Q3 2026 Audit Committee Agenda

This newsletter includes a comprehensive overview of current business issues, risk considerations, and recent regulatory developments to keep audit committees in the know. 

Contents

Leading Practice Guidance for Audit Committees
Practical Tools for Audit Committees
SEC Update
PCAOB Update
Resources

Leading Practice Guidance for Audit Committees

Enterprise Risk Management: Driving Performance & Resilience

In today's volatile and interconnected environment, organizations need an ERM approach that goes beyond static risk assessments and siloed activities. 

BDO's Enterprise Risk Management: An Engine for Achieving Performance eBook explores how leading organizations are building dynamic, enterprise-wide risk capabilities that align risk, resilience, accountability, and decision-making to support strategic objectives and performance.

Key Benefits of an Integrated ERM Approach:

• Aligns risk management with strategy and business performance
• Enhances organizational resilience and preparedness
• Reduces duplication and improves efficiency across risk activities
• Strengthens accountability and risk-informed decision-making
• Provides a coordinated view of risks across the enterprise

Building Trust Through Privacy, AI & Data Governance

As organizations accelerate their use of AI, analytics, and digital platforms, integrated privacy, AI governance, and data governance frameworks are becoming essential for resilience, compliance, and stakeholder trust. BDO’s Global Privacy, AI, and Data Governance for Resilience and Trust eBook provides practical guidance for building operational, measurable governance programs that support innovation while reducing regulatory, reputational, and business risk.

Why Does It Matter?

• AI adoption and digital transformation are increasing data-related risks and regulatory scrutiny.
• Organizations must move beyond policies to operational, measurable governance practices.
• Effective governance enables innovation while reducing compliance, reputational, and business risk.
• Trust is built when legal, technical, and business teams work from a common governance framework.

Key Takeaways:

• Treat data as a strategic asset
• Move to continuous oversight
• Align governance across functions 
• Embed responsible AI practices 
• Prepare for evolving regulation
• Build organizational resilience

Find more in our featured webcast: Director's Guide to AI in Digital Assets: Practical Uses, Safeguards, and Governance

What the 2026 BDO Board Survey Reveals About Technology Readiness & Skillsets

• In 2026 only 35% of board members indicated that management is highly effective at implementing effective change management strategies for integration AI & emerging technology.
• Nearly 1/3 (32%) said in 2025 advancing the use of emerging technology implementation will require the most board time and attention. In 2026, over half (51%) agreed that keeping pace with AI & emerging technology will present the most significant challenge adapting to change in the coming year.
• In 2026, boards believe that for both boards & management teams, technology & innovation are the most critical skillsets needed to enhance the current composition of the board and C-Suite: 49% & 52%, respectively. This has increased/remained consistent from 2025 at 42% & 52%, respectively.
• 57% of boards view the pace of AI & cyber technology capabilities as the factor outside their control that is of greatest concern in the near term. 
• 23% of directors in 2025 somewhat or strongly believed their company was lagging in technological implementation.

Sources: BDO 2026 Public Company Board Survey

The Human Element

According to The Conference Board, over the past five years disclosed independent director qualifications of the Russell 3000 increasingly report skills/experience in governance, technology, cybersecurity, human capital, and international markets. 

Most Important Skillsets and Experiences Needed to Enhance Board Composition

Sources: BDO 2025 Public Company Board Survey & Preview of BDO 2026 Survey Findings

Center for Audit Quality Research Findings

Institutional Investor Survey | AI Use

Key Takeaways:

• AI is mainstream and growing: 68% of investors use AI in research and decision-making, and 83% expect usage to increase.
• Capabilities are still developing: 38% of firms have proprietary AI tools; 54% are developing or planning them.
• Approaches vary: Firms use in-house, third-party, and hybrid strategies, with hybrid most common at 37%.
• Qualitative research leads: AI is primarily used to analyze disclosures and extract metrics, with scenario and projection use expected to grow. Trust requires verification: 54% “trust but verify,” while one-third largely or fully trust AI insights.
• Human oversight remains essential: 60% use AI to support decisions with human review.
• Efficiency is the top benefit: Speed and reduced manual work lead, followed by better identification of patterns, anomalies, and risks.
• Data quality is the primary concern: Reliability remains the biggest barrier to AI adoption.
• AI is improving performance: 67% report better investment performance, driven by stronger decisions, faster analysis, and improved risk assessment.

