PCAOB NOCLAR Proposal: Status, Why It Failed, and What Comes Next (2026)

The PCAOB NOCLAR proposal is dead for now, but confusion about its status persists. Many sources still discuss it as pending or imminent. It is neither. This article gives CFOs, audit committees, and compliance teams the definitive 2026 status update, a clear-eyed post-mortem on why it failed, and a practical read on what your auditor is actually required to do today.

What Does NOCLAR Mean and What Did the PCAOB Propose?

NOCLAR stands for Noncompliance with Laws and Regulations. On June 6, 2023, the PCAOB issued a proposal to replace AS 2405, "Illegal Acts by Clients" in its entirety with a new standard titled "A Company's Noncompliance with Laws and Regulations," along with conforming amendments to AS 2110, AS 2410, AS 4105, and other standards.

The existing AS 2405 has remained largely unchanged since 1988, predating the PCAOB's own risk assessment standards and the Sarbanes-Oxley whistleblower requirements. The proposal was partly motivated by a desire to align US standards with the IAASB's revised ISA 250, the international equivalent that already imposes more demanding obligations on auditors outside the US.

The proposed standard would have required auditors to:

1. Identify all laws and regulations with which noncompliance could reasonably have a material effect on the financial statements.
2. Assess and respond to risks of material misstatement due to that noncompliance.
3. Identify whether information indicates noncompliance has or may have occurred, covering both intentional and unintentional violations.
4. Communicate findings to management and the audit committee, including the results of the auditor's evaluation.
5. Expressly include fraud (as defined by PCAOB standards) within the definition of noncompliance, aligning with Section 10A of the Securities Exchange Act of 1934.

This was a significant expansion from the current standard, which focuses narrowly on illegal acts with a direct effect on financial statement amounts. The proposal would have swept in environmental violations, labor law breaches, product safety failures, and other regulatory noncompliance that could eventually produce material financial consequences.

Key takeaway: The NOCLAR proposal was not a tweak to AS 2405. It was a wholesale replacement that would have fundamentally broadened what auditors are required to look for, and report on, during a financial statement audit.

Was the PCAOB NOCLAR Proposal Ever Finalized?

No. The NOCLAR proposal was never adopted, and no amendments from it are in force.

The proposal passed the PCAOB Board on a narrow 3-2 vote, with both CPA board members, DesParte and Ho, dissenting. That split was itself a governance signal: a contested proposal at the proposal stage, not a consensus standard moving toward adoption.

The comment period closed August 7, 2023, after 62 days. More than 200 comment letters were submitted. The board never moved to finalize the standard. On November 18, 2024, a PCAOB spokesperson confirmed the position in plain terms: "PCAOB will not take additional action on NOCLAR this year. We will continue engaging with stakeholders, including the SEC, as we determine potential next steps."

The decision to shelve NOCLAR appears to have been made on November 15, 2024, just days before that public statement, suggesting a rapid, politically-driven call tied to the incoming Trump administration. PCAOB standards require SEC approval, and the incoming administration was expected to pull back on what business groups had characterized as regulatory overreach.

As of August 2026, the NOCLAR project page remains open on the PCAOB website, but the proposal is institutionally dormant with no finalization timeline.

Why Did the NOCLAR Proposal Fail?

The failure was not a single event. It was the product of governance fractures, industry opposition, political timing, and a new board that has explicitly repudiated the prior board's approach.

The 3-2 Vote and Internal Dissent

The proposal was contested from the moment it passed. Former board member DesParte acknowledged in his dissent that "many of today's proposed enhancements are positive" but warned that NOCLAR was one of 14 projects on "one of the most ambitious standard-setting agendas in PCAOB history." His concern: the board was "incrementally imposing new auditor responsibilities in ways that will significantly expand the scope and cost of audits, and fundamentally alter the role of auditors without a full and transparent vetting of the implications."

Board member Christina Ho, on November 14, 2024, warned that rushing to finalize rules before the administration change could "end up wasting taxpayer dollars by adopting ill-considered rules" and risk "undermining the democratic process." The NOCLAR shelving decision followed the next day.

Industry Opposition

The opposition was broad and well-organized. Audit firms, public companies, stock exchanges, and the U.S. Chamber of Commerce all pushed back, arguing the proposal would improperly place auditors in a legal compliance role outside their core competency. Tom Quaadman, the Chamber's Senior Vice President of Economic Policy, called the proposal "unwarranted" and called on the PCAOB to rescind it entirely.

Critics raised a practical concern: requiring auditors to assess whether noncompliance with environmental regulation, OSHA, or fair competition law "may have occurred" across the full range of a company's operations goes well beyond financial statement auditing. The PCAOB's own economic analysis conceded that the cost of additional procedures "could be sizeable."

