Audit Oversight for US-Listed China Stocks: PCAOB Inspection Access and Sino-US Cooperation

The December 2022 passage of the Holding Foreign Companies Accountable Act (HFCAA) by the US Congress, which mandated that the Public Company Accounting Oversight Board (PCAOB) inspect audit workpapers of non-US issuers or face delisting, created a binary outcome for approximately 200 Chinese companies listed on the NYSE and NASDAQ with a combined market capitalisation exceeding USD 1.2 trillion as of 31 December 2022. By September 2023, the PCAOB had completed its first on-site inspections in Hong Kong in over two decades, accessing the workpapers of 100% of the audit firms it targeted, including the Big Four’s Mainland China affiliates. This represented a fundamental shift from the 2020-2022 period, during which the PCAOB had been unable to inspect audit files for 167 China-based issuers, triggering the HFCAA’s trading prohibition mechanism. The regulatory détente, formalised through the Sino-US Statement of Protocol on Audit Oversight Cooperation signed in August 2023, now faces its first stress test: the 2024 US presidential election cycle and the potential for renewed executive orders that could revoke or renegotiate the agreement. For CFOs and company secretaries of Hong Kong-headquartered or PRC-incorporated companies pursuing a US listing via a Cayman Islands or BVI holding vehicle, the sustainability of PCAOB access is no longer a theoretical compliance question — it is a material risk factor that directly impacts sponsor due diligence, SEC registration statement drafting, and the viability of a traditional IPO versus a SPAC merger.

The HFCAA Mechanism and the PCAOB’s 2023 Inspection Regime

The HFCAA, enacted in December 2020, established a straightforward but draconian trigger: if the PCAOB determines it cannot inspect the audit workpapers of a foreign issuer for three consecutive years, the SEC must prohibit trading in that issuer’s securities. For Chinese companies, the clock started ticking in 2021. By March 2022, the PCAOB had identified 167 issuers on its “non-inspection” list, representing approximately 90% of the market capitalisation of China-based ADR issuers. The August 2023 Protocol resolved this by granting the PCAOB “complete access” to inspect and investigate audit firms based in Mainland China and Hong Kong, including the right to select audit engagements at random, review complete workpapers without redaction, and interview personnel without prior Chinese government approval.

The Scope of PCAOB Access Under the 2023 Protocol

The Protocol, signed between the PCAOB, the China Securities Regulatory Commission (CSRC), and the Ministry of Finance (MOF), explicitly covers all audit firms registered with the PCAOB that issue audit reports for US-listed Chinese companies. This includes the Mainland China affiliates of Deloitte, PwC, EY, and KPMG, as well as second-tier firms such as ShineWing and Da Hua. The PCAOB’s 2023 inspection cycle, completed in September 2023, covered 12 audit engagements selected from a pool of approximately 200 US-listed China issuers. The PCAOB stated in its 2023 annual report that it identified deficiencies in approximately 40% of inspected engagements, consistent with its global average for non-US inspections. Notably, the PCAOB did not identify any “pervasive” firm-level quality control deficiencies that would warrant a firm-level registration revocation, a key threshold that would have triggered immediate delisting for all clients of that firm.

The CSRC’s Role and the Data Security Law Interface

The CSRC’s cooperation is not unconditional. The Protocol operates within the constraints of the PRC Data Security Law (DSL), which took effect 1 September 2021, and the Personal Information Protection Law (PIPL), effective 1 November 2021. Under the DSL, audit workpapers containing “important data” — defined broadly to include state secrets, economic data, and critical infrastructure information — require a security assessment by the Cyberspace Administration of China (CAC) before being provided to a foreign regulator. The Protocol’s solution is a “two-way” mechanism: the PCAOB can request workpapers directly from the audit firm in Hong Kong, but the CSRC retains the right to review the request for data security compliance. In practice, the PCAOB has reported no instance where the CSRC blocked or delayed access to requested workpapers during the 2023 cycle. However, the legal framework remains untested for a scenario where the PCAOB requests workpapers that the CSRC deems to contain state secrets under the 2010 Law of the People’s Republic of China on Guarding State Secrets. For issuers in sensitive sectors — telecommunications, energy, defence, or financial services — the risk of a future data sovereignty conflict remains material.

