resources and information and technology roles, required to complete mandatory QC 1000-specific training to comply with QC 1000.48?

No. There is no requirement for QC 1000-specific training for all firm personnel^definition. The type and extent of training should be directed at whatever is necessary to enable firm personnel to fulfill their assigned QC and engagement ^definition roles in accordance with applicable professional and legal requirements ^definition and the firm’s policies and procedures. Firms can determine the type and extent of training necessary based on the roles assigned to firm personnel and the nature and circumstances of the firm and its engagements. A firm may determine that different types of training are necessary on a wide array of topics for certain roles within the firm. For example, a firm may elect to tailor its training to include training for human resources firm personnel involved in activities related to developing and evaluating firm personnel under the QC system, or training for information technology firm personnel responsible for implementing and maintaining technological resources used in the operation of the QC system, to focus on the aspects of QC 1000 relevant to the specific roles rather than providing the same training as the firm provides to firm personnel that perform engagements.

B. Technological Resources

Question VII.B.1 (August 17, 2026)

Can a firm group technological resources together for purposes of risk assessment?

Yes. A firm may find it helpful, based on the nature and the circumstances of the firm and its QC system, to consider grouping technological resources when performing its risk assessment procedures. It may be beneficial to group together technological resources that share similar quality risks ^definition and potentially require similar quality responses^definition. For example, a firm may group technological resources with common features or control environments (e.g., all cloud-based systems managed by a single provider) for identifying quality risks and designing quality responses.

Question VII.B.2 (August 17, 2026)

Is a firm required to establish separate policies and procedures for each individual technological resource, or can multiple technological resources be addressed by a single set of policies and procedures?

When designing quality responses ^definition related to technological resources, a firm is not required to have a separate policy or procedure for each individual technological resource. Instead, a set of policies or procedures may be applicable to a group of technological resources based on their shared functions or characteristics, such as the origin (e.g., purchased or internally developed), purpose within the audit process (e.g., audit methodology platforms, data analytics tools, confirmation tools, and engagement collaboration platforms), or other functions and characteristics (e.g., artificial intelligence), depending on the nature and circumstances of the firm. Also, only technological resources used in the firm’s QC system or in its work on engagements^definition fall within the scope of QC 1000; other technological resources used by the firm are not in scope.

Question VII.B.3 (August 17, 2026)

The characteristics of technology referred to in QC 1000.51 are capacity, integrity, resiliency, availability, reliability, and security. Is a firm required to design and implement quality responses that address all six characteristics for each technological resource?

QC 1000.51 requires firms to design, implement, and maintain policies and procedures so that technological resources have the capacity, integrity, resiliency, availability, reliability, and security necessary to enable the operation of the firm’s QC system and the performance of its engagements ^definition in accordance with applicable professional and legal requirements^definition. However, firms may not need quality responses ^definition that address all six characteristics for each technological resource. For example, the firm’s risk assessment may not identify relevant risks with respect to all characteristics. Further, firms may already have quality responses in place that address the six characteristics, as risks to these characteristics are typically considered by firms when implementing and maintaining technology.

A firm can comply with the requirement in QC 1000.51 in more than one way. In doing so, a firm may address the six characteristics, individually or collectively, based on the type of technological resource involved. The applicability and importance of each characteristic may vary based on the type of technological resource and the firm’s identified quality risks^definition. Accordingly, a firm’s quality response may vary depending on how it (1) groups technological resources when performing its risk assessment, (2) identifies specific quality risks during the risk assessment, and (3) determines the applicability and importance of those characteristics in responding to identified quality risks. For example:

• For a cloud-based audit documentation system, capacity, availability, resiliency, and security may be relatively more important than other characteristics because the system may need to store large volumes of sensitive engagement data, recover quickly from disruptions, and ensure that authorized staff can access it when needed.
• For an engagement acceptance tool, security may be relatively more important than other characteristics due to the need to protect confidential company information.
• For a data analytics platform and artificial intelligence tools used on engagements, integrity and reliability may be relatively more important than other characteristics to ensure the accuracy of outputs that will be used when making engagement decisions.

VIII. Information and Communication

Question VIII.1 (August 17, 2026)

Does the quality objective in QC 1000.53d regarding communications to external parties being made in accordance with applicable professional and legal requirements apply to communications to the PCAOB in connection with inspections?

