Call a Spade a Spade: Is there a distinction between PCAOB and AICPA audits?

Firms have a habit of dividing audits between PCAOB/SEC audits and AICPA / private company audits. This permeates methodology, training, staffing, career paths, and honestly, all facets of a firm’s system of quality management. 


I fully acknowledge that there are distinct differences in requirements for a PCAOB audit versus an AICPA audit, especially if the PCAOB audit is integrated under SEC 404 requirements. But let’s also have an honest dialogue and acknowledge that the core audit principles (I’m talking planning and risk assessment, understanding the entity and its controls, and the design of the overall responses to the risks of material misstatement) are VERY similar. 


While 404 may require the testing of internal controls, regardless of the audit opinion or auditing standard, ALL auditors have to understand the company’s processes and controls and evaluate the design and implementation of those controls. The only difference between an integrated and a non-integrated audit is the testing over operating effectiveness of controls. This is true for both PCAOB and AICPA audits. In fact, let’s take a look at the guidance: 


PCAOB: AS 2210.18 and .20 states: The auditor should obtain a sufficient understanding of each component of internal control over financial reporting ("understanding of internal control") to (a) identify the types of potential misstatements, (b) assess the factors that affect the risks of material misstatement, and (c) design further audit procedures…Obtaining an understanding of internal control includes evaluating the design of controls that are relevant to the audit and determining whether the controls have been implemented. 


AICPA: AU-C Section 315.13 and .14 states: The auditor should obtain an understanding of internal control relevant to the audit…When obtaining an understanding of controls that are relevant to the audit, the auditor should evaluate the design of those controls and determine whether they have been implemented by performing procedures in addition to inquiry of the entity's personnel. 


Both PCAOB and AICPA require the same planning procedures. The extent of those procedures will depend on risk and complexity of a client, but the procedures are the same: understand design of controls and determine whether they have been implemented. In fact, the guidance for AICPA indicates that evaluation of design and implementation is more than just inquiry. The PCAOB also states that in controls, inquiry alone is never sufficient. 


If we take a step back, the reason both standards require this understanding of controls is because once an engagement team understands the controls, they can then identify the risks and potential misstatements and from that understanding, appropriately design an audit approach, whether integrated or not. 


Time and again, when helping firms with audit quality, I’ll hear firms say something along the lines of “well, that’s a private company audit, so it’s different.” Is it really though? 


The most unique aspects of a PCAOB audit stem from certain specific SEC and PCAOB independence requirements, specific audit committee communication requirements, and a few other auditor reporting considerations, such as critical audit matters. However, the majority of the audit standards are very similar. This shouldn’t be a surprise since the PCAOB initially took the AICPA auditing standards and adopted them as interim standards until the PCAOB could issue official guidance. While there is some wordsmithing here and there, the core principles remain largely unchanged. Perhaps the most significant difference in the two audit standards is the requirement of the PCAOB to perform a test of detail to address a significant risk and/or fraud risk, regardless of controls reliance, while the AICPA only requires a test of detail if there is no controls reliance. 


There really isn’t much of a distinction otherwise. So why do firms treat AICPA and PCAOB audits so differently? Well, in my opinion, it’s because the PCAOB performs inspections and holds firms strictly to the standard. There is no regulator for the AICPA; rather, enforcement of AICPA standards is accomplished through peer review. Is that really sufficient? Isn’t peer review and the lack of an enforcement agency what ultimately gave rise to the PCAOB in the first place? 


Essentially, firms are dividing audits between PCAOB and AICPA standards because the regulator of PCAOB auditing standards holds firms to a higher bar. Standards are largely the same and yet, we treat them as night and day. Is that really the right approach? When I challenge firms on auditing, generally most will acknowledge that audit is audit is audit, regardless of the standards. But when it comes to how we actually execute audits, firms inherently accept that there is a different standard. If we accept that there are minor differences between a PCAOB and AICPA audit, let’s see how that might change or impact aspects of a firm’s system of quality management. 


Training


Currently, most firms break up their staff into public company and private company auditors and provide different training and career paths for the two populations. Does that really make sense? Perhaps audit training should be the same for all staff. The principles, after all, are largely the same. For those who work on a PCAOB audit, perhaps those staff should also attend a supplemental training where the “bridge” from an AICPA to a PCAOB audit is explained. But that might only be an additional hour or two of training. There just aren’t that many differences otherwise, to merit two distinct training paths. 


In particular, I find this to be overwhelming present within the space of ICFR. Again, both PCAOB and AICPA have the same minimum requirements for understanding the design and implementation of controls and yet, most AICPA auditors never receive in-depth ICFR training. Historically, given most private company audits are non-integrated, perhaps that was okay. But with the ever-increasingly pervasive nature of technology within clients, all auditors need to have a strong understanding of internal controls. This helps to identify risks and plan an appropriate audit response. 


