When Is a PCAOB Audit Required? Issuers, Broker-Dealers, and SPACs

A PCAOB audit is required whenever a company qualifies as an “issuer” under the Sarbanes-Oxley Act or is an SEC-registered broker-dealer. In practical terms, that means any company with securities registered under Section 12 of the Securities Exchange Act, any company required to file periodic reports under Section 15(d), and any company with a pending SEC registration statement must have its financial statements audited by an accounting firm registered with the Public Company Accounting Oversight Board.¹ Federal law makes it illegal for a non-registered firm to prepare or issue an audit report for any of these entities.²

The Core Trigger: Being an Issuer

“Issuer” is the word that does the work. Under Sarbanes-Oxley, it covers three groups: companies whose securities are registered under Section 12 of the Exchange Act, companies required to file reports under Section 15(d) of that act, and companies that have filed a registration statement under the Securities Act of 1933 that has not yet become effective and has not been withdrawn.¹ That reaches domestic public companies on major exchanges, foreign private issuers operating in U.S. markets, and companies in the middle of going public.

Once a company fits that definition, only a PCAOB-registered firm can issue its audit report, and the audit itself has to follow PCAOB Auditing Standards rather than the Generally Accepted Auditing Standards used for private companies.³ Those standards apply to every annual report and quarterly review the company files with the SEC.

Public Companies Listed on Exchanges

The clearest case is a company listed on the NYSE, Nasdaq, or another national securities exchange. Listing brings SEC reporting obligations, which makes the company an issuer. Every Form 10-K annual report must carry financial statements audited by a PCAOB-registered firm under PCAOB standards, and every Form 10-Q must include financial statements reviewed under those standards.

Section 404(b) Internal Controls Attestation

Larger public companies face an added requirement on top of the basic financial statement audit. Under Section 404(b) of Sarbanes-Oxley, an independent auditor must attest to the effectiveness of the company’s internal controls over financial reporting. The 404(b) attestation applies only to accelerated filers and large accelerated filers, categories the SEC defines by public float:

Large accelerated filer: public float of $700 million or more.
Accelerated filer: public float of $75 million or more but less than $700 million.

Non-accelerated filers, generally companies with a public float below $75 million, are not subject to the 404(b) auditor attestation.⁴ They still need the PCAOB-audited financial statements, and management still has to run its own internal controls assessment under Section 404(a). The auditor simply doesn’t have to separately sign off on those controls.

Emerging Growth Companies

The JOBS Act of 2012 created a lighter path for newer public companies. A company qualifies as an Emerging Growth Company if it has total annual gross revenues below $1.235 billion and has been public for fewer than five fiscal years. EGC status ends early if revenue crosses that threshold, if the company issues more than $1 billion in non-convertible debt over a three-year period, or if it becomes a large accelerated filer.⁵

For as long as a company holds EGC status, it is exempt from the Section 404(b) auditor attestation of internal controls.⁶ EGCs are not exempt from the underlying PCAOB audit itself. They still need a registered firm auditing under PCAOB standards for their annual filings, and management still has to perform its own Section 404(a) assessment.

SEC-Registered Broker-Dealers

Broker-dealers registered with the SEC have their own PCAOB audit mandate, distinct from the issuer rules. SEC Rule 17a-5 requires these firms to file annual reports that include financial statements examined by an independent public accountant, and those examinations must follow PCAOB standards.⁷ The Dodd-Frank Act explicitly brought broker-dealer audits under PCAOB oversight.

The scope goes beyond a standard corporate audit. The accountant must also examine whether the firm complied with rules on net capital reserves and customer protection, or review the firm’s report explaining why it is exempt from those requirements.⁷

Not every broker-dealer files the same reports. Firms that neither clear transactions nor carry customer accounts, typically introducing brokers that forward all customer orders to a clearing firm, file a simpler quarterly and annual report on Part IIA of Form X-17A-5 rather than the more detailed reports required of carrying firms.⁸ They still need a PCAOB-registered auditor. The engagement is just narrower.

Investment Companies and Funds

Mutual funds, exchange-traded funds, closed-end funds, and other entities registered under the Investment Company Act of 1940 are issuers under Sarbanes-Oxley. Their financial statements must be audited by PCAOB-registered firms under PCAOB standards.³ Business development companies, a type of closed-end fund that invests in small and mid-sized businesses, fall under the same rule.

The audit work concentrates on the valuation of underlying portfolio securities, particularly for funds holding illiquid or hard-to-price assets, and on the disclosure of management fees, expense ratios, and distribution practices. Audit committee pre-approval is required before the fund’s auditor can provide any non-audit services within the investment company complex.⁹

SPACs and De-SPAC Transactions

Special purpose acquisition companies trigger the requirement at multiple stages. A SPAC’s own IPO registration statement needs PCAOB-audited financials, which is straightforward because the SPAC is a shell holding cash in trust.

