Risk Management in the New Quality Management Era: Practical Lessons for CPA Firms

By Duncan B. Will, CPA/ABV/CFF, CFE

In CAMICO’s newsletter, IMPACT (issue 126), the article, “Be Prepared: The Quality Management Standards Are Coming,” addressed the transition to the AICPA’s Statements on Quality Management Standards (“SQMS”), focusing on steps firms should take to build a compliant system by December 15, 2025 — the date by which firms were required to have their systems of quality management designed and implemented. This article, as with the earlier, is not intended as a treatise on the SQMS. Instead, it provides a brief overview of aspects of the SQMS, and shares observations and some risk management advice intended to be beneficial for firms subject to the new standards.

This article has a different premise: firms subject to those standards have drafted their Quality Management Document (QMD) and now must make sure that their document is being followed, evaluated, and refined. A well-written QMD should not sit on a shelf as evidence of compliance. It should function as an operating manual that influences how the firm assigns responsibility, performs engagements, monitors quality, and responds when deficiencies or circumstances change.

Once a firm adopts a Quality Management Document, firm leadership’s responsibility shifts from designing the system of quality management (SQM) to executing it. Managing partners and firm leadership should make clear that their QMD is not optional guidance but is the framework that firm personnel are to follow in areas such as acceptance and continuance, independence, objectivity, consultation, supervision, engagement quality review, and remediation. Firm leadership should reinforce that expectation regularly; assign clear ownership for major QM processes; and verify that the individuals assigned to those roles have sufficient time, authority, competence, and accountability to carry them out. A QMD is most effective when tone at the top is visible in everyday decisions rather than reflected only in policy language.

Ultimate responsibility and accountability for the SQM must be assigned to the firm’s CEO/managing partner or managing board (or equivalent), with separate operational responsibility for the SQM and for monitoring and remediation. The individuals assigned ultimate responsibility and accountability for the system of quality management must evaluate the system as of a point in time and at least annually, and to conclude whether the system provides reasonable assurance that the objectives of the system are being achieved. That conclusion should consider identified deficiencies, including their severity and pervasiveness, root causes, remedial actions, and effect on the system.

Delegation of tasks does not relieve the firm of ultimate responsibility, nor those assigned of accountability. So, that responsibility still rests with the managing partner even if the managing partner is a tax partner with no or few clients subject to the SASs, SSARSs, or SSAEs.

Firms will encounter avoidable quality problems if their QMD assigns responsibilities in theory but not in practice. Ideally, firms will confirm that each significant quality management function has an identified owner, a workable process, and a reporting path to follow when issues arise. Those with this responsibility must have sufficient time, authority, experience, and a direct line to leadership. That includes not only who is responsible for independence oversight, monitoring, and remediation, but also who follows up when deadlines are missed, consultations are not documented, or engagement issues resurface. Role clarity should also extend to succession and backup coverage so that qualified personnel are available to carry out QM responsibilities when key individuals are unavailable. If responsibilities exist only in the document and not in actual firm behavior, the QMD loses value as a QM tool.

For firms that already have a QMD, one of the most important best practices is to treat monitoring as a continuous check on whether the document is being followed as intended. Monitoring should not be limited to asking whether a policy exists. Rather, it should ask whether the policy is operating consistently and producing the desired result. A practical approach is to build a monitoring calendar that tests selected processes throughout the year, such as independence confirmations, engagement inspections, consultation requirements, documentation standards, and follow-up on prior findings. Firms’ monitoring activities should be designed and performed to monitor activities that provide a basis for identifying deficiencies and to determine the nature, timing, and extent of monitoring, taking into consideration risk ratings, prior results, complaints, and external inspections.

Remediation should then be tracked with the same discipline: each issue should be evaluated, assigned to a responsible person, given a completion expectation, and revisited to confirm that corrective action was implemented and effective. Remediation must be designed and implemented to address root causes and then evaluated for effectiveness, and modified if determined to be ineffective.

Firms following a QMD should periodically step back and ask not only whether reviews are being performed, but whether they are being performed objectively and by individuals with the right qualifications. Internal inspections are more useful when reviewers are sufficiently independent from the work being evaluated and capable of distinguishing a minor execution lapse from a broader weakness in the system. Inspections of completed engagements are required as part of monitoring, not optional. Rather than relying on convenience or routine rotation alone, firms often gain more value by reviewing higher-risk engagements, newer service lines, matters involving significant judgment, first-year clients, or teams with prior findings. The engagements and partners selected must be responsive to quality risks, not solely based on rotation or convenience. Firms must establish policies that require monitors to be competent and capable and that address their objectivity, with objectivity enhanced when individuals don’t monitor engagements on which they worked. In smaller firms, outside assistance may be a sensible way to improve objectivity and strengthen the firm’s ability to evaluate whether the QMD is functioning as designed.