Increasingly, I am seeing engagement teams struggle with adopting “hybrid” approaches to testing data and information coming from systems, but ultimately asserting to a “non-controls reliance” approach. In other words, teams don’t think they’re relying on controls, but they are relying on system generated reports which are inherently relying on controls over a system in order to ensure reliability. When I have conversations with these teams, they are quickly lost. Some assert to the fact that they evaluated the design of ITGCs and believed that they could rely on the system without testing the operating effectiveness. Some assert to the testing completeness and accuracy of information by tying a report back to the system. Well, that’s fine, except you haven’t tested controls over inputs into the system and you have tested controls around the system. These hybrid approaches are popping up more and more and teams don’t have the rhetoric or knowledge to understand internal controls, in particular around systems and information. If teams understood these concepts (because they were invited to ICFR trainings), they might be able to better plan a more appropriate audit approach, taking into account the decision to test or not test controls. It starts first with understanding; knowledge is power. 


Methodology 


Methodology is another area firms distinguish between PCAOB and AICPA audits. Again, I fully acknowledge that there are differences between the two standards and so an audit binder should have supplemental workpapers for a PCAOB audit that “bridge” the gap, such as requirements around independence and audit committee communications, etc. But again, the main audit principles are the same. 


I think it’s appropriate to have two different “workpaper setups” for public and private company audits that ensure engagement teams will meet the minimum requirements. What I find is perhaps less acceptable is to have different methodologies when the standards are largely the same. 


Let’s consider sampling for a moment. I’ve worked with multiple firms that have different sampling methodologies for public and private company audits. In the public company space, the PCAOB often challenges the use of a judgmental sample if the remaining untested balance is material. As a result, firms have moved away from judgmental samples in PCAOB audits and instead pushed teams to either apply targeted sampling (i.e. targeting items until the untested balance is below materiality) or statistical sampling. However, I’ve heard comments that in the private company space, the firm still often uses judgmental samples, and these are considered acceptable. 


Let’s take a look at the sampling guidance for an AICPA audit. AU-C Section 530.06-.08 indicates: 


When designing an audit sample, the auditor should consider the purpose of the audit procedure and the characteristics of the population from which the sample will be drawn. (Ref: par. .A7–.A11) The auditor should determine a sample size sufficient to reduce sampling risk to an acceptably low level. (Ref: par. .A12–.A14) The auditor should select items for the sample in such a way that the auditor can reasonably expect the sample to be representative of the relevant population and likely to provide the auditor with a reasonable basis for conclusions about the population. (Ref: par. .A15–.A17) 


When taking a deeper look into the referenced guidance (i.e. A14), the AICPA guidance specifically states: 


The decision whether to use a statistical or nonstatistical sampling approach is a matter for the auditor's professional judgment; however, sample size is not a valid criterion to use in deciding between statistical and nonstatistical approaches…An auditor who applies nonstatistical sampling exercises professional judgment to relate the same factors used in statistical sampling in determining the appropriate sample size. Ordinarily, this would result in a sample size comparable with the sample size resulting from an efficient and effectively designed statistical sample, considering the same sampling parameters… 


The AICPA does allow for judgmental samples, but it also explicitly states that those samples should consider the same sampling parameters (i.e. tolerable misstatement, expected misstatement, risk of material misstatement, assurance from other substantive procedures, number of sampling units, and stratification, etc.) and should be comparable to a statistical sample. Do you know how many times I’ve seen teams apply “professional judgment” and test only five items or maybe ten items? And when I ask what a statistical sample would yield, the answer is “Way too many. We ran the model and it would have been in the hundreds.” The AICPA explicitly states that “…sample size is not a valid criterion to use in deciding between statistical and nonstatistical approaches.” My response is always, “So how does this judgmental sample take into account risk of material misstatement and materiality?” The answer, to which, is typically silence. No documentation and no response. 


This is just one example of how firms allow for different methodologies for public and private company audits, even though the principles are largely the same. 


Firm Monitoring


Finally, as part of PCAOB and AICPA quality management standards, firms are required to perform internal monitoring procedures. This typically translates into lookback reviews performed during the slower summer months over a sample of audits. 


In its Staff Update and Preview of 2020 Inspection Observations, the PCAOB indicates that it is 


We also observed situations where we identified deficiencies through our inspection procedures that were not identified through an audit firm’s internal inspection procedures directed to the same engagements. Such results may indicate that the audit firm’s QC system related to monitoring does not provide reasonable assurance that the audit firm’s internal inspection program is suitably designed and/or being effectively applied. 


What this tells me is that firms apply a different level of rigor internally than the PCAOB. It comes as no surprise that the PCAOB, being the regulator is by far the most exigent in terms of adhering to standards. Some might argue, it’s overly exigent, but that’s a debate for another time. The point of the matter is that firms are inherently missing the mark when inspecting their own work and are failing to identify quality concerns. 


If firms are failing to identify internal issues, what does that mean for the peer review process for AICPA audits? The auditing profession was self-regulated up until the Enron scandal and the collapse of Arthur Andersen which brought about the advent of the PCAOB and Sarbanes-Oxley. I’m not saying the PCAOB is always right or justified, but that the profession missed the mark once before and if the PCAOB is finding that firms’ internal inspections are not of a sufficient quality, then arguably, peer reviews are not being held to the same rigor. I believe this all stems from the fact that firms, and the industry as whole, views PCAOB and AICPA standards as inherently different and thus, applies an inherently different level of quality. Yes, there is less public exposure in the private company world, but does that mean audits should be performed at a different level of quality? 


