Overview of QC 1000: What Auditors Need to Know
A tsunami is coming for accounting firms and it’s name is QC 1000! QC 1000 is the PCAOB’s new quality management standard and is similar to SQMS 1 which we discussed in this post. And it is effective this year! Do you remember the effort required by public companies in the U.S. to implement the requirements of the Sarbanes-Oxley Act (SOX)? Well, we believe implementing QC 1000 requires a similar level of effort from audit firms. Don’t fret. We’ve got you covered with this post that provides you with an overview of QC 1000 to get you ready to ride the wave!
Why was QC 1000 issued?
As we discussed in this post, rising audit deficiency rates and deficiencies in firms’ quality control (QC) systems as noted in inspections have resulted in the issuance of new quality management standards around the world. According to PCAOB inspections, approximately 40% of issuer audits reviewed had one or more deficiencies. As a reminder, this is where the auditor failed to obtain sufficient appropriate audit evidence to support its opinion. Furthermore, within the last few years several audit firms in the U.S. have received significant fines for pervasive quality control violations. Quite frankly, this was not acceptable to regulators and the new quality management standards were born.
Outside of the U.S., audit firms were required to have systems of quality management designed and implemented in accordance with ISQM 1 (the international version of the quality management standards) by December 15, 2022. In the U.S., the equivalents are SQMS 1 (for audits conducted in accordance with U.S. GAAS) and QC 1000 (for audits conducted in accordance with PCAOB auditing standards) and they are effective this year!
What is the objective of a QC system within QC 1000?
According to QC 1000, a QC system consists of components that are present, function, and operate together, enabling the consistent performance of engagements and the issuance of informative, accurate, and independent engagement reports in accordance with applicable professional and legal requirements (APLR). In layman’s terms, an effective QC system ensures that the firm and its people are doing what they should be doing and the reports that the firm issues are proper.
Now, is the QC system going to be perfect 100% of the time? No. That’s why QC 1000 has this concept of “reasonable assurance.” Reasonable assurance is not absolute assurance, but rather a high level of assurance. It is obtained when the firm’s QC system reduces to an appropriately low level the risk that the objectives set forth within QC 1000 are not achieved.
Scope and applicability of QC 1000
All PCAOB-registered firms are required to design a QC system that complies with QC 1000. This is known as scaled applicability. However, if any of the following applies the firm is subject to full applicability:
- Lead an engagement under PCAOB standards
- Play a substantial role in the preparation or furnishing of an audit report
- Have current responsibilities under APLR with respect to any of the firm’s engagements
What is APLR?
APLR stands for applicable professional and legal requirements which are:
- Professional standards, as defined in PCAOB Rule 1001(p)(vi);
- Rules of the PCAOB that are not professional standards; and
- To the extent related to the obligations and responsibilities of accountants or auditors in the conduct of engagements or in relation to the QC system, rules of the SEC, other provisions of U.S. federal securities law, ethics laws and regulations, and other applicable statutory, regulatory, and other legal requirements.
What are the requirements of firms with full applicability?
For firms subject to full applicability, they must:
- Assign QC-related roles and responsibilities
- Design, implement, and operate a risk management process
- Design, implement, and operate a monitoring and remediation process
- Document the design of the QC system
- Evaluate the effectiveness of the QC system and report on that evaluation
We go through each of these requirements in-depth during our Overview of QC 1000: A Firm’s System of Quality Control eLearning course.
Components of a QC system
QC 1000 describes the following eight integrated components of a firm’s QC system:
1. The firm’s risk assessment process
Much like an audit, it all starts with risk assessment. The firm’s risk assessment process provides the basis for the design, implementation, and operation of the firm’s QC system. It is during the risk assessment process that the firm will establish quality objectives, identify quality risks, and design and implement quality responses for the next six components. The risk assessment process relates to the entire QC system.
2. Governance and leadership
Have you heard of “tone at the top?” Well, that concept is in this component which addresses the environment that enables effective oversight and operation of the QC system and directs the firm’s culture, decision-making processes, organizational structure, and leadership.
3. Ethics and independence
You’d think that this component is self-explanatory for a CPA! However, you’d be surprised at how many independence violations are noted by the PCAOB during their inspections!
4. Acceptance and continuance of engagements
This component addresses the firm’s process for making decisions about whether to accept or continue an engagement.
5. Engagement performance
This component addresses the firm’s processes relating to performance of the firm’s engagements by firm personnel and other participants in accordance with APLR.