Firms must evaluate findings to determine whether deficiencies exist, and to evaluate the severity and pervasiveness of identified deficiencies, including root causes and their aggregate effect. One of the most valuable disciplines under an existing QMD is learning to recognize when a problem calls for a one-time correction and when it signals that the document or related processes need to be revised. An isolated engagement misstep may be resolved through coaching, supervision, or file-level correction. But repeated issues, inconsistent performance across teams, recurring consultation failures, or monitoring findings that point to confusion in the firm’s expectations may indicate that the QMD is incomplete, outdated, unclear, or unrealistic. When that happens, the firm should not simply restate the policy. Instead, it should reconsider whether the documented response matches how the firm operates and whether additional guidance, training, or procedural changes are needed.

Where the QMD addresses EQRs, firms should make sure the documented criteria are applied consistently and not informally overridden for scheduling or staffing convenience. Best practice is to define clearly which engagements require an EQR, when the reviewer must become involved, what matters the reviewer is expected to evaluate, and how the review will be documented. Firms should also revisit those criteria periodically. As engagement risk, service offerings, or personnel change, the QMD may need to be adjusted so that EQR requirements remain aligned with the firm’s actual risk profile rather than with outdated assumptions.

If an EQR is required or selected as a response to quality risk, the firm needs to identify a reviewer with the competence, capability, authority, time, and objectivity to perform the review. When the firm has no eligible reviewer available outside the engagement team, the firm should obtain an external qualified reviewer. Smaller firms should establish relationships with qualified external reviewers before the need arises or decline engagements if an eligible reviewer cannot be secured. During acceptance and continuance, firms should consider reviewer availability so they do not accept or continue engagements requiring an EQR without a realistic plan for obtaining an eligible reviewer.

A QMD is only as effective as the firm’s ability to translate it into consistent behavior. That means communication and training should be practical, role-specific, and recurring. Personnel should understand not only what the document says, but what it requires them to do in real situations, when to escalate issues, who has the authority to resolve them, and where discretion ends. Equally important, firms should create feedback loops so that engagement teams, reviewers, and firm leadership can identify where the QMD is unclear, burdensome, outdated, or does not match its operations. The document should be revisited whenever monitoring results, staffing changes, new service lines, technology changes, regulatory developments, or repeated deficiencies suggest that the firm’s quality responses need refinement. A strong QMD is therefore not static; it is a living document that evolves as the firm learns more about its own quality risks and how best to address them.

Although not intended to be all-inclusive, firms that have already implemented a Quality Management Document should consider the following post-implementation risk management tips:

Applicability: Determine Whether the Standards Apply Before Accepting or Expanding Services

• If your firm performs or plans to perform engagements under the SASs, SSAEs, or SSARSs, the AICPA quality management standards apply. If you are unsure whether your services trigger those requirements, do not guess. Call us so we can help you think about the applicable standards before the engagement is accepted or expanded.

Implementation: Treat the QMD as the Start of the System, Not the End of the Project

• Treat implementation as the starting point, not the finish line. Don’t assume completion equals compliance. Your QMD may be drafted, but will fail if responsibilities are unclear, deadlines are missed, or personnel revert to prior habits. Periodically compare the firm’s actual behaviors with the documented process and promptly address gaps.
• Document what the firm expects to do — then follow it. Overly aspirational language can create avoidable peer review, inspection, or professional liability risk if the firm documents procedures that are more extensive than what it will consistently perform. The QMD and related records should be precise, realistic, and aligned with how the firm intends to operate.
• Translate policies into operating routines. Firms most likely to follow their QMD well are those that convert key requirements into recurring actions, calendars, checklists, assignment workflows, consultation triggers, and sign-off expectations. When policies remain abstract, consistency will likely erode.
• Document why assigned leaders and monitors are qualified for their roles. Your peer reviewer, or worse, plaintiff’s counsel if your firm becomes subject to a claim, may question their qualifications.
• Train to real scenarios, not just policy language. Personnel are more likely to follow the QMD when training uses the firm’s actual workflows, common fact patterns, documentation issues, and escalation decisions. Post-implementation training should focus on how the system works and where professional judgment must be documented and supported.

Operation: Ensure the System Functions in Daily Practice

• Embed EQR discipline early rather than waiting until your peer review is imminent. Where an engagement quality review is required or selected as a response to quality risk, the reviewer should be involved early enough to evaluate significant judgments before report release pressure limits the value of the process. A late-stage or tardy review can become a compliance formality rather than a meaningful quality response. Timely involvement helps the EQR function as a quality response rather than a last-minute administrative step.
• Define EQR criteria clearly and consistently apply them. Firms should avoid ad hoc decisions about which engagements receive EQRs. Criteria should reflect the firm’s risk assessment and be revisited as the firm’s client mix, engagement complexity, staffing profile, and prior findings change. Higher-risk engagements, significant estimates, going concern issues, first-year engagements, and emerging practice areas are indicators of when firms should reassess whether their EQR criteria remain appropriate.
• Protect reviewer objectivity and competence. An EQR adds value only if the reviewer has sufficient authority, experience, and objectivity to challenge significant judgments. In smaller firms, that may require using personnel outside the engagement team or obtaining external support when independence, expertise, or capacity is limited.
• Plan for reviewer availability before accepting or continuing EQR engagements. If an EQR is required or selected as a response to quality risk and the firm has no eligible reviewer available outside the engagement team, the firm should identify a qualified external reviewer before the need arises or decline engagements for which an eligible reviewer cannot be secured. Reviewer availability should be considered during acceptance and continuance, not after the engagement is substantially complete.
• Review consultation activity. Monitor whether teams consult when required, document the consultation, and follow the conclusion reached. Too few consultations may not mean the firm is oblivious to or ignoring difficult issues. It may mean difficult issues are not recognized or elevated.

