For a small CPA firm, peer review is the one time every few years when an outside practitioner reads your files the way a regulator, a lender or a plaintiff's expert might. It is also a licensing matter: most state boards of accountancy require firms that perform accounting and auditing work to be enrolled in a peer review program and to keep their review current.
This guide covers the AICPA Peer Review Program as it applies to small and mid-size firms that perform nonissuer audits, reviews and compilations. It explains which type of review applies, how reviews are rated, what reviewers tend to flag, and how to prepare. It paraphrases the AICPA Standards for Performing and Reporting on Peer Reviews (the PRP manual). It is not a substitute for the current PRP sections or your administering entity's guidance.
What is AICPA peer review?
AICPA peer review is a practice-monitoring program in which a qualified CPA from another firm evaluates a firm's accounting and auditing practice. Firms that audit issuers are inspected by the PCAOB instead for that work; the AICPA program covers the nonissuer practice.
The program is administered at the state level by administering entities, usually the state CPA society, with the AICPA's National Peer Review Committee covering certain firms. A firm enrolls, the administering entity schedules its review based on the firm's peer review year-end, and reviews generally recur every three years.
The program's stated aim is educational and remedial. A poor result usually leads to corrective actions and implementation plans rather than discipline, though state boards can act on results and failed reviews.
System review vs engagement review
The type of review depends on the highest level of service the firm performs.
| System review | Engagement review | |
|---|---|---|
| Who needs it | Firms that perform engagements under the SASs (audits), Government Auditing Standards, or examinations under the SSAEs | Firms whose highest level of service is SSARS reviews or compilations, or certain SSAE engagements that do not trigger a system review |
| Focus | The firm's system of quality management and whether it is designed and complied with, plus engagement-level work | Whether selected engagements were performed and reported on in conformity with professional standards in all material respects |
| Where it happens | Usually at least partly on-site or through remote access to the firm's systems | Usually off-site; the reviewer receives copies of selected reports and engagement documentation |
| What is reviewed | Quality management documentation, monitoring, independence, CPE, plus a risk-based selection of engagements | A selection of engagements across the firm's partners and engagement types |
System review
A system review looks at the firm as a whole. The reviewer obtains an understanding of the firm's system of quality management, assesses peer review risk, and selects engagements and functional areas to test. Under the AICPA's quality management standards (SQMS No. 1), that system includes the firm's own risk assessment process, its responses to quality risks, and its monitoring and remediation process.
Certain engagement types are must-select in a system review if the firm performs them. The categories have included audits under Government Auditing Standards (including single audits), audits of employee benefit plans subject to ERISA, audits of depository institutions subject to FDICIA, audits of carrying broker-dealers, and SOC 1 and SOC 2 examinations. If you perform any of these, expect at least one to be pulled.
Engagement review
An engagement review is narrower. The reviewer does not test the firm's system of quality management. Instead, the reviewer reads the selected reports and financial statements and the documentation required by the SSARS (AR-C sections) or SSAEs, and evaluates whether the engagements conformed to professional standards.
Preparation of financial statements under AR-C 70 is generally outside the scope of AICPA peer review, which covers compilations, reviews and higher services, but state board rules can differ.
How peer review results are reported
Both review types end in a report with one of three ratings:
- Pass: the firm's system (or, for an engagement review, the engagements reviewed) provides reasonable assurance of conformity with professional standards in all material respects, with no deficiencies reported.
- Pass with deficiency(ies): the system provides that assurance except for one or more deficiencies described in the report.
- Fail: the system (or the engagements reviewed) does not provide reasonable assurance of conformity with professional standards in all material respects.
Below the report level, reviewers document matters on Matter for Further Consideration (MFC) forms. Matters that are more than isolated or that point to a pattern are elevated to a Finding for Further Consideration (FFC), which the firm responds to in writing. FFCs do not appear in the report but are part of the review record and can lead to implementation plans.
When an engagement is nonconforming, meaning it was not performed or reported on in conformity with applicable standards in all material respects, the firm is expected to consider whether it needs to take action under the standards on omitted procedures (AU-C 585 for audits) or on subsequent discovery of facts.
Peer review and the quality management standards
The AICPA Peer Review Board updated the peer review standards to align with SQMS No. 1 and SQMS No. 2. The quality management-related revisions (Peer Review Standards Update No. 2) apply to peer reviews with years ending on or after December 31, 2025. Firms were required to have their system of quality management designed and implemented by December 15, 2025, with the first annual evaluation due by December 15, 2026. See our guide to SQMS 1, SQMS 2 and SAS 146 for what that system involves.
Areas to self-review before a peer review
The themes below are areas where the standards set clear documentation or performance requirements. They are a good place to focus self-review.
Audit engagements
- Risk assessment not linked to procedures. The file documents risks under AU-C 315 but the audit program is a standard checklist that does not respond to them. Significant risks, including the presumed fraud risk in revenue recognition, need a tailored response.
- Internal control understanding is thin. Under the risk assessment standard as revised by SAS No. 145, the auditor must understand the components of the entity's system of internal control and evaluate the design and implementation of certain controls, even when not testing operating effectiveness. A file that says "we do not rely on controls" and stops there does not meet that requirement.
- Materiality not documented or not used. AU-C 320 requires the file to show the benchmark, the reasoning and the amounts, and performance materiality should actually drive sample sizes and scoping.
- Sampling that cannot be re-performed. The population, sampling unit, sample size rationale and selected items must be identifiable. See AU-C 530.
- Accounting estimates not tested. Allowances, inventory reserves and impairment need an evaluation of management's method, data and assumptions, not just management's number.
