New Standards for Quality Management in Your Accounting or Auditing Practice

The new Quality Management (QM) Standards, which will replace the quality control standards that currently apply, require significant revisions to the quality control systems of any CPA firm performing audits, reviews, compilations, or other attest engagements. Although the preparation service is a non-attest service, the new QM standards also apply to firms that have restricted their accounting practice to the preparation service. However, you are exempt if you are solely a tax and bookkeeping practice.

There are two new QM standards:

• AICPA Statement on Quality Management Standards (SQMS) No. 1, which requires that a firm with an accounting or auditing practice design, implement and operate a system of quality management. This new quality management standard replaces the existing standard: AICPA Statement on Quality Control Standards (SQCS No. 8). SQMS No. 1 requires your system of quality management (SOQM) have eight components. Most of these components carry over from the old quality control standards, but the first one is new and requires special attention. This is the risk assessment process. The QM standards require the firm to apply a risk-based approach in designing, implementing, and operating the components of its SOQM.
• AICPA Statement on Quality Management Standards (SQMS) No. 2, which addresses the appointment and eligibility of the engagement quality reviewer and performance of engagement quality reviews (EQR) by a qualified party not part of the engagement team. SQMS No. 2 emphasizes the need for a proper response to quality risk but does not introduce many new concepts or significantly revise the existing requirements for pre-issuance reviews contained in SQCS No. 8.

Implementing SQMS No. 1 will be a relatively heavy lift for most CPA firms, particularly for smaller firms, like mine, that may be primarily a tax practice.

SQMS No. 1 will require you to consider how you manage risk in your accounting and auditing practice and based on those considerations you will need to prepare properly tailored policies and procedures. Moreover, you will need to document the risk assessment supporting those policies and procedures, documentation that was not required under the old quality control standards.

Under the old quality control standards, many firms would utilize a standard template, perhaps provided to them by a practice aid or by a CPE instructor, for use as their quality control document. Under the new quality management standards, the quality management document will be designed by you specifically for your firm in response to your risk assessment.

This does not mean you have to throw out your old quality control document, which might serve as a starting point. Many of the policies and procedures in your old quality control document will carry over.

If you have an audit practice and are undergoing a system peer review, expect your peer reviewer to ask to see documentation of your risk assessment supporting the policies and procedures in your new quality management document.

Upcoming CPE: 3 courses on the new QM Standards:

The quality management standards and the peer review standards are two different things. The AICPA recently issued Peer Review Standards Update (PRSU) No. 2, which aligns the peer review standards with the new quality management standards. If you do not have an audit practice, and therefore undergo an engagement peer review, the engagement peer review will continue to be focused on the engagements, rather than on your QM system. As in the past, the peer reviewer on an engagement peer review will not ask to see your written policies and procedures for quality management.

You might ask then whether you need a quality management document if you do not conduct audits and therefore are not subject to a system peer review. The short answer is that you will need to comply with the new quality management standards even though your peer reviewer will not be testing compliance.

The AICPA issued a practice aid to help you design your SOQM. There are two versions of the practice aid, one for sole proprietors, and another for small- to medium-sized partnerships.

The AICPA practice aid for sole proprietors is here:
https://www.aicpa-cima.com/resources/download/practice-aid-quality-management-system-sole-practitioners

The AICPA practice aid for small to medium partnerships is here:
https://www.aicpa-cima.com/resources/download/free-practice-aid-set-up-your-a-and-a-quality-management-system-small-medium-firms

Within the practice aid, whether for sole proprietor or for partnership, the most important tool is the “Example Risk Assessment Template.” You can use this Excel template to document your risk assessment process. Your peer reviewer on system peer reviews will be looking for this or something like it. Also useful is the guide “Establishing and Maintaining a System of Quality Management for a CPA Firm’s Accounting and Auditing Practice,” particularly Chapter 3, entitled “Library of Quality Objectives, Potential Risks, and Potential Responses,” which provides numerous example responses to identified risks.

However, if you are looking for a ready-made quality management document, the AICPA has not provided one. This makes sense because of the eight components required for your SOQM under the QM standards, the first one is risk assessment. If you simply adopt a ready-made quality QM document, you have not performed the risk assessment required under the standard.

The AICPA Excel template, when completed, cannot be deemed your Quality Management Document (or “Quality Control Document” using the old terminology). Once completed, the AICPA Excel template on its own provides only partial documentation of your SOQM. The Excel template addresses six of the eight elements required under the new QM Standards. The two missing components are 1) the policies and procedures for risk assessment and 2) those for monitoring and remediation. You need to create a quality management document that formalizes and fleshes out the responses to quality risk summarized on the Excel template and be sure to address the additional two components.

The new QM standards will take effect December 15, 2025. Although you have until December 15, 2025, to implement these standards, you may wish to implement early to align with the start of your peer review fiscal year. Otherwise, you will have a split year, with your firm under the existing quality control standards for the first part of its peer review year, and under the new standards for the remainder of the year.

About the Author: Harry Bose has been practicing public accounting in Pendleton, Oregon, since 1986 with a focus on income taxation, accounting and auditing. He is active in peer review, a member of the OSCPA Peer Review Committee, and a past member on an AICPA peer review task force. Harry chaired the OSCPA during the Society’s fiscal year April 2016 through March 2017.