Monitoring: Test Operation, Not Existence

• Use monitoring to test operation, not merely existence. It is not enough to confirm that a policy appears in the QMD. Monitoring should evaluate whether the policy is being followed consistently, whether the evidence of compliance is reliable, and whether the policy is achieving the quality objective it was intended to address.
• Establish a foundation for your monitoring calendar. Monitoring works best when it is ongoing, not rushed at year end or in anticipation of peer review. Early scheduling will help firms select engagements thoughtfully, assign qualified reviewers, preserve time for root cause analysis, and implement timely remediation to improve future behavior.
• Assign monitoring to someone with competence, authority, and sufficient time. Each attribute matters. Without competence, deficiencies may not be identified. Without authority, findings may not be addressed. Without sufficient time, monitoring can become a check-the-box exercise.
• Separate those who operate controls from those who monitor them. As with internal control, incompatible roles threaten objectivity. Monitoring is more reliable when it is performed by someone with enough independence from the activity being evaluated to challenge whether the control was properly designed, consistently applied, and effective.
• Build unpredictability into engagement selection. Prior issues should influence what gets reviewed, but they should not be the only driver. Every engagement, industry, partner, manager, and team should know that their work could be selected, including services that might not otherwise be targeted for review. That possibility strengthens accountability and improves the ability of those monitoring to identify risks that targeted reviews might miss.
• Don’t treat engagement quality reviews as a substitute for monitoring. EQRs can be an important response to engagement risks, but they focus on selected engagements before release. Monitoring looks across the firm to evaluate whether the quality management system is properly designed, implemented, and operating effectively, and whether findings require remediation. EQR results can inform monitoring, but they should not replace inspections, root cause analysis, remediation, and follow-up.

Remediation: Identify Root Causes, Assign Corrective Action, and Verify Follow-Through

• Investigate root cause before deciding on remediation. When findings recur, ask why. The “Five Whys Technique,” mentioned in the June 2025 IMPACT article, may be useful in identifying root causes. Fix the cause, not just your file.
• Assign remediation to qualified owners and revisit it. Corrective actions should specify responsibility, target dates, and follow-up. Merely discussing an issue is not remediation. Firms should confirm that the response was implemented, that personnel understood it, and that the issue does not continue to recur.
• Promptly communicate findings and corrective actions. Deficiencies should not stay siloed. Share what was found, why it matters, what changed, and who needs to act. The goal is not to blame. The goal is to help the firm learn from the issue, update the system, and prevent similar issues from recurring.

Continuous Improvement: Keep the QMD Current as the Firm’s Risks Change

• Keep your QMD current and adaptive. Your quality management documentation should reflect changes in the firm’s risks, services, staffing, and technology. Firms that periodically revisit their quality objectives, risks, responses, monitoring results, as well as whether assigned personnel remain qualified, authorized, accountable, and adequately resourced for their roles will be better positioned to comply with standards and improve performance.
• Update your risk assessment when technology, staffing, client mix, or workflow changes. Risk assessment is foundational to your quality management system. As risks change, revisit and update your QMD.
• Be thoughtful about when your QMD needs revision. Not every engagement error requires rewriting the document, but repeated inspection findings, recurring consultation failures, inconsistent EQR performance, changes in service offerings, turnover in key personnel, technology changes, or new regulatory expectations may signal that the QMD no longer fits the firm’s actual risks or operations.
• Consider collaborating with firms of similar size and practice areas. Thoughtful peer-to-peer discussions can help firms compare how they are applying their QMDs, identify blind spots, and glean insights about monitoring, documentation, training, EQR administration, and remediation that may improve their own system of quality management and related documentation.

The “Be Prepared: The Quality Management Standards Are Coming” article helped frame the urgency of preparing for the standards and building a compliant foundation. This article supplements that content, focusing on what comes next. For most firms, the real risk is no longer failing to draft their QMD but treating it as something to “set and forget” rather than as a living document. The discussion above, including the risk management tips, is intended to help firms strengthen day-to-day execution, make better use of monitoring and remediation, apply EQRs more effectively, and recognize when the QMD itself needs to evolve. Firms that consistently follow their QMD, monitor whether it is working as intended, recognize when it no longer reflects actual practice, and adjust it thoughtfully as risks and circumstances change will be better positioned to maintain quality, demonstrate accountability, and respond effectively to changing risks and demands.

CAMICO policyholders with questions regarding this article or other risk management questions should contact the Loss Prevention department at lp@camico.com or call our advice hotline at 800.652.1772 and ask to speak with a Loss Prevention Specialist.

Reprinted by permission from CAMICO.