Strengthening Board Oversight of Special Committee Investigations: Independence, Escalation, & Governance Excellence

As boards face increasing expectations around independence, accountability, and risk oversight, effective governance of special committee investigations requires disciplined processes, clear escalation protocols, and credible investigative independence. 

Key Takeaways:

• Boards face increasing pressure to oversee investigations in a more complex risk environment, driven by whistleblower activity, cyber and privacy incidents, regulatory scrutiny, and stakeholder expectations for transparency and accountability.
• Investigations are no longer viewed as purely reactive exercises. Leading boards are using them as part of broader governance, risk management, and organizational resilience efforts.
• A disciplined escalation and triage process is critical. High-performing boards formalize protocols that distinguish routine compliance matters from issues requiring board or special committee involvement.
• Whistleblower and disclosure processes must balance responsiveness with proportionality. Companies increasingly categorize complaints by risk level and materiality to avoid overreacting while ensuring significant matters receive appropriate oversight.
• Regulators continue to reward credible, independent investigations. The SEC has indicated that companies conducting thorough inquiries and promptly reporting misconduct may receive more favorable treatment.
• "True independence" extends beyond technical compliance requirements. Boards and advisers must be free from financial, professional, personal, or other relationships that could impair objectivity or create the appearance of bias.

Learn more: 

Testing Organizational Readiness for Deepfake Fraud

As AI-powered fraud becomes more sophisticated, organizations must move beyond awareness training and actively test their ability to detect, verify, and respond to deepfake-enabled attacks. Tabletop exercises and red-team simulations help build resilience before a real incident occurs. 

Key Takeaways:

• Deepfake Risk Is Rising
  • AI-generated videos, voice clones, and highly personalized phishing attacks are becoming increasingly difficult to detect.
  • According to Gartner, 62% of organizations have experienced a deepfake attack, yet only 7% believe they are prepared to defend against one.
• Build "Muscle Memory" Through Simulation
  • Tabletop exercises allow teams to discuss response plans, roles, and decision-making processes.
  • Red-team simulations test responses in real time under realistic conditions, helping identify control gaps before attackers do.
• Strengthen Governance & Controls
  • Test verification procedures, escalation protocols, and cross-functional coordination.
  • Include Finance, IT, Legal, Compliance, Operations, and senior leadership in exercises.
  • Use findings to improve policies, controls, and fraud response plans.

For more, check out:

Practical Tools for Audit Committees

Assuming the Audit Committee Chair Role

Guidance for first-time and experienced audit committee chairs:

Audit Committee Self-Assessment

Effective committee evaluations go beyond compliance to sharpen oversight, improve meetings, strengthen accountability, and keep pace with emerging risks such as AI, cybersecurity, privacy, trade, and third-party risk.

BDO’s Audit Committee Self–Assessment will help: 

• Strengthen oversight effectiveness by moving beyond a check-the-box evaluation.
• Clarify committee responsibilities and alignment with the Audit Committee Charter.
• Improve meeting quality, accountability, culture, and leadership.
• Assess readiness for evolving risks, including AI, cybersecurity, privacy, trade, third-party risk, and enterprise risk management.
• Identify oversight gaps across governance, risk, and compliance.
• Translate findings into action through scorecards, documented feedback, and clear improvement plans.

Illustrative Audit Committee Charter

Audit committees are responsible for an expanding range of oversight areas, from financial reporting, internal controls, auditor independence, and compliance with technology, cybersecurity, and emerging disclosure requirements. 

• BDO’s Illustrative Audit Committee Charter reflects relevant stock exchange listing standards, SEC requirements, common governance practices, and our experience working with public and private company audit committees. 
• This practice aid outlines key charter components and provides illustrative guidance that organizations can tailor to their governance framework and documentation.

Establishing a Corporate Governance Structure: Standing Committees of the Board

An effective board and committee structure is essential to sound governance and particularly for IPO readiness. Key standing committees to stand up generally include Audit and Risk, Compensation and Human Capital, and Nominating and Governance.