When the auditing standards (or the core principles at least) are arguably the same, why do we have such a divergence in application of the standards when we execute on public company and private company audits? At the December AICPA SEC Conference, the SEC’s Division of Enforcement asked the question, “Where are the gatekeepers?” They indicated that there is an erosion of trust in the markets. The Division went on to share numerous examples of accounting concerns and made very clear they are challenging the gatekeepers, which includes the audit firms issuing the opinions. 


Let’s call a spade a spade. An audit is an audit is an audit, regardless of whether it’s a PCAOB audit or an AICPA audit. Yes, there are distinct differences, but the core of an audit is the same. It’s time we as a profession apply the same level of quality to public as well as to private company audits. 


Dane Dowell is a Director at Johnson Global Accountancy who works with PCAOB-registered accounting firms to help them identify, develop, and implement opportunities to improve audit quality. With over 12 years of public accounting experience, he spent nearly half of his career at the PCAOB where he conducted inspections of audits and quality control. Dowell has extensive experience in audits of ICFR and has worked closely with attorneys in the PCAOB’s Division of Enforcement and Investigations. Prior to the PCAOB, he worked with asset management clients at PwC in Denver, Singapore, and Washington, DC.

Joe Lynch, JGA Shareholder, to Provide Insights on Changes to Engagement Quality Review Requirements

By Jackson Johnson • January 20, 2026
JGA is pleased to announce that Joe Lynch , JGA Shareholder, will be a featured guest on the upcoming AICPA & CIMA A&A Focus live webcast on February 4, 2026. Joe has been invited to join the program to provide insights on changes to engagement quality review requirements. This appearance offers a valuable opportunity for viewers to gain practical, real-time guidance on effective EQR practices—an increasingly critical component of audit quality and compliance under the evolving professional standards landscape. Click here for m ore information about the program and registration details. At Johnson Global Advisory, we support firms in selecting, implementing, and optimizing these tools to meet their unique needs. For more insights, visit our blog or contact us to learn how we can help your firm AmplifyQuality®. For more information, please contact your JGA audit quality expert .

Quality Management in 2026: Considerations to Successfully Adapt to a Transforming Environment

By Boyd O'Rourke • January 20, 2026
Introduction The accounting firm industry experienced a ground-breaking transaction in August of 2021 when TowerBrook acquired EisnerAmper, which marked the first private equity (“PE”) transaction of a large-scale accounting firm. This transaction was structured using an alternative practice structure (“APS”). Historically, licensing and independence rules have barred non-CPAs from owning accounting firms. Through an APS, a PE firm may invest in the non-attest entity with service lines such as tax advisory and consulting. The CPA partners retain control over the attest functions, which preserves regulatory compliance. While the APS model has been in existence since the 1990s, this August 2021 transaction brought new attention to this structure. What has followed is an extraordinary volume of deal activity. Per the CPA Trendlines (“CPAT”) Cornerstone report posted on November 18, 2025, CPAT has tracked over 115 PE-related transactions from 2020 to 2025, with over 80 transactions in 2025. While PE in the accounting firm space is no longer news, the pace and volume of transactions is certainly news-worthy. Impact of PE Investment The impact of PE investment on the accounting firm space is unprecedented. The APS has enabled PE to fuel billions of capital investment. PE-backed firms provide immediate payouts to partners at appealing valuations while providing access to capital to these firms for merger and acquisition growth, technology investments, and other priorities. Well-capitalized firms now have an improved ability to invest in technological capabilities, attract experienced talent to be more competitive for college graduates, and improve their market position. With new technologies, routine tasks are being automated such as data entry, tie-outs and controls testing, resulting in less time needed to perform certain audit procedures. What the regulators are saying At the AICPA December 2025 conference on Current SEC and PCAOB Developments, common topics were the presence of private equity in the accounting firm space and the opportunities and challenges that come with this investment. PCAOB Acting PCAOB Chair George Botic described that both transformative technologies (e.g., artificial intelligence or “AI”) and the continuing expansion of private equity investments in accounting firms are two developments that bring opportunities and challenges. Mr. Botic noted that while AI has enhanced risk assessment, reduced manual processes and made it possible to efficiently analyze entire populations of data (which can reduce the risk of missing irregularities or unusual patterns), that overreliance on AI may ultimately threaten auditors’ exercise of professional skepticism and judgment. As it relates to private equity, Mr. Botic noted that while these investments have the potential to enhance audit quality by increasing firm capacity and modernizing audit tools with advanced technologies, the presence of private equity presents a risk that firms shift incentives to prioritize profitability over audit quality. Mr. Botic stated, “Both AI and private equity investments in accounting firms carry the potential to truly reshape the profession. Yet these opportunities come with clear challenges to ensure that overreliance on AI and the pressures of private equity do not jeopardize audit quality.” SEC SEC Chair Atkins discussed in his remarks that he would like the PCAOB to modify its inspections process to place more reliance on the system of quality management and that inspection of certain engagements would inform the PCAOB if the firm’s system of quality management is effective. He also expressed a view that accountability for audit quality should move upward to firm leadership. How is a firm’s system of quality management (“SQM”) impacted? Today’s transforming environment has far-reaching impacts on a firm’s SQM. This publication will focus on risk assessment, governance and leadership, ethics and independence, resources, engagement performance, and monitoring and remediation. 

