Subscribe
Share
Share
Embed
Standards aren't just boxes to check. This show digs into the audit, accounting, and tax rules that shape the profession and what they actually mean when you're the one applying them.
Attention: This is a machine-generated transcript. As such, there may be spelling, grammar, and accuracy errors throughout. Thank you for your understanding!
Meredith Mednick, CPA, CA: [00:00:00] It's a Tuesday afternoon, and Priya Nakamura, the director of quality at Clearview Auto Group, is looking at an email she's reread three times now. A colleague on a monitoring review just flagged something on an engagement that was wrapped up eight months ago. The report's been issued. The client's been relying on it ever since. Filed it with a lender. Referenced it in a proxy statement. The whole shebang and the monitoring review found a gap. Not a catastrophic one, but a real one. A place where the evidence on file doesn't clearly support a conclusion. The team reached about a significant estimate. Priya's first thought isn't how bad is this? It's what do we actually have to do now? The report already went out the door. The client's already using it. You can't unring that bell. That question what a firm is required to do the moment a completed, issued engagement turns out to have a problem. Used to live in a fairly thin, narrow piece of PCAOB guidance that most people never thought about until the day they needed it. As of December 15th, 2026, it lives somewhere much more deliberate. A new standard called A s 2901 responding to engagement deficiencies after issuance of the auditor's report. We're going to spend this episode inside that standard where it came from, what it actually requires, and where firms are already tripping over it in practice. And by the end, we'll come back to Priya's inbox and walk through exactly what she needs to do next.
Meredith Mednick, CPA, CA: [00:01:44] Welcome to Standard Practice, the show that digs into audit, accounting and tax rules that shape the profession and what they actually mean when you're the one applying them. I'm your host, Meredith Mednick, CPA, and today we're tackling a standard that isn't getting nearly the attention its companion is getting, but one that firms are going to feel just as directly and arguably sooner. One quick note before we continue this episode was built to work. Whether or not you caught the episode on QC 1000, a firm's system of quality control. If you did, you'll recognize some of the connective tissue, and that's a payoff for you later in the episode. If you didn't, don't worry, it's not a prerequisite. Everything you need to follow along today. I'm going to give you in the next few minutes. With that being said, I do encourage you to listen to that episode next if you haven't already. By the end of this episode, I want you to be able to explain what a s 2901 requires. Where it came from and how it differs from the guidance it replaces. Apply the standards threshold test for whether a firm is even has an obligation to act. Distinguish the two response paths the standard creates depending on what kind of deficiency was found. Identify as 2900 ones. Documentation requirements and how they differ from ordinary engagement documentation.
Meredith Mednick, CPA, CA: [00:03:08] Explain how, as 2901 intersects with as 2905, and how it applies differently to Icfr engagements and recognize the practical missteps firms are already running into as they build out their response process. Let's start with the piece you actually need. What the standard is, where it came from, and why it exists now. Here's the plain language version. No prior context required. As 2901 is a new PCAOB auditing standard, it becomes effective December 15th, 2026 for audits of financial statements and of internal controls over financial reporting. And it answers one specific question when a firm discovers a problem with an audit after the report has already been issued, what is the firm obligated to do about it? That question isn't new. The PCAOB has had guidance on this for a long time, under a name that tells you exactly how narrow it used to be. Consideration of omitted procedures after the report date. Sit with that name for a second. Omitted procedures. The old guidance was built around one specific scenario. The auditor realizes after the fact that a procedure that should have been performed simply wasn't. Somebody forgot to send a confirmation. Somebody skipped a step in the walkthrough. That's the world. The old guidance lives in. The new. As 2901 widens the lens considerably. And this is worth understanding as a real regulatory shift, not a rename. It's not limited to omitted procedures anymore. It applies to engagement deficiencies broadly, a term the standard defines to include the omitted procedure scenario, but also documentation gaps.
