The Peer Review Process
Approximately seven months before a firm’s peer review due date, the managing partner and peer review contact will receive an email notification from firstname.lastname@example.org that it is time to start the peer review process. When each peer review begins, a case number is assigned and is noted as PRI-xxxxxx. This should not be confused with the firm’s peer review number. The firm will provide information in PRIMA about its practice and either submit and continue to the scheduling form, where information about the team/review captain is provided, or submit and complete the scheduling form later. The peer review information must be provided within 90-days of the original request.
If the firm chooses to complete the scheduling form later, a scheduling case (SCH-xxxxxx) is generated and sent to the peer review contact. At this point, the peer review contact may provide information about the team/review captain and team members, if applicable.
The Peer Review Standards require that specific types or number of engagements must be selected in a System Review as well as specific audit areas. The specific audit areas are considered “must-select” engagements and should be included in the sample of engagements selected for review or assessed at a higher level of peer review risk. CPA firms should be certain that both the administering entity and the team captain are informed if their practice includes any of the following engagements, whether or not the work has begun on these engagements or if such engagements were issued subsequent to the firm’s prior peer review:
- Governmental – Government Auditing Standards
- Employee Benefit Plans
- Depository Institutions (assets of $500 million or greater)
- Broker-Dealers (carrying and non-carrying)
- Service Organizations (SOC 1 and 2 reports)
When planning and scheduling a peer review, firms are advised against scheduling the commencement and exit conference dates in the month the peer review is due. The due date is the date all items are to be submitted to the OSCPA Peer Review Program. Allowing sufficient time to complete the peer review well in advance of the due date will help ensure the review is completed in a timely manner . Many factors such as illness, loss of staff, weather, etc. may delay the commencement of a review and could cause the review to be submitted late.
Extensions and Change in Year-End
A firm may request an extension of time to complete its peer review under certain circumstances.
After the Review
Once the review has been completed, the reviewer will issue a report to the firm. The review then goes through a technical review process prior to being presented to the Report Acceptance Body (RAB) for consideration. During either the technical review process or while a review is being considered by the RAB, changes may be requested, which could result in a revised report with a different rating.
Administrative and Technical Reviews
The administrative review ensures that all the required documents from the reviewer and the firm are received and complete. The technical reviewer determines whether the review has been conducted in accordance with governing standards and whether the firm has responded to any matters or deficiencies in an appropriate manner.
Once all of the review documents have been through the administrative and technical review process, they are presented to the RAB for consideration of acceptance. After the RAB meets and accepts a review, the firm should receive the review acceptance letter from the OSCPA within 14 days through PRIMA. However, some firms may be required to perform corrective actions before the review can be closed. Generally, the firm's next review due date is set three years later.