While we’re on the topic of audits and auditors, the PCAOB recently reported on the results of its 2025 inspections of 143 PCAOB-registered public accounting firms and reviews of 780 public company audits. Here are the key findings featured in the press release:
– Overall: For all inspected firms, the aggregate Part I.A deficiency rate decreased to 23% in 2025, down from 38% in 2024.
– U.S. Global Network Firms (GNF): The aggregate Part I.A deficiency rate for the six U.S. GNFs decreased to 13% in 2025, from 26% in 2024. U.S. GNF firms regularly provide audit reports for more than 100 issuers and must be inspected by the PCAOB annually.
– “Big Four” U.S. Firms: The aggregate Part I.A deficiency rate for the Big Four U.S. firms – which as of December 31, 2025, collectively audited approximately 80% of the market capitalization of public companies listed on U.S. exchanges – decreased to 8% in 2025, from 20% in 2024.
– U.S. Non-Affiliated Firms (NAF) Annual: Part I.A deficiency rates at the annually inspected NAF firms decreased to 18% in the aggregate in 2025, compared to 52% in 2024. U.S. NAF firms that regularly provide audit reports for more than 100 issuers must be inspected by the PCAOB annually.
– U.S. NAF Triennial: Firms in this category regularly provide audit reports for 100 or fewer issuers and thus must be inspected by the PCAOB at least triennially (i.e., not less frequently than once every three years). Aggregate Part I.A deficiency rates in this category dropped to 32% in 2025, from 53% in 2024.
– Non-U.S. Firms: The aggregate deficiency rate at Non-U.S. GNFs increased to 26% in 2025, from 24% in 2024. Non-U.S. NAF deficiency rates declined in the aggregate from 76% in 2024 to 58% in 2025.
With election day just behind us (and hopefully election ads slowing down), it seemed fitting to share that the Center for Political Accountability (CPA) and the Carol and Lawrence Zicklin Center for Governance and Business Ethics at the Wharton School of the University of Pennsylvania just released the 2026 Index of Corporate Political Disclosure and Accountability. The index reviews political spending policies for S&P 500 companies and approximately 500 other Russell 1000 companies. As the press release notes, the index shows that leading U.S. public companies are “holding firm to transparency and accountability practices around their spending to influence elections.” Here are some other key findings highlighted in the press release:
TOP-TIER MILESTONES: 208 companies in the overall S&P 500 (more than 40 percent) placed in the first Index tier (scoring from 80 percent to 100 percent). This number increased slightly from 205 last year and is well more than double the 76 top-tier companies in 2015. Among core S&P 500 companies, those 308 that have been a constant in the Index since it began evaluating the S&P 500 in 2015, 164 companies – over 53 percent –placed in this year’s top tier. This compared to 160 last year and 56 in 2015.
TRENDSETTERS: The number of companies achieving Trendsetter status, scoring 90 percent or above for political disclosure and accountability, was 114. That’s a slight increase over last year’s record 112 and more than a fourfold increase from the 28 companies that received scores of 90 percent or higher in 2015. Trendsetters comprise 23 percent of all S&P 500 companies evaluated. Among the core S&P 500 companies, there are 96 Trendsetters this year compared to 90 in 2025 and 22 in 2015.
AVERAGE SCORE: For all S&P 500 companies the average overall score for political disclosure and accountability is 60.6 percent (compared to 60.4 percent last year). The average score has climbed steadily since 39.8 percent in 2015. The average score for core S&P 500 companies is higher at 71.1 percent, compared to 70.6 percent last year and 43.2 percent in 2015.
BOARD OVERSIGHT: There are 348 companies in the S&P 500 (more than two-thirds) with general board oversight of company political spending, compared to 328 last year and 214 in 2015. The number of companies in the core S&P 500 with general board oversight rose from 239 last year to 247 now. It was 139 in 2015.
BOARD COMMITTEE REVIEW: 300 companies in the full S&P 500 have board committee review of direct political contributions and expenditures, compared to 291 last year and 168 in 2015. In the core S&P 500, there are 223 companies with board committee review, compared to 218 last year and 111 in 2015.