Meredith Mednick, CPA, CA: [00:04:55] Judgment errors. Insufficient evidence to support a conclusion. And other shortfalls identified after issuance. Regardless of how the firm found out about them. A monitoring review, a PCAOB inspection, an internal quality review, a whistleblower tip, even something the engagement team itself notices on a later, unrelated engagement. The source doesn't change the obligation. If a deficiency is identified, the standard applies. If you listen to the QC 1000 episode, you'll remember we had our fictitious audit firm, Clearview Audit Group, for a firm like Clearview. This means the trigger isn't. Did we skip a step? It's. Did we identify anything from any source that calls a completed engagement into question? That's a meaningfully bigger net than the old guidance ever cast. Why now, though? Why? Why didn't this specific piece of guidance at this specific moment? The honest answer is that it didn't happen in isolation, as 2901 was adopted as part of a bundle of standards, the PCAOB rolled out together. All pointed at the same underlying idea. Audit quality problems shouldn't just get caught. They should get responded to consistently and traceably. No matter where in the firm, the catch happens, you'll see a S 1220 on engagement quality review in that same bundle as 1215 on audit documentation as 1310 on notification of auditor termination and a rewritten ethics standard. Ai 1000 replacing the old E two 102.
Meredith Mednick, CPA, CA: [00:06:35] All of them landing around the same December 2026 effective date. They reinforce each other, but as 2901 stand on its own as a binding requirement. And that's where we're spending our time today, here's the connective tissue for those of you who caught the QC 1000 episode and the one sentence version for everyone else. Qc 1000 requires firms to build a system that actively monitors for quality risks and catches problems before they compound. As 2901 is the rule book for what happens, the moment that system or genuinely any other source actually catches one. Quality control finds the deficiency as 2901 governs the response to that deficiency. That's the entire relationship between the standards, and it's all you need to carry forward, even if you've never heard of QC 1000 before this sentence. There's a subtler point buried in that relationship, too, and it's worth flagging even briefly. A firm can have a beautifully designed QC 1000 monitoring system and still fail on the back end if it doesn't have a disciplined As 2901 response process. Catching a problem and doing something meaningful about it are two different muscles. The PCAOB clearly decided both needed their own standard, rather than trusting one to imply the other. Let's stay with that bundle for a moment, because a little bit of context on what else landed alongside as 2901 helps explain why the PCAOB reached for a broader standard here, rather than a smaller tweak to the old omitted procedures guidance.
Meredith Mednick, CPA, CA: [00:08:13] As 1220 rewrites the requirements around engagement quality review tightening what a reviewer has to consider about the competence, independence and objectivity of the people doing that review and tying it explicitly back into the QC 1000 framework as 1215 updates audit documentation requirements more generally, which matters here because a chunk of what makes an A s 2901 response defensible is exactly how well the deficiency and the firm's reaction to it get documented. We'll touch on that in a few minutes, as 1310 addresses notification when an auditor issuer relationship ends. Closing a gap where a change in auditor could otherwise create ambiguity about who's responsible for what. And AI 1000 replaces the old ethics standard with language that speaks the same vocabulary as QC 1000 integrity and objectivity requirements that plug directly into a firm's quality control system, rather than sitting off to the side as a separate compliance exercise put together. The picture is a regulator that decided audit quality couldn't be governed by one standard in isolation. It needs a connected set of rules covering how firms build quality systems, how they review engagements, how they document work, how they handle a change in auditor, how they think about ethics. And with as 2901, how they respond when something slips through anyway. That's a meaningfully more architected approach than what existed before. And it's worth firms treating implementation the same way as one coordinated project, not six separate memos before a firm does anything else under as 2901.