Year in Review: Here are the Top 10 Actionable Insights of 2025

By Jackson Johnson • December 30, 2025
As we wrap up an incredible year, we’re showcasing the insights that sparked the most conversations and drove the most impact. Here are the Top 10 Actionable Insights from 2025: Use of Other Auditors: Managing Risk and the New PCAOB Standard ISQM 1, SQMS 1: Influencing the Firm on the Benefits Beyond Compliance (Part II) Case Study – Example Successor Auditor Considerations QC 1000 Implementation: Key Themes and Guidance from the PCAOB Workshop Clearing the Roadblocks: Auditing Estimates with Confidence in Small Firms Enhancing Auditor Independence: Key Themes from PCAOB Recent Spotlight The Never-Ending Story: How to Remediate Recurring EQR Findings – Part Deux Cryptic Audits of Crypto Assets: Auditing Digital Assets Innovative Solutions for QC 1000, SQMS 1, & ISQM 1: Quality Management tools in the Marketplace Enhancing Audit Evidence: PCAOB Expectations and What We Are Seeing in Practice

Enhancing Audit Evidence: PCAOB Expectations and What We Are Seeing in Practice

By Stephanie Mickens • November 24, 2025
As companies increasingly rely on cloud platforms, external data providers, and integrated third-party systems, the boundary between “internal” and “external” information has blurred. Audit evidence today may originate outside the company, but often arrives through the company, transformed, mapped, merged, or embedded within systems before it reaches the auditor. In response to this evolving landscape, the PCAOB amended AS 1105, Audit Evidence, effective for audits of fiscal years beginning on or after December 15, 2025. Central to these amendments is AS 1105.10A, which introduces a principle-based, risk-scalable framework for evaluating the reliability of electronic information provided by the company. At JGA, we view this development as a natural response to the data ecosystems shaping today’s financial reporting. We also see it rapidly becoming a recurring area of focus by global audit regulators, particularly when the information supports significant risks, revenue, fraud procedures, or management estimates. This article summarizes key themes from the PCAOB’s Board Policy Statement on Evaluating External Electronic Information (issued September 2025) paired with practical observations from JGA’s inspection support and methodology enhancement work with firms across the profession. Why External Electronic Information is a Growing Focus Area Across industries, external platforms now drive core financial and operational processes: payment processors, logistics platforms, third-party fulfillment solutions, subscription systems, industry data services, and more. Although such information originates from outside the company, it is often: Received, stored, or routed through company systems Transformed within spreadsheets or EUCs Merged with internally generated data Exported in formats that allow modification Provided to auditors without a traceable chain to the original source. Our direct experience working with our clients shows that PCAOB inspection teams consistently emphasize that external does not inherently mean reliable. The auditor must understand how the information was obtained, how it was handled, and whether there was a reasonable possibility that it could have been modified before reaching the auditor. Understanding AS 1105.10A The Board Policy Statement highlights two foundational expectations: 1. Auditors should understand the source and flow of the information. Inspection teams frequently question whether the engagement team understood: The true originating source of the data How the company received it (e.g., automated feed vs. manual upload) Whether the information is editable or configurable Whether it passed through multiple systems or spreadsheets How it is used in controls, substantive testing, or significant estimates In JGA’s experience, inspection findings often arise from situations where teams relied on a “system-generated” or “externally sourced” report without fully understanding where it came from or whether it could have been changed. 2. Auditors should address the risk of modification. The standard allows for two broad approaches, testing the information itself or relying on controls, depending on the assessed risk. The standard is intentionally flexible, but this flexibility requires well-supported judgments, especially for information affecting significant accounts or fraud risks. The PCAOB also acknowledged scenarios where separate testing may not be required (e.g., direct-to-auditor feeds or read-only API transfers) but emphasized that this exception applies only when the risk of modification is no more than remote. What We Observe in PCAOB Inspections Through JGA’s transformation activities with firms, we continue to see consistent challenges in the following areas: Reliance on information provided by the company without evaluating whether transformed, filtered, or merged with other data sets. Use of external or industry data in analytics without understanding the methods, assumptions, or relevance to the issuer. External information embedded in significant estimates or complex models without evaluating management’s process for compiling that information. System-generated or external journal entry listings used in fraud procedures without establishing completeness and reliability. In each of these situations, inspection teams focus on whether engagement teams understood how the information was obtained, how it was processed, and whether there was a reasonable possibility of modification before it reached the auditor. Emerging PCAOB Expectations Although the standard is principles-based, several expectations are now appearing consistently in inspections: Reliability cannot be presumed, external information must be evaluated just like any other audit evidence. Understanding the company’s process for receiving and handling external information is foundational. Judgments about whether separate testing is required must be risk-responsive and well-supported. Documentation should clearly articulate the source of the information, the company’s process, and the basis for concluding the information was reliable. These expectations are shaping how firms need to think about IPE testing, data flows, and the role of technology within the audit. Areas Where Firms Often Seek Assistance Across our methodology enhancement and inspection support work, firms consistently ask for help in: Identifying when information is “external electronic information provided by the company”. Determining whether reliance on management’s process is appropriate. Navigating situations where data passes through multiple systems or spreadsheets. Evaluating third-party or industry data used in analytics. Assessing effects on significant risks, especially revenue and fraud. Aligning documentation practices with PCAOB expectations. Many firms have strong processes for testing IPE, but other nuances of the standards require an additional layer of consideration that is still evolving in practice. Looking Ahead As companies build increasingly automated and interconnected systems, auditors must deepen their understanding of those environments to obtain sufficient appropriate evidence. Firms that proactively adapt their methodologies and train engagement teams will be better positioned for both compliance and audit quality. At JGA , we help firms interpret emerging regulatory requirements, strengthen methodologies, and enhance the use of technology and data in the audit. Ultimately, ensure compliance and consistency get to our ultimate goal of helping firms grow and scale responsibly. To learn how we can help your firm navigate these expectations and #AmplifyQuality, visit www.johnson-global.com, or contact a member of your JGA client service team.