THIRD-PARTY GROUPS: There was a significant increase, to 272 full S&P 500 companies from 257 last year, for companies having board committee review of spending through third-party groups, including payments to trade associations and 501(c)(4) organizations. These recipient groups are not required to identify publicly their donors. In 2015, only 120 companies had this board committee review. Among core S&P 500 companies, 205 companies, compared to 202 last year and 80 in 2015, have board committee review of spending through third-party groups.
PROHIBIT SPENDING: Among S&P 500 companies, there were increases in three categories for prohibiting political spending in high-risk areas for corporations. Companies that prohibit spending on state and local candidates and parties increased from 166 last year to 178 this year, from 84 in 2015; companies that prohibit spending on 527 groups increased by two from 133 in 2025 to 135 now, from 65 in 2015; and companies that prohibit spending on ballot measures increased from 102 last year to 115 now from 50 in 2015.
Yesterday, Corp Fin Staff updated its frequently asked questions on the application of the securities laws to certain crypto assets and crypto asset transactions and the Interpretive Release issued by the Commission in March. Questions 1.4, 1.5 and 1.6 were newly added.
Question 1.4: Addresses when the participants in a functional crypto system’s broad-based governance system are considered a “group of persons or entities” for the purpose of the definition of “central party.”
Question 1.5: Addresses what it means for a central party to “oversee participation” for purposes of the Interpretive Release’s description of a functional crypto system.
Question 1.6: Discusses the relationship between a “functional” crypto system and a “decentralized” crypto system.
Yesterday, in remarks at Practicing Law Institute’s 58th Annual Institute on Securities Regulation, Commissioner Uyeda shared his views on the SEC’s Corporate Penalty Statement, which provides a framework for evaluating whether to impose corporate civil penalties in connection with enforcement actions, and looked back at how the statement has fared in the 20 years since it was issued. Commissioner Uyeda supports the principles behind the statement, which he says still point in the right direction (particularly that the Commission should consider the degree to which any penalty would compensate or further harm injured shareholders). But he identifies ways in which the world today differs from the world in which the statement was written, and how applying the statement may not always further the Commission’s goals or the principles for which it stood. For example:
[T]he broader use of dual-class stock corporate structures, where a founder or controlling shareholder may direct the company with a majority of the votes while owning a smaller fraction of the equity. When such a company pays a civil penalty, the cost tends to be borne by economic ownership, not by voting power. The public shareholders who had little or no influence on how the company was run may end up shouldering most of the civil penalties, while the controlling shareholder, who might arguably be closer to the misconduct at issue, may be impacted significantly less. Whatever one thinks of dual-class structures, that is a reason to look first to the individuals responsible for the violations. As corporate structures evolve, Commission staff should be thinking about which shareholders will be impacted the most by a civil penalty. Are there ways of using Fair Fund authority to recompense non-controlling shareholders in such situations?
[T]he interaction of the civil penalty with the SEC’s whistleblower program. The whistleblower program, created in 2010, pays awards of 10 to 30 percent of monetary sanctions collected in actions over $1 million, so the issuance of a penalty and its size now have consequences beyond deterrence. While the potential for a whistleblower award does not and should not factor into whether a corporate penalty is imposed, a greater focus on individual wrongdoers, who may lack the resources to pay, could result in smaller awards, or even possibly no award if the amount falls below the $1 million threshold, for the whistleblowers who made those cases possible. Given the public interest in encouraging reports of wrongdoing and malfeasance, are there other ways to ensure whistleblowers are meaningfully rewarded that do not depend on imposing large civil penalties borne by victimized shareholders?
He pointed to these developments to suggest that the statement should be revisited to address situations that were not originally contemplated. He also stressed the importance of holding the individuals responsible for the noncompliance personally accountable using the tools the Commission has for this purpose – including D&O bars, suspensions and clawbacks – even though pursuing individuals can be a harder path for Commission Staff.
The Commission should not be reluctant to pursue individuals and use these tools where warranted. Individual remedies can be harder to obtain. They take longer to investigate, they are litigated more often, and individuals with their livelihood at stake fight harder than corporations deciding whether to settle. Individuals are also often covered by insurance, indemnification, and expense advance provisions to fund their defense. Those are reasons to staff and support individual cases properly, not reasons to accept a corporate settlement in their place. When the choice is between a large corporate penalty and holding the responsible officers and employees accountable, the 2006 framework and common sense point in the same direction [. . .]