The harder part comes with the de-SPAC merger. Under SEC Rule 15-01 of Regulation S-X, the target company’s financial statements must be audited by an independent accountant following PCAOB standards if the target will become the predecessor to the shell company.¹⁰ A private target whose books were previously audited under GAAS typically needs a re-audit under PCAOB standards before those statements can appear in the proxy or registration statement filed with the SEC.

One nuance: when the target is not a predecessor to the shell company, its financial statements included in the filing may be audited under either PCAOB standards or U.S. GAAS.¹⁰ For most de-SPAC deals the target becomes the operating entity going forward, so PCAOB-standard audits are the default. Private companies weighing a SPAC merger should budget for that re-audit well before filings begin.

Employee Benefit Plans Filing Form 11-K

This trigger catches sponsors off guard. When a public company sponsors an employee benefit plan, typically a 401(k) or stock purchase plan, that lets participants buy employer stock, the plan itself must file an annual report on Form 11-K with the SEC.¹¹ The financial statements in that filing must be audited by a PCAOB-registered firm, and the filing is due 180 days after the end of the plan’s fiscal year.

This is separate from the ERISA audit the Department of Labor requires for most employee benefit plans. The ERISA audit can be performed under AICPA standards by a firm that is not PCAOB-registered. Once the plan holds employer securities and files with the SEC, though, the higher PCAOB standard applies to the 11-K. Some sponsors engage different auditors for each engagement; others have their PCAOB-registered firm handle both.

Foreign Issuers

Foreign companies listed on U.S. exchanges are issuers under Sarbanes-Oxley and must use PCAOB-registered auditors just as domestic issuers do. The Holding Foreign Companies Accountable Act adds an enforcement layer on top of that basic requirement. If the PCAOB is unable to inspect a company’s auditor for two consecutive years, the SEC must prohibit trading of the company’s securities on U.S. exchanges and in the over-the-counter market.¹² The original 2020 law set the trigger at three consecutive years; the Consolidated Appropriations Act of 2023 shortened it to two.

Who Does Not Need a PCAOB Audit

Plenty of companies raise money through SEC channels without needing a PCAOB audit. Private companies that do not file Exchange Act reports use GAAS-compliant audits performed under AICPA standards. Companies raising money under Regulation A or Regulation A+ get similar treatment: their auditors do not need to be PCAOB-registered, and the audits may follow either GAAS or PCAOB standards, unless the company simultaneously lists its securities on a national exchange. Companies using Regulation Crowdfunding or Regulation D private placements also fall outside the PCAOB requirement.

The line is straightforward. File periodic reports under Section 13 or 15(d) of the Exchange Act, or register securities under Section 12, and you need a PCAOB audit. Stay outside those channels and you almost certainly don’t.

What Happens If the Requirement Is Ignored

The SEC can reject financial filings that lack a proper PCAOB audit, which for a public company effectively freezes its ability to raise capital or complete transactions that need SEC approval. For the accounting firm, the SEC can censure the firm, permanently bar it and its partners from practicing before the Commission, and impose substantial civil penalties. In a 2024 enforcement action, the SEC barred a firm and its owner from SEC practice and imposed civil penalties of $12 million on the firm and $2 million on the individual partner for systemic failures to comply with PCAOB standards across hundreds of audits.¹³

Exchanges enforce the rule as well. Nasdaq requires companies to maintain audits by a PCAOB-registered firm as a condition of continued listing, and a company that loses its auditor or cannot obtain a compliant audit opinion faces potential delisting. Officers and directors who sign off on materially deficient financial statements can face personal liability under the Exchange Act’s anti-fraud provisions.

1
Office of the Law Revision Counsel. 15 U.S. Code 7201 – Definitions
2
Office of the Law Revision Counsel. 15 U.S. Code 7212 – Registration With the Board
3
Public Company Accounting Oversight Board (PCAOB). Auditing Standards
4
U.S. Securities and Exchange Commission. Accelerated Filer and Large Accelerated Filer Definitions
5
U.S. Securities and Exchange Commission. Emerging Growth Companies
6
U.S. Securities and Exchange Commission. Financial Reporting Manual – Topic 10 – Emerging Growth Companies
7
U.S. Securities and Exchange Commission. Broker-Dealer Reports
8
eCFR. 17 CFR 240.17a-5 – Reports To Be Made by Certain Brokers and Dealers
9
U.S. Securities and Exchange Commission. Final Rule – Strengthening the Commission’s Requirements Regarding Auditor Independence
10
U.S. Securities and Exchange Commission. Special Purpose Acquisition Companies, Shell Companies, and Projections
11
eCFR. 17 CFR 249.311
12
U.S. Securities and Exchange Commission. Holding Foreign Companies Accountable Act
13
U.S. Securities and Exchange Commission. Order Instituting Public Administrative and Cease-and-Desist Proceedings – BF Borgers CPA PC