JGA Welcomes Boyd O’Rourke as Managing Director

By Jackson Johnson • November 6, 2025
WASHINGTON, D.C. Johnson Global Advisory (JGA) is pleased to announce Boyd O’Rourke as a Managing Director, focused on helping audit firms meet their strategic objectives with audit quality in mind. With 30 years of experience in public accounting, Boyd has deep experience in firm management, strategy, risk management, and quality control. Boyd’s skillset complements JGA’s core services by adding new firm strategy and risk management service offerings. “ I have a passion for building high-functioning groups inside accounting firms,” said Boyd. “With private equity firmly in the accounting firm space, service line growth, acquisitions, and consolidation are happening at record speed. JGA’s goal is to help firms manage this growth while limiting exposure to regulatory and business risks. I am excited to advise firms navigating this most-critical period of their journey. ” Most recently, Boyd held multiple senior roles at CBIZ CPAs (formerly Mayer Hoffman McCann P.C.), including Executive Committee Member, National Practice Leader, Chief Risk and Quality Officer, National Director of Quality Control, Mid-west Regional Attest Practice Leader, and National Training Director. “ By most measures, Johnson Global Advisory is a small consulting firm—but over the past eight years, our impact on individual firms and the global profession as a whole has been vastly disproportionate to our size,” said Jackson Johnson, President and Founding Shareholder, JGA. “That is only possible because every professional that joins the JGA team brings deep senior-level experience, technical expertise, and a genuine ability to connect with our clients around the world. I am especially grateful that Boyd O’Rourke has chosen JGA as the platform to share his leadership and expertise to help firms grow and scale. Having known Boyd for several years, I’ve seen firsthand his commitment and executive approach to solving complex problems affecting public accounting firms. His decision to join us is a testament to the unique opportunities JGA offers—and to our shared mission of making a meaningful difference for our clients and the industry .” Boyd is based in the Kansas City area and received his Bachelor of Business Administration in Accounting from the University of Iowa. To learn more about Boyd and the full JGA team, read here . At Johnson Global Advisory , we support firms in selecting, implementing, and optimizing solutions and tools to meet their unique needs. For more insights, visit our blog or contact us to learn how we can help your firm AmplifyQuality®.