BDO’s practice aid (below) provides general guidance based on SEC rules, stock exchange listing standards, and other governance resources. Practice aid content is for informational purposes only, and companies should consult applicable requirements, governing documents, legal counsel, and other advisers when assessing committee responsibilities and practices.

Center for Audit Quality: Spring 2026 Audit Partner Pulse Survey

What do you believe are the largest economic risks facing companies in your primary industry sector over the next 12 months?

SEC Update

SEC Regulatory Agenda

• The SEC released its 2026 Regulatory Agenda in July
• Proposed Rules:
  • Semiannual reporting (BDO Bulletin)
  • Enhancement of EGC accommodations and simplification of filer status (BDO Bulletin)
  • Registered offering reform (BDO Bulletin)
  • Recission of climate-related disclosure rules (BDO Bulletin)
  • Regulation crypto assets (BDO Bulletin)
• Upcoming:
  • Executive compensation disclosure reform
  • Shareholder proposal and proxy solicitation modernization
• Other:
  • Regulation S-K
  • FPI eligibility enhancements

Proposal: Regulation Crypto Assets Overview

• Tailored offering framework for certain investment contracts involving crypto assets
• Two exemptions from the registration requirements of the Securities Act
  • Startup exemption – a one-time exemption for offerings of up to $5 million during a four-year period
  • Fundraising exemption – two tiers
    • Tier 1 - up to $75 million during each 12-month period
    • Tier 2 - up to $75 million during a 12-month period
• Conditional safe harbor from the term investment contract in the definitions of a security under the Securities Act and the Exchange Act
• Preemption of state registration and qualification requirements - new definition of “qualified purchaser” under the Securities Act

Proposal: Regulation Crypto Assets Fundraising Exemption

• Issuers relying on the fundraising exemption would conduct their offerings on new Form 1-CRYPTO, which would include:
  • Principle-based narrative disclosures, a discussion of the issuer’s financial condition, and the issuer’s financial statements, prepared in accordance with U.S. GAAP
• Financial statement assurance requirements
  • Tier 2 would require audited annual financial statements (may be audited in accordance with either U.S. GAAS or PCAOB standards)
  • Tier 1 would not require audited financial statements unless the issuer has obtained an audit in accordance with U.S. GAAS or the standards of the PCAOB
  • Interim financial statements would not be subject to any assurance requirements (applies to both Tier 1 and Tier 2 offerings)
• Issuers with a qualified offering statement would be subject to ongoing periodic reporting requirements
  • Annual reports on new Form 1-KC within 120 calendar days of fiscal year-end
  • Semiannual reports on new Form 1-SC within 90 calendar days of the end of the semiannual period
  • Current reports on new Form 1-UC within four business days after the occurrence specified events

Other Activities

• The SEC established a financial reporting and accounting unit within the Division of Enforcement
• Corporation Finance Interpretation (CFI) updates – beneficial ownership, crowdfunding, proxies, tender offers
• Administrative update to the FRM
• Capital markets activity – SEC’s Division of Economic and Risk Analysis (DERA) published updated statistics on the U.S. capital markets
• Increase in IPOs and follow-on offerings and the related proceeds

Tariff and AI Disclosure Observations

The SEC staff has shared observations on tariff and artificial intelligence (AI) disclosures:

• Tariff Disclosures:
  • Different models used to record tariff refunds
    • Loss recovery (when recovery is probable)
    • Gain contingency (when recovery is realized or realizable)
    • Legal claim (when the entity has a valid legal claim)
• Disclosures should address which model the registrant has applied (or will apply) and clearly describe the assumptions used to allow investors to assess judgements and related risks.
• BDO Bulletin: Financial Reporting Considerations for Tariffs
• AI Disclosures:
  • Avoid boilerplate disclosure – risk should be specific to the registrant
  • Disclose any basis for claims made about the impact of AI on operations/financial condition

