SAS No. 146, Quality Management for an Engagement Conducted in Accordance With Generally Accepted Auditing Standards, was issued by the AICPA Auditing Standards Board in June 2022. It supersedes AU-C 220, Quality Control for an Engagement Conducted in Accordance With GAAS. It is effective for engagements conducted in accordance with GAAS for periods beginning on or after December 15, 2025 (paragraph 10).
Note the trigger. SQMS No. 1 sets a date by which the firm's system must be in place. SAS 146 runs on the period of the audit: the audit period must begin on or after December 15, 2025, so a calendar-year 2026 audit is the first one subject to it. Our overview of SQMS 1, SQMS 2 and SAS 146 covers the three standards together. This article stays inside SAS 146 and reads its requirements in order.
How SAS 146 fits with the firm's system
The firm designs and operates the system of quality management under SQMS No. 1. The engagement team, led by the engagement partner, does three things within that system (paragraph 4):
- implements the firm's responses to quality risks that apply to the engagement;
- decides whether the engagement needs responses beyond the firm's policies and procedures; and
- communicates to the firm information from the engagement that the firm's policies require, so the firm can operate and monitor its system.
Engagement-level findings, such as a template that does not fit a type of entity, are inputs to the firm's monitoring and remediation process.
The partner's responsibility, and what can be delegated
Paragraph 9 draws the line that matters most in practice. The engagement partner remains ultimately responsible and accountable for compliance with the SAS. The phrase "take responsibility for" marks requirements where the partner may assign the design or performance of procedures to suitably skilled members of the team. Where the standard does not use that phrase, it expects the partner to fulfill the requirement personally, drawing on information from the firm or the team as needed.
Read the requirements with that filter. The partner:
- determines that firm policies on acceptance and continuance were followed (paragraph 22);
- determines that resources are sufficient and appropriate (paragraphs 25 to 27);
- reviews the financial statements and the auditor's report (paragraph 33);
- reviews formal written communications to management, those charged with governance and regulators before they are issued (paragraph 34); and
- determines, before dating the report, that the partner has taken overall responsibility for quality (paragraph 40).
A manager can track the consultation log and assemble the file. The partner owns the determinations.
Leadership and ethics
Paragraph 13 requires the partner to take overall responsibility for managing and achieving quality, including creating an environment that reflects the firm's culture, and to be sufficiently and appropriately involved throughout the audit. The test is outcome-based: the partner must have a basis for deciding whether the significant judgments and conclusions are appropriate.
On independence, the partner must understand the relevant ethical requirements (paragraph 16), make sure the team has been made aware of them (paragraph 17), stay alert for breaches throughout the audit (paragraph 19), and, before dating the report, take responsibility for determining that the requirements have been fulfilled (paragraph 21). The AICPA Code plus any more restrictive rules of the state board of accountancy or a regulator are the relevant ethical requirements (paragraph 12).
Acceptance, continuance and resources
Paragraph 24 requires the partner to tell the firm promptly if the team learns of information that would have caused the firm to decline the engagement had it known earlier.
For resources, the partner determines that the team collectively has the competence, capabilities and time (paragraph 26). If resources are insufficient, the partner acts, including asking for more or different resources (paragraph 27). The application material on technology (paragraphs A63 to A67) is directly relevant to firms adopting software and AI tools. It says technology can help the auditor evaluate large volumes of data and challenge management, but that inappropriate use can increase overreliance on information and create confidentiality threats. It also says firm policy may prohibit software not yet approved, or require steps before using it, such as testing operation and security and adding specific documentation to the file. See our guide to AI in auditing for small firms.
Direction, supervision and review
Paragraph 29 makes the partner responsible for direction and supervision of the team and review of its work. Paragraph 30 requires the partner to determine that the nature, timing and extent of direction, supervision and review follow firm policy and professional standards and respond to the engagement's circumstances.
The partner-level review requirements are specific:
- During the audit (paragraph 31): review documentation at appropriate points, including significant matters, significant judgments including difficult or contentious matters and the conclusions reached, and other matters the partner considers relevant.
