Quality management implementation starts now

By Laura Hay, CPA, CAE, OSCPA executive vice president

The best time for firms to begin implementing the new AICPA Quality Management Standards is now. Ahava Goldman, AICPA associate director of Audit and Attest Standards spoke to attendees at the Ohio Accounting Show and shared a best-practice implementation timeline and strategies for the new standards.

Issued in June 2022, the four new standards are:

• Statement on Quality Management Standards (SQMS) No. 1, A Firm’s System of Quality Management

• SQMS No. 2, Engagement Quality Reviews

• Statement on Auditing Standards (SAS) No. 146, Quality Management for an Engagement Conducted in Accordance with Generally Accepted Auditing Standards

• Statement on Standards for Accounting and Review Services (SSARS) No. 26, Quality Management for an Engagement Conducted in Accordance with Statements on Standards for Accounting and Review Services

WE BELIEVE THIS QUALITY MANAGEMENT SYSTEM IS VERY SCALABLE, BECAUSE IT IS TAILORED TO THE NATURE AND CIRCUMSTANCES OF THE FIRM AND THE ENGAGEMENTS IT PERFORMS. THIS DOES NOT REQUIRE FIRMS TO DO THINGS THAT ARE NOT RELEVANT FOR THEIR SIZE OF FIRM.

Ahava Goldman, AICPA associate director of Audit and Attest Standards

Key callouts

The requirement to implement Quality Management (QM) standards applies to every firm that conducts engagements under SASs, SSAEs, or SSARS.

The standards apply a risk-based approach, in which the firm is required to consider risks specific to the practice, rather than being able to rely upon one-size-fits-all practice aids.

Updated components include more robust leadership and governance requirements, and an enhanced monitoring and remediation process.

SQMS No. 1 components

The firm’s system of quality management includes eight components, two of which are new:

1. The firm’s risk assessment process (new)

2. The monitoring and remediation process

3. Governance and leadership (adapted from the current leadership responsibilities for quality within the firm)

4. Relevant ethical requirements

5. Acceptance and continuance of client relationships and specific engagements

6. Engagement performance

7. Resources (adapted from the current human resources component)

8. Information and communication (new)

Of note:

Firm leadership is required to take overall responsibility for the quality management system, to ensure that there is an annual evaluation of the system, and to perpetuate a culture that demonstrates a commitment to quality and permeates throughout the firm.

The risk assessment process requires the firm to (1) establish quality objectives specified in SQMS No. 1 (2) identify and assess risks that would affect the ability to achieve quality objectives, (3) design and implement responses to those risks in the form of policies and procedures, and (4) identify circumstances that would require updating the responses in between evaluations (for example, accepting a new industry or level of engagement.)

Monitoring and remediation include (1) a framework for evaluating findings, identifying deficiencies, and investigating the root causes of deficiencies, (2) appropriate remediation of deficiencies and determining if those remedial actions are effective, and (3) communication to the engagement team and others.

Determination of when an Engagement Quality Review (EQR) is appropriate is the firm’s judgment, but the QM system needs to set the criteria for when an EQR is performed.

For audit engagements, SAS 146 addresses the engagement partner being sufficiently and appropriately involved in the audit.

Effective dates

Dec. 15, 2025, is the date by which SQMS No. 1 implementation should be completed, and the quality management system of the firm be in place and operational.

From now until 2025, firms should perform their risk assessment, gap analysis, and designing and implementing new responses. Peer reviewers are a great resource to consult in conducting the firm’s risk assessment and identifying new responses.

Between Dec. 15, 2025, and Dec. 15, 2026, firms should:

• Perform the firm’s first annual evaluation as required under the new standards

• Perform EQ reviews as required by firm policy

• Apply the requirements of the QM SAS starting with calendar year 2026 engagements

Early adoption is permitted if all the QM standards are implemented at the same time.

Implementation steps

Best-practice implementation steps Goldman recommended are:

1. Understand the standards

Several implementation resources can be found at: https://www.aicpa.org/auditqm

In addition to CPE and executive summaries, practice aids include a crosswalk from Statement on Quality Control Standards No. 8 to SQMS No. 1, and a practice aid for small firms and sole practitioners.

2. Develop a plan for implementation

Develop an implementation plan and timeline. Determine who in the firm will own the process, and who will lead the implementation. Consult with the firm’s peer reviewer. Include time in budgets for appropriate personnel.

3. Perform the firm’s risk assessment

Establish required quality objectives. Identify and assess quality risks. Consider tackling one component at a time.

4. Perform a gap analysis

Map existing responses to the risks identified and identify gaps for which new responses are required. “You may find that there are things you can stop doing,” noted Goldman. “Some firms are identifying existing responses that don’t match to a risk.”

5. Design and implement new responses

AICPA practice aids are helpful in identifying potential responses, but the tailoring of the process to the circumstances of the firm will require customizing those responses and identifying additional responses.

6. Document

Prepare the plan document. “The hardest part in documenting the firm’s QM plan is getting the level of risks right,” said Goldman. “The firm is not required to document every single consideration. You don’t want to be at 30,000 feet; but you don’t want to be in the weeds either. For smaller practices, the elements for each component may simply be Quality Objectives, Quality Risks and Responses, and how they address risks.”

7. Establish the process for ongoing monitoring and remediation

Design the monitoring system, including how findings will be identified, evaluated, remediated and communicated. How will the design of the QM system and processes be evaluated, including changes in standards and consideration of the results of previous monitoring activities?

8. Evaluate whether the system provides reasonable assurance that objectives of Quality Management are being met

This is a step-back requirement of leadership, to be conducted annually, including in peer review years. The first annual evaluation is to be completed within one year of Dec. 15, 2025.

DEC. 15, 2025 SEEMS LIKE A LONG WAY OFF, BUT THE IMPLEMENTATION PROCESS IS LONG. START NOW, GET IT RIGHT THE FIRST TIME, GET IT DONE ON TIME, AND IT WON’T BE OVERWHELMING.”

Ahava Goldman, AICPA associate director of Audit and Attest Standards

Laura Hay, CPA, CAE is the executive vice president of The Ohio Society of CPAs and staff liaison to the Accounting, Auditing, Professional Ethics Committee and Peer Review Committee. She can be reached at Lhay@ohiocpa.com or 614.321.2231.

Learn more about the new quality management standards by taking “Audit & Attest Update: What’s Going on at the AICPA” at my.ohiocpa.com