Meredith Mednick, CPA, CA: [00:10:00] The standard asks one gating question, and it's worth sitting with because it's genuinely a judgment call, not a checkbox. The standard applies whenever a deficiency is identified on a completed engagement, unless it's probable that the auditor's report is no longer being relied upon. Listen to that carefully and read that standard carefully, because the exception is narrow by design. It's not. The client hasn't mentioned the report lately. It's not. The report is a year old. It's not even the client has since had a new audit done for a later period. The bar is that reliance has to be improbable, meaning there's a real evidentiary reason to believe nobody could reasonably still be leaning on that specific report. Let's go back to clear view. Picture two of their clients. One dissolved 18 months ago, deregistered its securities and there's no trading market for them anymore. Reliance on that old report is genuinely improbable. The other client is still a going concern, still filing with the SEC. And that same report from two years ago is sitting in the most recent 10-K by incorporation by reference. For that second client, reliance is alive and well, and the obligation absolutely applies no matter how old the report feels internally. The standard actually gives firms a shortcut for the harder cases, which is worth knowing because it removes a lot of the guesswork.
Meredith Mednick, CPA, CA: [00:11:30] If the auditor's report, directly or by reference, shows up in the client's most recent SEC filing, that requires when the inclusion itself is treated as evidence, the report is still being relied on. In other words, the default assumption runs in the favor of yes, this still matters, and firms need a genuinely good documented reason to conclude otherwise. Cessation of a trading market is the example the standard itself points to as a circumstance where reliance might reasonably be considered improbable. Short of something like that a bankruptcy liquidation, a full deregistration, an entity that simply cease to exist. The working assumption should be that the obligation is live. This matters practically because it's the first decision point, and it's tempting, understandably so, from a workload and reputational risk standpoint, for a firm to want to talk itself into. Probably nobody still looking at this as 2901 is written to resist that temptation directly. The default six on the side of the obligation applies, and the burden sits with the firm to affirmatively demonstrate otherwise with real evidence, not just a hunch. There's also a timing dimension worth mentioning here. This isn't a determination a firm makes once and forgets if clear view concludes. Reliance is improbable today. But six months from now, that same client refiles something that incorporates the old report by reference. The calculus can flip. Quality functions that treat this as a one time gate, rather than something to revisit, are setting themselves up for a gap.
Meredith Mednick, CPA, CA: [00:13:12] So deficiency identified reliance, not improbable. The obligation kicks in. Now the standard splits into two very different paths depending on what the deficiency actually is. And this is where the real substance of as 2901 lives. There are two response paths. This is the heart of the standard, and it's worth understanding upfront that these two paths aren't just different in degree. They're different in kind. They trigger different obligations. And in practice, they get decided by different people inside a firm. Path one. The deficiency means the opinion wasn't properly supported. This is a serious branch. If the deficiency is such that the auditor did not obtain sufficient appropriate audit evidence to support the opinion that was issued, the standard requires the auditor to perform additional procedures to the extent that's still possible, to obtain that evidence until the opinion actually is supported by sufficient appropriate audit evidence. Notice the phrase to the extent necessary. The standard isn't asking firms to re-audit the entire engagement from scratch. It's asking them to close the specific evidentiary gap that was identified, which could be narrow, focused on one account or one assertion, or could turn out to be broader once the team starts digging, which is its own risk worth planning for. And if closing that gap isn't possible, if the additional evidence genuinely can't be obtained anymore. Let's say the records have been destroyed.
Meredith Mednick, CPA, CA: [00:14:52] The client changed systems, key personnel are no longer there. Or if the evidence is obtained and it simply doesn't support the original opinion, then the auditor has to take action to prevent further reliance on that report. As 2901 doesn't invent new mechanics for that part. It points directly to As 2905 subsequent discovery of facts existing at the date of the auditor's report, which lays out exactly how an auditor withdraws support from a report that's already out in the world, notifying the client, notifying the regulators where required and in the most serious cases, taking steps to prevent further reliance entirely. We're not going to fully unpack as 2905 today, but the important thing to know is that as 2901 is what gets affirmed to that door, and as 2905 is what's on the other side of it. Let's jump back to Priya's email. If the monitoring review had found something that meant the original opinion wasn't fully supported, let's say evidence that a significant estimate was accepted without the substantive testing the file claims to have occurred. Clear view would be looking squarely at path one. Go get more evidence. Or if that's not achievable, start the As 2905 process. That's the expensive high visibility branch, and it's the one that tends to involve the firm's general counsel fairly quickly. We mentioned two paths. Let's move on to path two. The deficiency doesn't affect whether the opinion was supported.