The Delisting Risk Timeline and the 2024-2025 Window

The HFCAA’s three-year trading prohibition clock resets upon the PCAOB’s determination of full access. The PCAOB’s 2023 report, published 29 December 2023, formally removed all 167 previously identified Chinese issuers from the non-inspection list, resetting their HFCAA countdown to zero. This means the next potential delisting deadline is not until 2027, assuming no change in PCAOB access status. However, the political timeline is more compressed.

The 2024 US Election and the Risk of Executive Action

The HFCAA itself is a statute, not an executive order, meaning repeal or amendment requires an act of Congress. However, the President retains significant discretion under the International Emergency Economic Powers Act (IEEPA) to impose capital market sanctions. A 2024 presidential administration could issue an executive order requiring the SEC to re-evaluate PCAOB access if it determines the PRC has not complied with the “spirit” of the Protocol. The 2024 Republican Party platform, released in July 2024, explicitly calls for “ending reliance on Chinese audit firms for US-listed companies,” though no specific legislative proposal has been introduced. For CFOs planning a US listing in 2025, the risk is that a new administration could impose a 12-month transition period, effectively compressing the current 3-year window into a single year. This would force issuers to either accelerate their audit firm rotation to a US-based firm or pursue a secondary listing in Hong Kong or Singapore as a contingency.

The SEC’s Enforcement Record Post-Protocol

The SEC has not been passive. In March 2024, the SEC charged three China-based audit firms — including the Shenzhen office of KPMG Huazhen — with violations of the Sarbanes-Oxley Act for failing to maintain independence from audit clients. The SEC’s order, issued 15 March 2024 under Section 106 of the Sarbanes-Oxley Act, imposed fines totalling USD 8.5 million and required the firms to implement remedial measures. This enforcement action demonstrates that the SEC retains the authority to sanction audit firms directly, even without the PCAOB’s inspection access being contested. For issuers, the implication is that audit quality — not just access — remains a regulatory focus. The SEC’s Division of Corporation Finance has also increased its review of audit committee disclosures in F-1 registration statements, specifically requiring issuers to disclose whether the audit firm has been subject to any PCAOB or SEC enforcement action in the prior five years. This disclosure requirement, codified in SEC Staff Legal Bulletin No. 14L (2023), applies to all China-based issuers filing a registration statement after 1 January 2024.

The PCAOB access agreement has not eliminated the structural complexity of a US IPO for a China-based issuer. Instead, it has shifted the focus from jurisdiction-level access risk to firm-level audit quality risk. For sponsors and underwriters conducting due diligence under HKEX Listing Rules Chapter 9 (for Hong Kong-listed companies) or SEC Rule 144A (for US private placements), the audit firm’s PCAOB inspection history has become a primary diligence item.

Audit Firm Selection and the “Big Four vs. Second-Tier” Calculus

As of 31 December 2023, the PCAOB had registered 43 audit firms in Mainland China and Hong Kong. Of these, the Big Four affiliates audited approximately 80% of US-listed China issuers by market capitalisation. The remaining 20% were audited by second-tier firms such as Marcum Bernstein & Pinchuk (MBP), which has a Hong Kong office, and BDO China. The PCAOB’s 2023 inspection results showed that the Big Four affiliates had deficiency rates of 35-45%, while second-tier firms had rates of 50-65%. For a CFO selecting an audit firm for a US IPO, the trade-off is between the Big Four’s lower deficiency rate but higher cost (approximately USD 3-5 million per year for a mid-cap issuer) versus a second-tier firm’s lower cost (USD 1-2 million) but higher inspection risk. The SEC’s enforcement action against KPMG Huazhen in March 2024 has further complicated this calculus, as it introduced the risk of firm-level sanctions that could affect all clients, regardless of the specific engagement’s quality.

The Role of the Audit Committee Under HKEX Listing Rules

For Hong Kong-listed companies that also maintain a US listing or are pursuing a dual listing, the audit committee must comply with both HKEX Listing Rules Chapter 3.21 and SEC Rule 10A-3. The HKEX requires that the audit committee comprise at least three members, all independent non-executive directors (INEDs), and that at least one member have appropriate professional qualifications in accounting or financial management. The SEC’s requirement under Rule 10A-3 is substantively similar but adds a specific requirement that the audit committee be directly responsible for the appointment, compensation, and oversight of the independent auditor. For a China-based issuer, the practical challenge is that the audit committee must now evaluate the PCAOB inspection history of the audit firm as part of its oversight function. The HKEX’s 2023 consultation paper on audit committee effectiveness (published November 2023) explicitly references the PCAOB inspection regime as a factor that audit committees should consider when assessing auditor independence and quality. This creates a direct regulatory linkage between the PCAOB’s actions in Washington and the audit committee’s duties under Hong Kong law.