Yes. Communications to the PCAOB in connection with inspections are generally made pursuant to applicable professional and legal requirements ^definition (see PCAOB Rule 4000 series).

Question VIII.2 (August 17, 2026)

When obtaining the conclusion of the most recent evaluation of the QC system of the other participant firm under QC 1000.53g, is a firm also required to obtain information about any unremediated QC deficiencies?

No. With respect to other participants ^definition that are firms, information to be obtained under QC 1000.53g should include the conclusion of the other participant firm’s most recent evaluation of its QC system. There is no requirement for the firm to obtain information regarding unremediated QC deficiencies ^definition at the other participant firm and the other participant firm is not required to provide such information. However, a firm may discuss the conclusion with the other participant firm to gain a better understanding of the basis for that conclusion, including information regarding the nature of any unremediated QC deficiencies. The firm would then determine whether and how the conclusion and any other information from the other participant firm affects the firm’s engagements^definition and its use of the other participant.

IX. Monitoring and Remediation Process

A. Monitoring of Monitoring and Remediation Process

Question IX.A.1 (August 17, 2026)

Under QC 1000.58, the monitoring and remediation process applies to all of the components of the QC system, including monitoring and remediation, and provides the basis for evaluating and reporting on the QC system. When determining how to monitor the monitoring and remediation process, what considerations apply?

QC 1000 does not prescribe how to monitor the monitoring and remediation process. QC 1000.59 specifies three goals for the monitoring and remediation process: (a) provide relevant, reliable, and timely information about the design, implementation, and operation of the QC system; (b) provide a reasonable basis for timely detection of engagement deficiencies ^definition and QC deficiencies^definition; and (c) remediate identified engagement deficiencies and QC deficiencies and take any other required actions in relation to such deficiencies in accordance with applicable professional and legal requirements ^definition on a timely basis. Monitoring of the monitoring and remediation process is intended to inform the firm whether the process achieves these goals and, if there are issues that need to be addressed in the QC system, where and how these issues arose and how to address them.

When monitoring the monitoring and remediation process, a firm may consider how the various aspects of this process achieve these goals, for example, whether:

• The firm is gathering information about factors that help prevent engagement deficiencies and QC deficiencies from occurring;
• The engagement^definition partner monitoring cycle provides a reasonable basis for detecting engagement deficiencies and QC deficiencies;
• The monitoring activities are, in fact, identifying any engagement and QC deficiencies on a timely basis;
• The firm is appropriately incorporating multiple sources of information (e.g., internal inspections, external inspections, and other inputs) in evaluating engagement and QC system-level activities;
• The firm is performing an effective root cause analysis; and
• Remedial actions to address engagement deficiencies and QC deficiencies have been designed and implemented timely and operate effectively.

B. Engagement Monitoring Activities

Question IX.B.1 (August 17, 2026)

Is a firm required to have a three-year cycle for engagement partner monitoring to comply with the Note to QC 1000.62b?

No. A firm is not required to have a three-year cycle for engagement^definition partner monitoring and may use a cycle longer than three years, so long as the firm can support the adequacy of the cycle. QC 1000 does not require that a firm change its existing engagement partner monitoring cycle if that cycle is adequate to provide a reasonable basis for detecting engagement deficiencies ^definition and QC deficiencies^definition.

Question IX.B.2 (August 17, 2026)

How can the factors in QC 1000.64 guide a firm in determining the engagement partner monitoring cycle required by QC 1000.62b?

QC 1000.64 includes factors that the firm is required to take into account in determining the nature, timing, and extent of engagement ^definition monitoring activities, including engagement partner monitoring cycles. One of the factors addresses the nature, timing, extent, and results of previous monitoring activities undertaken by the firm, including from inspections of completed engagements, monitoring of in-process engagements, monitoring of work performed on other firms’ engagements, and QC system-level monitoring activities. A firm may take into account the results of these monitoring activities when deciding the length of the engagement partner monitoring cycle discussed in the Note to QC 1000.62b.

Another factor addresses information obtained from oversight activities by regulators, other external inspections or reviews, and, if applicable, monitoring activities performed by a network. While the firm cannot rely solely on monitoring activities performed by others (e.g., network activities, regulatory inspections, or peer reviews) in lieu of performing its own engagement monitoring activities, the firm would take into account the results of those activities in determining the engagement partner monitoring cycle.

