PCAOB Audit Deficiencies Small Firms Keep Repeating: 7 Critical Areas to Fix

PCAOB Audit Deficiencies Small Firms Face: Why the Numbers Haven't Improved Enough

The PCAOB's 2024 inspection results delivered a clear message: small firms are still struggling at rates the board considers unacceptable. At BusAcTa Advisors, we support CPA practices with audit support services, and the PCAOB audit deficiencies small firms generate most often trace back to the same handful of execution gaps, not to a lack of technical knowledge. Understanding where the PCAOB looks first, and where small firm teams most often fall short, is the foundation for getting your next inspection cycle right. The seven PCAOB audit deficiencies small firms generate most consistently are addressable with the right workflows.

This post is general information for CPA firm professionals. It doesn't substitute for your firm's own legal, compliance, or quality control counsel. PCAOB standards and inspection findings can change, and your firm should review current PCAOB publications directly.

For context on the numbers: triennially inspected non-affiliated US firms, the category that covers most small CPA firms doing public company audit work, carried a 61% Part I.A deficiency rate in 2024. That's an improvement from 67% in 2023, but it still means that in more than 6 out of 10 engagements reviewed, the PCAOB concluded the firm hadn't obtained sufficient appropriate audit evidence to support its opinion. For firms being inspected for the first time, the rate has been even higher in recent years.

What Part I.A and Part I.B Findings Actually Mean

Before the seven deficiency areas, it helps to know what the PCAOB is measuring. A Part I.A finding means the PCAOB concluded that, at the time your firm issued its audit report, you hadn't obtained sufficient appropriate audit evidence to support that opinion. This is the most serious category. A Part I.B finding covers other non-compliance with PCAOB standards or rules that doesn't rise to the insufficient-evidence threshold but still reflects a deficiency in how the engagement was conducted.

Neither category automatically means the financial statements are materially misstated. But both mean your workpapers, procedures, and documentation didn't meet the standard the PCAOB expected when it reviewed them. For a small firm being inspected every three years, a cluster of Part I.A findings can trigger Part II quality control criticisms, which carry additional consequences if not addressed within 12 months.

7 Deficiency Areas the PCAOB Flags Most in Small Firm Engagements

1. Risk Assessment (AS 2101)

Risk assessment failures are the most foundational deficiency the PCAOB finds. Under AS 2101, your team must identify and assess risks of material misstatement at both the financial statement and assertion levels, then design procedures that respond to those specific risks. The PCAOB's 2024 target team focused specifically on risk assessment execution across many engagements, and inspectors found it a recurring problem area.

Is your team treating the risk assessment as a checkbox completed at planning rather than a living document? What goes wrong in practice: engagement teams perform a risk assessment at the start of an engagement and treat it as complete, rather than updating it as new information emerges during fieldwork. The PCAOB expects risk assessment to be iterative, particularly when macroeconomic conditions, like interest rate shifts or supply chain disruptions, affect the client's business model mid-engagement.

2. Revenue and Related Accounts

Revenue is the most frequently cited financial statement area in PCAOB inspection findings across all firm sizes. For small firms auditing clients with complex revenue streams, including multi-element arrangements, subscription models, or long-term contracts, the specific failure is usually insufficient substantive procedures to address the identified risk of material misstatement at the assertion level.

Does your revenue testing program map explicitly to the specific risk assertions you identified during planning? Teams often design revenue testing around completeness when the real risk is overstatement, or test one revenue stream thoroughly while leaving others without adequate coverage. The PCAOB expects your procedures to match the specific risks you've identified for each significant revenue account.

3. Testing of Management Review Controls

For firms performing integrated audits that include ICFR, management review controls are one of the most commonly deficient areas. The PCAOB's 2024 Spotlight described the pattern clearly: teams test that a review happened rather than whether the review would actually catch a material misstatement.

Establishing the precision of a management review control requires understanding what the reviewer is comparing, what threshold would prompt them to investigate, and whether that threshold is tight enough to prevent or detect a material error. Testing that the review was performed and the sign-off exists doesn't satisfy the standard.

4. Reliance on System-Generated Data and Reports (AS 2301)

Small firm engagements increasingly involve clients whose accounting records are generated by third-party software, ERPs, or automated processes. Under AS 2301, when you rely on data or reports produced by a client's systems, you must test the completeness and accuracy of that data before relying on it as audit evidence.

The typical failure: an audit team uses a client-generated aging report or trial balance export as a starting point for substantive procedures without testing whether the system that produced it is generating accurate, complete output. If the underlying system has access issues or configuration errors, every procedure built on that data is built on an untested foundation.

