Your firm does not choose its peer review type by size or preference. The AICPA Standards for Performing and Reporting on Peer Reviews (the PRP standards) assign the type by the highest level of service the firm performs. This post walks through the exact rule, what each review covers, how reviewers pick engagements, and the dates that drive enrollment. For the program overview and a preparation checklist, start with the AICPA peer review guide. For what the ratings mean, see peer review ratings and corrective actions.
The standards apply to peer reviews commencing on or after May 1, 2022, as updated through Peer Review Standards Update No. 3, Modernizing Peer Review Administration Requirements (its administration revisions apply to peer reviews scheduled on or after February 28, 2026). The paragraph references below come from that text.
The rule: highest level of service decides
PR-C section 310, paragraph .02 is the system review trigger. A firm that performs any of the following must have a system review:
- Engagements under the Statements on Auditing Standards (SASs).
- Engagements under Government Auditing Standards (the Yellow Book).
- Examinations under the Statements on Standards for Attestation Engagements (SSAEs).
- Engagements under PCAOB standards.
PR-C section 220, paragraph .02 is the engagement review trigger. Engagement reviews are available to firms whose highest levels of service are engagements under the Statements on Standards for Accounting and Review Services (SSARSs) and SSAE engagements other than examinations. That covers reviews, compilations, preparation engagements and agreed-upon procedures.
One audit under the SASs moves the whole firm to a system review.
A firm eligible for an engagement review can elect a system review instead (PR-C section 320, paragraph .A1).
What falls outside the program
The program covers the firm's accounting and auditing practice except engagements subject to PCAOB permanent inspection. The standards state that, currently, those are audits of SEC issuers and the audits and related compliance and exemption engagements of broker-dealers registered with the SEC or dually registered with the SEC and CFTC. SIPC agreed-upon procedures engagements for SEC-registered broker-dealers, and audits of broker-dealers registered only with the CFTC, remain inside the program.
A regulatory body, for example a state board for licensing, can require a firm that performs only preparation engagements under SSARS to enroll (PR-C section 100, paragraph .A7).
What a system review covers
A system review evaluates the firm's system of quality management for its accounting and auditing practice. Since the firm's SQMS No. 1 system took effect on December 15, 2025, the reviewer tests a system built under QM section 10. Our SQMS No. 1 guide covers what that system must contain.
The reviewer works from a risk assessment. Paragraph .15 of PR-C section 210 calls the assessment qualitative, built from inherent risk and control risk, and paragraph .18 has the reviewer set an acceptable level of detection risk from it. The reviewer then reviews "a reasonable cross section" of engagements, weighted toward the portions of the practice with higher assessed risk. The reviewer tests operating effectiveness by reviewing the highest-risk areas on selected engagements, including accounting and auditing documentation and reports.
Must-select and must-cover engagements
Appendix C of PR-C section 210 removes discretion for specific work. At least one engagement from each of these types is reviewed when the firm performs it:
- Audits under Government Auditing Standards. If the firm performs engagements of entities subject to the Single Audit Act, the reviewer also evaluates a compliance audit.
- Audits of employee benefit plans under ERISA.
- Audits under FDICIA of insured depository institutions with total assets of $1 billion or more at the beginning of the fiscal year.
- Examinations of service organizations that produce SOC 1 or SOC 2 reports. SOC 3 engagements are not must-select.
The standards also list must-cover engagements, where a team member needs recent industry experience to judge whether to select the engagement: FDICIA internal control reports above $5 billion in total assets, state and local governments, and any industry that makes up 10 percent or more of the firm's audit practice.
The reviewer gives the firm the engagement selection no more than two weeks before starting the file review (paragraph .28). The standards also define a "surprise engagement": a selection provided to the firm to test whether engagement teams complete assembly of final engagement files on time.
What an engagement review covers
An engagement review evaluates selected engagements, not the firm's system. The standards say so directly: documentation and procedures related to the system of quality management are outside the scope, an engagement review includes no tests of administrative or personnel files and no interviews of firm personnel, and it gives the reviewer no basis for assurance on the firm's system (PR-C section 220, paragraph .A28).
