QC 1000 vs ISQM 1 explained: What audit leaders need to know

The good news, however, is that there’s a lot of familiar ground. QC 1000 and ISQM 1 share a similar foundation, with both taking a proactive, risk-based approach to quality and covering many of the same areas.

But alignment isn't the same as equivalence. QC 1000 is a separate PCAOB standard and brings its own requirements around areas such as accountability, evaluation, reporting, and documentation.

With the QC 1000 effective date set for December 15, 2026, firms already operating a system of quality management under ISQM 1 need to understand what they can carry forward. That means identifying where the QC 1000 vs ISQM 1 differences lie, and what still needs to be addressed.

Contents

1. What are QC 1000 and ISQM 1?

2. How do QC 1000 and ISQM 1 align?

3. What's the difference between QC 1000 and ISQM 1?

4. QC 1000 vs ISQM 1 component comparison

5. Does ISQM 1 compliance mean a firm is ready for QC 1000?

6. What does this mean for resource management?

7. What should firms do to prepare for QC 1000?

8. FAQs about QC 1000 and ISQM 1

What are QC 1000 and ISQM 1?

ISQM 1 and QC 1000 are both standards designed to support consistent audit quality, setting out how firms should design, implement, and operate their respective systems of quality management and quality control.

International Standard on Quality Management 1 (ISQM 1) was issued by the International Auditing and Assurance Standards Board (IAASB) and has applied since December 2022. A Firm’s System of Quality Control (QC 1000) was adopted by the Public Company Accounting Oversight Board (PCAOB) and will soon apply to PCAOB-registered firms within the scope of the standard.

At a high level, there is significant alignment between PCAOB QC 1000 and ISQM 1. Both take a proactive, risk-based approach and are structured around eight closely aligned components. But there are differences in how and where those requirements apply. Our guide to QC 1000 explores the standard and its implications for resource management in more detail, but for an at-a-glance comparison, the table below highlights the key differences.

While the terminology and regulatory context differ, the two standards have much in common. In fact, firms already working under ISQM 1 will recognize much of the structure and thinking behind QC 1000.

That makes existing work against ISQM 1 requirements a valuable foundation for QC 1000 readiness, but not a substitute for assessing and addressing QC 1000’s specific requirements.
 

How do QC 1000 and ISQM 1 align?

The same fundamental idea is core to both standards, which is that audit quality needs to be managed proactively, rather than relying on policies and procedures that only come into play when something goes wrong.

Both ISQM 1 and QC 1000 take a risk-based approach, requiring firms to establish quality objectives, carry out a quality risk assessment to identify and assess the risks that could prevent them from achieving those objectives, and design appropriate responses. Their systems are also intended to be iterative and responsive to changes in the firm, its engagements, and the risks it faces. The PCAOB itself describes QC 1000 and ISQM 1 as sharing the same basic framework, including the same eight components and a risk-based approach.

The similarities extend across those components, covering governance and leadership, ethical requirements, acceptance and continuance, engagement performance, resources, information and communication, and monitoring and remediation.

But the alignment goes further than structure. Both standards treat quality as an ongoing process. Firms need to understand their quality risks, respond to them, monitor how effectively their systems are operating, and address deficiencies when they arise.

This common foundation gives firms already working under ISQM 1 a head start. Much of the thinking, processes and infrastructure they have put in place may also support QC 1000 readiness, even where the specific requirements differ.
 

Regulatory scope

ISQM 1 was developed by the IAASB as an international standard for firms performing audits or reviews of financial statements, or other assurance or related services engagements. It’s been adopted or adapted in dozens of jurisdictions worldwide, including the UK, EU member states and countries across Asia, Africa and the Americas.

QC 1000, meanwhile, is a US regulatory standard issued by the PCAOB. However, its application isn't limited to firms based in the United States. It also applies to PCAOB-registered firms operating internationally, according to the nature of their PCAOB-regulated work.

Firms may therefore find themselves working with both standards, particularly where they operate across multiple jurisdictions.

Quality control vs quality management

The two standards also use different terminology. ISQM 1 introduced a system of quality management, while QC 1000 retains the PCAOB’s system of quality control terminology.

This difference goes further than naming, but it shouldn’t be taken to mean that QC 1000 follows a more traditional or reactive approach to quality control. Both standards are proactive and risk-based, with systems designed to respond to the nature and circumstances of the firm and its engagements.

The regulatory context differs too. PCAOB-registered firms are subject to the PCAOB’s inspection and enforcement framework, while ISQM 1 operates through the regulatory and oversight arrangements of the jurisdictions in which it has been adopted.

Accountability and governance

Both standards place responsibility for quality with firm leadership, but QC 1000 operates within the PCAOB’s own regulatory and oversight framework and includes specific requirements around roles, responsibilities, and accountability.

This is also an area currently affected by regulatory change. The PCAOB adopted amendments to QC 1000 in September 2026 to bring certain requirements into closer alignment with other quality management standards. Those amendments remain subject to SEC approval.

Evaluation, reporting and documentation

Both standards require firms to evaluate their systems at least annually, but QC 1000 adds PCAOB-specific requirements for reporting the results of that evaluation to the Board.