A civil penalty paid out of the corporate treasury is too often borne by shareholders and rarely is it felt by the executives and other company insiders who caused it. Personal consequences are different. An officer who knows that misconduct could end a career in public company leadership weighs a decision differently from one who expects the company—and by extension the shareholders—to write a check to cover their misdeeds.
In September, Liz shared that the PCAOB adopted amendments to certain provisions of QC 1000, A Firm’s System of Quality Control, after convening an open meeting in June on this topic. At the time, Liz noted that the amendments remained subject to SEC approval. The SEC has now granted that approval in an order issued yesterday.
QC 1000 was approved by the SEC back in September 2024, and the effective date of the new standard was postponed last August to December 15, 2026. These latest amendments (which Liz summarized when they were adopted by the PCAOB) did not change that effective date. The order states that the amendments will also be effective on December 15, 2026.
Under the Amendments, the first period for firms’ evaluation of their QC systems will cover the period beginning on the effective date of QC 1000 (i.e., December 15, 2026) and ending on the firm’s selected evaluation date, subject to a five-month minimum period of operation before a firm is first required to evaluate its QC system. Subsequent evaluation periods will cover the 12-month period ending on the firm’s selected evaluation date.
Last week, FASB announced the issuance of a proposed Accounting Standards Update (ASU) to make some tweaks to the accounting for equity method investments. This PwC viewpoint explains the proposed changes as follows:
A single significant influence threshold: Under existing guidance, the assessment can differ for investments in corporations compared with partnerships and similar entities [. . .] The proposal would eliminate those differing scope thresholds and use “significant influence” as the single principle for determining whether an investment is subject to the equity method. As a result, some investments in partnerships and similar entities that are currently accounted for under the equity method may no longer qualify for the equity method if the investor does not have significant influence. The FASB also proposed several targeted changes to the significant influence guidance in ASC 323 to:
– Remove the presumption that an investor does not have significant influence when it owns less than 20% of an investee’s voting stock
– Expand the existing board representation indicator to include representation on a functionally equivalent governing body
– Specify that a noncontrolling general partner or its functional equivalent (such as a managing member in a limited liability company) has significant influence
An investor would continue to presume significant influence when the 20% ownership threshold is met; however, an ownership interest below 20% would no longer create a presumption that significant influence does not exist. Rather, the other relevant factors in the existing guidance would need to be considered.
Complex allocation structures: The proposal also aims to clarify how an equity method investor determines its share of an investee’s earnings when the investee has a complex allocation structure, which is often done using an approach referred to as “hypothetical liquidation at book value.” The proposed ASU would move guidance on this topic in ASC 970-323, Real Estate—General—Investments—Equity Method and Joint Ventures, which is not specific to the real estate industry or to a particular transaction into ASC 323 so it is more easily accessible for financial statement preparers.
Other proposed amendments: The proposal would also make consequential amendments to ASC 810, Consolidation, related to (1) allocating income to noncontrolling interests that involve complex allocation structures and (2) the application of proportionate consolidation in certain industries.
Comments are due January 11, 2027. The proposed ASU is available at www.fasb.org with instructions on how to submit comments.
Earlier this month, State Street announced the results of its 2026 Digital Assets Study, which surveyed 300 institutional investors between July 20 and August 19 to understand institutional adoption, investment priorities and operational readiness for digital assets. It found that “institutional investors are becoming increasingly confident in the long-term future of digital assets.” Here are some stats and quotes from the summary that stood out to me:
– 51% expect digital assets to become mainstream within five years, if they have not already, up from 42% in 2025 and 11% in 2024.
– Just 3% believe digital assets will never become mainstream.
– More than one-third (35%) of respondents already manage or distribute digital assets, while another 28% have the provider relationships and infrastructure in place to do so if client demand arises.
– Cost reduction and efficiency were identified as the largest expected benefit of digital assets by 53% of respondents. Faster settlement was the most frequently cited advantage (67%), followed by new client acquisition (58%) and increased liquidity (53%).
– Nearly one in five respondents believe a fully on-chain market structure will never replace today’s hybrid model of traditional and digital infrastructure.