Meredith Mednick, CPA, CA: [00:16:30] This is the branch most engagement deficiencies probably fall into in practice. And it's also the vaguer one, which is exactly why it's worth spending some time here, because vague is usually where firms get into trouble. Here, the auditor's opinion still holds up. The evidence obtained genuinely does support it. However, something about the engagement fell short anyway. Perhaps documentation wasn't as complete as it should have been. Maybe a judgment was reached without the rigor of the firm's own methodology calls for. Even though the ultimate conclusion happened to be correct, it could be that a required communication with the audit Committee wasn't documented as clearly as it should have been. The standard requires the firm to take appropriate corrective or preventative action calibrated to the nature and severity of the issue. That phrase, appropriate corrective or preventative action, is doing a lot of work, and it's deliberately not a checklist. It could mean additional training targeted at the specific gap. It could mean a methodology update. If the deficiency reveals something systemic rather than isolated, it could be a direct conversation with the engagement team about how a conclusion was reached separate from any formal remediation. Perhaps it can mean all three layered together the standard trust firms to scale their response to what actually went wrong. Rather than prescribing one remediation recipe for each situation, which is a meaningful design choice and one that puts real weight on a firm's judgment rather than its paperwork.
Meredith Mednick, CPA, CA: [00:18:10] This is where the Clearview story gets interesting, and where firms are already finding real friction in practice. Because appropriate is exactly the word two reasonable people can disagree about. Picture this the engagement partner on the file in question sits down with Priya and makes the case that this is really just a documentation issue. The work was done. The conclusion was right. The file just doesn't tell the story as clearly as it should have. He's not being defensive for the sake of it. He genuinely believes the audit was sound. Priya's read is different if the file doesn't support the conclusion clearly enough for a monitoring reviewer to see it. That's not a footnote problem. That's a how did we actually get to this conclusion in the first place? Problem. And the fact that it turns out fine doesn't mean the process that got them there was neither of them is being unreasonable. That's precisely the tension. As 2901 is built to force into the open, rather than letting it stay buried in an engagement team's private confidence that everything was actually fine. And notice something important here. The standard doesn't resolve that tension for firms. It doesn't tell Priya she's right or the partner's right. It just requires that something appropriate happen, which means the quality of a firm's internal culture. And whether people like Priya have the standing to push back on people like an engagement partner matters enormously to whether this requirement gets satisfied in substance or just on paper.
Meredith Mednick, CPA, CA: [00:19:42] There's one more dimension to this scene worth drawing out, because it's the part that tends to determine whether a firm's response actually lands. Priya doesn't have a unilateral authority to override the engagement partner's judgment just because she disagrees with it. And as 2901 doesn't ask her to, what the standard does, does ask is that the disagreement itself gets resolved through a real process rather than through whoever has more seniority in the room. At Clearview, that means looping in a second partner not involved in the original engagement. Someone who can look at the file with fresh eyes and weigh in on whether the conclusion was reached with appropriate rigor, independent of whether it happened to be right. That extra step bringing in someone without a stake in the original outcome is exactly the kind of structural safeguard that turns appropriate corrective action from a phrase on paper into something firms can actually point to and defend. There's a piece of as 2901 that's easy to skip past if you're only focused on the two response paths. And it's this. The standard doesn't just require firms to do something in response to a deficiency, it requires firms to document that they did it and to document it in a specific way. This matters because it closes a loop that used to be genuinely loose.