6. Resources
Do your professionals have the right resources to perform quality audits? This component addresses the firm’s processes for obtaining, developing, using, maintaining, allocating, and assigning firm resources to enable the design, implementation, and operation of the firm’s QC system and the performance of its engagements. This component includes people, financial, technological, and intellectual resources, and resources from a network or third-party provider.
7. Information and communication
This component addresses the firm’s processes for obtaining, generating, and using information to enable the design, implementation, and operation of the QC system and the performance of its engagements, and for communicating information within the firm and to external parties on a timely basis.
8. The monitoring and remediation process
The monitoring and remediation component informs the risk assessment component. This means that the results of the monitoring and remediation process are taken into account when determining if changes to the quality objectives, quality risks, or quality responses are necessary. And, much like the risk assessment component, the monitoring and remediation component applies to all of the components of a QC system.
Quality objectives, risks, and responses
The risk assessment process consists of establishing quality objectives, identify and assessing quality risks to the achievement of the quality objectives, and designing and implementing quality responses to address the quality risks.
Quality objectives
The firm must establish the quality objectives necessary to achieve the reasonable assurance objective. Establishing quality objectives is the first step in the risk assessment process and forms the basis for the identification and assessment of quality risks and the design and implementation of quality responses.
These are what you want to happen. In other words, they are the desired outcomes of the QC system to be achieved by the firm. Likening it to ICFR, they’re akin to the 17 principles outlined in the COSO Framework.
Quality risks
Annually, the firm must identify and assess quality risks to achieving each of the quality objectives established by the firm. As you can see on the image above, quality risks are a “two-pronged” thing:
- They have a reasonable possibility of occurring (which applies to all risks, whether intentional or not); and
- If they occurred, they have a reasonable possibility of having an adverse effect.
Quality risks are like the what could go wrongs (WCGWs) when talking about ICFR.
Quality responses
The firm must design and implement quality responses that (1) are based on the quality risks and the reasons for the assessments given to the quality risks, and (2) reduce to an appropriately low level the risk that the quality objectives will not be achieved. In ICFR speak, these are the internal controls!
Quality responses are polices and procedures designed and implemented by the firm to address quality risks. Policies are statements of what should, or should not, be done to address assessed quality risks. Procedures are actions to implement and comply with policies.
Important note
QC 1000 specifies the MINIMUM quality objectives and quality responses. However, a firm may add additional ones depending on their complexity. That said, the quality risks are specific to the firm and the engagements that it performs.
Annual evaluation and reporting
Annually, the firm must evaluate the effectiveness of its QC system. This evaluation is based on the results of its monitoring and remediation activities. The firm must conclude as of September 30th (the evaluation date) that it’s QC system:
- Is effective with no unremediated QC deficiencies; or
- Is effective except for one more more unremediated QC deficiencies that are not major QC deficiencies; or
- Is not effective (i.e., one or more major QC deficiencies exists).
Obviously, #1 is the best and, if your conclusion is #3, you may not be a PCAOB-registered firm for very long!
Firms document the results of their valuation on Form QC and then submit the form to the PCAOB.
Effective date
As we discussed, QC 1000 is effective December 15, 2025, with the initial evaluation of the QC system performed as of September 30, 2026. Firms must submit their first Form QC to the PCAOB by November 30, 2026 and have their QC documentation wrapped up by December 14, 2026. I appreciate that its a lot to take in so here is an implementation timeline to make it a bit more easy to digest.
Closing thoughts
As noted above, the effective date is fast approaching, so there is no time to delay. Start your implementation today (well, actually yesterday)!
We believe that the first step for any firm is to provide training to its professionals about the requirements of QC 1000 and we’re here to help! Start your journey today with our new eLearning, Overview of QC 1000: A Firm’s System of Quality Control. It will improve the the quality of your audits and reduce engagement deficiencies! Need to train your entire firm? Contact us today and ask about our volume discounts for teams.
About GAAP Dynamics
We’re a DIFFERENT type of accounting training firm. We view training as an opportunity to empower professionals to make informed decisions at the right time. Whether it’s U.S. GAAP, IFRS, or audit training, we’ve trained thousands of professionals since 2001, including at some of the world’s largest firms. Our promise: Accurate, relevant, engaging, and fun training. Want to know how GAAP Dynamics can help you? Let’s talk!
Disclaimer
This post is for informational purposes only and should not be relied upon as official accounting guidance. While we’ve ensured accuracy as of the publishing date, standards evolve. Please consult a professional for specific advice.