A firm would also evaluate the characteristics of particular engagements, such as the industry and the type of engagement, when determining its engagement partner monitoring cycle. For example, engagements affected by newly adopted accounting standards may require more frequent monitoring cycles due to increased risk of misapplication of new standards. In another example, a firm may determine a longer cycle for engagements in industries that experience relatively little operational or regulatory change.

Question IX.B.3 (August 17, 2026)

Can engagement partner monitoring cycles vary for different engagement partners?

Yes. A firm can have different engagement ^definition monitoring cycles for individual engagement partners or different groups of engagement partners. For example, a firm may choose to inspect completed engagements for all new partners within two years of their admission, while applying a different cycle for more experienced partners. Similarly, a firm may choose to inspect engagements on a longer cyclical basis for partners who consistently demonstrate strong results based on internal and external inspections of their work. In contrast, an engagement partner with recent or repeated internal and PCAOB inspection findings may be subject to a shorter engagement partner monitoring cycle. Mergers and other consolidations among accounting firms can also affect these cycles. For example, a newly merged firm may initially apply a shorter engagement partner monitoring cycle to all partners from the acquired firm.

Question IX.B.4 (August 17, 2026)

If a partner participates on an engagement only in a supporting or a contributing role (rather than as the engagement partner), can monitoring the partner’s work in that capacity satisfy the requirements of QC 1000.62b to inspect at least one completed engagement for each engagement partner on a cyclical basis?

No. Inspecting the quality of a partner’s work performed in a supporting or contributing role does not satisfy the requirement of QC 1000.62b to inspect at least one completed engagement ^definition for which the partner serves as the engagement partner, which is defined in paragraph .A1 of AS 1201, Supervision of the Audit Engagement, as “the member of the engagement team with primary responsibility for the audit.”

However, results from inspections of a partner’s work performed in a supporting or contributing role may be considered as one of the factors under QC 1000.64 when determining the nature, timing, and extent of monitoring activities, including the length of the monitoring cycle discussed in the Note to QC 1000.62b. For example, if a supporting or contributing partner’s work in a significant or higher-risk area (e.g., revenue recognition on a complex engagement) has been recently inspected with positive results, a firm may determine, based on the totality of relevant factors, that a longer monitoring cycle for that partner’s own engagements may be appropriate.

C. QC System-Level Monitoring Activities

Question IX.C.1 (August 17, 2026)

Is every quality response required to be monitored every year?

No. QC 1000.65 provides factors to consider in determining the nature, timing, and extent of QC system-level monitoring activities. A firm’s monitoring activities are likely to vary over time as the firm takes these factors into account. Since a firm’s QC system is a continuous and iterative process, these factors will generally lead a firm to perform different monitoring activities or employ different monitoring approaches over time.

In cases where a firm determines that there have been no changes related to a particular quality response ^definition that was previously evaluated, the firm would still need to consider whether previous monitoring activities related to that quality response continue to provide the firm with a reasonable basis to evaluate the QC system, including the appropriateness of the firm’s monitoring activities for the current period.

Question IX.C.2 (August 17, 2026)

If the monitoring of a firm’s quality response involves obtaining a service auditor’s report, and if the service auditor’s report date does not align with the firm’s annual evaluation date, is the firm expected to update its monitoring procedures as of its evaluation date by, for example, obtaining a bridge or gap letter?⁶

QC 1000 does not prescribe the timing or frequency of monitoring activities. Instead, firms determine the nature, timing, and extent of monitoring activities necessary to provide relevant, reliable, and timely information about the design, implementation, and operation of the QC system.

When obtaining a service auditor’s report for monitoring a specific quality response^definition, a firm may use the service auditor’s report as monitoring evidence and determine whether additional procedures (such as obtaining a bridge or gap letter) are necessary based on the specifics of the quality response being monitored and the underlying facts and circumstances.

A bridge or gap letter may not be necessary in all cases. Whether it is needed would depend on, among other things, the objective of the quality response, assessment of the related quality risk^definition, whether there are other quality responses that address the same quality risk ^definition, and the period covered by the service auditor’s report relative to the monitoring period.