Not everyone agreed with shelving it. Lynn Turner, former SEC Chief Accountant, called the decision "a total capitulation to the large auditing firms who refuse to inform investors when they become aware of companies breaking laws." The Consumer Federation of America had cited research estimating that only one-third of corporate frauds are detected in normal times, and that corporate fraud destroys an estimated 1.6% of equity value each year, equal to approximately $830 billion in 2021.

The New Board's Verdict: "Struck Out"

The clearest post-mortem came from the new PCAOB board in 2026. In remarks on the 2026-2030 Strategic Plan, a new board member stated directly: "The PCAOB 'struck out' on NOCLAR because none of the proposed NOCLAR amendments were adopted. If the PCAOB had taken a more moderate approach, the amendments that Mr. DesParte referred to as 'positive' might have been adopted years ago."

The new board's 2026-2030 Strategic Plan explicitly embraces "moderation" as its governing philosophy, described as "hitting singles and doubles" rather than home runs. NOCLAR is the defining cautionary example of what happens when a standard-setter swings for the fences without the institutional consensus to get there.

The QC 1000 quality control standard offers a parallel lesson. Adopted in May 2024 with a December 15, 2025 effective date, it required a proposed one-year delay filed with the SEC in August 2025 because "some firms have encountered implementation challenges that may, as a practical matter, be insurmountable within the established time frame." The new board cites both episodes as evidence that the prior agenda was overextended. For more on QC 1000's current status, see QC 1000 Goes Live: Audit Committee Readiness Checklist for CFOs.

What Standard Governs Auditor Obligations on Illegal Acts Today?

The current, in-force standard is AS 2405, "Illegal Acts by Clients", unchanged since 1988. Nothing from the NOCLAR proposal was adopted. Your auditor's obligations for the 2024, 2025, and 2026 audit cycles are exactly what they were before the proposal was issued.

Under current AS 2405, auditors are required to:

• Detect and report misstatements resulting from illegal acts that have a direct effect on the determination of financial statement amounts (for example, violations of tax law or financial reporting regulations).
• Be alert to the possibility that other illegal acts may have occurred, but are not required to plan specific procedures to detect them unless circumstances indicate they may exist.
• Communicate identified or suspected illegal acts to the audit committee.

This is materially narrower than what the NOCLAR proposal would have required. Environmental violations, labor law breaches, and other regulatory noncompliance that do not directly affect financial statement line items are not within the mandatory scope of current AS 2405.

Key takeaway: Nothing changed. The November 2024 PCAOB staff spotlight on existing illegal acts requirements was guidance only, not a new standard. It created no new auditor obligations. Audit committees and CFOs should not expect their auditors to apply NOCLAR-style procedures in 2026 audits.

The November 2024 Staff Spotlight: Guidance, Not a Rule

On November 12, 2024, the PCAOB staff published a spotlight document summarizing existing auditor obligations to detect, evaluate, and communicate illegal acts under current standards. The staff issued it partly in response to stakeholder feedback on the NOCLAR proposal.

This document is not a standard, not a rule, and not an interpretation that expands auditor obligations. It is a summary of what AS 2405 already requires. Treating it as a signal that auditor behavior should change in 2025 or 2026 would be a mistake.

What This Means for ESG and Regulatory Compliance Teams

This is the angle most coverage has missed entirely. The NOCLAR proposal would have expressly required auditors to consider environmental, labor, and other regulatory violations as potential noncompliance within audit scope. Its failure has a direct consequence for ESG-related legal risk: auditors are not currently required to proactively assess whether a company's environmental or regulatory conduct could produce material financial consequences.

For ESG teams and compliance officers, this means:

• Auditors will not independently surface environmental enforcement actions, permit violations, or labor law breaches unless they directly affect financial statement amounts or come to the auditor's attention through other means.
• The burden of identifying and disclosing ESG-related legal risk remains with management and legal counsel, not the external auditor.
• If your company faces material regulatory exposure, the path to audit committee visibility runs through your own internal processes, not through auditor NOCLAR procedures that do not exist.

This also matters for multinational companies. The IAASB's ISA 250, which governs auditors in most jurisdictions outside the US, already requires auditors to perform specific procedures for laws and regulations that are "fundamental to the operating aspects of the business" or its ability to avoid material penalties. US auditors operating under AS 2405 work under a materially weaker framework. For cross-listed issuers or companies with significant non-US operations, the gap between what your US auditor and your non-US auditor are required to do on NOCLAR is real and consequential.