Meredith Mednick, CPA, CA: [00:21:06] Under the old omitted procedures guidance, a firm's response to a discovered gap could live almost entirely in institutional memory. A conversation happened. Someone decided it was fine. And if you asked six months later exactly what was considered and why, you might get a shrug. As 2901 doesn't allow for that, the documentation needs to capture what the deficiency actually was, what evaluation the firm performed to reach its threshold. Determination. Recall that reliance question. And what action was ultimately taken, whether that's additional evidence gathering under path one or corrective action under path two for clear view. This means Priya's eventual memo on this engagement needs to stand on its own. Not. We talked about it and agreed it was fine. It needs a documented trail showing the deficiency, the reliance analysis, the path determination, and the specific action taken in enough detail that an inspector reading it two years from now can follow the reasoning without having been in the room. This is also where the standard quietly raises the stakes on quality functions. In general. A director of quality now needs to think like a documentarian as much as an evaluator, because an inspector or a monitoring reviewer isn't just going to ask, did the firm respond appropriately? They're going to ask, can the firm show its work? Those are related questions, but they're not the same question. And firms that are strong on the first and weak on the second are going to find that out at the worst possible time.
Meredith Mednick, CPA, CA: [00:22:44] There's one more layer worth knowing, and it's the kind of detail that separates a firm that's read the standard from one that's actually implemented it as 2901 applies to internal control over financial reporting engagements, to not just financial statement audits. And icfr creates a specific complication that doesn't come up on the financial statement side. In the same way, when a deficiency is identified on an icfr engagement. The natural response. Let's go get more evidence runs into a timing problem that's almost always physical in nature. Evaluating the design and operating effectiveness of a control is inherently tied to a specific period. You're testing whether a control operated effectively during that window. If it's deficiency surfaces well after the report date, the window during which that controls design and operating effectiveness could actually be evaluated has already often closed. You can't go back in time and retest whether a control operated effectively last March. If it's now well into the following year, and the underlying process has since changed, the personnel running it may have turned over or the system itself has been replaced. If Clearview's deficiency had turned up on the ihc-fr side rather than the financial statement side, go get more evidence might not even be a live option anymore. The evaluation period has passed and the control environment has moved on. The firm's remediation approach has to be genuinely rethought for that reality, not just applied on autopilot from the financial statement playbook, which assumes a kind of evidence gathering flexibility that I see for work doesn't always allow for.
Meredith Mednick, CPA, CA: [00:24:32] This is a genuinely underappreciated wrinkle, and it's one more reason firms need people who understand both What the standard says and how audit evidence actually behaves in practice, including its limits, rather than treating as. 2901 as a purely procedural checklist that applies identically across every engagement type. One more scope note before we get to implementation. And this one's easy to miss if you only think about as 2901 in terms of large public company audits, the standards reach extends into the broker dealer attestation world two through related amendments to the PCAOB attestation standards covering examination and review engagements for broker dealers. If you're a firm that does compliance examinations or exemption report reviews for broker dealers, the same underlying logic applies. A deficiency identified after the attestation report has been issued triggers the same kind of threshold question about continued reliance and the same basic obligation to respond appropriately. This matters for a firm like Clearview, because broker dealer work often sits with a different team than the issuer audit practice, sometimes with less day to day exposure to PCAOB standard setting. Generally, it's worth firms explicitly confirming that whoever runs their broker dealer attestation practice knows this obligation extends to them, too, rather than assuming, as 2901 is purely an issuer audit concern.
