Following an open meeting yesterday, the PCAOB announced that it has proposed amendments to AS 6101, Letters for Underwriters and Certain Other Requesting Parties, to be issued for public comment. The open meeting and proposed amendments follow a request for public comment on PCAOB standard setting issued in June, which explains that the amendments address one of the big questions everyone has been asking after the SEC’s semiannual reporting proposal:
Under the [Semiannual Reporting] Proposal, the existing financial statement requirements for periodic reports, registration statements, and proxy statements in Regulation S-X that govern the age of financial statements would be simplified and amended to reflect the new semiannual reporting option. AS 6101, Letters for Underwriters and Certain Other Requesting Parties, addresses the auditor’s responsibilities for performing engagements to issue comfort letters.
Certain provisions of AS 6101, specifically those that establish limitations on the auditor’s ability to provide negative assurance on subsequent changes in specified financial statement items, are based on the most recent audited or reviewed period and the existing SEC requirements for determining the age of financial statements, which assumes a quarterly filing cadence, and would change if the SEC Proposal were adopted. In conjunction with the SEC Proposal, the PCAOB is considering whether to make narrow, conforming amendments to AS 6101 to accommodate the changes the SEC may adopt to its reporting requirements.
But those existing limitations created complications unrelated to the semiannual reporting proposal (see the graphics in Figures 1 & 2 on pages 11 & 12 of the proposal showing the periods when underwriters are unable to provide negative assurance for a non-accelerated filer under quarterly reporting and semiannual reporting regimes), and the PCAOB has apparently decided that it’s time to address this now — without waiting on the SEC to adopt final rules related to semiannual reporting. The press release says:
Under the current requirements within AS 6101, which has not been substantially amended since its adoption as an interim standard in 2003, an auditor may be unable to provide negative assurance as to subsequent changes in select financial statement items in a comfort letter solely because more than 135 days have passed since the company’s most recent audit or review – even when the company remains current with all applicable U.S. Securities and Exchange Commission (SEC) filing requirements. For example, for a calendar-year filer, the auditor is unable to provide negative assurance between a date that is 135 days after the third quarter reporting date (generally, September 30) and the annual report filing deadlines (which is generally due no earlier than March 1 and up to March 31).
As a result, issuers could be unnecessarily constrained in accessing capital markets if underwriters are unwilling to engage in offerings after the 135-day period without an auditor’s ability to provide negative assurance as to subsequent changes. Such obstacles can impede capital formation, with no clear benefit to investors.
Here’s the TL; DR: The proposed amendments would move away from a fixed day convention by replacing the 135 day limitation with references to the filing deadline for the next annual or interim period for which financial statements are required to be filed. No more gaps between the date through which auditors can provide negative assurance and an issuer’s next filing deadline!
The proposal also contemplates the addition of a new note listing examples of risk factors that may influence the auditor’s decision to provide negative assurance, even within a permitted period. In addition to the length of time that has passed since the auditor’s last audit or review, those factors include management’s ability to respond to inquiries regarding changes in financial statement line items, changes in senior management, the effectiveness of the company’s ICFR, the company’s ability to continue as a going concern, restatements or other financial statement changes or the appointment of new accountants during the period. The proposal clarifies that these are meant to be reminders; the presence of one or more of these factors does not restrict an auditor’s ability to provide negative assurance. Also, while this list of factors is new, auditor discretion on negative assurance is not. Auditors have always had the ability to decline to provide negative assurance even within the 135 days, although I’m not sure I’ve ever seen that happen….
Public comments should be submitted by January 4, 2027.
While we’re on the topic of audits and auditors, the PCAOB recently reported on the results of its 2025 inspections of 143 PCAOB-registered public accounting firms and reviews of 780 public company audits. Here are the key findings featured in the press release:
– Overall: For all inspected firms, the aggregate Part I.A deficiency rate decreased to 23% in 2025, down from 38% in 2024.
– U.S. Global Network Firms (GNF): The aggregate Part I.A deficiency rate for the six U.S. GNFs decreased to 13% in 2025, from 26% in 2024. U.S. GNF firms regularly provide audit reports for more than 100 issuers and must be inspected by the PCAOB annually.
