Peer Review Under the Quality Management Standards: PRSU No. 2, the QM Checklists and What to Have Ready

For firms that perform audits, the peer reviewer's job is now to evaluate a system of quality management, not a system of quality control. The AICPA Peer Review Board adopted the change through Peer Review Standards Update (PRSU) No. 2, Reviewing a Firm's System of Quality Management and Omnibus Technical Enhancements. This article covers the dates, what the reviewer works from, how peer review relates to the firm's own monitoring under SQMS No. 1, and what a firm should have ready. For the mechanics of system and engagement reviews and ratings, see our peer review guide.

PRSU No. 2: dates and scope

The Peer Review Board approved PRSU No. 2 in November 2024. It has two effective dates:

The AICPA describes the update as aligning peer review standards with the quality management standards. It revises terminology and phrasing to conform to them, adapts requirements and application material to address the risk-based considerations that SQMS No. 1 introduces, and clarifies and expands existing requirements and guidance.

Two dates matter to a firm and they are different:

• December 15, 2025 is when the system had to be designed and implemented under SQMS No. 1, with the first evaluation due within one year after that date.
• December 31, 2025 is the earliest peer review year-end to which the quality management revisions to peer review apply.

A firm with a calendar-year peer review year-end of December 31, 2025 or later is therefore reviewed under the revised standards. Journal of Accountancy reported that the first peer reviews of work done under the new standards would generally not occur until 2026.

What changed for the reviewer

The Journal of Accountancy summary of the AICPA's guidance is direct: the peer review process itself is unchanged, but reviewers ask different questions about the quality management system and about management's responsibilities. Three consequences follow.

Ultimate responsibility. SQMS No. 1 assigns ultimate responsibility and accountability for the system to the individual or individuals the firm designates, and requires them to evaluate it at least annually. Reviewers may speak with the managing partner about the process.

Risk assessment is a likely pressure point. The firm must set quality objectives, identify and assess quality risks and implement responses. Unlike audit-level risk assessment, it is firmwide and needs regular monitoring. A reviewer who finds the objectives, risks and responses disconnected from each other will find it hard to conclude the system is designed appropriately. See the SQMS 1 risk assessment process.

The engagement-level duties are part of the system. SAS No. 146 and SSARS No. 26 put responsibility for managing and achieving quality on the engagement partner, and the firm's system is how that responsibility is supported and monitored.

The reviewer's checklists

The AICPA built quality management checklists for peer reviewers. They were first released as a pilot in May 2025 as four forms, split by firm size and by what they evaluate:

In April 2026 the AICPA released final checklists, with a pre-read of documentation examples, which replace the pilot versions. Work from the final checklists rather than the pilot forms.

The pilot split shows the two questions a reviewer answers. Is the system designed to meet the standard: objectives established, risks identified and assessed, responses designed, monitoring and remediation process in place? And has it been implemented and operating as designed? A document that describes a good system does not answer the second question. The firm needs evidence that monitoring ran, that findings were evaluated, and that remedial actions were carried out and followed up.

Peer review and the firm's own monitoring

The peer review standards describe the objective of the firm's system: to design, implement and operate a system of quality management that gives reasonable assurance that the firm and its personnel fulfill their responsibilities under professional standards and that the firm's engagement reports are appropriate in the circumstances (PR-C section 100, paragraph .A8). They add that the nature and extent of the system depend on factors such as firm size, the nature of the practice and risk-based considerations (paragraph .A9).

The practical point: do not wait for the peer review to find deficiencies. SQMS No. 1 requires the firm to evaluate its system at least annually, and a peer review is a separate, external process. See monitoring and remediation under SQMS 1.

What to have ready

Assemble one folder, indexed to the checklists:

1. The identification of the individuals with ultimate and operational responsibility for the system.
2. The quality objectives, quality risks and responses with owners.
3. The monitoring plan, the inspection schedule by engagement partner and completed inspection reports.
4. The evaluation of findings, identified deficiencies, root cause analyses and remedial actions with follow-up evidence.
5. The annual evaluation memo and conclusion, with its basis. See the first annual evaluation.
6. The annual independence confirmations.
7. The policy on external communication about the system and the complaints and allegations process.
8. The firm's engagement quality review policy and eligibility criteria. See engagement quality reviews.
9. Evidence of how technology and service providers were evaluated for use. See network requirements and service providers.

Frequently asked questions

Does my peer review type change?

PRSU No. 2 aligns the peer review standards with the quality management standards. For a system review, the reviewer now evaluates the firm's system of quality management.

Can our peer review replace our own monitoring?

No. The annual evaluation of the system is the firm's own requirement under SQMS No. 1, and the peer review is a separate external process.

When does the first review under the new standards happen?

For peer review years ending on or after December 31, 2025. The date of a firm's review depends on its peer review year-end and its administering entity's schedule.

Sources

• AICPA, Peer Review Standards Update No. 2, Reviewing a Firm's System of Quality Management and Omnibus Technical Enhancements (approved November 2024; effective dates as stated)
• AICPA, "Final version of new AICPA peer review standards update now available" (December 2024)
• AICPA, Peer Review Pilot Quality Management Checklists (PRP4500QM, PRP4550QM, PRP4600QM, PRP4650QM), 2025
• Journal of Accountancy, "Peer review standards updated" (November 2024) and "How new QM standards may affect peer review" (December 2024)
• AICPA, Standards for Performing and Reporting on Peer Reviews (updated through PRSU No. 3), PR-C section 100, paragraphs .A8 and .A9
• AICPA, Statement on Quality Management Standards No. 1 (June 2022)
• AICPA, Final peer review QM checklists (April 2026)

CORAA prepares ready-to-review audit files for US CPA firms from QuickBooks books; you review and sign. See /us.

AU-C references are to AICPA Professional Standards, paraphrased here; read the standard itself before relying on a requirement. This page is guidance, not professional advice. Report an error