Meredith Mednick, CPA, CA: [00:26:06] A standard with auditor's report in the title can read at a glance like it's only about financial statement audits, and that's exactly the kind of assumption that creates a gap in implementation. As I mentioned earlier, the standard isn't effective until December 15th, 2026, but firms are starting to implement it now ahead of that date, and a few patterns are already showing up in practice. This is worth knowing before you're the one designing the response process, rather than finding out the hard way once it's live. When a deficiency surfaces and a firm reaches for corrective action, the instinct is often to schedule training that makes sense on its face. Training feels like tangible, demonstrable action, but a recurring finding in practice is that the training firms initially select tends to skew accounting focused, reinforcing gap or gas concepts in general. When the actual gap identified by the PCAOB or the monitoring review was audit related. How evidence was gathered, how a judgment was documented in real time, how a risk was assessed and challenged. Generic training addresses the wrong layer entirely. It feels like action, and it can even look good on a remediation log without actually closing the specific gap that was found, which means the same deficiency or something close to it can resurface on the next engagement. Here's another one. The internal defense reflex. This is the more human one, and honestly, the harder one to engineer around with policy alone.
Meredith Mednick, CPA, CA: [00:27:43] When an engagement team's work gets flagged, especially in an inspection context, the instinct to defend the original work is completely understandable. Nobody wants to hear that something they signed off on eight months ago has a hole in it, and there's a real professional identity wrapped in that reaction. But as 2901 is built on the premise that if an issue makes it far enough to be identified and reported, the engagement team's private confidence that everything was fine isn't going to be the final word. Firms that build a defensive culture around these conversations, where the reflex is to explain away rather than investigate, tend to produce weaker remediation, slower documentation, and a quality function that has to fight for every inch of ground. Firms that build a genuinely investigative culture where a flag deficiency is treated as useful information rather than an accusation, tend to move through the process faster and with better outcomes on both sides. Another one is treating a documentation issue as a stopping point. We touched on this with Priya in her engagement partner earlier. It's just documentation is sometimes true. Sometimes the work really was sound and the file genuinely just needs better articulation. But as 2900 one's whole design assumes, firms will interrogate that claim rather than accept it at face value. Because a documentation gap and a conclusion gap can look identical from the outside until someone actually digs into digs in, into the underlying reasoning.
Meredith Mednick, CPA, CA: [00:29:21] A firm that just reflexively categorizes every flagged item as just documentation is a firm that's quietly under remediating. Even if every individual call feels defensible in isolation, Under-resourcing the reliance analysis. This one's newer and less discussed, but worth naming because the reliance threshold we discussed defaults to word, the obligation applies. Some firms are discovering that they need a more formal, more frequently run process for tracking, which old reports are still being incorporated by reference into current filings, rather than relying on institutional memory or an engagement partner's recollection. That's a genuinely new operational lift for firms that haven't had to track this systematically before. Another thing is treating the two path decision as a one person call, because the difference between path one and path two turns on a genuinely technical judgment. Did this affect the sufficiency of evidence supporting the opinion, or didn't it? Firms that let a single engagement partner make the call unilaterally, without the kind of second partner review Priya used at Clearview You are exposing themselves to exactly the kind of inconsistency the PCAOB is going to be looking for on inspection. The judgment might be right every time, but a firm can't demonstrate that it's reliably right without some structure around who makes the call and how it gets reviewed. None of these are standard setting failures. They're implementation failures, and they're exactly the kind of thing a firm can get ahead of before December 2026, rather than discovering the hard way mid inspection with a deficiency response that doesn't hold up to scrutiny.
Meredith Mednick, CPA, CA: [00:31:09] Before we head back to Priya, let's pull the whole standard together in one place because we've covered a lot of ground. As 2901 replaces the old narrow omitted procedures guidance with a broader requirement covering any engagement deficiency identified after a report is issued, regardless of the source it applies unless it's probable the report is no longer being relied on And that exception is meant to be narrow with the default running toward the obligation applies. Once triggered, the standard splits into two paths. If the deficiency means the opinion wasn't properly supported, the firm has to go get more evidence. Or, failing that, move towards As 2905 and prevent further reliance. If the opinion still holds up, the firm owes appropriate corrective or preventative action scaled to what exactly went wrong. Whichever path applies, the firm has to document the deficiency. The reliance analysis and the action, taken in enough detail to stand on its own is for engagements at a wrinkle, because the evaluation window for a control's effectiveness can close before a deficiency even surfaces, and the obligation isn't limited to issuer financial statement audits. It reaches broker dealer attestation work, too. That's the whole standard in a couple of minutes. The harder part, as always, is building a firm culture and a set of internal processes that actually make good on it when a real deficiency shows up.