Reminders on the SEC's Definition of a Business

• The SEC staff has shared guidance on the definition of a business in S-X Rule 11-01(d) (see Topic III.A in the June 2026 SEC Regulations Committee Highlights)
• The definition of a business in S-X Rule 11-01(d) is intended to provide guidelines (not inflexible) 
  • The definition differs from U.S. GAAP – an asset acquisition under U.S. GAAP may meet the SEC’s definition of a business
• Consider whether there is sufficient continuity of the acquired operations such that historical financial information is material to an understanding of future operations
  • Operations that are/were dormant, or will only continue for limited period after acquisition – consider the length, nature, and extent of dormancy or continuity
• License arrangements – entering into a licensing arrangement may represent the acquisition of a business for SEC reporting purposes
  • The SEC staff provided several fact patterns at the 2025 AICPA Conference on Current SEC and PCAOB Developments (see section 1.3.2.3 in BDO’s publication)
• The determination of whether acquired operations meet the SEC’s definition of a business requires consideration of specific facts and circumstances

PCAOB Update

Summary of Select Recent PCAOB Board Activities

• September 2026 - Adopted amendments to certain provisions of QC 1000, A Firm’s System of Quality Control, and related amendments to PCAOB forms and the QC reporting rule.
• August 2026 – Released Inspection Modernization Council discussion materials. 
• July 2026 – Requested public comments to advance the PCAOB’s Strategic Draft 2026-2030 Goals and Objectives. Comments were due by September 4, 2026.
• June 2026 – Launched audit firm consultation process allowing firms to submit questions directly to the PCAOB’s Office of the Chief Auditor (OCA) and receive informal staff views regarding implementation of new standards and application of existing standards regarding to auditing, attestation, quality control, ethics and independence standards and related rules and forms.
• June 2026 – Requested public comments on PCAOB Standard Setting. Comments were due August 7, 2026. 
• June 2026 – Issued a supplemental release for Proposed Amendments to QC 1000, A Firm’s System of Quality Control. Public comments were due on July 9, 2026.
• May 2026 – Established new Inspections Modernization Council, an advisory body comprised of participants with capital market expertise and knowledge of the PCAOB’s inspection program to share perspectives on how to continue to evolve and enhance the inspection process. Members were announced in July. 
• April 2026 – Released Spotlight publication on the perspectives from 2025 Conversations with Audit Committee Chairs.
• April 2026 – Released 2025 Annual Report. 
• March 2026 – Announced new Audit Practitioner Fellowship Program to bring experienced auditors with recent practical experience to the OCA for two-year terms to engage with the PCAOB staff on the PCAOB’s new and existing standards, as well as providing insights into emerging issues. The first application period closed on May 15, 2026. 

PCAOB Advances Strategic Planning Process With Request for Comment on Draft 2026-2030 Goals and Objectives

July 2026 – PCAOB requested public comments to advance the PCAOB’s Strategic Draft 2026-2030 Goals and Objectives. Comments were due by 9/4/2026.

PCAOB priorities: 

• Advance audit quality and investor protection
• Clarify expectations and our bases for decisions leading to understandable outcomes
• Transform how oversight is delivered

PCAOB Goals: 

• Goal 1: Modernize Standard Setting and Implementation
• Goal 2: Modernize the Inspections and Registration Program
• Goal 3: Sharpen Enforcement focus on Conduct Harmful to Investors
• Goal 4: Deepen Stakeholder Engagement and Communication
• Goal 5: Modernize Oversight Through Technology and Data
• Goal 6: Strengthen Organizational Effectiveness and Stewardship

PCAOB Requested Public Comment on Standard Setting

• June 2026 – Following its March request for public component on its strategic priorities, the PCAOB further requested public comments on Standard Setting through several series of questions pertaining to:
  1. Updating the PCAOB’s standard-setting and research agendas*, 
  2. Revisiting the PCAOB’s approach to standard setting, and 
  3. Considering the impact of the recent proposal by the SEC regarding semiannual reporting.  
     *Potential focus areas included: Data and technology; fraud; critical audit matters; noncompliance with laws and regulations; firm and engagement performance metrics; and auditor independence.
• The request is designed to promote transparency and help ensure the PCAOB’s standard-setting and research priorities take into account stakeholder views and views about the need for, priority of, and potential scope. 
• Comments were due on August 7, 2026. 