Question IX.C.3 (August 17, 2026)

When a firm has certain quality responses that are designed and operate across the firm’s work performed under both PCAOB standards and other standards, does QC 1000 require the firm’s samples related to QC-system level monitoring activities to be representative of the firm’s PCAOB audit practice?

QC 1000 does not prescribe specific approaches to QC system-level monitoring, including the sample size, composition, or representativeness of the samples selected for the purpose of QC system-level monitoring activities. Accordingly, QC 1000 neither requires nor prohibits selecting monitoring samples from a firm-wide population.

However, the firm’s monitoring and remediation process is required to comply with QC 1000.59, .61b, and .65. Among other things, the monitoring and remediation process must:

• Provide a reasonable basis for timely detection of engagement deficiencies ^definition and QC deficiencies^definition, as defined in QC 1000; and
• Include QC system-level monitoring activities directed at the performance of activities under the requirements of QC 1000.

These requirements focus on the firm’s work performed under PCAOB standards and the QC system as it applies to such work.

Monitoring samples representative of a firm-wide population may be appropriate if the QC 1000 requirements for the monitoring and remediation process are met. This could occur, for example, if a quality response ^definition is designed and operates consistently across the firm’s audit practice such that the population is homogeneous related to the quality response being monitored.

Information identified through monitoring of quality responses that operate across the firm’s work performed under both PCAOB standards and other standards may constitute findings or other relevant information of which the firm becomes aware and would be evaluated under QC 1000.71 to determine whether a QC observation^definition exists.

D. Engagement Deficiencies

Question IX.D.1 (August 17, 2026)

How should a firm incorporate information from oversight activities by the PCAOB into its evaluation and determination of whether engagement deficiencies (QC 1000.68) or QC observations exist (QC 1000.71)?

Under QC 1000.67d and .71b, a firm is required to evaluate information from oversight activities by regulators and other external inspections or reviews to determine whether engagement deficiencies ^definition or other QC observations^definition exist. The PCAOB’s inspection process and resulting inspection reports are certainly relevant to the determination of whether engagement deficiencies and QC observations exist, but are separate from the firm’s own evaluation.

X. Evaluation and Reporting

Question X.1 (August 17, 2026)

How should a firm treat information that, whether through monitoring activities or otherwise, comes to its attention after the evaluation date but before Form QC is filed? Should such information be reflected in the firm’s annual evaluation of its QC system and in the conclusion reported on Form QC?

Information that relates to the firm’s QC system as of the evaluation date but comes to the firm’s attention afterwards should be factored into the firm’s evaluation and reflected, if and as appropriate, in Form QC, meaning that the firm is expected to evaluate and make appropriate determinations regarding the information in a timely manner and report any relevant conclusions it reaches.

QC 1000 requires firms to monitor, evaluate, remediate, and conclude on QC observations ^definition and potential QC deficiencies^definition on a timely basis.⁷ The Board stated in the adopting release that “timely” is not defined by fixed calendar deadlines, but by the particular facts and circumstances, including (1) the nature and severity of the matter, (2) its pervasiveness, (3) risk to audit quality, and (4) whether immediate action is necessary.⁸ This timeliness obligation applies consistently throughout the year, including during the period between the evaluation date and the filing of Form QC.

Consistent with its obligations throughout the year, the firm is required to act on a timely basis on the information received after the evaluation date but before Form QC is filed. However, timeliness does not require that the firm immediately complete its full evaluation process or reach final conclusions by the Form QC filing date in all cases. Rather, the appropriate response depends on the specific facts and circumstances, including the nature and severity of the matter, its pervasiveness, its risk to audit quality, and whether immediate action is necessary. If, as of the Form QC filing date, the firm has not yet made a QC deficiency determination with respect to information that came to light after the evaluation date, despite acting timely as required by QC 1000.67, .71, and .72, then the matter is not required to be reported in Form QC. However, if the firm determines, based on such information, that a QC deficiency existed as of the evaluation date, the firm would be required to report that QC deficiency in Form QC and evaluate its impact on the conclusion from the firm’s evaluation of its QC system.

XI. Documentation

Question XI.1 (August 17, 2026)

How should firms interpret and apply the “experienced auditor that understands QC systems” threshold when determining the nature and extent of documentation necessary to evidence the design, implementation, and operation of quality responses?