– “Big Four” U.S. Firms: The aggregate Part I.A deficiency rate for the Big Four U.S. firms – which as of December 31, 2025, collectively audited approximately 80% of the market capitalization of public companies listed on U.S. exchanges – decreased to 8% in 2025, from 20% in 2024.
– U.S. Non-Affiliated Firms (NAF) Annual: Part I.A deficiency rates at the annually inspected NAF firms decreased to 18% in the aggregate in 2025, compared to 52% in 2024. U.S. NAF firms that regularly provide audit reports for more than 100 issuers must be inspected by the PCAOB annually.
– U.S. NAF Triennial: Firms in this category regularly provide audit reports for 100 or fewer issuers and thus must be inspected by the PCAOB at least triennially (i.e., not less frequently than once every three years). Aggregate Part I.A deficiency rates in this category dropped to 32% in 2025, from 53% in 2024.
– Non-U.S. Firms: The aggregate deficiency rate at Non-U.S. GNFs increased to 26% in 2025, from 24% in 2024. Non-U.S. NAF deficiency rates declined in the aggregate from 76% in 2024 to 58% in 2025.
With election day just behind us (and hopefully election ads slowing down), it seemed fitting to share that the Center for Political Accountability (CPA) and the Carol and Lawrence Zicklin Center for Governance and Business Ethics at the Wharton School of the University of Pennsylvania just released the 2026 Index of Corporate Political Disclosure and Accountability. The index reviews political spending policies for S&P 500 companies and approximately 500 other Russell 1000 companies. As the press release notes, the index shows that leading U.S. public companies are “holding firm to transparency and accountability practices around their spending to influence elections.” Here are some other key findings highlighted in the press release:
TOP-TIER MILESTONES: 208 companies in the overall S&P 500 (more than 40 percent) placed in the first Index tier (scoring from 80 percent to 100 percent). This number increased slightly from 205 last year and is well more than double the 76 top-tier companies in 2015. Among core S&P 500 companies, those 308 that have been a constant in the Index since it began evaluating the S&P 500 in 2015, 164 companies – over 53 percent –placed in this year’s top tier. This compared to 160 last year and 56 in 2015.
TRENDSETTERS: The number of companies achieving Trendsetter status, scoring 90 percent or above for political disclosure and accountability, was 114. That’s a slight increase over last year’s record 112 and more than a fourfold increase from the 28 companies that received scores of 90 percent or higher in 2015. Trendsetters comprise 23 percent of all S&P 500 companies evaluated. Among the core S&P 500 companies, there are 96 Trendsetters this year compared to 90 in 2025 and 22 in 2015.
AVERAGE SCORE: For all S&P 500 companies the average overall score for political disclosure and accountability is 60.6 percent (compared to 60.4 percent last year). The average score has climbed steadily since 39.8 percent in 2015. The average score for core S&P 500 companies is higher at 71.1 percent, compared to 70.6 percent last year and 43.2 percent in 2015.
BOARD OVERSIGHT: There are 348 companies in the S&P 500 (more than two-thirds) with general board oversight of company political spending, compared to 328 last year and 214 in 2015. The number of companies in the core S&P 500 with general board oversight rose from 239 last year to 247 now. It was 139 in 2015.
BOARD COMMITTEE REVIEW: 300 companies in the full S&P 500 have board committee review of direct political contributions and expenditures, compared to 291 last year and 168 in 2015. In the core S&P 500, there are 223 companies with board committee review, compared to 218 last year and 111 in 2015.
THIRD-PARTY GROUPS: There was a significant increase, to 272 full S&P 500 companies from 257 last year, for companies having board committee review of spending through third-party groups, including payments to trade associations and 501(c)(4) organizations. These recipient groups are not required to identify publicly their donors. In 2015, only 120 companies had this board committee review. Among core S&P 500 companies, 205 companies, compared to 202 last year and 80 in 2015, have board committee review of spending through third-party groups.
