Audit Quality Indicators Boards and Audit Committees Should Track
Boards can monitor audit quality through specific indicators tracked throughout the year.
Audit quality is not a settled fact that boards simply receive along with the audit opinion. It is a property of how the audit was performed, and it leaves traces that a committee can track long before the report arrives. This piece lays out the indicators that matter and the questions that make them usable.
Why boards and audit committees need a more active role in tracking audit quality
Regulatory upheaval, economic volatility, and the pace of technological change are converging to test the limits of board oversight. BDO's 2026 audit committee priorities frame the consequence plainly: committees must refine their oversight and ask sharper questions of management and auditors. A committee stretched across all these fronts cannot afford to treat auditor evaluation as a background activity.
Yet that is precisely what many committees do. The Center for Audit Quality's January 2026 Audit Committee Insights calls on committees to plan when their external auditor assessment will be conducted and to review the external audit partner rotation schedule. Both requests presuppose a formal quality-tracking framework. Without one, the assessment has no calendar home and no defined inputs.
The regulators see the gap as well. SEC Chief Accountant Kurt Hohl, speaking at the 2025 AICPA Conference on Current SEC and PCAOB Developments, described PCAOB oversight as a top priority and encouraged the Board to consider whether inspection reports are providing meaningful information to stakeholders. The framework that follows supplies those means.
What audit quality indicators are and how they differ from audit outputs
An audit opinion tells a committee what the auditor concluded. Audit quality indicators close that distance. Conflating the two leaves a committee blind to the drivers of reliability, because a clean opinion can emerge from a weak process just as a qualified one can emerge from a rigorous engagement.
The indicator set spans both qualitative and quantitative signals. Quantitative and externally observable signals include inspection deficiency rates, the substance of critical audit matter disclosures, and the pattern of internal control findings. Each of these categories gets its own treatment in the sections that follow.
There is a reasonable objection to this apparatus. The question is not whether one firm outscores another. It is whether this year's engagement signals are stronger or weaker than last year's, and why.
Engagement team expertise and partner involvement as the first quality signal
Who actually does the work, and how senior and specialized they are, is the most direct predictor of engagement quality. Is the engagement partner substantively involved in audit judgments, or has the work been delegated heavily to less experienced staff? The answers reveal more about quality than any polished summary. Specialist support matters in ways that a firm-level statement of capability cannot capture. The question is whether it is applied to the judgments that matter here. Partner rotation deserves its own calendar slot. A committee that tracks it is doing audit quality work with a concrete, dated deliverable.
Industry specific expertise is not interchangeable with generalist competence. An engagement team that understands the regulatory environment of skilled nursing facilities, multifamily housing finance, or mortgage banking brings qualitatively different judgment to materiality and going concern assessments than a generalist team applying generic procedures. Recruiting and retaining skilled auditors is an acknowledged industry challenge, and committees should ask how workforce pressures are being managed on their specific engagement, and whether staffing changes mid-engagement have occurred and been communicated.
Auditor independence: the indicators that reveal threats before they become violations
Independence is not a binary condition confirmed once at engagement start. It is a continuous state that committees should monitor through specific observable indicators across the year. The monitoring protects the committee as much as it protects investors.
Independence monitoring is explicitly part of what audit firm quality control systems are designed to manage. Committees should maintain an updated log of all non-audit engagements with the auditor and annually assess whether the aggregate creates impairment risk. The fee ratio is a standard signal: a non-audit fee total that approaches or exceeds audit fees warrants explicit discussion.
AI adds a new category of dependency. AI-assisted procedures can create third-party dependencies that raise scope or independence questions committees have not historically encountered. The BDO 2026 priorities fold this concern into a broader call to refresh fraud risk assessment and confirm the auditor's use of data analytics, a question that also surfaces whether the auditor is maintaining a skeptical, evidence-driven posture.
Reading PCAOB inspection results as a benchmarking tool, not just a regulatory report
PCAOB inspection reports are the most objective external signal of audit quality available to committees. They require active interpretation to function as a benchmark rather than a compliance artifact. The scale of the inspection program makes the signal substantive: in 2025 the PCAOB inspected more than 200 registered firms, reviewed more than 880 audits, and issued 37 public disciplinary orders involving audit failures, quality control violations, and related misconduct.
