Peer Review Ratings, MFCs, FFCs and Corrective Actions Explained

A peer review ends in one of three ratings, but the rating is the last step in an escalation ladder. A reviewer starts with checklist answers, moves to matters, then findings, then deficiencies, and the firm's response to each rung decides what follows: nothing, an implementation plan, or corrective actions that the firm must complete before the review closes. This post follows that ladder through the AICPA Standards for Performing and Reporting on Peer Reviews (PR-C sections 100, 220, 400 and 420). For which firms get which review, see system review vs engagement review.

The escalation ladder

The standards define each term, starting with engagement reviews:

• Matter. One or more "no" answers on the peer review checklists that the review captain does not resolve. The captain records it on a matter for further consideration (MFC) form.
• Finding. One or more matters that the captain concludes make an engagement not performed or reported on in conformity with applicable professional standards. The captain records it on a finding for further consideration (FFC) form.
• Deficiency. One or more matters that result in an engagement not performed or reported on in conformity with applicable professional standards in all material respects. A deficiency is written into the report, and the report carries a rating of pass with deficiencies or fail.

The captain completes a Disposition of Matter for Further Consideration for every MFC. It records whether the MFC went onto an FFC (alone or combined with other MFCs) or into the report as a deficiency (PR-C section 220, paragraph .25).

System reviews use the same vocabulary with a different threshold, because the object under review is the firm's system of quality management:

• A finding is one or more related matters with the same systemic cause in designing, implementing or operating the system, such that there is more than a remote possibility that the firm would not perform or report in conformity with professional standards.
• A deficiency is one or more matters the captain concludes can create a situation in which the firm would not have reasonable assurance of conforming with professional standards in one or more important respects.
• A significant deficiency is one or more matters the captain concludes create a situation in which the system does not provide reasonable assurance of conforming in all material respects. Significant deficiencies produce a rating of fail.

A systemic cause is "a condition in the firm's system of quality management that allowed noncompliance to occur and remain undetected."

The three ratings

Engagement reviews: counted by engagement

The engagement review rating counts the nonconforming engagements among those submitted:

• Pass: nothing came to the captain's attention indicating that the engagements submitted for review were not performed and reported on in conformity with applicable professional standards in all material respects.
• Pass with deficiencies: at least one but not all of the engagements submitted were nonconforming.
• Fail: all of the engagements submitted were nonconforming.

The standards require the reviewer to select at least two engagements, unless the firm performs only one, so for a small firm one nonconforming engagement is the difference between pass and pass with deficiencies.

System reviews: worded as an opinion on the system

• Pass: the system of quality management in effect for the year ended has been suitably designed, implemented and operated to provide reasonable assurance of performing and reporting in conformity with applicable professional standards in all material respects.
• Pass with deficiencies: the same conclusion, "except for the deficiencies described."
• Fail: as a result of the significant deficiencies described, the system was not suitably designed, implemented or operated to provide that reasonable assurance.

A scope limitation, such as an excluded engagement, attaches to any of the three, giving six system review report forms.

What happens at the closing meeting and exit conference

Before the report is final, the captain holds a closing meeting to discuss matters, findings and deficiencies, the expected rating, the firm's obligation to respond, and the written representations. The captain then reviews the firm's responses before the exit conference.

The standards set the test for a response: the firm's actions must be "feasible, genuine, and comprehensive." The response states what the firm has done or will do, the timing, and the additional procedures that keep the issue from recurring. If the firm has already acted, the captain reviews the documentation of those actions.

A pass report with FFCs takes responses on the FFC forms. A pass with deficiencies or fail report takes a letter of response. Reviewers cannot require the firm to perform omitted procedures, reissue accounting reports or revise and reissue financial statements. The standards state that those decisions belong to the firm and its client (paragraph .20 of PR-C section 220). The firm still carries its obligations under professional standards for a nonconforming engagement.

Implementation plans versus corrective actions

The report acceptance body (RAB) assigns follow-up work after reviewing the results. PR-C section 420 separates two instruments by the rung that triggered them.

Implementation plans respond to findings. The RAB assigns only the allowable plans in the standards' exhibits.

• Engagement reviews: for repeat findings, require members of the firm to take specified types and amounts of CPE. For failure to possess applicable firm licenses, require proof of valid firm licenses.
• System reviews: for nonconforming engagements and initial findings on a must-select industry or engagement, or for repeat findings in any industry, the allowable plans include specified CPE, an outside party's pre-issuance or post-issuance review of certain engagements, an outside party's review of the firm's remediation of nonconforming engagements, an outside party's review of the firm's completion of its response actions, and an outside party's review of the firm's internal monitoring or inspection report.

If the RAB concludes that stronger actions are needed than the allowable plans, the standards direct it to consider whether the findings had to be elevated to deficiencies in the report.

Corrective actions respond to deficiencies and significant deficiencies, which means they follow a pass with deficiencies or fail report. The standards' suggested actions include:

• Specified types and amounts of CPE.
• An outside party approved by the RAB performing a pre-issuance or post-issuance review of certain engagements, or reviewing the firm's remediation of nonconforming engagements or completion of the actions in its letter of response.
• Proof of valid individual licenses.
• For system reviews on engagement performance, joining an AICPA audit quality center that applies to the nonconforming engagements.

Where the AICPA's Enhancing Audit Quality Initiative has identified prevalent nonconformity in the area, and the RAB selects CPE, the RAB requires specific CPE on that area, either an AICPA course or one with substantially the same content. For repeat findings or deficiencies the RAB can require more than 8 hours of CPE, including 24 hours, change the required courses, or add a requirement to engage an outside party to review the firm's internal monitoring report.

A peer review with corrective actions is accepted on the date the firm acknowledges its responsibility to complete them. Completion of a non-pass report is the date the firm finishes all required corrective actions to the committee's satisfaction.

Extensions and waivers

A technical reviewer or the CPA on staff can accept a due date change only when the committee has granted that authority, the firm asked before the due date, and the new date is three months or less from the original. Corrective actions are not waived because the firm cannot meet the due date or has an upcoming review.

Consecutive non-pass reports

The standards treat a pattern of non-pass reports as a program-compliance issue.

• After a second consecutive non-pass report, the RAB assesses whether to refer the firm for potential termination once the firm submits the results of the corrective actions assigned in the current review. When the second report is a fail, referral to the board is presumptively mandatory.
• A third consecutive non-pass report triggers an RAB assessment at acceptance, and referral to the board is presumptively mandatory.
• Failure to complete corrective actions as required is a failure to cooperate that warrants referral to a board hearing panel for potential termination.

Termination ends the firm's enrollment in the program.

Who sees the results

The AICPA public file shows whether the firm is enrolled, the acceptance date and period covered by its most recently accepted review, and any recent drop or termination. The firm can authorize its administering entity or AICPA staff to release the report, letter of response and acceptance letter to the public or to state boards of accountancy.

Sources

• AICPA, Standards for Performing and Reporting on Peer Reviews (effective for peer reviews commencing on or after May 1, 2022; updated through Peer Review Standards Update No. 3): PR-C sections 100, 210, 220, 400, 420, https://www.aicpa-cima.com/resources/download/clarified-aicpa-standards-for-performing-and-reporting-on-peer-reviews

CORAA prepares ready-to-review audit files for US CPA firms from QuickBooks books; you review and sign. See /us.

AU-C references are to AICPA Professional Standards, paraphrased here; read the standard itself before relying on a requirement. This page is guidance, not professional advice. Report an error