ISA Audit vs PCAOB Audit: What Changes When Your European Company Goes Public in the US

The main difference between an ISA audit and a PCAOB audit, for a European company going public in the US, is not the audit procedures. It is what the US rules require around them. Every audited year in your registration statement needs a report under Public Company Accounting Oversight Board (PCAOB) standards from a PCAOB-registered firm, including years already audited under International Standards on Auditing (ISA). Your auditor must be independent under SEC and PCAOB rules from the first day of the last fiscal year before you first file, which rules out bookkeeping, valuation, systems implementation and other services from that date. And internal control over financial reporting (ICFR) becomes a reporting obligation under Section 404 of the Sarbanes-Oxley Act (SOX), although an emerging growth company (EGC) is exempt from the auditor’s attestation.

The independence rules cause the most problems, because they apply to a period that has often already started when the IPO timetable is set.

Key takeaways

Financial statements in a US registration statement need audit reports under PCAOB standards, including years already audited under ISA.
PCAOB standards add a 14-day limit for assembling audit documentation, a prescribed list of audit committee communications and critical audit matters in the auditor’s report (except for EGCs).
Management’s ICFR assessment under SOX 404(a) is required from the second Form 20-F; the auditor’s attestation under 404(b) applies only to accelerated and large accelerated filers that are not EGCs.
SEC rules prohibit ten categories of non-audit services, including bookkeeping, valuation and financial systems implementation, from the first day of the last fiscal year before you first file.
Move GAAP conversion, valuation and systems work to an independent provider before that period starts.

What the PCAOB is and why it applies to foreign private issuers

The PCAOB was created by the Sarbanes-Oxley Act of 2002. It sets auditing, independence and quality control standards for audits of SEC registrants, and it registers and inspects the firms that perform them, including European firms, which it inspects under cooperative arrangements with national audit regulators (for example, with the German audit oversight body since April 2012).

A European company that lists in the US as a foreign private issuer (FPI) files an annual report on Form 20-F and furnishes interim and current information on Form 6-K, instead of the Forms 10-K and 10-Q that US domestic companies file. The audit requirement is the same as for a domestic company: the financial statements in your Form F-1 registration statement and in every Form 20-F must be audited under PCAOB standards by a PCAOB-registered firm (SEC Financial Reporting Manual, Topic 4).

ISA audit vs PCAOB audit: the differences that affect your company

The two sets of standards are both risk-based and share most of their structure, although they have different origins: ISA are issued by the International Auditing and Assurance Standards Board (IAASB), while the PCAOB started in 2003 from the AICPA’s US auditing standards and has replaced many of them since. The differences that matter to a company preparing for a US listing are these:

Prior years need PCAOB reports. A registration statement includes two years of audited financial statements for an EGC and three years otherwise. Each year needs an audit report under PCAOB standards, even if it was already audited under ISA, so the auditor performs additional procedures and issues a new report. Build that work into the IPO timetable.
Internal control. Once the SOX 404(b) attestation applies, the auditor performs an integrated audit of the financial statements and ICFR (AS 2201) and gives an opinion on both. Before then, the audit covers the financial statements only, but the auditor must still communicate significant deficiencies and material weaknesses to the audit committee (AS 1305).
Documentation. The auditor must assemble the final audit documentation within 14 days after the report release date (AS 1215, as amended for fiscal years beginning on or after 15 December 2024 for the largest firms and 15 December 2025 for all others). ISA 230 guidance allows ordinarily not more than 60 days. Expect open requests for support to be closed out before the report is issued.
Audit committee communication. ISA 260 requires communication with those charged with governance. PCAOB AS 1301 prescribes the matters to communicate before the report is issued, including critical accounting policies and estimates, significant unusual transactions, difficult or contentious matters, uncorrected misstatements and a draft of the auditor’s report. SEC rules also require the audit committee to pre-approve every audit and non-audit service before the auditor is engaged (Regulation S-X Rule 2-01(c)(7)).
The auditor’s report. The PCAOB report states that the firm is PCAOB-registered and required to be independent, states the auditor’s tenure and describes critical audit matters (AS 3101). Critical audit matters are similar to the key audit matters that ISA 701 requires for listed entities, but they are not required in audits of EGCs.