PROHIBIT SPENDING: Among S&P 500 companies, there were increases in three categories for prohibiting political spending in high-risk areas for corporations. Companies that prohibit spending on state and local candidates and parties increased from 166 last year to 178 this year, from 84 in 2015; companies that prohibit spending on 527 groups increased by two from 133 in 2025 to 135 now, from 65 in 2015; and companies that prohibit spending on ballot measures increased from 102 last year to 115 now from 50 in 2015.
Yesterday, Corp Fin Staff updated its frequently asked questions on the application of the securities laws to certain crypto assets and crypto asset transactions and the Interpretive Release issued by the Commission in March. Questions 1.4, 1.5 and 1.6 were newly added.
Question 1.4: Addresses when the participants in a functional crypto system’s broad-based governance system are considered a “group of persons or entities” for the purpose of the definition of “central party.”
Question 1.5: Addresses what it means for a central party to “oversee participation” for purposes of the Interpretive Release’s description of a functional crypto system.
Question 1.6: Discusses the relationship between a “functional” crypto system and a “decentralized” crypto system.
Yesterday, in remarks at Practicing Law Institute’s 58th Annual Institute on Securities Regulation, Commissioner Uyeda shared his views on the SEC’s Corporate Penalty Statement, which provides a framework for evaluating whether to impose corporate civil penalties in connection with enforcement actions, and looked back at how the statement has fared in the 20 years since it was issued. Commissioner Uyeda supports the principles behind the statement, which he says still point in the right direction (particularly that the Commission should consider the degree to which any penalty would compensate or further harm injured shareholders). But he identifies ways in which the world today differs from the world in which the statement was written, and how applying the statement may not always further the Commission’s goals or the principles for which it stood. For example:
[T]he broader use of dual-class stock corporate structures, where a founder or controlling shareholder may direct the company with a majority of the votes while owning a smaller fraction of the equity. When such a company pays a civil penalty, the cost tends to be borne by economic ownership, not by voting power. The public shareholders who had little or no influence on how the company was run may end up shouldering most of the civil penalties, while the controlling shareholder, who might arguably be closer to the misconduct at issue, may be impacted significantly less. Whatever one thinks of dual-class structures, that is a reason to look first to the individuals responsible for the violations. As corporate structures evolve, Commission staff should be thinking about which shareholders will be impacted the most by a civil penalty. Are there ways of using Fair Fund authority to recompense non-controlling shareholders in such situations?
[T]he interaction of the civil penalty with the SEC’s whistleblower program. The whistleblower program, created in 2010, pays awards of 10 to 30 percent of monetary sanctions collected in actions over $1 million, so the issuance of a penalty and its size now have consequences beyond deterrence. While the potential for a whistleblower award does not and should not factor into whether a corporate penalty is imposed, a greater focus on individual wrongdoers, who may lack the resources to pay, could result in smaller awards, or even possibly no award if the amount falls below the $1 million threshold, for the whistleblowers who made those cases possible. Given the public interest in encouraging reports of wrongdoing and malfeasance, are there other ways to ensure whistleblowers are meaningfully rewarded that do not depend on imposing large civil penalties borne by victimized shareholders?
He pointed to these developments to suggest that the statement should be revisited to address situations that were not originally contemplated. He also stressed the importance of holding the individuals responsible for the noncompliance personally accountable using the tools the Commission has for this purpose – including D&O bars, suspensions and clawbacks – even though pursuing individuals can be a harder path for Commission Staff.
The Commission should not be reluctant to pursue individuals and use these tools where warranted. Individual remedies can be harder to obtain. They take longer to investigate, they are litigated more often, and individuals with their livelihood at stake fight harder than corporations deciding whether to settle. Individuals are also often covered by insurance, indemnification, and expense advance provisions to fund their defense. Those are reasons to staff and support individual cases properly, not reasons to accept a corporate settlement in their place. When the choice is between a large corporate penalty and holding the responsible officers and employees accountable, the 2006 framework and common sense point in the same direction [. . .]
A civil penalty paid out of the corporate treasury is too often borne by shareholders and rarely is it felt by the executives and other company insiders who caused it. Personal consequences are different. An officer who knows that misconduct could end a career in public company leadership weighs a decision differently from one who expects the company—and by extension the shareholders—to write a check to cover their misdeeds.