Meredith Mednick, CPA, CA: [00:32:43] Which is exactly where we left Priya off. Let's get back to Priya sitting with that email under as 2901. Here's her actual path, step by step. First is reliance on that report still probable? The client's still operating. Still filing. Still referencing that report. By incorporation. Reliance is alive and well. The obligation applies. There's no plausible argument otherwise. And Priya doesn't spend much time on this step because the facts are clear. Second, what kind of efficiency is this? The monitoring review found a gap in the evidence supporting a conclusion about a significant estimate, not proof the conclusion was wrong, but proof the file doesn't clearly show how the team got there. That puts Priya somewhere between the two paths, and it's her job working with the engagement partner to determine which one it actually is. Does the evidence gap mean the opinion itself wasn't properly supported, requiring clear view to go get more evidence and potentially opening the door to an As 2905 conversation if that evidence can't be obtained. Or does the opinion still hold? Meaning this is a corrective action conversation about how the team reached and documented that conclusion and what needs to change so that it doesn't happen again. Third, whichever path it turns out to be, Priya needs a documented trail, not a hallway conversation that lives in her head, but a written record of the deficiency.
Meredith Mednick, CPA, CA: [00:34:14] The reliance analysis, the path determination, and the specific action taken. Something that holds up if someone reads it two years from now with no other context. Either way, let's not think about this too hard. Was never on the table. That's exactly the outcome, as 2901 is designed to produce. Before we wrap up, there are a few questions worth sitting with. Whether you're building your firm's response process or just making sure you understand where you'd fit into it. One if your firm identified a deficiency on a completed engagement tomorrow, do you know who makes the is reliant still probable call? And what evidence they point to in order to support it? Two does your firm's current escalation process clearly distinguish between. The opinion wasn't supported and the opinion holds up, but something fell short. Or does everything get routed through the same process regardless of severity? Three if your answer due to efficiency is usual schedule training. Have you actually checked whether that training targets the specific audit judgment that was missing, or whether it just reinforces accounting knowledge? That was never the problem in the fourth place? Four. Does your firm have a systemic way of tracking which older reports are still being incorporated by reference into current client filings, or is that living in an individual engagement partner's memories? Fifth, when a deficiency surfaces, does your firm's culture treat it as useful information to investigate or as something engagement teams need to defend against? Be honest with yourself on one.
Meredith Mednick, CPA, CA: [00:35:56] That's as. 2901 a standard that sounds procedural on paper, but is really about how a firm behaves in the moment. Its own work turns out to have a gap. It's concise as standards go. Only a handful of paragraphs if you read it cold, but the judgment it demands from the reliance threshold all the way through documenting the final response is anything but simple. The firms that come out of the December 2026 effective date in good shape aren't going to be the ones with the longest policy manual. They're going to be the ones where a director of quality like Priya has the standing, the process and the documentation habits to make the standard mean something in practice, not just on paper. If this connected some dots with our earlier episode on QC 1000, that's exactly the idea. Monitoring finds it as 2901 governs what happens next. And if this was your first time with either standard, you're caught up on both fronts now. No rewind required. Although if you haven't listened to the QC 1000 episode, I encourage you to do so. If you found this episode useful, share it with someone on your quality team, and don't forget to head to earmark.app and take the quiz for this episode to claim your CPE credit. Thank you for spending this time with me on standard practice. I'm Meredith Mednick. Until next time.