Audit Deficiencies Fell to 23%. The Data Auditors Test Is Still the Weak Spot.

This month the audit profession's regulator had good news to share. Inspectors found far fewer audits where the auditor lacked enough evidence to support its opinion, and the largest firms cut their deficiency rate by more than half. It would be tempting for a finance team to treat that as someone else's win. It is not. The deficiencies that persist sit in exactly the places auditors lean on the company: the system reports, the spreadsheets behind an estimate and the data extracts handed over at year-end. As audit firms tighten their own testing, those are the artifacts that get pulled apart first.

The Inspection Numbers Moved Sharply in One Year

The PCAOB's Division of Registration and Inspections inspected 143 registered firms and reviewed portions of 780 public company audits in 2025. As the Journal of Accountancy reported, the Part I.A deficiency rate, which flags audits where the firm failed to obtain sufficient appropriate evidence for its opinion, fell from 38% in 2024 to 23% in 2025. U.S. global network firms dropped from 26% to 13%. U.S. firms with more than 100 issuer clients fell from 52% to 18%, and those with 100 or fewer fell from 53% to 32%.

The Big Four, which audit roughly 80% of the market capitalization of U.S.-listed companies, cut their combined rate to 8% from 20%, CFO Dive noted. PCAOB Chair Demetrios Logothetis said the Board is "working to identify the factors that produced these results." Not every group improved. Non-U.S. global network firms rose from 24% to 26%, and non-U.S. nonaffiliated firms, though better, still came in at 58%.

Where the Remaining Deficiencies Cluster

The firm-level inspection reports show what is left. According to Thomson Reuters' breakdown, Deloitte and EY each came in at 5%, PwC at 9% and KPMG at 13%. Grant Thornton was at 33% and BDO at 34%, both improved but still above 30%. Revenue and related accounts was the most frequently reviewed area across the Big Four, and both Grant Thornton and BDO had four revenue deficiencies in 21 audits.

The pattern that matters for finance teams is in the type of failure. At both Grant Thornton and BDO, the most common deficiencies involved testing data or reports used in substantive testing and testing an estimate. In plain terms, an auditor relied on a report the company produced, or on the inputs behind a judgment such as a reserve or accrual, without proving that the underlying information was complete and accurate. EY's Joe Link credited his firm's improvement to investments in technology, data analytics and people. The direction of travel is clear: better audits mean more scrutiny of where a company's numbers come from.

That scrutiny lands on processes many companies still run by hand. A Sixthfin survey conducted by Odoxa of 303 CFOs at UK companies with 250 or more employees found 67% use Excel for account analysis and reconciliation. Spreadsheets remain the main tool for accruals at 57% of companies, for manual journal entries at 54% and for managing the close calendar at 53%. More than one in three CFOs were not highly confident in their own figures. Accruals are estimates, and a spreadsheet with no version history is precisely the kind of evidence an inspector expects an auditor to challenge.

The Oversight Rules Are Changing on December 15

The inspection results arrive as the profession's own quality control rules are being rewritten. Deloitte's summary of the PCAOB staff update notes that inspectors expect to place greater emphasis on evaluating firms' quality control systems as QC 1000 takes effect on December 15, 2026. The PCAOB has already amended that standard, and CFO Dive reported on October 19 that all four of the largest firms have urged the SEC to approve the changes, which drop the External QC Function requirement for firms that published more than 100 audits in the prior year. PwC wrote that the changes "do not diminish investor protection."

Investors disagree. Sandra Peters of CFA Institute called the external function "the single clearest structural safeguard investors have," and the Council of Institutional Investors asked the SEC to consider whether the standards should be rejected. Whichever way that goes, a CFO should not plan on outside oversight to catch weak evidence. The fewer independent layers sit between an audit firm and the inspector, the more the quality of the audit depends on the quality of what the company hands over.

The Playbook for Audit-Ready Data

• Inventory the reports your auditor relies on: List every system report and data extract used in substantive testing, name an owner for each and document how completeness and accuracy are checked before it leaves finance.
• Put estimates on a controlled model: Reserves, accruals and allowances should run from a versioned model with documented inputs and assumptions, not a personal spreadsheet rebuilt every quarter.
• Reconcile continuously, not at year-end: Monthly account reconciliations with retained evidence turn the audit request list into a retrieval task instead of a reconstruction project.
• Treat tax data as audit evidence: Tax calculations across jurisdictions feed provisions and disclosures. Automated, consistent calculation gives auditors a cleaner trail than manual workbooks do.
• Brief the audit committee on revenue evidence: Revenue remains the most inspected area. Show the committee how contract, billing and cash data tie together before the auditor asks the same question.
• Ask your auditor about QC 1000 now: Before December 15, find out how the firm's new quality control system changes its requests to you, including any added testing of company-produced information.