Engagement Quality Review Guide: SQMS 2 and AU-C 220 for Small CPA Firms

An engagement quality review (EQR) is an objective evaluation, before the report is released, of the significant judgments the engagement team made and the conclusions it reached. Many firms previously called this a concurring or second-partner review. It sits at the intersection of three documents: SQMS No. 1 (which says when a review is needed), SQMS No. 2 (which says who can do it and what they do) and AU-C 220 as revised by SAS No. 146 (which says what the engagement partner must do).

This guide is practical: who needs one, who can be the reviewer, when it happens and what to keep. For the wider framework, see the SQMS 1 quality management guide.

What the standards say about when an EQR is needed

SQMS No. 1 requires the firm to establish policies and procedures that require an EQR for particular engagements. In summary, those are engagements for which an EQR is required by law or regulation, and engagements for which the firm determines that an EQR is an appropriate response to assessed quality risks.

For most small firms the second category matters. The firm decides which engagements need an EQR as part of its risk assessment. Criteria a firm might use include:

• audits of entities with public interest, such as financial institutions or entities with significant public accountability
• engagements under Government Auditing Standards and single audits
• employee benefit plan audits where the firm performs few of them
• first-year audits of complex entities
• engagements with going concern doubt, significant fraud risk, significant estimates or a modified opinion
• engagements for which the engagement partner has limited experience in the industry
• any engagement a lender, regulator or insurer requires to have a second review

Document the criteria in the firm's quality management policies and apply them consistently.

Not every engagement needs an EQR, and the standards do not require one for every audit. When no EQR is required, the engagement partner's own review and any consultation still apply. See AU-C 220 and the engagement partner's duties in SAS No. 146.

Who can be the engagement quality reviewer

SQMS No. 2 expects the firm to set eligibility criteria. In summary, the reviewer must have:

• competence and capabilities, including sufficient experience and knowledge of the engagement type and the industry, and the time to perform the review
• appropriate authority to challenge the engagement team's judgments
• objectivity: not a member of the engagement team, and not in a position where their judgment is compromised

A reviewer can be a partner or other individual in the firm, or an external individual. For a small firm with few partners, an external reviewer is often the only way to meet the objectivity requirement. The firm remains responsible for the appointment and for deciding that the reviewer is eligible.

Objectivity in practice

Consider these cases and record the conclusion:

• Consultation. The reviewer may be consulted on technical matters by the team, but should not make decisions for the team. If the reviewer effectively decided an accounting question, they have reviewed their own judgment.
• Prior engagement partner. A former engagement partner who becomes the reviewer creates a self-review threat. The firm's policies need to address the threat, including whether to set a minimum period before a former engagement partner can serve as reviewer.
• Close relationships. A family or close personal relationship with a member of management or the team.
• Firm size. Where only one qualified person exists, the answer is an external reviewer, such as another firm or a contractor.

The engagement team members should not select the reviewer for their own engagement. The firm's leadership, or the person it designates, should assign them.

What the engagement partner does

AU-C 220, as revised by SAS No. 146, requires the engagement partner for audits subject to an EQR to:

• determine that an engagement quality reviewer has been appointed
• cooperate with the reviewer and tell other team members to do so
• discuss significant matters and significant judgments with the reviewer, including those arising during the review
• not release the auditor's report until the EQR is complete

SAS No. 146 is effective for audits of financial statements for periods beginning on or after December 15, 2025. The application material notes that if the reviewer has communicated concerns about significant judgments or conclusions, the review is not complete. Frequent communication with the reviewer, and assigning someone on the team to coordinate requests, helps.

What the reviewer does

SQMS No. 2 sets out the performance of the review. In summary, the reviewer:

1. Understands the engagement by reading the planning documentation, the risk assessment, the strategy and other information about the entity and the team's conclusions. See the audit planning memo guide.
2. Discusses significant matters and judgments with the engagement partner and other team members.
3. Reviews selected documentation relating to significant judgments, including the team's evaluation of independence, the significant risks and how they were addressed, judgments on materiality, the evaluation of misstatements, matters communicated with management and those charged with governance, consultations and any going concern conclusions.
4. Evaluates the basis for the conclusions reached, including whether the documentation supports them.
5. Reviews the financial statements and the proposed report to evaluate the conclusion on the opinion and whether the report is appropriate.
6. Notifies the engagement partner when concerns remain, and when the review is complete.