SOX 404(a) and 404(b): what management reports and what the auditor attests

Section 404(a): management’s assessment. Management evaluates ICFR against a recognized framework (almost always COSO 2013) and reports whether it is effective. A newly public company does not include this report in its first annual report; it is required from the second Form 20-F. The CEO and CFO certifications under SOX Sections 302 and 906 are required from the first.
Section 404(b): the auditor’s attestation. The auditor gives its own opinion on ICFR. This applies to accelerated filers (public float of USD 75 million or more but less than USD 700 million) and large accelerated filers (USD 700 million or more), after at least 12 months of reporting and one annual report, unless the company is an EGC.

A company is an EGC if its total annual gross revenues were less than USD 1.235 billion (the inflation-adjusted threshold set in 2022) in its most recently completed fiscal year. The status lasts for the first five fiscal years after the IPO and ends earlier if revenue reaches USD 1.235 billion, the company issues more than USD 1 billion of non-convertible debt in three years, or it becomes a large accelerated filer. EGC status removes the 404(b) attestation only, so management’s 404(a) assessment still requires designed, documented and tested controls. For the full requirements, see SOX requirements for foreign private issuers.

In May 2026 the SEC proposed (Release No. 33-11419) to raise the large accelerated filer threshold to USD 2 billion of public float and remove the accelerated filer category, which would limit 404(b) to large accelerated filers. As of 16 October 2026 the proposal has not been adopted.

The services your PCAOB auditor can no longer provide

Regulation S-X Rule 2-01(c)(4) prohibits your auditor from providing ten categories of non-audit services, because the firm would otherwise be auditing its own work or acting as management:

Bookkeeping or other services related to your accounting records or financial statements
Financial information systems design and implementation
Appraisal or valuation services, fairness opinions and contribution-in-kind reports
Actuarial services
Internal audit outsourcing
Management functions
Human resources services
Broker-dealer, investment adviser or investment banking services
Legal services
Expert services unrelated to the audit

Preparing your US GAAP or IFRS financial statements or conversion journal entries falls under the first category. The team that builds your converted numbers cannot be the team that audits them.

The timing is what catches finance teams. For a first-time filer, the SEC and PCAOB independence rules apply from the first day of the last fiscal year before the company first files a registration statement, provided the firm complied with the independence standards that applied in earlier periods (Rule 2-01(f)(5)(iii), as amended in 2020). A company with a December year end that files its registration statement in 2027 therefore needs its auditor to meet the SEC and PCAOB rules from 1 January 2026. If the audit firm provided conversion support, valuation or systems implementation during that period, it may not be able to issue the audit reports for the registration statement, and the work cannot be undone.

What to assess 12 to 18 months before your first PCAOB audit

Confirm your auditor. Check that the firm that will sign your reports is PCAOB-registered, and agree how and when the years audited under ISA will be brought up to PCAOB standards.
List every service your audit firm provides. Include other firms in the same network, and stop any prohibited service before the first day of the last fiscal year before you expect to file.
Move conversion, valuation and systems work to an independent provider. This keeps your intended auditor eligible and avoids a change of auditor close to the IPO.
Put a pre-approval process in place. The audit committee, or the board until one exists, approves each service from the audit firm before the firm is engaged.
Confirm your EGC and filer status. Know which reliefs apply and when they end, and plan for management’s 404(a) assessment in your second Form 20-F.
Build the documentation as you convert. Prepare the support for each conversion adjustment to the standard a PCAOB auditor expects, not during fieldwork. For what that package contains, see what auditors want to see in your GAAP conversion package.

Read the full guide to being public in the US

For the full overview of what it means to be an SEC-registered company, including ongoing reporting, PCAOB audits and corporate governance, read the Being Public in the US section of the European Accounting and Reporting Guide.