The relevant benchmark is the deficiency rate on the specific firm engaged, not the industry average. A committee should obtain and review the most recent inspection report for its firm and ask the engagement partner to walk through any cited deficiencies and the firm's remediation response. A firm with an improving deficiency rate over three inspection cycles is a different quality signal than one with a worsening rate, even if the current year rate appears similar.
The nature of inspection information may evolve. SEC Chief Accountant Hohl, at the 2025 AICPA Conference, encouraged the PCAOB to consider shifting inspections toward review of a firm's system of quality management corroborated by engagement-level reviews. In September 2026 the PCAOB adopted targeted amendments to QC 1000 and related amendments to the QC reporting rule and PCAOB forms, addressing implementation challenges identified by firms. Committees should confirm their auditor has documented its compliance path with the updated standard. One fair objection is that inspection reports lag by a year or more and may not reflect current firm quality. Committees should also monitor whether structural changes to the PCAOB affect the availability and reliability of inspection data they depend on, given that future leadership of the Board remains uncertain and recent legislative attempts to integrate its functions into the SEC have faced dissent.
Critical audit matter disclosures as a window into auditor judgment and engagement depth
The quality of critical audit matter disclosures reveals whether the auditor is exercising genuine judgment on the hardest questions or producing boilerplate. A high-quality CAM disclosure names the specific risk, explains why it was judged to be a CAM, describes the procedures applied, and indicates the auditor's conclusion. Vague or formulaic language is a quality warning sign, not a compliance pass.
The timing of the dialogue matters as much as the text. Ongoing CAM discussion, rather than a year-end document dump, is the quality signal. Comparing disclosures year-over-year adds another layer: a CAM that appeared in prior years and suddenly disappears without a corresponding change in business circumstances warrants an explanation from the engagement partner.
The current environment concentrates CAMs in predictable places. The CAQ's January 2026 guidance calls on committees to challenge impairment and going concern judgments amid interest rate and liquidity dynamics, and to review refinancing plans and covenant sensitivities. Where AI is used in the audit, the committee should ask how that use affects the auditor's judgment on complex estimates, including the benefits, the limits, and how management's AI controls interface with audit procedures.
Internal control findings and what their pattern reveals about financial reporting reliability
The pattern of internal control findings, not merely whether any exist, is one of the clearest signals of underlying financial reporting risk. The CAQ's January 2026 guidance identifies the top internal control issues in adverse ICFR management assessments: accounting personnel resources, segregation of duties, information technology, inadequate disclosure controls, and non-routine transactions. Committees should map their own environment against each of these categories.
Accounting personnel resources is particularly pointed in the current environment. Segregation of duties, the most traditional of all control concepts, becomes harder to maintain as teams shrink and automation consolidates responsibilities. IT general controls are a fast-growing deficiency category as companies accelerate AI adoption, and the CAQ guidance calls on committees to update cyber incident response and AI governance, including model risk controls, change management, and monitoring, with reporting metrics such as time to detect and model drift indicators.
Non-routine transactions consistently generate control gaps because existing frameworks were designed for recurring processes. Fraud risk assessment is linked to internal control quality: the CAQ guidance calls on committees to refresh fraud risk protocols, including data-driven detection and hotline triage, and to confirm the auditor's use of data analytics. A team that understands the control environment of multifamily housing, skilled nursing, or mortgage banking will identify gaps that a generalist firm may miss.
Tracking AQIs in specialized audit engagements: HUD 232, skilled nursing, SOC, and mortgage banking
The five core AQI categories apply across all audit engagements, but their specific content and the highest-risk signals differ materially by engagement type. Committees overseeing specialized entities need a targeted version of each indicator.
HUD Section 232 and multifamily housing audits
HUD's Office of Residential Care Facilities administers the Section 232 mortgage insurance program, which insures more than 3,600 loans. ORCF staffing fell sharply between October 2024 and May 2025, which means that well-documented, clean submissions draw less regulatory friction than those with deficiencies. Audit quality is directly consequential for program administration outcomes.
Key AQIs for HUD 232 borrowers include timely submission of audited financials, with a fiscal year-end of December 31 requiring submission by March 31, compliance with HUD's Uniform Financial Reporting Standards under 24 CFR 5.801, and the quality and clarity of going-concern and surplus cash disclosures. The updated Section 232 Handbook, with provisions effective January 19, 2017, applies to all new loan applications and transactional requests. Committees should confirm their auditor is current on the updated handbook requirements.