- On or before the report date (paragraph 32): determine, through review of documentation and discussion with the team, that sufficient appropriate audit evidence supports the conclusions and the report.
- Before dating the report (paragraph 33): review the financial statements and report, including key audit matters if applicable, and related documentation.
The application material is practical. The partner need not review all documentation and exercises judgment on the extent (A92). Significant judgments can include materiality, the decision to use a specialist, and inherent risk assessments that require significant judgment (A93).
Consultation, EQR and differences of opinion
On consultation (paragraph 35), the partner takes responsibility for the team consulting on difficult or contentious matters and on matters firm policy designates, determines the consultation was appropriate, determines the conclusions were agreed with the party consulted, and determines they were implemented.
Where an engagement quality review is required, the partner determines a reviewer has been appointed, cooperates with the reviewer, discusses significant matters and judgments with the reviewer, and does not release the report until the review is complete (paragraph 36). See the engagement quality review guide.
For differences of opinion within the team, with the EQ reviewer or with consultants, the team follows firm policy. The partner takes responsibility for resolution, determines conclusions are documented and implemented, and does not date the report until differences are resolved (paragraphs 37 and 38).
Monitoring information
Paragraph 39 asks the partner to understand the information from the firm's monitoring and remediation process, determine its effect on the engagement, and stay alert for information the process would want. If last year's inspection found weak documentation of estimates, the partner of an audit with significant estimates is expected to know that and respond.
What the file must show
Paragraph 41 adds three documentation items to AU-C 230:
- significant issues, discussions and conclusions on independence and other ethical requirements, and on acceptance and continuance;
- the nature, scope and conclusions of consultations and how the conclusions were implemented; and
- if an EQR is required, that it was completed before the report was released.
Evidence of the paragraph 31 and 32 reviews should sit alongside these, dated, with reviewer sign-off showing the review happened before the report date.
SAS 151 and the engagement-level text
SAS No. 151, the new fraud standard, makes conforming amendments to other SASs and takes effect for audits of financial statements for periods ending on or after December 15, 2028. Read its amendments section for any change to the SAS 146 text. See SAS 151: what it replaces and when it applies.
Frequently asked questions
Does SAS 146 apply to reviews and compilations?
SAS 146 applies to audits under GAAS and, adapted as necessary, to other GAAS engagements such as a review of interim financial information under AU-C 930 (paragraph 1). The standard's appendix also amends AT-C section 105 under SSAE No. 18 for attestation engagements.
Can a manager perform the partner's file review?
A manager's review counts as supervision and review within the team. For requirements that do not use the phrase "take responsibility for," the partner must fulfill the requirement personally, and may take the outcomes of others' review into account (paragraph 9).
Does the partner have to review every workpaper?
No. The partner exercises judgment about the extent of review and focuses on significant matters and judgments (A92 and A93).
Sources
- AICPA, Statement on Auditing Standards No. 146, Quality Management for an Engagement Conducted in Accordance With Generally Accepted Auditing Standards (June 2022), paragraphs 1 to 41 and A63 to A67, A91 to A93: https://a-us.storyblok.com/f/1015104/x/32853782b6/aicpa-sas-146.pdf
- AICPA, Statement on Quality Management Standards No. 1, A Firm's System of Quality Management (June 2022)
- AICPA, "New Auditing Standard Clarifies and Enhances CPAs' Responsibilities Relating to Fraud in a Financial Statement Audit" (August 2026): https://www.aicpa-cima.com/news/article/new-auditing-standard-clarifies-and-enhances-cpas-responsibilities-relating-to-fraud-in-a-financial-statement-audit
CORAA prepares audit files for US CPA firms from client books; the firm reviews and signs. See /us.
Part of CORAA University · Evidence and audit procedures: related guides, calculators and templates.
AU-C references are to AICPA Professional Standards, paraphrased here; read the standard itself before relying on a requirement. This page is guidance, not professional advice. Report an error