PCAOB Standards QC 1000 and AS 2901: What Audit Firms Must Do Before December 2026

Audit firms have nine months to overhaul their quality control systems before two major PCAOB standards take effect December 15, 2026. If you audit public companies, you're running out of runway.

QC 1000: The Big One

QC 1000 replaces decades-old quality control rules with a risk-based, firm-wide approach. Instead of waiting for inspections to find problems, you're now required to proactively identify risks to audit quality and put controls in place to manage them.

Key elements include governance and leadership accountability, ethics and independence policies, client acceptance procedures, engagement performance and supervision, personnel and technology resources, and monitoring and remediation processes.

The standard was originally set for December 2025, but PCAOB delayed it a year after finding some firms couldn't implement fast enough. That extra year is now almost gone.

"At this point, firms that audit issuers should be in that additional PCAOB requirements stage, and focusing on things like monitoring, remediation, and reporting," said Alison Stephens, Executive Editor of PPC products at Thomson Reuters.

The good news: if you already follow AICPA's SQMS No. 1 or international quality management standards, you've got a foundation. The bad news: PCAOB-specific requirements add reporting obligations you might not have systems for yet.

AS 2901: The Follow-Up Standard

AS 2901 replaces the old "Consideration of Omitted Procedures After the Report Date" guidance and expands it to cover any engagement deficiency found after you issue a report — not just missing procedures.

It gives you a framework: evaluate whether the deficiency means you lacked sufficient audit evidence to support your opinion. If yes, perform additional procedures or take steps to prevent reliance on the report. If no, take corrective or preventive action based on severity.

The catch: AS 2901 ties directly into AS 1215 amendments that cut the audit documentation deadline from 45 days to 14 days after the report release date. That's a massive operational change that hits with the 2026 audit cycle.

What Firms Should Do Now

First, read the standards if you haven't. PCAOB published implementation guides and FAQs to help.

Second, confirm you have systems to collect, track, and report quality control findings to PCAOB. QC 1000 adds new reporting requirements that demand data infrastructure.

Third, train your staff. Quality control policies often live at the firm-management level, so engagement teams may not know how these changes impact their daily work.

Fourth, update your documentation processes for the 14-day finalization deadline. That's going to require workflow changes for most firms.

Bottom Line

PCAOB delayed QC 1000 once. They're not delaying it again. If you audit public companies and haven't started implementation, you're behind. Nine months sounds like plenty until you factor in training, system updates, policy rewrites, and getting everyone on the same page.

Start now, or explain to inspectors later why you didn't.

Source: Thomson Reuters Tax Blog, March 25, 2026