Will NOCLAR Come Back Under the Current PCAOB Board?

The honest answer is: not in its current form, and not soon.

The new board's 2026-2030 Strategic Plan is built around moderation and incremental improvement. The explicit lesson drawn from NOCLAR is that overreach produces nothing. The board has signaled it would prefer to adopt the elements that even the dissenters acknowledged as "positive" through a narrower, more targeted proposal rather than a wholesale standard replacement.

What a narrower successor might look like:

• Updating AS 2405's terminology from "illegal acts" to "noncompliance with laws and regulations" without expanding the substantive scope.
• Aligning the standard's risk assessment framework with the PCAOB's own post-2003 risk assessment standards, which AS 2405 predates.
• Clarifying Section 10A alignment without imposing the full identification and assessment obligations of the 2023 proposal.
• Adopting a tiered approach closer to ISA 250, distinguishing between laws with direct financial statement effects and those with indirect but potentially material effects.

None of this is on a published timeline. The PCAOB's 2026-2030 Strategic Plan is the place to watch. For the broader picture of what the new board is prioritizing, see PCAOB 2026 Inspection Priorities: What's Actually Changing.

NOCLAR vs. Current AS 2405: Key Differences at a Glance

Practical Steps for Audit Committees and CFOs

Given where things stand, here is what finance and compliance leaders should actually do:

1. Brief your audit committee accurately. NOCLAR was not adopted. Auditor obligations on illegal acts and regulatory noncompliance are unchanged from prior years. Do not let the proposal's coverage create false expectations about what your auditor will or must do.
2. Do not mistake the staff spotlight for a rule change. The November 2024 guidance document summarizes existing AS 2405 requirements. It does not expand them.
3. Own your ESG legal risk internally. Because auditors are not required to proactively assess environmental or regulatory noncompliance, that identification and disclosure process must be driven by management, legal counsel, and your internal compliance function.
4. Monitor the PCAOB's 2026-2030 Strategic Plan. If a narrower successor proposal emerges, it will appear on the PCAOB's standard-setting agenda first. Engage early if your company has a stake in the scope of auditor obligations.
5. Consider the international gap if you have non-US operations. Your non-US auditors may be operating under ISA 250, which already requires more than AS 2405. Understand what each auditor is required to do and where the gaps are.

For audit committee agenda priorities more broadly, see PCAOB 2026 Inspection Guide: What Every CFO Should Know.

FAQ

What does NOCLAR stand for in auditing? NOCLAR stands for Noncompliance with Laws and Regulations. In the PCAOB context, it refers to the 2023 proposal to replace AS 2405, "Illegal Acts by Clients," with a broader standard requiring auditors to proactively identify and assess a company's noncompliance with a wide range of laws and regulations.

Was the PCAOB NOCLAR proposal ever adopted? No. The proposal was issued for public comment on June 6, 2023, and was shelved in November 2024. No amendments from the proposal were ever adopted. Current AS 2405 remains the governing standard, unchanged since 1988.

Does the PCAOB staff spotlight from November 2024 create new auditor obligations? No. The spotlight document published November 12, 2024, summarizes existing requirements under AS 2405. It is guidance only, not a standard or rule change, and creates no new obligations for auditors.

How is the PCAOB different from normal audit standard-setters? The PCAOB is a nonprofit corporation established by the Sarbanes-Oxley Act of 2002 to oversee audits of public companies. Unlike the AICPA, which sets standards for private company audits, the PCAOB's standards apply only to registered public accounting firms auditing SEC-registered issuers. Critically, PCAOB standards require SEC approval before taking effect, which creates political vulnerability when administrations change.

Is the PCAOB US only? The PCAOB's jurisdiction covers audits of companies registered with the SEC, which includes non-US companies listed on US exchanges. However, its auditing standards do not apply to audits conducted solely under IAASB standards (ISA) for non-US issuers that do not file with the SEC.

What is AS 2405 and does it cover environmental violations? AS 2405, "Illegal Acts by Clients," is the current PCAOB standard governing auditor obligations on illegal acts. It requires auditors to detect and report illegal acts with a direct effect on financial statement amounts. Environmental violations, labor law breaches, and other regulatory noncompliance are not within mandatory audit scope under AS 2405 unless they directly affect financial statement line items.

Could a future NOCLAR standard be revived? Possibly, but not in the form proposed in 2023. The new PCAOB board's 2026-2030 Strategic Plan emphasizes incremental, targeted improvements. A narrower successor that updates AS 2405's terminology and aligns it with the board's risk assessment standards, without the full identification and assessment obligations of the 2023 proposal, is more plausible than a wholesale replacement.