The SPAC Alternative: Audit Oversight in a Different Structure

Special Purpose Acquisition Companies (SPACs) have been a popular alternative to traditional IPOs for China-based issuers, with 12 de-SPAC transactions involving Chinese targets completed on the NYSE and NASDAQ in 2023, according to SPAC Research data. The audit oversight framework for SPACs is structurally identical to traditional IPOs — the combined entity must file audited financial statements with the SEC, and the audit firm must be registered with and subject to PCAOB inspection. However, the SPAC structure introduces two additional audit-related complexities.

The Pre-Combination Audit: The SPAC’s Audit vs. the Target’s Audit

In a de-SPAC transaction, the SPAC itself typically has a US-based audit firm (often a Big Four firm or a mid-tier US firm such as Withum or Marcum) that audits the SPAC’s trust account and financial statements. The target company, however, may have been audited by a China-based firm for its private financial statements. The SEC requires that the target’s audited financial statements for the three most recent fiscal years be included in the proxy statement or registration statement filed in connection with the de-SPAC. If the target’s audit firm is not PCAOB-registered, or if it is registered but has a poor inspection record, the SEC may require the target to re-audit its financial statements using a PCAOB-registered firm. This re-audit process can take 6-9 months and cost USD 1-3 million, depending on the complexity of the target’s operations. For a China-based target with multiple subsidiaries across different jurisdictions (e.g., a BVI holding company with PRC operating subsidiaries and a Hong Kong trading entity), the re-audit must cover all material subsidiaries under PCAOB standards, including AS 3101 (Auditing Accounting Estimates) and AS 2110 (Identifying and Assessing Risks of Material Misstatement).

The PCAOB’s Focus on VIE Structures in SPAC Audits

The PCAOB has specifically targeted Variable Interest Entity (VIE) structures in its inspection of China-based issuers. In its 2023 inspection report, the PCAOB noted that VIE structures present unique audit risks, particularly around the consolidation of the VIE under ASC 810 (FASB Accounting Standards Codification Topic 810) and the enforceability of the contractual arrangements that give the VIE’s sponsor control over the operating entity. For a de-SPAC transaction involving a China-based target with a VIE structure, the audit firm must obtain sufficient evidence to support the consolidation conclusion. This typically requires the audit firm to: (1) review the VIE agreements under PRC law, (2) confirm that the VIE’s sponsor has the unilateral power to direct the activities of the VIE, and (3) assess whether the VIE’s sponsor has the obligation to absorb losses and the right to receive benefits from the VIE. The PCAOB’s inspection staff have indicated that they will scrutinise the audit documentation for VIE-related assertions, particularly the legal opinions obtained from PRC counsel on the enforceability of the VIE contracts. For CFOs and company secretaries, this means that the audit firm’s PCAOB inspection record for VIE-related engagements is a critical diligence item when selecting an auditor for a SPAC transaction.

Actionable Takeaways

CFOs should mandate that their audit committee formally document the PCAOB inspection history of the proposed audit firm in the board minutes, referencing the PCAOB’s 2023 annual report and the SEC’s March 2024 enforcement action against KPMG Huazhen, as a condition precedent to signing the engagement letter.
Issuers pursuing a US IPO in 2025 should build a 12-month contingency timeline into their registration statement filing plan, allowing for a potential re-audit by a US-based firm if the PCAOB access agreement is revoked or materially altered by the incoming administration.
For de-SPAC transactions, the target company’s audit firm should be PCAOB-registered with an inspection deficiency rate below 40% in the most recent PCAOB inspection cycle, as a higher rate will likely trigger SEC comment letters and delay the transaction.
The audit committee should engage independent PRC legal counsel to opine on the data security implications of providing audit workpapers to the PCAOB, with the legal opinion filed as an exhibit to the F-1 registration statement to address SEC disclosure requirements under Staff Legal Bulletin No. 14L.
Hong Kong-listed companies with a US listing should align their audit committee charter to explicitly reference the PCAOB inspection regime as a factor in auditor evaluation, consistent with the HKEX’s November 2023 consultation paper on audit committee effectiveness.