PCAOB Audit Support

The audit is conducted under PCAOB auditing standards by a PCAOB-registered firm, layered with SEC and PCAOB independence rules that are stricter than the AICPA’s. Concretely, expect: deeper required work on internal control understanding even without an ICFR opinion, mandatory journal-entry testing and fraud procedures, expanded related-party and significant-unusual-transaction requirements, engagement quality review before the opinion, and an audit report that names tenure, Form AP disclosure of the engagement partner, and, for non-EGC issuers, critical audit matters. Behind all of it sits inspection: the PCAOB reviews the firm’s files, and deficiencies land on the firm, which is why requests that feel excessive are often the auditor evidencing against their own inspection risk. Budget the first PCAOB cycle at a meaningful premium to the AICPA audit in both cost and management time, and treat the evidence bar as the standard, not a negotiation.

What we do: We brief your team on what changes, budget the real premium, and build the evidence packages the standards demand.

Three paths, in descending order of speed. If the incumbent firm is PCAOB-registered and performed quality AICPA audits, it can generally uplift: perform the incremental procedures PCAOB standards require for the already-audited periods and reissue under the right standards, the fastest route and the reason auditor selection years before an IPO matters. If the incumbent is not registered or not positioned to continue, a successor firm re-audits the required periods, a full audit of years whose closes are cold, with the timeline consequences that implies; predecessor cooperation, workpaper access, and, where any predecessor-audited period remains presented, the predecessor’s reissued report and consent become their own workstream. The third variable is period count: emerging growth company status cuts the required years from three to two, sometimes the difference between uplift and re-audit being feasible at all. We scope this decision in week one of any going-public engagement, because everything else schedules behind it.

What we do: We scope uplift versus re-audit in week one, including predecessor consent logistics, because everything schedules behind it.

The SEC’s independence rules prohibit the auditor from, among other things, bookkeeping, preparing the financial statements they audit, valuation services, and internal audit outsourcing for the audit client, with every permissible non-audit service requiring audit committee preapproval. Partner rotation applies on defined cycles, and independence reaches back: services the firm provided during the audit periods can impair independence retroactively, a diligence item when selecting the IPO auditor and a problem when the friendly local firm that kept the books wants to become the registered auditor of those same books. The practical consequence is structural: someone independent of the audit firm must prepare the statements, the memos, and the schedules the auditors test, which is the company-side preparation we handle. We also run the preapproval hygiene, the service inventory, the audit committee calendar, the fee disclosure, so independence is a documented state rather than an assumption.

What we do: We do the preparation the rules require, and run the preapproval and service-inventory hygiene for the audit committee.

In an integrated audit (required when 404(b) attestation applies), the auditor opines on ICFR under AS 2201: walkthroughs, control testing at the assertion level, and a top-down risk approach that mirrors the management program on our SOX page. In a financial-statement-only audit, the auditor still must obtain an understanding of internal control sufficient to assess risk, walk through significant processes, and evaluate control deficiencies they observe, and without tested controls they cannot rely on them, so the audit goes substantive-heavy: bigger samples, more confirmations, more year-end work, which is a cost you pay in fees and year-end overtime. Either way, deficiencies get communicated, and material weaknesses disclosed in a registration statement are priced by investors. The company-side move is the same in both worlds: a documented close, key reports validated, and reconciliations that work, because control quality sets the audit’s tone even when nobody opines on it.

What we do: We harden the close and validate the key reports so control quality helps the audit whether or not anyone opines on it.

A CAM under AS 3101 is a matter communicated to the audit committee that relates to material accounts or disclosures and involved especially challenging, subjective, or complex auditor judgment, in practice, revenue recognition judgments, business combination valuations, impairment, complex instruments, and heavy estimates. EGCs are exempt, one of the less obvious benefits of the status. You cannot veto a CAM, but you can prepare for it: know from the audit plan which areas are candidates, ensure the related footnote and MD&A disclosure is robust enough that the CAM description references your disclosure rather than substituting for it, and see the draft language early through the audit committee process so the description is accurate. A CAM on a well-documented judgment reads as rigor; a CAM describing procedures around thin disclosure reads as a flag. The position memos we write are, among other things, CAM preparation: the better the company’s documentation, the more the CAM narrates your framework instead of the auditor’s struggle.

What we do: We strengthen the disclosure behind each CAM candidate and get draft language in front of the audit committee early.

The persistent inspection themes map directly to the requests you should pre-build for: revenue recognition (contract-level testing, cutoff, the estimates inside variable consideration), estimates and fair value (impairments, valuations, allowance models, with the auditor obligated to test data, methods, and assumptions), journal entries (population completeness for the fraud-focused JE testing, which means your ledger extract has to reconcile to the statements to the dollar), related parties and significant unusual transactions, and ICFR testing depth where integrated. The efficient response is to treat these as standing PBC categories: contract packages assembled at signing, estimate files with inputs sourced and sensitivity shown, a JE population reconciliation that runs at close, and a related-party inventory maintained continuously. Auditors under inspection pressure do not need less evidence from you; they need it organized, and the companies that internalize that stop experiencing PCAOB audits as adversarial.

What we do: We pre-build the standing PBC categories, contracts, estimate files, JE reconciliation, related parties, before the requests arrive.