The reviewer does not reperform the audit and does not replace the engagement partner's review. The aim is a fresh, challenging look at the matters most likely to be wrong.

Timing

The review is performed at appropriate points throughout the engagement, not only at the end. A review done in the last two days before the report date finds problems when the team has no time to fix them. A better pattern is:

The EQR must be completed on or before the date of the auditor's report. The report cannot be dated and released before the reviewer notifies the engagement partner that the review is complete. Put the EQR date in the schedule at the start of the engagement. See managing busy season, where review capacity is usually the constraint.

Documentation

The EQR documentation should show, at a minimum:

• the name of the reviewer and the basis for their eligibility
• the procedures the reviewer performed and the documents they looked at
• the significant matters raised, how they were resolved and by whom
• any differences of opinion between the team and the reviewer and how they were resolved under the firm's policy
• the date the review was completed, and the reviewer's notice to the engagement partner that it is complete
• any matters the reviewer could not complete

Keep the documentation in the engagement file. Documentation requirements under AU-C 230 apply. The planning memo should state that an EQR will be performed, who the reviewer is and the planned timing, and the final file should show that it was done.

A simple reviewer checklist

The firm can use a checklist to structure the review and record it. The engagement quality review checklist is a starting point to adapt; the audit planning memo template and the peer review readiness checklist are useful companions. A useful checklist has these headings:

• engagement and reviewer details; eligibility and objectivity confirmed
• independence and acceptance matters reviewed
• risk assessment, fraud risk discussion and significant risks
• materiality and the evaluation of misstatements
• significant estimates and judgments, with the evidence reviewed
• going concern, subsequent events and contingencies
• communications with those charged with governance
• the financial statements, disclosures and the report
• matters raised and resolution, with dates
• conclusion and sign-off, with the completion date

Avoid a checklist that is all yes boxes with no reference to the file. A reviewer's notes with workpaper references are better evidence than a form filled in by ticking.

Differences of opinion

If the team and the reviewer disagree, the firm's policy governs how the matter is resolved. The report is not released until the matter is resolved. Policies commonly route the matter to the firm's managing partner or to a consultation. Record the disagreement and the resolution. See the SAS No. 146 requirement on differences of opinion and the firm's own policies.

Common problems

• EQR required by firm policy but not performed, or done after the report date.
• A reviewer who was involved in the audit, for example by approving the materiality.
• No documentation of what the reviewer looked at.
• A signature on a checklist with no evidence of review of the significant judgments.
• No reviewer notice before the report was released.
• Policies that require EQR for engagement types but no process to identify them at acceptance.

See the AICPA peer review guide for the review process.

Frequently asked questions

Does every audit need an engagement quality review?

No. SQMS No. 1 requires an EQR where law or regulation requires one and where the firm determines it is an appropriate response to quality risks. Firms set their own criteria beyond that.

Who can perform an EQR?

A partner or other individual in the firm, or an external individual, who has the competence, capabilities, time and authority, and who is objective and not a member of the engagement team.

When must the EQR be finished?

On or before the date of the auditor's report. The engagement partner cannot release the report until the reviewer says the review is complete.

Can the engagement partner become the reviewer later?

It creates a self-review threat. The firm's policy must address it, for example by setting a minimum period before a former engagement partner can be the reviewer.

What should the EQR file contain?

The reviewer's name and eligibility basis, the procedures performed, the significant matters raised and how they were resolved, any differences of opinion, and the date of completion.

Sources

• AICPA, SQMS No. 1, A Firm's System of Quality Management (EQR required by law or regulation, or as a firm-determined response to quality risks)
• AICPA, SQMS No. 2, Engagement Quality Reviews (eligibility, objectivity, performance and documentation of the review)
• AICPA, SAS No. 146, Quality Management for an Engagement Conducted in Accordance With Generally Accepted Auditing Standards (AU-C 220 as revised; effective for audits of financial statements for periods beginning on or after December 15, 2025)
• AICPA, AU-C Section 230, Audit Documentation

CORAA prepares ready-to-review audit files for US CPA firms; see /us.

AU-C references are to AICPA Professional Standards, paraphrased here; read the standard itself before relying on a requirement. This page is guidance, not professional advice. Report an error