The Never-Ending Story: How to Remediate Recurring EQR Findings – Part Deux

By Geoff Dingle • October 28, 2025
In September 2022, we wrote an article discussing the struggle that firms were experiencing at that time in remediating Quality Control (QC) criticisms as it relates to their Engagement Quality Review (EQR) process. This struggle seemingly continues today, as, so far in 2025, the PCAOB has publicly re-released previously issued inspection reports for 32 registered firms, and in 19 of those reports, EQR was a QC criticism that was released to the public as these firms had failed to satisfactorily remediate their EQR QC criticism¹. This means that firms continue to struggle to identify and effectively implement remedial actions to the satisfaction of the PCAOB that demonstrate that they have successfully remediated their non-compliance with AS 1220, Engagement Quality Review . So why are firms still failing to remediate this QC criticism? As we stated previously, having worked with engagement teams and looking at the nuanced and sometimes detailed nature of some of the PCAOB Part I findings, attributing the audit issue to a deficient EQR review can sometimes feel like the regulator is being overly exigent. In fact, in its adopting release to the EQR standard , the Board stated that it “…has been sensitive to commenters' concerns and agrees that the EQR should not become, in effect, a second audit.” This is a difficult concept for EQRs to balance though, as engagement teams often ask us, “As EQR am I required to review every test of design and operating effectiveness for internal controls related to every significant risk? Which substantive workpapers in significant risk audit areas should I review and to what level of detail?” Though not explicitly required in AS 1220, implicitly by the very nature of the EQR attribution, the PCAOB is inherently creating an expectation of a detailed EQR review. After all, AS 1220.09 does require the EQR to “review documentation.” When the PCAOB evaluates a firm’s Rule 4009 remediation response, they pay particular attention to recurring deficiencies. If the same deficiency is long-standing or occurs in subsequent reports, remediation efforts undertaken must be incremental in each remediation submission so as to address the recurring deficiency. Said otherwise, a firm cannot deliver the same training year after year and expect it to drive change; it must change its approach to remediate the recurring deficiencies. We have numerous clients telling us that this is the second or third inspection report that includes an EQR QC criticism. They often ask us, “This time, what can we do that is incremental that we haven’t already done?” Remediation Considerations The new quality control standards (QC 1000, ISQM 1 and SQMS1) require firms to perform root cause analyses for audit deficiencies. In doing so, firms should identify the real root cause behind why EQRs are failing to identify audit deficiencies and then design specific remedial actions to address these root causes. So, remedial action should be in response to the actual root cause of the EQR deficiency – i.e., what is the ultimate root cause of EQR’s not identifying the Part I deficiencies at the time of their review? The following are typical actions that we see firms undertake: a. Training as an Action For many firms, they start out the remedial process by providing training to audit professionals that specifically address the requirements of AS 1220. Some firms attempt this by sourcing online training from the marketplace. If this is the first time your firm has received a Part II EQR criticism, then this action might be effective. However, training designed to remediate quality control deficiencies must be specific to the facts and circumstances of your issue(s). Oftentimes though, when the EQR criticism is long-standing or repetitive, training alone is not sufficient. Key takeaway : Consider developing more robust training that specifically addresses nuances of firm findings and walk through examples of EQR reviews. b. EQR Sign-off Checklist as an Action Another common remedial action is for firms to make enhancements to their methodology, including their EQR sign-off checklist . Most firms subscribe to audit software programs already which have a basic EQR checklist that calls out the requirements under AS 1220. Modification to the EQR checklist and/or creation of addendums that specifically focus on the issues or concerns can be a meaningful improvement and can add rigor to the review process. Key takeaway : Firms should determine whether they need to modify their EQR sign-off checklist and/or create addendums to include specific bullets and questions addressing firm audit deficiencies, specifically calling it out to the EQR’s attention. c. EQR mentoring/coaching program as an Action Many firms have already implemented the previous two actions, and they may continue to see deficiencies in the QC criticism. The PCAOB is expecting firms to do more to ensure quality audits. As we have worked with firms on remediation, we recommend firms consider an EQR mentoring/coaching program . When designed and implemented properly – and timely – we believe this action to be important to a successful remediation of QC deficiencies around the EQR function. Key takeaway : Consider designing and implementing an EQR coaching or mentoring program, paying close attention to key elements important for effective remediation criteria. Other Considerations Given that global audit regulators have raised the bar in expectations on recurring findings – specifically on the EQR process – we cannot stress enough the importance of beginning the remediation process early . Engage the PCAOB in a dialogue immediately once your 12-month remediation period begins, to discuss the planned remedial actions and get feedback on the sufficiency of those actions. Pay particular attention to understanding what is considered timely implementation. Do not underestimate the amount of time it will take to fully implement remedial actions. Key takeaway : Engage the PCAOB early in the remediation process to seek feedback on the sufficiency of the remedial actions (perhaps even before the final report has been issued). EQR as last line of defense Another important point is that EQRs are essentially the last line of defense with regard to audit quality. Said differently, audit quality starts with the audit engagement team and the firm’s entire QC system (training, methodology, tools, etc.) that enables and supports audit engagement teams to perform quality audits. Firms must also consider the remedial actions that also address the PCAOB’s Part I audit deficiency(ies). The EQR QC criticism, while linked to its own standard, is really just the review of the audit work performed under all the other audit standards (e.g., AS 2501, AS 1301, etc.). It is a collective effort, and the EQR as well as the entire engagement team should be considered when remediating all QC criticisms identified in firm inspection reports. It may feel like a never-ending story and perhaps regulators are being overly rigorous, but the reality is this issue is not going away, so firms need to consider what incremental actions they can take to truly ensure EQRs perform quality reviews. At Johnson Global Advisory , we support firms in selecting, implementing, and optimizing these tools to meet their unique needs. For more insights, visit our blog or contact us to learn how we can help your firm AmplifyQuality®. ¹ Part I of a PCAOB inspection report contains audit deficiencies; this part is made public when the report is initially published. Part II contains the firm’s QC criticism(s); and this part is not initially released to the public. The firm has one year from the date the report is published to remediate the QC criticism(s). If the remediation is satisfactory to the Board, then Part II is kept private. However, if the firm fails to satisfactorily remediate the QC criticism, the QC criticism in Part II is then released to the public.