In September, Liz shared that the PCAOB adopted amendments to certain provisions of QC 1000, A Firm’s System of Quality Control, after convening an open meeting in June on this topic. At the time, Liz noted that the amendments remained subject to SEC approval. The SEC has now granted that approval in an order issued yesterday.
QC 1000 was approved by the SEC back in September 2024, and the effective date of the new standard was postponed last August to December 15, 2026. These latest amendments (which Liz summarized when they were adopted by the PCAOB) did not change that effective date. The order states that the amendments will also be effective on December 15, 2026.
Under the Amendments, the first period for firms’ evaluation of their QC systems will cover the period beginning on the effective date of QC 1000 (i.e., December 15, 2026) and ending on the firm’s selected evaluation date, subject to a five-month minimum period of operation before a firm is first required to evaluate its QC system. Subsequent evaluation periods will cover the 12-month period ending on the firm’s selected evaluation date.
Last week, FASB announced the issuance of a proposed Accounting Standards Update (ASU) to make some tweaks to the accounting for equity method investments. This PwC viewpoint explains the proposed changes as follows:
A single significant influence threshold: Under existing guidance, the assessment can differ for investments in corporations compared with partnerships and similar entities [. . .] The proposal would eliminate those differing scope thresholds and use “significant influence” as the single principle for determining whether an investment is subject to the equity method. As a result, some investments in partnerships and similar entities that are currently accounted for under the equity method may no longer qualify for the equity method if the investor does not have significant influence. The FASB also proposed several targeted changes to the significant influence guidance in ASC 323 to:
– Remove the presumption that an investor does not have significant influence when it owns less than 20% of an investee’s voting stock
– Expand the existing board representation indicator to include representation on a functionally equivalent governing body
– Specify that a noncontrolling general partner or its functional equivalent (such as a managing member in a limited liability company) has significant influence
An investor would continue to presume significant influence when the 20% ownership threshold is met; however, an ownership interest below 20% would no longer create a presumption that significant influence does not exist. Rather, the other relevant factors in the existing guidance would need to be considered.
Complex allocation structures: The proposal also aims to clarify how an equity method investor determines its share of an investee’s earnings when the investee has a complex allocation structure, which is often done using an approach referred to as “hypothetical liquidation at book value.” The proposed ASU would move guidance on this topic in ASC 970-323, Real Estate—General—Investments—Equity Method and Joint Ventures, which is not specific to the real estate industry or to a particular transaction into ASC 323 so it is more easily accessible for financial statement preparers.
Other proposed amendments: The proposal would also make consequential amendments to ASC 810, Consolidation, related to (1) allocating income to noncontrolling interests that involve complex allocation structures and (2) the application of proportionate consolidation in certain industries.
Comments are due January 11, 2027. The proposed ASU is available at www.fasb.org with instructions on how to submit comments.
Earlier this month, State Street announced the results of its 2026 Digital Assets Study, which surveyed 300 institutional investors between July 20 and August 19 to understand institutional adoption, investment priorities and operational readiness for digital assets. It found that “institutional investors are becoming increasingly confident in the long-term future of digital assets.” Here are some stats and quotes from the summary that stood out to me:
– 51% expect digital assets to become mainstream within five years, if they have not already, up from 42% in 2025 and 11% in 2024.
– Just 3% believe digital assets will never become mainstream.
– More than one-third (35%) of respondents already manage or distribute digital assets, while another 28% have the provider relationships and infrastructure in place to do so if client demand arises.
– Cost reduction and efficiency were identified as the largest expected benefit of digital assets by 53% of respondents. Faster settlement was the most frequently cited advantage (67%), followed by new client acquisition (58%) and increased liquidity (53%).
– Nearly one in five respondents believe a fully on-chain market structure will never replace today’s hybrid model of traditional and digital infrastructure.
The DOJ has been focused on encouraging corporate self-reporting and holding the real “bad guys” accountable in the last few years. Over on Radical Compliance, Matt Kelly recently wrote about a technology company charged with violations of U.S. sanctions laws through its Russian subsidiary, where the timing of the self-reporting didn’t do the company any favors.
