December 15, 2026 is 126 days away. On that date, five PCAOB standards take effect simultaneously, led by QC 1000, the new quality control framework that requires every registered public accounting firm to design, implement, and maintain a comprehensive quality management system. The other four standards effective on the same date are AS 1215 (audit documentation, including the 14-day documentation completion window), AS 2901 (considerations when a deficiency is identified after the date of the auditor's report), AS 2201 (the amended integrated audit standard for internal controls over financial reporting), and AS 2101 (the amended audit planning standard).
Every company whose fiscal year ends December 31, 2026 will have its year-end audit conducted under these five standards simultaneously. The engagement planning conversations, ICFR scoping discussions, and documentation protocols that your audit team applies in the fourth quarter will all operate under a framework that did not exist before December 15.
The PCAOB inspection blog published earlier in this session (PCAOB Inspection 2026 CFO Preparation) covered the inspection cycle, persistent deficiency areas (inventory observation, complex estimates, ICFR), and the ten questions CFOs should ask their auditor. This blog is different in two ways: it is specifically focused on the December 15 implementation of the five new standards, not on the ongoing 2026 inspection cycle; and it is structured as an audit committee checklist for the August or September board meeting, which is the last strategic window before December 15 to assess whether your auditor is ready.
Zero issuer-facing checklists exist for this purpose. Guidance on QC 1000 readiness is written almost entirely for audit firms. This post addresses the question from the audit committee's and CFO's perspective: not "how do we implement QC 1000" but "how do we know our auditor has implemented it correctly and what does that mean for our December 31 year-end audit."
What Happens on December 15, 2026: The Five Standards Going Live Simultaneously
The Thomson Reuters analysis from March 25, 2026 provides the most comprehensive publicly available description of the December 15 package. All five standards were adopted by the PCAOB under the current and prior leadership and survive the Logothetis-era strategic review confirmed in the PCAOB inspection blog.
QC 1000, A Firm's System of Quality Control: the foundational standard of the package. QC 1000 replaces QC Section 20 and adopts a principles-based quality management framework. Firms must design a quality control system that is specifically tailored to the nature and circumstances of their practice, implement it, and maintain it through continuous monitoring and improvement. The standard requires firms to identify quality risks, design responses to those risks, and evaluate whether the quality control system is operating effectively. QC 1000 applies to all registered public accounting firms for fiscal years ending on or after December 15, 2026.
AS 1215, Audit Documentation (amended): the amendment updates the standard for audit documentation, including the period within which audit documentation must be assembled and completed. The existing standard requires documentation to be assembled no more than 60 days after the auditor's report date. The amended AS 1215 maintains the 14-day assembly requirement for documentation that is completed during the audit and requires specific procedures for any documentation created or modified after the audit report date. For year-end audits with report dates in February or March 2027, the 14-day assembly window begins at the report date.
AS 2901, Consideration of an Issuer's Ability to Continue as a Going Concern (amended): the amendment is specifically titled "Consideration When a Deficiency Is Identified After the Date of the Auditor's Report" and addresses the protocols for how auditors handle the discovery of a deficiency, including a potential misstatement or control failure, after they have already issued their audit report. The standard describes what auditors must do, and what they must communicate to management and the audit committee, when this occurs.
AS 2201, An Audit of Internal Control Over Financial Reporting That Is Integrated With an Audit of Financial Statements (amended): the amendment updates the ICFR audit standard to reflect changes in audit practice, align with QC 1000's risk-based approach, and address certain deficiency areas identified in PCAOB inspections.
AS 2101, Audit Planning (amended): the amendment updates how auditors plan their engagements, including the risk assessment process, the use of technology in planning, and the documentation of planning procedures. The amendment aligns audit planning with QC 1000's risk identification framework.
Why August and September Are the Critical Window for Issuer-Side Readiness Assessment
The December 15 effective date does not give audit committees much warning time. Most audit committees meet quarterly. The August or September meeting is typically the last meeting before the fourth quarter close begins in earnest, and the last meeting before the year-end audit engagement plan is formally established with the auditor.