Skilled nursing facility accounting and compliance
National improper payments for nursing homes have risen materially in recent years, with SNF errors among the highest of care settings by dollar amount, though inpatient rehabilitation facilities now post a higher improper payment rate. Selected facilities must designate and submit Points of Contact within five business days and submit all required documentation within 45 calendar days or face a payment reduction. Noncompliance with the 2026 data validation process will impact a facility's FY 2027 Annual Payment Update, now finalized at 2.4 percent.
Key AQIs for SNF boards include MDS accuracy cross-checked against clinical documentation, staffing domain scores based on six measures, and accuracy and timeliness of Payroll-Based Journal data, where late, rejected, or inaccurate data can force a one-star rating regardless of actual staffing. The six staffing measures are case-mix adjusted RN hours per resident day, case-mix adjusted total nurse hours per resident day, case-mix adjusted total nurse hours per resident day on weekends, total nurse staffing turnover, RN turnover, and administrator turnover. Beginning September 2026, CMS will allow higher-quality nursing homes to undergo a Risk-Based Survey, a more focused inspection requiring less onsite time, creating a direct quality incentive for audit accuracy and compliance documentation.
SOC 1 and SOC 2 examinations
SOC 1 evaluates a service organization's controls relevant to a client's internal control over financial reporting, performed under SSAE 18's AT-C 320. Security is mandatory and the other four are selected based on customer and contractual needs. SSAE 23 is the newest attestation amendment, effective for engagements beginning on or after December 15, 2025. Committees relying on vendor SOC 2 reports should require Type 2, not Type 1 reports. Type 2 examinations are substantially more likely to contain at least one exception and provide a materially stronger quality signal about control operating effectiveness over time.
A critical quality gap merits direct attention. The Trust Services Criteria underlying every SOC 2 report were last substantively revised in 2017, with a points-of-focus refresh in 2022, well before generative AI reshaped enterprise software. The scrutiny in SOC examination quality centers on auditor judgment, evidence sufficiency, independence, scope control, sampling, testing, management assertions, subservice organizations, and complementary user entity controls, not on a new framework version.
Mortgage banking audit and compliance
Mortgage banking audit quality is directly affected by the internal control indicators discussed earlier, particularly IT general controls, non-routine transaction controls, and accounting personnel resources, given the volume, complexity, and regulatory sensitivity of loan origination and servicing data.
How to build an ongoing AQI tracking process rather than an annual review ritual
Effective AQI tracking requires a structured annual calendar, a defined assessment process, and a committee composition that includes the expertise to interpret what the indicators mean. The CAQ January 2026 guidance calls on committees to set a proactive calendar that maps to audit committee charter responsibilities and to plan when the external auditor assessment will be conducted. A structured calendar is the foundation, not a supplementary tool. The four-method assessment framework from the BDO 2026 priorities, ongoing dialogue, structured surveys, firm self-assessments, and external indicators, should be distributed across the calendar year, not compressed into Q4. Inviting experts to audit committee meetings throughout the year builds interpretive capacity on emerging quality dimensions such as AI in audit, cybersecurity controls, and new attestation standards.
The audit committee chair's role in structuring this process is a governance design question, not just a scheduling one. The BDO Q2 2026 agenda describes the chair role as becoming more complex, requiring strong leadership, independence, judgment, and ongoing education. Tabletop exercises for cyber, AI, and transaction risk double as practical training for the control-environment and independence indicators in the AQI framework.
What distinguishes a truly quality-focused audit relationship from a transactional one
The goal of AQI tracking is not to generate a score. The tracking framework described throughout this piece is the mechanism for verifying that standard is being met engagement by engagement. Committees overseeing specialized entities should hold their auditors to an additional standard: not just technical competence in generally applicable standards, but demonstrated fluency in the specific regulatory and risk environment of the industry. Committees that build AI literacy now will be better positioned to evaluate emerging assurance standards as they develop.
The public-facing dimension closes the loop. The CAQ January 2026 guidance calls on committees to enhance the audit committee report in the proxy statement, a signal that the committee is exercising active, informed oversight rather than passive receipt of deliverables. The indicators are how a committee knows whether it is being met.
