In July 2025, the US PCAOB sanctioned a mid-sized audit firm, imposing a civil penalty, a censure, and mandatory remedial actions before it could re-register. The order wasn’t about fraud or accounting tricks. It was about lapses in documentation — failures to capture judgments, inquiries, and filings that sit at the core of audit quality.

The Defaults and the Standards Behind Them

1. Critical Audit Matters (CAMs) – AS 3101

Under AS 3101, auditors are required to determine whether matters communicated to the audit committee qualify as Critical Audit Matters — those that involve especially challenging, subjective, or complex judgment.

In one audit, the firm disclosed impairment of intangibles as a CAM but failed to evaluate at least seven other matters tied to material accounts and disclosures. Without documenting why those issues did or did not rise to the level of CAMs, the audit report offered investors an incomplete picture of the areas that required the most judgment.

Violation: Failure to evaluate and document CAMs under AS 3101.11–.13.

2. Risk Assessment Procedures – AS 2110

AS 2110 requires auditors to perform sufficient risk assessment procedures to identify and assess the risks of material misstatement, including making inquiries of the audit committee about fraud risks.

In the cited audit, those inquiries never happened — and there was no documentation to show otherwise. Risk assessment is not just about forming a view; it must be evidenced in the file. Skipping a basic step, such as audit committee inquiries, undermines the foundation of fraud risk evaluation.

Violation: Failure to comply with AS 2110.54 and .56b.

3. Auditor Reporting of Certain Participants – PCAOB Rule 3211

Rule 3211 requires firms to file a Form AP for every issuer audit, disclosing the engagement partner and any other firms that participated in the audit. The filing deadline is 35 days after the audit report is first included in an SEC filing (or 10 days if included in a registration statement).

Between 2020 and 2023, the firm filed nine Form APs late — some weeks late, others more than 200 days overdue. Each late filing meant investors and regulators lacked timely visibility into who was responsible for the audit.

Violation: Repeated failures to file Form APs on time under Rule 3211(b)(1) and (b)(2).

4. Special Reporting Obligations – PCAOB Rule 2203

Rule 2203 requires firms to file a Form 3 within 30 days when certain events occur, including when the firm admits as a partner or principal someone barred from practice before the SEC.

In this case, the firm admitted such a partner in 2020 but did not file the Form 3 until January 2024 — three and a half years late. The documentation of this event, which should have been immediate, was left to languish.

Violation: Failure to timely file Form 3 under Rule 2203.

The Thread That Ties It Together: Documentation

What these violations share is not complexity, but neglect. The CAMs were not evaluated and documented. Fraud risk inquiries were not documented. PCAOB forms — the documentation of who did the work and under what conditions — were filed late.

The firm wasn’t penalized for missing accounting issues; it was penalized for failing to show its work.

Documentation Is the Audit

Auditors sometimes treat documentation as clerical — the paperwork after the “real” audit is done. But PCAOB standards make documentation inseparable from audit quality:

• It is evidence of compliance with standards.
• It is the record of professional judgment.
• It is the assurance that investors can rely on.

If it isn’t documented, regulators and investors must assume it wasn’t done.

The Way Forward

To prevent these failures, firms need to build documentation into their DNA:

• Integrate documentation into workflows so CAM evaluation, fraud inquiries, and filings are completed in real time.
• Train staff that documenting judgment is as important as exercising it.
• Supervise rigorously, checking whether the file supports conclusions.
• Leverage technology to track deadlines and ensure filings don’t slip.
• Monitor internally, treating documentation lapses as audit quality failures, not clerical errors.

KNAV Comments

The PCAOB’s action shows how fragile audit quality becomes when documentation is treated as an afterthought. CAMs unrecorded, filings delayed, inquiries skipped — each may appear small in isolation, but together they break the chain of evidence that investors depend on.

Imagine getting a medical scan done but receiving no report. What would you assume — that everything is fine, or that something must be seriously wrong? Human tendency leans toward the worst. Auditing is no different. If the work isn’t documented, regulators and investors have no reason to believe it was done at all.

The lesson is clear: documentation is not a formality — it is the audit itself.

Share via