The Deloitte audit committee priorities guide from February 2026 recommends that audit committees schedule a specific agenda item for PCAOB standards readiness at least once per year. For December 15 implementations, the August or September meeting is the appropriate vehicle: late enough that the auditor's implementation plan is sufficiently advanced to discuss meaningfully, and early enough that the audit committee can ask questions and request changes before the engagement starts.
The Riveron Q1 2026 accounting advisory guide from June 12, 2026 specifically noted QC 1000 readiness as one of the items audit committees should be monitoring in their second-half 2026 planning. The guide flagged that implementation timelines at some firms are compressed and that audit committees should not assume readiness without asking directly.
The CAQ Audit Committee Council comment letter to the PCAOB (July 2026, covered in the PCAOB inspection blog) recommended that the PCAOB develop mechanisms for communicating QC 1000 inspection findings to audit committees. That recommendation reflects the Audit Committee Council's view that issuers need better direct access to information about their auditor's quality control system, particularly during a transition to a new standard.
The practical calendar argument: if the audit committee identifies a material concern about the auditor's QC 1000 readiness at the August or September meeting, there are approximately 90 to 120 days to resolve it before December 15. If the concern is first identified in November, there are fewer than 30 days. The August or September window is the only window with sufficient lead time to make a meaningful difference.
Checklist Item #1: Has Your Auditor Shared Its QC 1000 Implementation Timeline With Your Audit Committee?
This is the threshold question. If your auditor has not proactively communicated its QC 1000 implementation plan and timeline to the audit committee, the audit committee should ask for it directly.
QC 1000 requires firms to design, implement, and maintain a system of quality control. Implementation is not a one-time event: it is an ongoing process that should have been in development since QC 1000 was adopted by the PCAOB and should reach completion before the December 15 effective date. A firm that presents a credible implementation timeline in August or September 2026 is in a different position than a firm that has no timeline to present.
The specific questions to ask:
When did the firm begin its QC 1000 implementation programme?
What is the expected completion date for the core implementation, and how does that date relate to December 15?
Has the firm designated a partner or senior leadership team responsible for QC 1000 implementation and ongoing maintenance?
Has the firm completed any independent assessment or dry-run of the quality control system's design before December 15?
A firm that can answer all four questions with specificity is demonstrating substantive engagement with QC 1000 implementation. A firm that responds with general statements about being on track without specifics should trigger a follow-up request for documentation.
Checklist Item #2: Does Your Auditor Have a Written Quality Control System Document?
QC 1000 requires each registered firm to have a documented quality control system. The documentation is not just an administrative requirement: it is the foundation on which PCAOB inspectors will assess QC 1000 compliance in the first inspection cycle after December 15.
A written quality control system document describes: the firm's quality objectives, the quality risks the firm has identified, the firm's policies and procedures for addressing those risks, the monitoring and remediation process for quality deficiencies, and the governance structure for the quality control function within the firm.
For audit committees, the question is not whether the firm will share the full QC 1000 documentation (it likely will not, as that is a firm-internal governance document). The question is whether the firm can describe the key elements of its quality control system in a way that gives the audit committee confidence that a compliant system exists.
Specifically, the audit committee should ask:
What are the quality risks the firm has identified as most significant for our engagement?
What policies and procedures has the firm implemented to address those risks?
How does the firm monitor whether those policies and procedures are operating effectively?
What is the remediation process when the monitoring identifies a quality deficiency?
The auditor's ability to answer these questions with specificity about this engagement, not just in the abstract about the firm's general quality programme, is the indicator of a QC 1000 system that has been designed at the engagement level rather than only at the firm level.
Checklist Item #3: How Does the EQCF Rollback Affect Your Auditor's QC 1000 Compliance Plan?
On June 9, 2026, the PCAOB issued a supplemental release proposing to rescind the External Quality Control Function (EQCF) requirement from QC 1000. The EQCF was a controversial element of the original QC 1000 adoption that required certain large firms to establish an independent external function to review the effectiveness of their quality control system. The PCAOB proposed rescinding the EQCF on grounds that it was duplicative of other oversight mechanisms.
