Join the waitlist
Guides/Peer Review & Quality

Peer Review of Firms That Outsource Audit Prep: Where Supervision, Providers and Confidentiality Show Up

How AICPA peer review reaches a firm that uses outside preparers: system review scope, the SQMS 1 resources component, engagement-level supervision evidence, and the file items to have ready.

CORAA TeamUpdated November 5, 20267 min read

The AICPA Peer Review Program does not have a separate outsourcing test. It reviews the firm's system of quality management and its engagements against professional standards, and outsourced preparation is visible in both places. Where a firm uses outside preparers, the provider appears in the resources component of the quality system, the supervision evidence appears in the engagement files, and the notice and confidentiality paperwork appears in the ethics and acceptance records. This post maps each to the standard behind it so the firm knows what to have ready.

For review types and engagement selection, read system review vs engagement review and the AICPA peer review guide.

What the current standards look like

The AICPA Clarified Standards for Performing and Reporting on Peer Reviews apply to peer reviews commencing on or after May 1, 2022, as amended by Peer Review Standards Updates. Three updates matter now:

  • PRSU No. 2, "Reviewing a Firm's System of Quality Management and Omnibus Technical Enhancements," aligns peer review with the quality management standards. Its omnibus technical enhancements apply to peer reviews commencing on or after December 1, 2024. Its quality management revisions apply to peer reviews with years ending on or after December 31, 2025. The Peer Review Board approved it in November 2024.
  • PRSU No. 3, "Modernizing Peer Review Administration Requirements," applies to peer reviews scheduled on or after February 28, 2026, and makes clerical revisions to the engagement review sections.
  • Firms had to have a system of quality management in place by December 15, 2025, the effective date of the new quality management standards. The Journal of Accountancy reports that the firm evaluates the system within one year of implementation or by December 15, 2026, and annually after that.

So a review with a year-end on or after December 31, 2025 is the first generation of peer review conducted against a quality management system rather than a quality control system.

System review: the quality system layer

In a system review, the reviewer tests all parts of the firm's quality management system and a representative sample of engagements. The areas covered include firm leadership's quality responsibilities, ethics requirements, client acceptance and continuance, staffing, and how engagements are performed and monitored (Florida Institute of CPAs summary of the program). The reviewer's opinion covers the design, implementation and operating effectiveness of the system.

For a firm with outside preparers, three components carry the load.

Resources

SQMS 1 has eight components: risk assessment, governance and leadership, relevant ethical requirements, acceptance and continuance, engagement performance, resources, information and communication, and monitoring and remediation. The resources component extends past staff to technological and intellectual resources and to service providers that support the firm's system or its engagements (Thomson Reuters). An outside preparation team or an automated preparation service is a service provider.

The firm's file shows: how the provider was selected, what the firm required of it, how the firm determined that its output is appropriate to use, and how performance is evaluated. See SQMS 1 quality management.

Relevant ethical requirements

The outsourcing rules sit here. ET 1.150.040 requires notice to the client, preferably in writing, before confidential information is shared. ET 1.300.040 requires qualified providers and planning and supervision of their work. ET 1.700.040 requires a confidentiality contract that meets the interpretation's conditions, or specific client consent. The reviewer reads the engagement letters, the provider agreement and the vendor file to see the system working. The rules are summarized in ET 1.150.040 disclosure and oversight.

Engagement performance

SQMS 1 sets a quality objective on the nature, timing and extent of direction and supervision of engagement teams and review of their work, with less experienced members directed, supervised and reviewed by more experienced ones (SAS 146 paragraph A82). The firm's policy states how that applies to outside preparers: who reviews, at what level, and at what points.

Monitoring and remediation

Thomson Reuters describes the stronger expectation to identify issues, perform root cause analysis and remediate. A firm that finds a recurring error in provider-prepared schedules records it, identifies the cause, fixes the instruction or the provider process, and checks the fix. That record is monitoring evidence.

Engagement files: where the reviewer sees the work

The sample of engagements is where the outsourced work meets the standards. Each audit file selected is read against GAAS. For outsourced preparation, three standards bring evidence into view.

  • SAS 146 (AU-C 220). The engagement partner takes responsibility for direction and supervision of the engagement team and review of its work (paragraph 29), determines that the nature, timing and extent are responsive to the resources assigned (paragraph 30), reviews documentation on significant matters and judgments (paragraph 31), and determines before the report date that evidence supports the conclusions (paragraph 32). Outside individuals who perform audit procedures are members of the engagement team (paragraphs 12, A15, A17, A18). See supervision and review of outsourced work under AU-C 220.
  • AU-C 230. The file identifies who performed each piece of work, the completion date, who reviewed it and the date and extent of review (paragraph .09b-c). See documenting outsourced workpaper review under AU-C 230.
  • SAS 146 paragraph 41. The file documents independence and acceptance conclusions, consultations, and completion of any engagement quality review before release. See engagement quality review.

A reviewer reading a provider-prepared schedule looks for the same things as for staff-prepared work: a named preparer, a date, a named reviewer, a date, evidence that review notes were cleared, and a partner conclusion.

Engagement review

An engagement review applies to firms performing reviews and compilations, and tests a limited number of engagements chosen under selection guidelines. The reviewer reports every departure from professional standards found in them (Florida Institute of CPAs summary). The firm's outsourced compilation and review work is read against SSARS. The supervision and documentation evidence is the same in kind. See review engagement under AR-C 90.

What to have ready

Assemble this set before the review is scheduled:

  1. A written policy for the use of third-party service providers, tied to the resources and ethics components.
  2. A vendor file per provider: selection record, qualifications, signed agreement with confidentiality terms, evaluation.
  3. The client notice per engagement letter, with dates, for every client whose files went to the provider.
  4. A roster of provider personnel mapped to the initials in the files.
  5. Per engagement: written direction to the provider, planned reviewer levels, review notes and clearance, partner conclusion.
  6. The monitoring log showing issues found in provider output, causes and fixes.
  7. The firm's annual evaluation of the system of quality management, due within one year of implementation or by December 15, 2026.

The point for firms that use CORAA

CORAA prepares ready-to-review audit files from QuickBooks books, and the CPA firm reviews and signs. The peer reviewer treats that arrangement as the firm's own: the firm's resources component, ethics paperwork and engagement-level review are what gets tested. The seven items above are what the reviewer will ask for.

Sources

CORAA prepares ready-to-review audit files for US CPA firms from QuickBooks books; you review and sign. See /us.

Part of CORAA University · Quality management and practice: related guides, calculators and templates.

Share

AU-C references are to AICPA Professional Standards, paraphrased here; read the standard itself before relying on a requirement. This page is guidance, not professional advice. Report an error

For US CPA firms

Join the CORAA waitlist

CORAA AI drafts audit working papers from your client’s QuickBooks books and does the first pass: lead schedules, tie-out, memos, draft notes and letters. CORAA Network reviewers clear every finding. Your firm reviews and signs.

  • First audit free, so you can judge the quality on a real file
  • Flat fee by entity size; messy books included
  • We work only with CPA firms, never their clients
See how it works →

* required

Keep reading
Schedule M-1 / M-2 / M-3
Book-Tax Differences: Schedules M-1, M-2 and M-3 and How They Tie to the Audit
2 CFR 200.303
2 CFR 200.303 Internal Controls Over Federal Awards: What Recipients Must Have and How Auditors Test It
2 CFR 200.332
2 CFR 200.331 and 200.332 Subrecipient Monitoring: Subrecipient vs Contractor and Pass-Through Duties