The sanctions violations finally came to the attention of Extreme’s legal and compliance team in April 2022 thanks to a whistleblower complaint. (Yay for internal reporting!) The company then conducted what the Justice Department readily admits was a “good-faith investigation,” complete with outside counsel and a presentation to Extreme’s board in summer 2022 [. . .] The issue stayed dormant until October 2022, when a news media outlet contacted Extreme to say it was working on a story about the Moscow office selling goods to Russian military contractors.
The news reporters “cited new facts previously unknown to the company’s counsel regarding the possibility of willful misconduct by the company’s Russia-based employees,” the Justice Department said. That prompted Extreme to reopen its original investigation and submit a self-disclosure to the Justice Department just days before the news report was published.
Now we get to the key point. Since Extreme made its self-disclosure in anticipation of the media disclosing the matter anyway, that decision did not qualify as a voluntary self-disclosure under the Justice Department’s Corporate Enforcement Policy.
This is all known as a “near miss” under the latest incarnation of the Corporate Enforcement Policy, unveiled last March. A company’s self-disclosure doesn’t qualify as voluntary if that company makes its disclosure under “imminent threat” of some other party disclosing the same violation — like, say, a media outlet about to blast news of your sanctions violations across the interwebs.
To be clear, Extreme Networks did everything else right, such as cooperating with the Justice Department’s investigation and improving its sanctions compliance program. But without the voluntary self-disclosure prong, the best Extreme (or any other company) could hope for is a non-prosecution agreement rather than a declination. Which is exactly what Extreme received.
To quote directly from the Justice Department’s press release on the case:
While Extreme Networks’ disclosure to the National Security Division was not timely because it occurred under imminent threat of disclosure by a news publication, Extreme Networks nonetheless fully cooperated with the department’s investigation and timely and appropriately remediated the misconduct. As a result, its disclosure qualified as a near-miss Voluntary Self-Disclosure under the policy.
Matt says, “Now the compliance community knows what a near-miss situation looks like.”
Earlier this week, I highlighted that October is Cybersecurity Awareness Month and I noted how CrowdStrike’s 2026 Global Threat Report described the growing threat from AI systems, but I failed to mention the threat much closer to home: Cybersecurity threats targeting law firms.
As this Reuters article notes, CrowdStrike highlights ever-increasing security breaches at law firms, which are prime targets given their propensity to be sitting on lots of highly sensitive confidential information while publishing everyone’s email address on a public website. The article notes:
CrowdStrike’s report said threats are coming from entities including profit-motivated “e-crime” groups and nation-state adversaries. The report said China-linked groups likely will remain the greatest intelligence collection threat to the legal sector.
The new report said it found for the first time an entity targeting legal industry-specific software. The hackers in that instance, the report said, exploited a vulnerability in software that law firms use for timekeeping and billing.
In another episode in November, cyber criminals hired a Russian national to walk into a US law firm while posing as an internal IT employee.
Many major law firms targeted in recent cyber attacks said they were victims of a “social engineering” event. Such attacks can involve manipulating people into revealing sensitive information or granting access to secure systems.
A not-so-comforting sentiment was shared with Reuters by CrowdStrike’s senior vice president for counter adversary operations:
“What we’re seeing across the broader threat landscape, more and more threat actors are using agentic technology to democratize hacking,” said Adam Meyers, CrowdStrike’s senior vice president for counter adversary operations. “It’s going to get a lot worse before it gets better.”
If you, like me, are a law firm denizen, let this CrowdStrike report and all of the hoopla around Cybersecurity Awareness Month serve as a wake-up call. We all receive constant warnings from our IT departments about the risk of cyber attacks, but admittedly we get numb to those warnings over time. It is really up to each individual to exercise vigilance and common sense when you receive a random email or a suspicious call. There is a lot at stake, so it really makes sense to be overly cautious when it comes to cybersecurity, particularly as the methods are constantly being advanced with the presence of AI. In short, don’t fall for it!