As of August 14, 2026, the EQCF rescission is a proposed amendment, not a final rule. The PCAOB has not yet issued a final rule confirming the rescission. QC 1000 with the EQCF requirement intact is still the effective standard unless and until a final rescission is issued.
For audit committees, the EQCF situation creates a specific compliance planning question. Firms that were planning to establish an EQCF as part of their QC 1000 compliance programme may have paused or modified those plans in response to the proposed rescission. But if the PCAOB does not finalise the rescission before December 15, those firms must have an EQCF in place by December 15.
The audit committee should ask:
Has the firm established or is it in the process of establishing an EQCF?
If the firm paused EQCF planning in response to the June 9 proposal, what is its contingency plan if the rescission is not finalised before December 15?
Has the firm consulted with PCAOB staff about the EQCF transition status?
The EQCF uncertainty is the most specific QC 1000 implementation risk that large firm audit committees should be probing in August and September 2026.
Checklist Item #4: Is Your Auditor Prepared for the AS 1215 14-Day Documentation Window and What Does That Mean for Your Year-End Close Timeline?
AS 1215 as amended establishes a 14-day window for audit documentation completion after the audit report date. The existing standard had a 60-day assembly period for most documentation. The amendment accelerates the timeline for completing documentation that was created during the audit.
For December 31 year-end companies, the audit report date is typically in February or March 2027. The 14-day assembly window means that audit documentation must be substantially complete within 14 days of the report date, rather than within 60 days.
The issuer-facing implication is indirect but real: if the auditor must complete documentation within 14 days of the report date, the auditor has a stronger incentive to ensure that client-prepared schedules, workpapers, and supporting analyses are received and reviewed before the report date, rather than being finalised after. A company whose year-end close deliverables arrive late in the audit process creates AS 1215 compliance risk for the auditor.
For audit committees, the question is: has your auditor discussed with management the timeline implications of AS 1215 for the year-end close deliverables? Specifically:
What is the auditor's expected report date for the December 31, 2026 year-end audit?
What deliverables from management must be received by what dates to allow the auditor to complete fieldwork before the report date?
Are there specific deliverables (goodwill impairment DCF, valuation allowance memo, CAMT AFSI calculation) that typically arrive late in the audit process and that will need to be accelerated under the AS 1215 timeline?
For companies that have complex estimates (goodwill, pension, credit losses) reviewed late in the audit cycle, the AS 1215 amendment creates a specific operational change: those deliverables must arrive earlier, and the close calendar must be built to support that earlier delivery.
Checklist Item #5: Has Your Audit Team Discussed AS 2901, What Happens if a Deficiency Is Found After the Audit Report?
AS 2901 as amended establishes the procedures auditors must follow when they identify a deficiency (including a potential misstatement or material weakness in internal controls) after they have already issued the audit report. This is a situation that occurs more often than most boards realise: post-report deficiency identification is the scenario that leads to audit report withdrawal, restatement, and going concern reversals.
The amended AS 2901 requires the auditor to: assess the significance of the deficiency, communicate immediately with management and the audit committee, determine whether the previously issued audit report remains appropriate or needs to be withdrawn, and consult with the PCAOB staff in certain circumstances.
For audit committees, AS 2901 is not primarily a compliance planning item for the committee itself. It is a communication protocol item: the audit committee needs to understand what communications it should expect to receive if a post-report deficiency is identified, and what authority it has to request the auditor to take specific actions in response.
The audit committee should ask:
Under AS 2901, what are the auditor's communication obligations to the audit committee if a deficiency is identified after the audit report date?
What circumstances would require the auditor to consult with PCAOB staff after a post-report deficiency identification?
What is the timeline for the auditor's assessment and communication process under AS 2901?
The audit committee chair should confirm that they have a direct communication protocol with the engagement partner that would allow AS 2901-required communications to reach the audit committee promptly and outside of the normal quarterly meeting schedule if necessary.
Checklist Item #6: How Does AS 2201's Amendment Affect Your SOX Section 404 Audit?
AS 2201, the integrated audit standard for internal controls over financial reporting, is amended effective December 15, 2026. The amendment aligns the ICFR audit methodology with QC 1000's risk-based quality approach and addresses certain inspection-identified deficiency patterns in ICFR testing.