From Planning to Practice: 10 Steps to Build Your Firm’s Quality Management System

By Jackson Johnson • September 30, 2025
With the effective date for SQMS 1 and QC 1000 fast approaching, firms of all sizes—especially small and sole practitioners—must take action to implement a system of quality management (SQM) that meets the new standards. The good news? You don’t have to start from scratch. Despite QC 1000’s implementation date deferral, the AICPA’s date hasn’t changed, and the international standards are already effective. It’s important to maintain momentum on the efforts toward implementation of all applicable standards for your firm. This article outlines 10 practical steps to help firms build their SQM. Each step includes actionable guidance and considerations for firms with limited resources, and ties into JGA’s broader thought leadership on quality management, risk assessment, and system evaluation. The 10 Steps to Build Your SQM Step 1: Establish a Project Team Form a team with the right mix of quality expertise and operational insight. For small firms, this may mean involving a manager who can grow into a leadership role or setting aside dedicated time as a sole practitioner. Recommended actions to consider: Identify internal champions with interest or experience in quality. Schedule recurring project meetings to maintain momentum. Join a peer group for support and shared learning. Step 2: Understanding and Awareness Document your firm’s business strategy, service offerings, and operational conditions. This step helps identify factors that may impact quality—such as remote work, new industries, or staff turnover. Recommended actions to consider: Conduct a strategy review with firm leadership. List recent changes in firm structure or engagement types. Use these insights to inform your risk assessment. Step 3: Assign Responsibilities Define who is accountable for the SQM. The new standards require clear delineation of ultimate and operational responsibility, including oversight of independence and monitoring. Recommended actions to consider: Assign roles based on existing responsibilities. Clarify delegation boundaries for managing partners. Document responsibilities in your quality manual. Step 4: Establish a Risk Assessment Function Design a process to identify and assess quality risks. This includes understanding conditions or events that could impact quality objectives. Recommended actions to consider: Create a risk assessment policy tailored to your firm. Use relatable examples to demystify risk factors. Leverage AICPA practice aids for structure and templates. Step 5: Perform the Initial Risk Assessment Conduct brainstorming sessions by component and document risks using the AICPA Risk Assessment Template. Include both formal and informal responses. Recommended actions to consider: Use the AICPA risk library to identify common risks. Tailor risks to your firm’s size and services. Include existing responses—even if informal—for evaluation. Step 6: Finalize the Gap Analysis Evaluate where your current responses fall short. This may include undocumented policies or areas where responses don’t fully address the risk. Recommended actions to consider: Identify gaps in governance, ethics, and technology. Determine which informal practices need formalization. Prioritize gaps based on risk severity and regulatory impact. Step 7: Implement Responses to Address the Gaps Develop policies and procedures to close gaps. Responses must be documented and operational. Recommended actions to consider: Draft policies that reflect your firm’s values and risks. Link procedures to specific quality objectives. Use existing documentation as a starting point. Step 8: Update Your Monitoring Process Move beyond peer review prep—monitoring should be continuous and system-wide. Recommended actions to consider: Assign monitoring responsibilities across the team. Incorporate testing of responses into internal inspections. Use dashboards or checklists to track progress. Step 9: Formalize Root Cause and Remediation Procedures Investigate deficiencies and document why they occurred. This step is essential for both system and engagement-level reviews. Recommended actions to consider: Conduct interviews to understand root causes. Use findings to improve policies and training. Apply remediation even if your firm only undergoes engagement reviews. Step 10: Initial Test of Design and Implementation Review documentation and walk through processes to ensure your system is operational and testable. Recommended actions to consider: Validate that each component is supported by evidence. Simulate a peer review to test your system. Confirm that objectives, risks, and responses align. Conclusion Implementing a system of quality management is not just a compliance exercise—it’s an opportunity to strengthen your firm’s foundation for audit quality, risk management, and long-term success. Whether you’re a sole practitioner or a small firm with a few partners, these 10 steps offer a scalable roadmap to meet the new standards. Ready to get started or need help refining your approach? Contact your JGA audit expert today to schedule a consultation and ensure your implementation is tailored to your firm’s needs. At Johnson Global Advisory , we support firms in selecting, implementing, and optimizing these tools to meet their unique needs. For more insights, visit our blog or contact us to learn how we can help your firm AmplifyQuality®.

