PCAOB QC 1000 — Quality Control Standard Now Fully Effective

The PCAOB's landmark quality control standard, QC 1000, became effective for all registered public accounting firms on December 15, 2025. For audit engagement teams — particularly those testing IT controls — the standard introduces new documentation and monitoring requirements that directly affect how ITGC engagements are conducted.

What QC 1000 Requires

At its core, QC 1000 requires firms to design, implement, and operate a system of quality control that is risk-based, scalable, and subject to annual evaluation. Unlike the predecessor standard (QC 10, adopted from AICPA), QC 1000 is principles-based and requires firms to tailor their QC systems to the nature and complexity of their practice.

Key Elements Relevant to IT Audit Teams

• Engagement performance: Firms must document the criteria used to determine when IT specialists are required on an engagement — and how their work is supervised and reviewed
• Technology resources: Use of automated audit tools, data analytics platforms, and AI-assisted procedures must be documented within the QC system
• Monitoring and remediation: Firms must annually assess whether their QC system is operating effectively and document remediation of identified deficiencies

Annual Reporting Requirement

By December 2026, all registered firms must file their first annual report on QC system effectiveness. The PCAOB has indicated that inspection teams will review these reports as part of the 2027 inspection cycle.