Every year, the PCAOB signals inspection priorities through its annual report and supplemental communications. For 2026, the Board has been explicit: ITGC deficiencies remain the leading contributor to engagement-level audit failures, and the shift to cloud-hosted ERPs has introduced new testing complexities that many auditors have not fully adapted to.
Traditional ITGC testing assumed that access was managed at the application layer by on-premise administrators. In SAP BTP, Oracle Cloud, and Workday environments, access is often managed at multiple layers — the platform layer, the application layer, and the integration layer — each of which represents an independent control population.
Inspectors are finding that auditors are testing only one layer and relying on that to cover the others. This is no longer acceptable under AS 2201 guidance issued in Q1 2026.
The PCAOB is specifically calling out change tickets that are approved after deployment, approvals from individuals who also made the change (segregation of duties failures in the change process itself), and emergency change populations that are not properly evaluated post-implementation.
PCAOB Release 2026-002 (Staff Guidance on Auditor Use of AI Tools) makes clear that using an LLM to generate workpaper text does not reduce the auditor's professional responsibility. Inspectors will evaluate whether the auditor exercised appropriate professional judgment in reviewing AI outputs.
Even if you are not a registered audit firm, your auditor's inspection findings affect you. If your external auditor receives a PCAOB deficiency finding related to your engagement, they may expand testing scope in the following year — increasing your audit fees and evidence burden.