SQMS No. 1 had two dates. The first was December 15, 2025, by which the firm's system of quality management had to be designed and implemented. The second is in the same paragraph: paragraph 14 says the evaluation of the system required by paragraphs 54 and 55 must be performed within one year following December 15, 2025. The first evaluation is therefore due by December 15, 2026.
This article covers what the evaluation must contain, how to reach one of the three permitted conclusions, and what the file should hold. For the overall standard, see our SQMS 1 overview.
Who performs it
Paragraph 54 assigns the evaluation to the individual or individuals assigned ultimate responsibility and accountability for the system, acting on behalf of the firm. In a small firm that is usually the managing partner or a partner group. They may be assisted by others, but they remain responsible and accountable for the evaluation (A206), so a quality manager or consultant can prepare the analysis but cannot own the conclusion.
The evaluation is undertaken as of a point in time and performed at least annually. The application material says the point in time depends on the firm's circumstances and may coincide with the firm's fiscal year-end or the completion of an annual monitoring cycle (A207). Pick the date, state it in the memo, and use the same date next year.
What the evaluator relies on
The basis for the evaluation includes the information communicated to the evaluator by the person with operational responsibility for monitoring and remediation under paragraph 47: a description of the monitoring activities performed, the identified deficiencies with their severity and pervasiveness, and the remedial actions (A208).
That is why monitoring has to run before the evaluation. If inspections of completed engagements, the review of complaints and the review of external inspection results have not been done, the evaluator has no basis. The standard also scales this expectation. In a less complex firm, the evaluator may be directly involved in monitoring and remediation and already know the information. In a more complex firm, the evaluator may need a process to collate and summarize it (A209).
The three permitted conclusions
Paragraph 55 requires the evaluator to conclude one of the following on behalf of the firm:
| Conclusion | Wording in the standard |
|---|---|
| (a) | The system provides the firm with reasonable assurance that its objectives are being achieved |
| (b) | Except for matters related to identified deficiencies that have a severe but not pervasive effect, the system provides reasonable assurance |
| (c) | The system does not provide reasonable assurance |
The objectives referred to are those in paragraph 15: that the firm and its personnel fulfill their responsibilities under professional standards and legal and regulatory requirements, and that engagement reports are appropriate in the circumstances.
Judging severity and pervasiveness
The standard gives no formula, but the application material supplies factors and examples.
A deficiency may be pervasive when it affects several components, is confined to one component but fundamental to the system, affects several business units or locations, is confined to a unit that is fundamental to the firm, or affects a substantial portion of engagements of a certain type (A212). For a small firm, the last two are the likely routes. A deficiency in how a single partner documents going concern conclusions might not be pervasive. A deficiency in how the firm performs all of its single audits might be.
The standard's own examples involve a regional office whose leadership culture was overly focused on financial priorities, driving noncompliance with many firm policies. The effect is severe because it relates to culture and overall compliance. It is not pervasive when confined to a smaller office (A213) and is pervasive when the office is the largest and supports others (A215).
Factors for evaluating identified deficiencies include whether compensating responses exist, the root causes, the frequency of the matter, and its magnitude and duration (A179). The evaluator also considers whether remedial actions were designed and implemented and are effective at the time of the evaluation, and whether the effects of the deficiency have been corrected, including actions on a particular engagement under paragraph 46 (A210).
Two points help calibrate:
- Severe, even severe and pervasive, deficiencies that have been appropriately remediated and corrected by the evaluation date may still support conclusion (a) (A211).
- If remediation is underway, pervasiveness may diminish. A deficiency once severe and pervasive may become severe but not pervasive, supporting conclusion (b) instead of (c) (A216).
What happens after conclusions (b) and (c)
If the conclusion is (b) or (c), paragraph 56 requires the firm to take prompt and appropriate action and to communicate to engagement teams and other individuals with activities in the system, to the extent relevant to their responsibilities, and to external parties in accordance with the firm's policies on external communication under paragraph 35e. The application material gives examples of action: assigning more resources, developing more guidance, taking measures so that reports issued are appropriate until deficiencies are remediated, and obtaining legal advice (A218).
Paragraph 35e requires the firm to have a policy on when and what to communicate externally about the system. If the firm has not drafted it, conclusion (b) or (c) will expose that gap.
Related requirements
- Performance evaluation. The firm periodically evaluates the individuals with ultimate and operational responsibility for the system, taking the system evaluation into account (paragraph 57).
- Independent evaluation is not required. The standard does not require an annual independent evaluation, such as a peer review report or a report on service organization controls, and does not preclude one (A217).
- Documentation. The firm documents the conclusion reached and the basis for it (paragraph 59e), along with the identification of the individuals with ultimate and operational responsibility, the quality objectives and risks, the responses, and the monitoring evidence, deficiencies, root causes and remedial actions (paragraph 59).
- Retention. The firm sets a retention period for system documentation sufficient to enable the firm and its peer reviewer to monitor the system (paragraph 61).
An outline for the memo
- Evaluator and date. Name the individuals with ultimate responsibility, the as-of date, and the period covered.
- Information used. List the monitoring activities performed, engagements inspected and other sources, such as complaints, external inspection results, independence confirmations and the firm's annual CPE records.
- Findings and deficiencies. For each finding, state whether it is a deficiency, the root cause, the severity and pervasiveness analysis, the remedial action and whether it was effective.
- Compensating responses. Record any response that addresses the same quality risk.
- Conclusion. State (a), (b) or (c) in the standard's words, with the basis.
- Actions and communication. For (b) or (c), the prompt actions, who was informed and any external communication.
- Changes. Quality objectives, risks or responses to be added or modified because of the results, linking back to the risk assessment process.
- Signature and date.
A conclusion of (a) is a conclusion the evaluator has to support. A memo that says "no deficiencies noted" with no listing of monitoring performed will not carry it.
Frequently asked questions
Is the first evaluation due December 15, 2026 for every firm?
Paragraph 14 sets the deadline as within one year following December 15, 2025, which is December 15, 2026. It applies to every firm subject to the standard.
Can the evaluator conclude (a) if the firm found deficiencies?
Yes, when the deficiencies are not severe, or when severe deficiencies have been remediated and their effect corrected by the evaluation date (A211).
Must the evaluation be shared with clients?
No requirement exists to share it routinely. Paragraph 35e requires a firm policy on when to communicate externally about the system, and paragraph 56 requires external communication per that policy after conclusion (b) or (c).
Sources
- AICPA, Statement on Quality Management Standards No. 1, A Firm's System of Quality Management (June 2022), paragraphs 14, 15, 35e, 54 to 61 and application material A179, A206 to A218
CORAA prepares ready-to-review audit files for US CPA firms from QuickBooks books; you review and sign. See /us.
Part of CORAA University · Quality management and practice: related guides, calculators and templates.
AU-C references are to AICPA Professional Standards, paraphrased here; read the standard itself before relying on a requirement. This page is guidance, not professional advice. Report an error