The DOJ has been focused on encouraging corporate self-reporting and holding the real “bad guys” accountable in the last few years. Over on Radical Compliance, Matt Kelly recently wrote about a technology company charged with violations of U.S. sanctions laws through its Russian subsidiary, where the timing of the self-reporting didn’t do the company any favors.
The sanctions violations finally came to the attention of Extreme’s legal and compliance team in April 2022 thanks to a whistleblower complaint. (Yay for internal reporting!) The company then conducted what the Justice Department readily admits was a “good-faith investigation,” complete with outside counsel and a presentation to Extreme’s board in summer 2022 [. . .] The issue stayed dormant until October 2022, when a news media outlet contacted Extreme to say it was working on a story about the Moscow office selling goods to Russian military contractors.
The news reporters “cited new facts previously unknown to the company’s counsel regarding the possibility of willful misconduct by the company’s Russia-based employees,” the Justice Department said. That prompted Extreme to reopen its original investigation and submit a self-disclosure to the Justice Department just days before the news report was published.
Now we get to the key point. Since Extreme made its self-disclosure in anticipation of the media disclosing the matter anyway, that decision did not qualify as a voluntary self-disclosure under the Justice Department’s Corporate Enforcement Policy.
This is all known as a “near miss” under the latest incarnation of the Corporate Enforcement Policy, unveiled last March. A company’s self-disclosure doesn’t qualify as voluntary if that company makes its disclosure under “imminent threat” of some other party disclosing the same violation — like, say, a media outlet about to blast news of your sanctions violations across the interwebs.
To be clear, Extreme Networks did everything else right, such as cooperating with the Justice Department’s investigation and improving its sanctions compliance program. But without the voluntary self-disclosure prong, the best Extreme (or any other company) could hope for is a non-prosecution agreement rather than a declination. Which is exactly what Extreme received.
To quote directly from the Justice Department’s press release on the case:
While Extreme Networks’ disclosure to the National Security Division was not timely because it occurred under imminent threat of disclosure by a news publication, Extreme Networks nonetheless fully cooperated with the department’s investigation and timely and appropriately remediated the misconduct. As a result, its disclosure qualified as a near-miss Voluntary Self-Disclosure under the policy.
Matt says, “Now the compliance community knows what a near-miss situation looks like.”
Earlier this week, I highlighted that October is Cybersecurity Awareness Month and I noted how CrowdStrike’s 2026 Global Threat Report described the growing threat from AI systems, but I failed to mention the threat much closer to home: Cybersecurity threats targeting law firms.
As this Reuters article notes, CrowdStrike highlights ever-increasing security breaches at law firms, which are prime targets given their propensity to be sitting on lots of highly sensitive confidential information while publishing everyone’s email address on a public website. The article notes:
CrowdStrike’s report said threats are coming from entities including profit-motivated “e-crime” groups and nation-state adversaries. The report said China-linked groups likely will remain the greatest intelligence collection threat to the legal sector.
The new report said it found for the first time an entity targeting legal industry-specific software. The hackers in that instance, the report said, exploited a vulnerability in software that law firms use for timekeeping and billing.
In another episode in November, cyber criminals hired a Russian national to walk into a US law firm while posing as an internal IT employee.
Many major law firms targeted in recent cyber attacks said they were victims of a “social engineering” event. Such attacks can involve manipulating people into revealing sensitive information or granting access to secure systems.
A not-so-comforting sentiment was shared with Reuters by CrowdStrike’s senior vice president for counter adversary operations:
“What we’re seeing across the broader threat landscape, more and more threat actors are using agentic technology to democratize hacking,” said Adam Meyers, CrowdStrike’s senior vice president for counter adversary operations. “It’s going to get a lot worse before it gets better.”
If you, like me, are a law firm denizen, let this CrowdStrike report and all of the hoopla around Cybersecurity Awareness Month serve as a wake-up call. We all receive constant warnings from our IT departments about the risk of cyber attacks, but admittedly we get numb to those warnings over time. It is really up to each individual to exercise vigilance and common sense when you receive a random email or a suspicious call. There is a lot at stake, so it really makes sense to be overly cautious when it comes to cybersecurity, particularly as the methods are constantly being advanced with the presence of AI. In short, don’t fall for it!