Because firms’ QC systems vary, QC 1000 does not prescribe the nature and extent of documentation necessary. The experienced auditor threshold is intended to provide the context in which the nature and extent of necessary documentation is determined. Documentation must be sufficient to enable the requisite understanding of the design, implementation, and operation of the QC system—not for any person, or any auditor, but for an experienced auditor that understands QC systems but does not have experience with the firm’s particular QC system. It is expected that the level of documentation needed for an experienced auditor that understands QC systems to understand the firm’s QC system would be less than what would be needed for an individual with no or limited experience with QC systems.

Question XI.2 (August 17, 2026)

How should a firm determine whether documentation is in sufficient detail to demonstrate that a quality response was designed, implemented, and operated as intended?

QC 1000 requires documentation sufficient to enable an experienced auditor that understands QC systems to understand the design, implementation, and operation of the firm’s QC system, and to evaluate the operation of the quality responses ^definition. The standard does not, however, specify that this evaluation involves reperformance of the quality response or prescribe any other approach for performing that evaluation. Further, QC 1000 does not require firms to document every action, meeting, discussion, or other activity associated with the operation of a quality response. The nature and complexity of the quality response, the assessed quality risk ^definition, and the underlying facts and circumstances would influence the approach or approaches used to evaluate the operation of the quality response and, in turn, the nature and extent of documentation necessary to enable that evaluation.

The documentation necessary to meet the requirements in QC 1000 can be analogized to the documentation necessary for the firm to be able to perform its own monitoring of the operation of the quality response. If certain information related to the operation of a quality response is relevant or needed for the firm to monitor and evaluate whether the quality response operated as intended, then the firm would need to prepare and retain that information to meet the documentation requirements of QC 1000.

Some quality responses may necessitate more extensive documentation to enable evaluation of their operation. In determining the nature and extent of documentation necessary to evidence the design, implementation, and operation of quality responses, relevant considerations would include:

• What documentation does an individual need to understand how to carry out their QC-related responsibilities?
• What documentation is necessary to demonstrate that a quality response is implemented and operating as designed? And is the documentation sufficient for the firm to monitor the quality response?
• Would an experienced auditor that understands QC systems, but is unfamiliar with the firm’s QC system (see Question XI.1), understand from the documentation how the quality response is designed, and whether it was implemented and operated as designed?

The answers to these questions may help guide QC documentation in terms of:

• Detail (e.g., brief note vs. detailed narrative, one time vs. monthly).
• Format (e.g., checklist, memo, system logs, or copies of emails).

For example, if a quality response requires a firm-wide email communication to all firm personnel ^definition, it may be sufficient to retain a single copy of the email and to whom it was sent to demonstrate that the quality response operated as designed. However, if the quality response requires a tailored communication to different levels of firm leadership, then it may be appropriate to retain each distinct email sent to the respective leaders to demonstrate that the quality response operated as designed.

Question XI.3 (August 17, 2026)

What extent of documentation should a firm retain to demonstrate that an automated quality response is designed and operated effectively?

QC 1000 does not prescribe specific documentation requirements for automated quality responses^definition.

The extent of documentation depends primarily on the design of the automated quality response, including whether it is designed to prevent, detect, or address the quality risk ^definition associated with the automated quality response, and the effectiveness of related IT general controls (ITGCs) throughout the period. The documentation could vary depending on whether ITGCs relevant to the automated quality response were tested and deemed effective.

Documentation of the design and operation of an automated quality response may include:

• Documentation describing the design and configuration of the automated quality response.
• If ITGCs were tested and deemed to be effective throughout the period, limited evidence of operation (for example, a test of one) may be sufficient. A firm is not expected to retain evidence each time the automated quality response operates.
• If ITGCs were tested and deemed not effective, a firm would generally need to retain additional evidence of effective operation of the automated quality response.
• If the automated quality response has multiple outcomes, a firm would generally retain evidence demonstrating that each relevant outcome effectively operated as designed.

Documentation should be sufficient to demonstrate an understanding of the automated quality response and support a conclusion that it operated effectively throughout the period. Documentation for automated quality responses does not create an expectation of repetitive or continuous evidence just because the quality response is automated.

Question XI.4 (August 17, 2026)

Do the documentation requirements under QC 1000 differ for U.S. and non-U.S. registered firms?

No. The documentation requirements of QC 1000 apply equally to registered firms both outside of the U.S. and in the U.S.