- Documentation gaps. No evidence of who performed and reviewed the work, conclusions missing, or changes after the documentation completion date with no explanation. AU-C 230 sets the bar: an experienced auditor with no connection to the engagement should be able to understand the work.
- Reporting errors. Outdated report formats, missing emphasis-of-matter or other-matter paragraphs, and incorrect references to the financial reporting framework.
- Disclosure gaps. Missing or incomplete disclosures for leases (ASC 842), revenue (ASC 606), credit losses (ASC 326) and going concern.
Reviews and compilations
- No engagement letter, or a letter that does not contain the elements the SSARS require.
- Review procedures not documented. For an AR-C 90 review, reviewers expect documentation of analytical procedures with expectations, inquiries and the responses, and the representation letter.
- Independence impairments not handled. A compilation report issued when the firm is not independent must say so; a review cannot be performed if the firm is not independent.
- Report wording errors, including outdated report language and incorrect references to supplementary information.
Firm-level matters in a system review
- Monitoring that was not performed, or was performed by the same person who did the engagement.
- Independence confirmations not obtained or nonattest services not evaluated under the AICPA Code.
- CPE records incomplete, especially specialized CPE for governmental and ERISA work.
- Quality management documentation that is a purchased template never tailored to the firm.
How to prepare for a peer review
Preparation starts long before the reviewer is scheduled. The firms that do well treat peer review as the visible end of continuous monitoring.
Twelve months out
- Confirm your review type and due date with your administering entity. Changes in practice, such as taking on your first single audit or ERISA audit, can move a firm from an engagement review to a system review.
- Run your monitoring. Under SQMS No. 1 the firm needs a monitoring and remediation process. For a small firm, that usually means a documented inspection of a sample of completed engagements by someone not involved in them, often an outside reviewer.
- Fix root causes, not just files. If inspection finds the same issue in several files, change the methodology, template or training. Peer reviewers look at whether the firm acted on its own monitoring results.
Three to six months out
- Inventory engagements. Prepare a complete list of accounting and auditing engagements with report dates in the peer review year, by partner and by industry. Reviewers select from this list, so omissions are a serious problem.
- Identify must-select engagements and give them an extra internal review.
- Gather firm-level documentation: quality management documentation, the annual evaluation of the system, independence confirmations, CPE records, licenses and engagement acceptance and continuance documentation.
During the review
- Assign one point of contact to respond to reviewer requests and track MFCs.
- Respond to MFCs and FFCs carefully. Explain what happened, the root cause, and what the firm will do. Do not argue with standards; do provide context the reviewer may have missed.
- Address nonconforming engagements promptly, considering AU-C 585 for audits and whether reissuance or additional procedures are needed.
Peer review checklist
Use this checklist as a starting point. It is not a substitute for the AICPA practice aids and checklists.
- Review type and peer review year-end confirmed with the administering entity
- Complete list of A&A engagements in the peer review year, by partner
- Must-select engagements identified and internally reviewed
- System of quality management documented, tailored and evaluated
- Monitoring performed and results remediated
- Independence confirmations and nonattest service evaluations on file
- CPE records complete, including governmental and ERISA requirements where applicable
- Engagement letters on file for every engagement
- Materiality, risk assessment and responses documented and linked in audit files
- Sample selections identifiable and re-performable
- Summary of uncorrected misstatements evaluated (AU-C 450)
- Preparer and reviewer sign-offs with dates; documentation assembled within 60 days
- Report formats current; disclosures checked against current GAAP
Frequently asked questions
How often does a CPA firm have a peer review?
Firms enrolled in the AICPA Peer Review Program generally have a review once every three years, timed to the firm's peer review year-end. The administering entity sets the due date, and extensions require approval.
Can a firm choose an engagement review instead of a system review?
A firm can only have an engagement review if it does not perform engagements that require a system review, such as audits under the SASs or Government Auditing Standards, or SSAE examinations. A firm that only needs an engagement review may elect a system review.
Does a fail rating mean a firm loses its license?
A fail rating does not automatically end a firm's ability to practice, but the administering entity will typically require corrective actions, and state boards may impose their own requirements. Repeated failures can lead to referral and further action.
Who can be a peer reviewer?
A peer reviewer must be a CPA with current experience in the engagement types being reviewed, hold a supervisory role in a firm with an acceptable peer review result, and meet AICPA training requirements. Independence from the reviewed firm is required.
What is the difference between an MFC and an FFC?
An MFC records a matter the reviewer noted during the review. An FFC is a finding that is more significant or systemic, which the firm must respond to in writing and which may result in an implementation plan, but which does not rise to a deficiency in the report.
CORAA prepares ready-to-review audit files for US CPA firms from QuickBooks books; you review and sign. See /us.
Sources
- AICPA, Standards for Performing and Reporting on Peer Reviews (Peer Review Standards), including Peer Review Standards Update No. 2 (system of quality management revisions effective for peer reviews with years ending on or after Dec. 31, 2025)
- AICPA, Peer Review Program Manual and administering entity guidance: https://www.aicpa-cima.com/resources/landing/peer-review
- AICPA, SQMS No. 1 and SQMS No. 2
- AICPA, SAS No. 145 (AU-C 315), SAS No. 146 (AU-C 220), AU-C 230, 320, 450, 530 and 585
- AICPA, Statements on Standards for Accounting and Review Services, AR-C 70, 80 and 90
- GAO, Government Auditing Standards (2024 Revision)
Part of CORAA University · Quality management and practice: related guides, calculators and templates.
AU-C references are to AICPA Professional Standards, paraphrased here; read the standard itself before relying on a requirement. This page is guidance, not professional advice. Report an error