The specific ICFR audit changes most likely to affect issuers in the December 31, 2026 year-end audit cycle:
Risk-based scoping alignment: the amended AS 2201 reinforces the requirement that ICFR scoping be driven by the auditor's assessment of the risk of material misstatement, not by historical scoping precedent. Companies where the risk profile changed materially in 2026 (new OBBBA-related tax positions, new AI-assisted workflows in the close process, new stablecoin treasury holdings, new segment structure) should expect their auditor to reassess ICFR scope based on the current risk environment.
Management review control testing: the PCAOB inspection blog in this cluster documented the persistent deficiency finding that auditors tested management review controls at too high a level of precision. The AS 2201 amendment addresses this directly. Audit committees should ask whether the auditor's approach to testing management review controls has changed in response to the PCAOB's inspection findings and the AS 2201 amendment.
Technology-related ITGC scope: the amendment reinforces requirements for testing IT general controls for applications involved in significant financial reporting processes. Companies that implemented new AI-assisted workflows, new ERP modules, or new automated reconciliation tools in 2026 should confirm that those new systems are within the ICFR scope for the December 31 year-end audit.
Checklist Item #7: What Is the PCAOB's Inspection Posture for QC 1000 in Year One?
The PCAOB has confirmed that inspections going forward will incorporate assessment of QC 1000 compliance. But the specific posture for year-one inspections (which will be conducted in calendar year 2027 on December 31, 2026 year-end engagements) has not been fully described.
The CAQ Audit Committee Council comment letter to the PCAOB from July 2026 recommended that the PCAOB provide clearer guidance on how QC 1000 implementation will be evaluated during the transition period. The Grant Thornton comment letter from June 3, 2026 (referenced in the PCAOB inspection blog) similarly recommended that the PCAOB clarify the methodology for assessing QC 1000 compliance in the first inspection cycle.
The Logothetis PCAOB's stated philosophy, confirmed in the Controllers Council's April 2026 analysis, is a risk-based, quality-control-oriented inspection approach. Applied to QC 1000 first-year inspections, this suggests the PCAOB will focus on whether the quality control system's design addresses genuine audit quality risks rather than conducting a checklist-based assessment of whether every QC 1000 element is technically present.
For audit committees, the year-one inspection posture question has two practical dimensions.
First: if inspectors find a QC 1000 design deficiency at your auditor's firm in the first year of inspections, what will that deficiency look like in the publicly released inspection report, and how will it affect confidence in the auditor's work on your engagement?
Second: the PCAOB's Part I.A inspection findings are public. After December 15, any QC 1000-related finding in a firm's inspection report will be attributable to the first year of QC 1000 compliance. Audit committees should be monitoring PCAOB inspection reports for their auditor's firm through 2027.
Ask the engagement partner: what is your firm's understanding of how the PCAOB will assess QC 1000 compliance in the first inspection cycle, and how has that understanding shaped your implementation plan?
The 10 Questions Your Audit Committee Should Ask Your Auditor at Its Next Meeting
These ten questions should be placed on the August or September audit committee agenda as a standing item specifically for December 15 readiness.
One: what is the firm's QC 1000 implementation completion timeline, and will all required elements be operational before December 15, 2026?
Two: does the firm have a written quality control system document, and can the engagement partner describe the key quality risks identified for this engagement and the firm's responses to those risks?
Three: has the firm established an External Quality Control Function, and what is the firm's contingency plan if the PCAOB does not finalise the EQCF rescission before December 15?
Four: how has the AS 1215 amended documentation timeline affected the planned audit schedule for the December 31, 2026 year-end engagement, and what management deliverables does the auditor need by what dates?
Five: what is the firm's protocol under AS 2901 for communicating with the audit committee if a deficiency is identified after the audit report is issued?
Six: how has the AS 2201 amendment changed the planned ICFR scope for the December 31 year-end audit, and does that revised scope address the new control areas introduced in 2026 (OBBBA tax positions, AI-assisted workflows, new segment structure)?
Seven: has the firm reviewed this engagement's management review controls to confirm they are being tested at sufficient precision to detect material errors under the AS 2201 amendment?