QC 1000 also contains its own documentation requirements covering the design, implementation, and operation of the system, as well as its evaluation. The September 2026 amendments make changes to aspects of both evaluation and documentation, including greater flexibility around the annual evaluation date and a shorter documentation retention period, subject to SEC approval.

QC 1000 vs ISQM 1 component comparison

QC 1000 is compared with ISQM 1 at a component level, both standards cover the same broad areas, but there are differences in the specific objectives, requirements and terminology within them. 

Does ISQM 1 compliance mean a firm is ready for QC 1000?

Firms already working under ISQM 1 may have much of the groundwork for QC 1000 in place, but that doesn't mean they're automatically ready. QC 1000 remains a separate standard with its own requirements.

Rather than starting again, firms can use their existing ISQM 1 system as a foundation for QC 1000 readiness. That means mapping existing quality objectives, identified risks, responses, controls, information flows, monitoring activities, and supporting evidence against the QC 1000 requirements to understand what can be carried across and where gaps remain.
Those gaps may relate to PCAOB-specific requirements, but firms should also consider whether existing processes work effectively in the context of their PCAOB-regulated engagements. Where changes are needed, clear ownership and an implementation plan can help ensure they are addressed ahead of the effective date.

The important distinction is that alignment can reduce duplication, but it doesn't remove the need for a dedicated QC 1000 assessment. ISQM 1 provides a strong foundation, not a shortcut to QC 1000 compliance.

What does this mean for resource management?

Audit resource management is central to both standards because audit quality depends, in part, on firms having the right people, with the right skills and experience, available to perform and supervise engagements.

That requires visibility of more than headcount. Firms need to understand capacity and workload, skills and experience, team composition, supervision requirements, and engagement demands. That information can also inform acceptance and continuance decisions by helping firms assess whether they have sufficient resources to take on new work without putting existing engagements under pressure.

Reliable operational data is equally important once work is underway. Better visibility of changing workloads, resource constraints and emerging risks can help firms identify potential quality issues earlier and intervene before they affect engagement delivery.

These aren't new considerations for firms already working under ISQM 1. As we explore in our guide to preparing your resource management for ISQM 1, effective resource management supports several components of the standard. QC 1000 reinforces many of the same underlying requirements, while firms still need to assess the specific expectations of the PCAOB standard.

What should firms do to prepare for QC 1000?

For firms already working under ISQM 1, preparing for QC 1000 shouldn't mean rebuilding their quality systems from the ground up. The more useful starting point is understanding how existing processes map to the new standard, and where additional work is required.

A structured gap assessment can help firms identify which quality objectives, risk assessments, responses, controls, monitoring activities, and documentation can be carried forward, as well as any areas that need to be adapted or introduced specifically for QC 1000. From there, firms can establish clear ownership for closing those gaps and make sure any changes are implemented ahead of the December 15, 2026 effective date.

The significant overlap between the standards gives firms a strong foundation to build on. But with QC 1000 introducing its own requirements within the PCAOB regulatory framework, preparation still needs to be based on the standard itself instead of an assumption that existing ISQM 1 processes will be enough.

For a closer look at QC 1000, including the workforce and operational factors that can affect audit quality, download our guide - QC 1000: Creating the conditions for quality.

FAQs about QC 1000 and ISQM 1

Where do QC 1000 and ISQM 1 apply?
QC 1000 is a US regulatory standard that applies to PCAOB-registered firms, including those operating outside the United States, depending on the nature of their PCAOB-regulated work. ISQM 1 has been adopted or adapted in dozens of jurisdictions worldwide, including the UK, EU member states and countries across Asia, Africa and the Americas. Firms operating internationally may therefore need to comply with both standards.

Can firms use their existing ISQM 1 framework for QC 1000?
Yes, existing ISQM 1 work can provide a strong foundation for QC 1000. Firms may be able to build on existing quality objectives, risk assessments, responses, monitoring processes, and documentation, but should map these against QC 1000 to identify any additional or different requirements.

Do firms need separate quality systems for QC 1000 and ISQM 1?
The standards don’t necessarily mean firms need two entirely separate systems. Given the significant overlap between them, firms may be able to integrate many of their processes. However, they still need to demonstrate that their system addresses the specific requirements that apply under each standard.

What should firms include in a QC 1000 gap assessment?
A gap assessment should compare existing quality objectives, risks, responses, controls, monitoring activities, information flows, and documentation with QC 1000 requirements. Firms can then identify what already aligns, what needs to change, and where new processes or controls may be required.

How does resource management support QC 1000 readiness?
Resource management can help firms understand whether they have the capacity, skills and experience needed to perform and supervise engagements effectively. Reliable information on workloads, team composition, and engagement demands can also support acceptance decisions, monitoring and earlier identification of potential quality risks. 

Support audit quality with Dayshape

Dayshape's AI-powered resource management platform helps audit firms meet quality management requirements with better resource allocation, real-time project visibility, early issue detection, and full audit trails.

Discover how Dayshape supports quality and governance