Clearing the Roadblocks: Auditing Estimates with Confidence in Small Firms

By Jackson Johnson • September 30, 2025
Introduction Auditing accounting estimates has long been one of the most judgment-intensive and inspection-prone areas of the audit. For smaller firms, the challenge is even greater due to limited resources and evolving regulatory expectations. At JGA , we’ve worked closely with firms navigating these complexities and have identified three critical areas where auditors can strengthen their approach and reduce risk. What’s Recurring and What’s New: Insights from PCAOB’s Latest Audit Focus The PCAOB’s recent Audit Focus¹ underscores persistent deficiencies in how auditors evaluate accounting estimates. Common issues include failure to identify significant assumptions, reliance on inquiry or simple recalculations, and inadequate testing beyond vouching to internal or external data. These recurring gaps continue to surface in inspections of smaller firms. What’s new is a sharper emphasis on critical accounting estimates—those with high uncertainty and material impact. Auditors are now expected to understand how management analyzes the sensitivity of assumptions to other likely outcomes and to incorporate that understanding into their evaluation of bias and reasonableness. Additionally, the PCAOB highlights good practices such as updating internal guidance, enhancing EQR partner reviews, and aligning audit programs with the standards. Key Takeaways and Our Recommended Action Items 1. Evaluate the Reasonableness of Significant Assumptions What the PCAOB said: The PCAOB continues to observe recurring deficiencies in how auditors evaluate significant assumptions used in accounting estimates. Common issues include failing to identify key assumptions, relying solely on inquiry or recalculations, and not assessing whether assumptions are consistent with external factors like market conditions or industry trends. Auditors are expected to evaluate assumptions both individually and in combination, and to consider management’s intent and ability to carry out specific actions when assumptions are forward-looking². JGA’s reaction: In our article “Like Making Concrete out of Jell-O”², we described the inherent difficulty of auditing estimates that are subjective, uncertain, and often based on future projections. We emphasized that auditors must go beyond surface-level validation and challenge management’s assumptions with rigor. In “An Update for Unprecedented Times”³, we noted that economic volatility has made assumption testing even more complex, requiring auditors to evaluate whether recurring assumptions still hold in today’s environment. JGA’s recommendation: Firms should implement structured assumption testing protocols that go beyond vouching. Use external data sources to validate assumptions and ensure that engagement teams document how each assumption was evaluated. Partner and EQR reviews should include a step to confirm that all significant assumptions were tested for reasonableness and consistency. 2. Develop Independent Expectations and Use Reliable Data What the PCAOB said: AS 2501 outlines three approaches to testing estimates, including developing an independent expectation. The PCAOB stresses that auditors must have a reasonable basis for their own assumptions and methods and must evaluate the relevance and reliability of third-party data. This is especially important when using unobservable inputs or when substituting auditor assumptions for those used by management². JGA’s reaction: We’ve consistently advocated independent modeling as a way to reduce bias and improve audit quality. In our earlier articles, we highlighted how auditors can use historical data, peer comparisons, and macroeconomic indicators to build independent expectations. In “An Update for Unprecedented Times”³, we emphasized that auditors must reassess models and assumptions that were previously considered reliable, especially in light of post-pandemic economic shifts. JGA’s recommendation: Firms should train engagement teams to build independent expectations using validated data sources. When using third-party data, document the evaluation of reliability per AS 1105. Consider integrating external audit methodology tools that support independent modeling and provide templates for documenting assumptions and methods. 3. Strengthen Audit Methodology and Engagement Oversight What the PCAOB said: The PCAOB highlights good practices from firms that have updated their internal guidance, audit programs, and review checklists. These updates include scoping exercises for identifying estimates subject to AS 2501, requiring EQR partners to review all significant inputs, and linking risk assessments to audit responses. These practices are especially important for smaller firms that may lack centralized oversight². JGA’s reaction: We’ve seen firsthand how firms that invest in methodology updates experience fewer inspection findings. In “Like Making Concrete out of Jell-O”², we discussed how subjective estimates—like goodwill impairments or startup valuations—require more than just technical compliance. In “An Update for Unprecedented Times”³, we noted that firms must adapt their methodologies to reflect new economic realities and ensure that recurring assumptions are still valid. JGA’s recommendation: Firms should revise their audit programs to include scoping for all types of estimates, not just those flagged as significant risks. Partner and EQR checklists should be updated to ensure comprehensive review of estimate testing. Risk assessment documentation should clearly link identified risks to specific audit responses, with traceable evidence. Conclusion Firms should assess their current audit programs and consider enhancements aligned with AS 2501. JGA offers tailored consultations to help firms implement best practices and prepare for inspections. Contact us today to schedule a review or download our latest audit quality resources. Auditing estimates doesn’t have to feel like “making concrete out of Jell-O.” With a disciplined approach to assumptions, independent analysis, and robust methodology, firms can deliver high-quality audits that stand up to regulatory scrutiny. JGA is here to help you lead with confidence. For more information, reach out to your JGA audit quality expert . Sources ¹PCAOB’s new publication Audit Focus- Auditing Accounting Estimates | PCAOB ²See our full article Auditing Estimates: Like Making Concrete out of Jell-O ³See our full article Auditing Estimates: An Update for Unprecedented Times

PCAOB Technology Innovation Alliance Working Group Report Focuses on Emerging Audit Technologies

By Jackson Johnson • September 5, 2025
The PCAOB’s Technology Innovation Alliance (TIA) Working Group released a report on using AI, data analytics, and digital signatures to improve audit quality and investor protection. It recommends standardizing documentation, adopting responsible AI, and fostering innovation. Joe Lynch , JGA Managing Director, contributed insights as a stakeholder in the TIA roundtables and panels.

Timely Quality Management: Joe Lynch, JGA Managing Director, Insights Featured in Journal of Accountancy

By Jackson Johnson • August 18, 2025
Learn how to build your firm’s quality management system on time with actionable insights from Joe Lynch , Managing Director at JGA, as featured in the Journal of Accountancy . This article outlines eight strategic steps to ensure effective and timely implementation of quality management practices for your business.