5. Fair Value and Other Significant Estimates (AS 2501)

Auditing estimates, particularly fair value measurements of assets like intangibles, goodwill, and investment securities, is one of the hardest areas for small firms to execute correctly when the client engages a specialist to develop the estimate. The PCAOB expects you to evaluate the specialist's work, not simply accept their conclusion because they hold a credential.

That evaluation includes assessing whether the specialist's assumptions and methods are reasonable, whether the data inputs are consistent with what your audit evidence supports, and whether the resulting estimate falls within an acceptable range. Teams that test a control over the issuer's review of the specialist's report, without independently evaluating the specialist's inputs, are testing a process rather than the estimate itself.

6. Audit Committee Communications (AS 1301)

Audit committee communication deficiencies show up in Part I.B of inspection reports, meaning they reflect non-compliance with PCAOB standards rather than the insufficient-evidence threshold. Under AS 1301, your firm must communicate specific matters to the audit committee, including the basis for identifying and assessing risks of material misstatement, significant accounting policies, and any matters that could affect the reliability of your report.

What the PCAOB found in 2024: auditors weren't communicating the basis for their risk assessment to the audit committee, and were missing required communications around fraud considerations. For small firms where the audit committee relationship is informal, these documentation gaps are common and easy to miss until an inspector asks for the written record.

7. Auditor Independence Compliance

Independence violations at smaller firms most commonly involve personal financial holdings, non-audit services to audit clients, and certain tax services that compromise independence under SEC rules. The PCAOB noted in its 2024 findings that potential violations of SEC independence requirements occurred primarily at smaller, triennially inspected firms, often because the firm didn't have formal internal compliance testing procedures in place.

For small firms with a limited number of public company clients, the risk isn't usually intentional. It's a lack of systematic monitoring. A partner who buys a small position in a fund that holds a client's securities, or a firm that provides a bookkeeping service to a public company audit client, may not recognize the independence issue until the PCAOB raises it. Formal annual independence confirmations and a prohibited investment holdings policy are not optional.

PCAOB inspection data shows that triennially inspected non-affiliated US firms carried a 61% Part I.A deficiency rate in 2024, down from 67% in 2023. The PCAOB has described this rate as still unacceptable and called on small firms to build on improvement momentum. (PCAOB, Staff Update on 2024 Inspection Activities, March 2025)

QC 1000: What Changes in Your Quality Control System by December 2025

The PCAOB's new quality control standard, QC 1000, became effective December 15, 2025, replacing the interim quality control standards that have governed registered firms since 2004. QC 1000 requires firms to design and operate a system of quality control that is integrated with the firm's risk assessment, rather than treating quality control as a separate administrative function.

For small firms, the most significant practical change is the requirement to formally assess quality risks specific to your firm's engagements and demonstrate how your policies and procedures address those risks. The PCAOB has indicated it will evaluate QC 1000 compliance as part of ongoing inspections, and firms that continue to show recurring deficiencies in the areas above can expect those deficiencies to be analyzed as potential QC system failures under the new standard.

How Dedicated Audit Support Addresses the Preparation Layer

Many of the deficiency areas above, particularly workpaper documentation, data reliability testing, and lead schedule completeness, involve preparation work that pulls licensed CPA time away from the judgment calls that actually determine inspection outcomes. What does your current engagement workflow look like at peak audit season? If your senior auditors are spending significant hours on workpaper assembly, data export formatting, and documentation binders, they have less time and attention for the risk assessment, control evaluation, and estimate review work where the PCAOB looks hardest.

A dedicated offshore audit manager or support team handles the preparation layer: organizing workpapers, preparing lead schedules, tracking confirmation responses, formatting analytics, and maintaining the engagement binder to your firm's documented standards. Your licensed CPA retains every judgment call and every sign-off. That division doesn't lower your standards. It frees the time and attention your licensed team needs to actually meet them. You can see how the model works on our how it works page.

The four drivers of improvement the PCAOB identified at firms that reduced deficiency rates in 2024: more in-person work, more focused training, stronger national office resources, and better supervision and review. Each of those requires your licensed team to have time for engagement oversight, not documentation. (PCAOB, Staff Update on 2024 Inspection Activities, March 2025)

Conclusion: Your Next Inspection Cycle Starts With This Year's Work

PCAOB audit deficiencies small firms generate year after year come from the same execution gaps, not from a lack of technical understanding. Risk assessment that doesn't get updated, revenue testing mismatched to the actual risk, management review controls tested for existence rather than precision, and independence monitoring that relies on good intentions rather than formal procedures. These are fixable. They require documented workflows, adequate supervision time, and consistent execution across every engagement in the cycle.

If your firm wants to build a more defensible audit engagement workflow before your next PCAOB inspection window, contact BusAcTa Advisors to discuss how our offshore audit support team integrates into your existing process and absorbs the preparation work that currently competes with your licensed staff's judgment time.