Introduction of Inspections Modernization Council

• The PCAOB selected outside experts to serve on a new advisory body: the Inspections Modernization Council (IMC).  
• The IMC is a resource group composed of outside parties with a stake in the PCAOB’s inspection activities. The IMC’s objective is to provide the PCAOB Chairman, Board, and/or PCAOB staff with the views of IMC members on the PCAOB’s inspection activities, including:  
  • Serving as a source of knowledge, experience, perspectives, and recommendations regarding the PCAOB’s inspection oversight activities, including potential modernizing changes to the inspection program; and  
  • Providing the PCAOB with IMC members’ perspectives on current and developing technologies, as they may be applied to or used in connection with the PCAOB’s inspection oversight activities. 
• Application and other information can be found on the Inspections Modernization Council page. Applications were accepted through June 15, 2026.
• Materials released in August 2026: 
  • Presentation: Modernizing PCAOB Inspections (PDF)
  • Illustrative Example: Modernized Inspection Report (PDF)
  • Discussion Draft: Staff Guidelines for Developing a Satisfactory Remediation Plan (PDF)
  • Analysis: Satisfactory and Unsatisfactory Remediation Determinations
    
    

“Modernization of PCAOB inspections has the potential to bring improved audit quality and other significant benefits to investors and other stakeholders. The Inspections Modernization Council will help us shape the future of PCAOB inspections, and we invite individuals of the highest integrity to join us in this effort.”

- PCAOB Chairman Demetrios (Jim) Logothetis

PCAOB Staff Launches Firm Consultation Process to Enhance Clarity and to Support Application and Implementation of PCAOB Standards

The PCAOB’s new Firm Consultation Process gives registered firms direct access to staff guidance on interpreting and applying PCAOB standards and requirements. 

• The new process will:
  • Allow registered firms to request a consultation with the Office of the Chief Auditor (OCA) on the interpretation and application of PCAOB auditing, attestation, and quality control standards and related rules and forms as well as PCAOB standards and rules on ethics and independence.
  • Require requests for consultation to be submitted by completing the Consultation Intake Form available within a new PCAOB Registered Firm Consultation Portal. 
• Caveats: 
  • While the PCAOB does not currently intend to make consultation requests and responses public, firms should note that their submissions, including supporting materials, likely are not subject to confidentiality protections under the Sarbanes-Oxley Act.
  • OCA’s responses to consultation requests are not rules, standards, or statements of the Board, and the Board has neither approved nor disapproved the staff’s responses or interpretations. 
  • Due to their informal nature, these responses are not necessarily binding on OCA, the Division of Registration and Inspections, the Division of Enforcement and Investigations, the Board, or the Securities and Exchange Commission and its staff. OCA’s responses do not constitute legal advice, for which firms should consult with their own attorneys.

PCAOB Leadership Changes

• George G. Demos was appointed Director of the PCAOB’s Division of Enforcement and Investigations
• Barbara Vanich announced departure as PCAOB Chief Auditor
• Dr. Ying Li Compton was appointed PCAOB Chief Economist and Director of the Office of Economic and Risk Analysis
• George Kostolampros was appointed PCAOB General Counsel
• Kyle S. Hauptman was confirmed as a PCAOB Board Member

PCAOB Inspection Process for Issuer Audits

The PCAOB conducts inspections:

• Annually for firms auditing >100 issuers
• At least every 3 years for firms auditing 100 or fewer issuers 

The PCAOB selects audits using both risk-based and random methods with no firm influence and generally focus attention on audit areas believed to be of greater complexity, greater significance, or with a heightened risk of material misstatement to the issuer’s financial statements, and areas of recurring deficiencies. This review includes nonfinancial areas such as auditor independence.

The PCAOB inspection team reviews work and potential deficiencies, issues comment forms for observed deficiencies, evaluates responses/remediation by the audit firm, and reports inspection results publicly comprised of:

• Part I.A – Failure to obtain sufficient and appropriate audit evidence to support the audit opinion
• Part I.B – Non-compliance with other PCAOB standards/rules issues
• Part I.C – Non-compliance with independence rules under PCAOB, SEC and related rules
• Part II – Criticisms of, or potential defects in, the firm’s system of quality control