It is finally my turn to chime in the 2026 Proxy Disclosure & 23rd Annual Executive Compensation Conferences, which took place in Orlando earlier this month. You will be pleased to know that the video archives and transcripts for the Conferences are now available! If you registered for the conferences through our sites, you can access the video archives and transcripts via the access links on the 2026 Conference Archives page. Members of TheCorporateCounsel.net, CompensationStandards.com, Section16.com and DealLawyers.com who registered for the conferences can use their existing logins to access the Proxy Disclosure Archives and the Executive Compensation Archives.
If you are not a member, do not know your password, or are experiencing issues accessing the 2026 Conference archives, please reach out to our Member Services team by calling 800-737-1271 or send an email to info@ccrcorp.com.
We covered a lot of ground at the Conferences. I would like to thank Christina Thomas from the SEC for giving us so much insight into the SEC’s agenda, and to all of the SEC All Stars who provided great insights across two days of conferences. Thanks as well go out to the great team at CCRcorp, as well as all of our sponsors, speakers, and attendees! We could not have done it without you.
What were some of my key takeaways from the 2026 Proxy Disclosure & 23rd Annual Executive Compensation Conferences, you may ask? Here are the top five:
1. The SEC’s reform proposals (if adopted) will require some thoughtful analysis. I will often trot out the old proverb “you can lead a horse to water but you can’t make it drink,” and I think it is well-suited for the SEC’s package of reform proposals. Time and time again throughout the Conferences, our speakers noted a number of considerations that companies will need to focus on before implementing the SEC’s reforms if they are adopted as proposed. This notion particularly applies in the context of the SEC’s semiannual reporting proposal, where there is skepticism that public companies will rush headlong into the optional semiannual reporting scheme, recognizing that it will be necessary to carefully consider investor reactions, financing needs, peer practices, insider trading considerations and other factors before changing the interval for periodic reporting. Similarly, if the SEC adopts the filer status reforms as proposed, companies will need to evaluate whether it makes sense to avail themselves of all of the exemptions and accommodations that would then be available to non-accelerated filers.
2. Rescission of Rule 14a-8 could complicate things for public companies. In the “be careful watch you wish for” category, the SEC’s proposal to rescind Rule 14a-8 generated a great deal of discussion among the speakers at our Conferences, and they described a post-Rule 14a-8 landscape that could be much more complicated for public companies. Our speakers noted that shareholders will likely shift to other avenues for advancing their proposals, which could lead to more contested situations and less predictability as to outcomes. The possibility of state law changes and private ordering could result in a lack of uniformity as to how shareholder proposals are addressed in company proxy statements (if at all), making things more complicated for companies and shareholders alike.
3. Prediction markets have grabbed our attention. The explosion in popularity of prediction markets has brought about concerns as to how company employees can use confidential information to their trading advantage, and insider trading policies and codes of conduct are being updated to address these concerns.
4. Everyone is waiting for the SEC’s executive compensation disclosure reforms. I kicked off our SEC All-Stars panel at the 23rd Annual Executive Compensation Conference with a trip down memory lane, describing my odyssey with executive compensation disclosure and highlighting some of the areas where the rules just don’t work today. Christina Thomas indicated that they Commission is considering major changes to the rules, now just some trimming around the edges. While we were hopeful that we would have a concrete rule proposal to discuss at the Conferences, it appears that perhaps election year politics may have gotten in the way. In any event, everyone is anxiously awaiting the arrival of the SEC’s reform proposal, which will likely be out “soon.”
5. The shareholder engagement landscape has really changed. Over the course of this year, I have been writing a lot about the significant shift in the shareholder engagement landscape, and our speakers did a great job exploring these changes and what it means for public companies. From the chilling effect of the SEC’s early 2025 beneficial ownership reporting guidance to artificial intelligence to standing voting instruction programs, there was a great deal to cover on this front, and companies should be very aware of these significant changes going into the 2027 proxy season.
It was great to see everyone who attended the Conferences in person this year, and I look forward to doing it all over again next year in New Orleans on September 21 & 22, 2027. I hope you get a chance to check out the video archives and transcripts of this year’s Conferences, and be sure to look out for my more detailed coverage in the November-December 2026 issue of The Corporate Executive.
