AuditsCompliance-in-a-Box: The Startup Guide to Audit-Ready DocsSVSid Varma · 12 min readFor CPA firm leaders and quality management owners running an accounting and auditing practice through the first annual evaluation and a quality management peer review.
30-day trialUnlimited free viewersNo credit card required
Checked against primary sources on 18 October 2026.
CPA firms with an accounting and auditing practice performing engagements under AICPA professional standards must design, implement and operate a system of quality management.
Peer reviewers in the AICPA Peer Review Program, using the quality management checklists finalized April 24, 2026; firm leadership also evaluates the system itself each year
System in place by December 15, 2025; first evaluation within one year of implementation, then at least annually; peer review on the firm's peer review cycle
SQMS No. 1, codified as QM sec. 10, effective December 15, 2025; read with SQMS No. 2 (QM sec. 20) on engagement quality reviews, 2025-12-15. Free to read.
| Date | What happens | Status |
|---|---|---|
| 2025-12-15 | Systems of quality management must be designed and implemented under SQMS No. 1 | Done |
| 2026-04-24 | AICPA releases final quality management peer review checklists, replacing the pilot versions | Done |
| 2026-12-15 | First evaluation of the system of quality management due, one year after implementation | Scheduled |
Each one needs an owner, an approval, and proof it reached the people it covers.
QM sec. 10, The firm's risk assessment process; Documentation
The firm documents its quality objectives, the quality risks it identified and the responses designed to address them, and keeps that record current as conditions change.
QM sec. 10, Governance and leadership
Ultimate responsibility and accountability for the system sit with the managing partner or equivalent, with operational responsibility assigned to named individuals.
QM sec. 10, Relevant ethical requirements
Policies and procedures for relevant ethical requirements, including independence, with independence inquiries and confirmations from personnel memorialized.
QM sec. 10, Acceptance and continuance of client relationships and specific engagements
Procedures for accepting or continuing clients and engagements, with each completed evaluation kept as evidence that the response operated.
QM sec. 10, Information and communication
Records of how quality policies, changes and expectations were communicated across the firm, including who received them, when and through which channel.
QM sec. 10, Monitoring and remediation process; Evaluating the system of quality management
Monitoring results, root cause analysis and remediation are documented, and the individual with ultimate responsibility evaluates the system at least annually and records a conclusion.
Citations are to the standard or regulation; wording is ours. Component titles are shown instead of paragraph numbers, which sit behind AICPA's login.
What reviewers sample about these documents and the people they cover.
AICPA guidance says peer reviewers assess whether the system is designed appropriately, implemented and operating effectively, including whether the firm identifies objectives, quality risks and responses to those risks.
Reviewers interview firm leadership to confirm they understand the system, monitor it and own its outcomes, which brings the annual evaluation and its conclusion into scope.
Reviewers look for policies embedded in workflows and applied consistently across engagements, supported by items such as training records, completed acceptance evaluations and independence confirmations.
Reviewers examine whether monitoring findings led to root cause analysis and remediation, and how the system has evolved since implementation.
Write each policy, send it through approval, and send it to the people it covers. Each acknowledgment is recorded by name, with the version, the date and the time.
When a policy changes, the new version is approved, its Editor sends it out again, and everyone it applies to is asked again. Export the record as a PDF or CSV, or give a reviewer Viewer access to the documents their tags allow.
Need help with the rest of AICPA SQMS No. 1? Find a consultant for your standard (opens in a new tab).
Your region’s laws, the standards your customers ask for, and your own house rules. Write each one as a policy, approve it, and send it to the people it covers.
Firms had to design and implement their systems by December 15, 2025. Leadership then has one year from implementation to perform the first evaluation, which the Journal of Accountancy places at December 15, 2026, with evaluations annually after that.
The individual assigned ultimate responsibility and accountability for the system, the managing partner or equivalent, evaluates whether the system provides reasonable assurance that its objectives are achieved. Journal of Accountancy guidance describes a signed conclusion memo stating the conclusion and its basis.
The standard is risk-based and scalable, so documentation follows the firm's size and complexity. Small practices may evidence communication with meeting minutes and archived emails, provided the trail from objective to risk to response to evidence holds.
SQMS No. 2 (QM sec. 20) addresses engagement quality reviews at the engagement level. The firm-level system, its policies and the annual evaluation are set by SQMS No. 1.
The firm sets a retention policy long enough for the firm and its peer reviewer to monitor the system, or longer where GAAS or law requires. Keeping prior cycles also shows trends across evaluations.
free for 30 days