Selection is formulaic. Under paragraph .13 the review captain selects:
- One engagement from each level of service the firm performs: reviews of financial statements, compilations with disclosures, compilations that omit substantially all disclosures, and SSAE engagements other than examinations.
- One engagement from each engagement partner who signs reports at those levels.
- At least two engagements, unless the firm performed only one.
Paragraph .14 limits when a preparation engagement is selected: when it is the only level of service an engagement partner performs, the only engagement with disclosures, the only engagement without disclosures, or needed to reach the minimum of two. The captain selects only the number of engagements needed to satisfy those rules.
The captain also verifies firm and individual licensure. A missing firm license is documented on a finding for further consideration; a report signed by an individual without the required license makes that engagement nonconforming.
Report types
System review reports come in six forms, illustrated in Exhibit B of PR-C section 210: pass, pass with deficiencies, and fail, each with or without a scope limitation. Engagement review reports come in three forms: pass, pass with deficiencies, and fail. The engagement review report is a report on the firm's conformity with professional standards on the engagements reviewed. The definitions behind each rating are in the ratings and corrective actions post.
Moving between review types
A firm with an engagement review that later performs an engagement that requires a system review must notify its administering entity immediately and undergo a system review. That system review is due on the earlier of 18 months from the engagement's year-end (18 months from the report date for forecasts, projections and agreed-upon procedures) or the firm's next scheduled due date (PR-C section 320, paragraph .18). A firm that fails to notify the administering entity gets a system review with a peer review year-end that covers the engagement (paragraph .19).
Timing and administration
- A firm enrolls no later than the date it issues its first report on an engagement within the scope of the standards (PR-C section 100, paragraph .23).
- The review covers a one-year period, and the firm has a review once every three years (paragraph .22).
- The initial due date falls within 18 months after the firm issues its first in-scope report (paragraph .25). A firm that misses enrollment gets 90 days from its enrollment date (paragraph .26).
- Each later review is due no more than 42 months after the previous peer review year-end (paragraph .27).
- Changing the peer review year-end or extending the due date needs prior approval from the administering entity.
Administering entities are state CPA societies, groups of state societies, or the National Peer Review Committee. The National Peer Review Committee administers firms that played a substantial role in a PCAOB-standards engagement during the peer review year, firms that provide quality management materials used by firms they review, and firms the board judges to present elevated risk. For system reviews scheduled on or after February 28, 2026, a firm closely aligned with a non-CPA-owned entity, an alternative practice structure, also goes to the National PRC.
An individual CPA in a firm that cannot enroll, such as one without CPA-majority ownership, enrolls individually if the CPA performs SSARS compilations, and receives an engagement review (paragraphs .45 and .46).
What this means for audit file quality
In a system review the reviewer reviews the highest-risk areas on selected engagements, including accounting and auditing documentation and reports. CORAA builds the audit file from the client's QuickBooks books so each schedule traces to source; the partner's review and sign-off remain the firm's judgment.
Sources
- AICPA, Standards for Performing and Reporting on Peer Reviews (effective for peer reviews commencing on or after May 1, 2022; updated through Peer Review Standards Update No. 3): PR-C sections 100, 210, 220, 310, 320 and Appendix C, https://www.aicpa-cima.com/resources/download/clarified-aicpa-standards-for-performing-and-reporting-on-peer-reviews
- AICPA, Peer Reviews: System Review vs. Engagement Review, https://www.aicpa-cima.com/resources/article/peer-reviews-system-review-vs-engagement-review
- AICPA, QM section 10, A Firm's System of Quality Management (design and implementation required by December 15, 2025)
CORAA prepares ready-to-review audit files for US CPA firms from QuickBooks books; you review and sign. See /us.
Part of CORAA University · Quality management and practice: related guides, calculators and templates.
AU-C references are to AICPA Professional Standards, paraphrased here; read the standard itself before relying on a requirement. This page is guidance, not professional advice. Report an error