Eight: what changes in audit planning under AS 2101 affect the timing and structure of the year-end engagement planning process?
Nine: what is the firm's understanding of how the PCAOB will assess QC 1000 compliance in its first inspection cycle of December 15 engagements?
Ten: based on the firm's current QC 1000 implementation status, what is the risk that a material QC 1000 compliance issue will be identified in the PCAOB's inspection of this engagement?
Frequently Asked Questions
What is QC 1000 and when does it go live?
QC 1000, A Firm's System of Quality Control, is the PCAOB's new quality management standard that replaces QC Section 20. It requires every registered public accounting firm to design, implement, and maintain a system of quality control tailored to the nature and circumstances of its practice. QC 1000 is effective for fiscal years ending on or after December 15, 2026. For December 31 calendar-year companies, QC 1000 applies to the year-end audit conducted beginning in Q4 2026.
What five PCAOB standards go live December 15, 2026?
QC 1000 (firm quality management system), AS 1215 (amended audit documentation and 14-day assembly window), AS 2901 (amended post-report deficiency protocol), AS 2201 (amended integrated ICFR audit standard), and AS 2101 (amended audit planning standard). All five apply simultaneously to fiscal years ending on or after December 15, 2026.
What should audit committees ask auditors about QC 1000 readiness?
The ten questions in this post provide the specific framework. At minimum: what is the implementation timeline and will it be complete before December 15, does the firm have a written quality control system document, what is the firm's EQCF status given the proposed rescission, how has AS 1215's 14-day documentation window affected the audit schedule, and what is the post-report deficiency protocol under AS 2901.
What is the EQCF and was it removed from QC 1000?
The External Quality Control Function was a requirement in the original QC 1000 adoption for large firms to establish an independent external review of their quality control system's effectiveness. On June 9, 2026, the PCAOB proposed rescinding the EQCF requirement. As of August 14, 2026, the rescission has not been finalised. QC 1000 with the EQCF requirement remains the effective standard unless the PCAOB issues a final rescission rule before December 15.
What does QC 1000 mean for companies and issuers (not just audit firms)?
QC 1000 does not impose direct obligations on companies. Its obligations run to registered public accounting firms. However, the quality of the audit firm's quality control system affects the audit quality on every engagement, which means companies are indirectly affected by whether their auditor has implemented QC 1000 correctly. Additionally, the companion standards effective on December 15 (AS 1215, AS 2901, AS 2201, AS 2101) directly affect how the audit is conducted and how the auditor communicates with the audit committee, which issuers need to understand.
Key Takeaways
- December 15, 2026 is 126 days away. Five PCAOB standards go live simultaneously: QC 1000, AS 1215, AS 2901, AS 2201, and AS 2101. For December 31 calendar-year companies, these standards apply to the year-end audit beginning in Q4 2026.
- QC 1000 requires each registered firm to design, implement, and maintain a quality management system tailored to its practice. Its implementation status varies across firms, and the August or September audit committee meeting is the last strategic window to assess whether your auditor is ready.
- The EQCF situation is the most specific QC 1000 compliance risk: the PCAOB proposed rescinding the External Quality Control Function requirement on June 9, 2026, but has not finalised the rescission. Firms that paused EQCF planning face compliance risk if the rescission is not finalised before December 15.
- AS 1215's amended 14-day documentation window has a direct issuer implication: management deliverables for the year-end audit must be completed earlier to allow the auditor to complete documentation within the tightened timeline. This must be reflected in the Q4 close calendar.
- AS 2901's post-report deficiency protocol requires the auditor to communicate immediately with the audit committee if a deficiency is identified after the audit report date. Audit committees should confirm they have a direct communication protocol with the engagement partner for this scenario.
- AS 2201's amendment requires ICFR scoping to reflect the current risk environment, including new OBBBA-related tax positions, AI-assisted workflows, new segment structures, and any new systems placed in service in 2026.
- The ten questions in this post should be placed on the August or September audit committee agenda as a standing item for December 15 readiness. Waiting until November eliminates the time to make meaningful changes before the year-end engagement begins.
