Monitoring is where a system of quality management shows whether it works. SQMS No. 1 paragraph 36 requires the firm to establish a monitoring and remediation process that does two things: provide relevant, reliable and timely information about the design, implementation and operation of the system, and take appropriate action so that deficiencies are remediated on a timely basis. The results also feed the evaluation of the system that the firm must complete by December 15, 2026. See our article on the first annual evaluation.
Designing monitoring activities
Paragraphs 37 and 38 require the firm to design and perform monitoring activities that give a basis for identifying deficiencies. The nature, timing and extent depend on:
- the reasons for the assessments given to the quality risks;
- the design of the responses;
- the design of the risk assessment process and the monitoring and remediation process itself;
- changes in the system;
- results of previous monitoring, including whether earlier remedial actions were effective; and
- other information: complaints and allegations, external inspections and information from service providers.
The application material adds that monitoring can combine ongoing activities, which are routine and built into firm processes and generally timelier, and periodic ones performed at intervals (A149). Where the system has changed, earlier monitoring may no longer support the evaluation (A156). External inspections are not a substitute for internal monitoring, but their results inform it (A161).
Inspecting completed engagements
Paragraph 39 requires inspection of completed engagements in the monitoring activities. The firm determines which engagements and partners to select, taking into account the paragraph 38 matters and other monitoring activities, and must select at least one completed engagement for each engagement partner on a cyclical basis determined by the firm.
The standard does not fix the cycle. Its example policy (A165) is an inspection of a completed engagement for each partner performing audits once every, for example, three years, and for other partners once every, for example, five years. The same example provides that a partner who performs audits has an audit engagement selected, that selection is unpredictable, and that the policy addresses when to select a partner more or less often.
The factors that justify more frequent selection include multiple deficiencies evaluated as severe, a partner serving entities in industries with high complexity or judgment, unsatisfactory results from other monitoring, limited experience in the industry or level of service, and a newly appointed partner or one who recently joined the firm (A165). The firm may defer selection, for example by a year, when other monitoring has produced enough information about the partner.
For a small firm, this reduces to a schedule: each partner, the date of the last inspection, the engagement type and the next due date.
Where peer review fits
The standard states that a peer review is not a substitute for all monitoring. Because its objective is similar to an inspection's, firm policy may provide that an AICPA peer review substitutes for inspection of engagement documentation, reports and financial statements for some or all engagements for the period the peer review covers (A167). The definitions of findings and deficiencies in SQMS 1 differ from those in the peer review standards, so a peer review finding may not equal a deficiency in the system, and the firm assesses peer review results for their effect on its evaluation (A168). See peer review under the quality management standards.
Who may perform monitoring
Paragraph 40 requires policies that the people performing monitoring have the competence, capabilities and time, and that address objectivity, on the premise that objectivity is enhanced when engagement team members and the engagement quality reviewer of an engagement are not involved in monitoring it.
This is hard in a small firm, and the standard says so directly. A self-review threat arises when an inspector worked on the engagement, or when someone operating a response monitors it, for example the person who accepts clients also monitors compliance with acceptance policies (A170). The standard does not preclude self-inspection, but warns it may be less effective and carries a higher risk that noncompliance goes undetected (A171). Safeguards include training on how to inspect, use of peer review checklists and requiring time to pass before self-inspection (A172). The firm may use an outside service provider when no one has the competence, time and objectivity (A169), and when deficiencies or changes in the firm indicate self-inspection is not effective (A173).
Evaluating findings and identifying deficiencies
Paragraph 41 requires the firm to evaluate findings to determine whether deficiencies exist, including in the monitoring and remediation process itself. A deficiency exists when an objective is not established, a risk is not identified or properly assessed, a response does not reduce the likelihood of the related risk to an acceptably low level, or another aspect of the system is absent or not properly designed, implemented or operating so that a requirement is unaddressed.
Judgment is required. The standard lists factors (A176): how the response is designed, how important it is to the risk, whether other responses address the same risk, whether findings indicate a trend or systemic issue, and the extent of findings relative to the selection and the expected deviation rate the firm set. Findings on leadership actions and behaviors can be qualitatively significant because of their pervasive effect.
The process is iterative. Investigating a root cause may reveal that earlier findings, not considered deficiencies, should be reclassified (A177). Root cause analysis has its own article: root cause analysis of deficiencies.
The standard treats identifying deficiencies as "not unusual" given the inherent limitations of any system (A148).
Remediation
Paragraph 43 requires remedial actions responsive to the results of the root cause analysis. Paragraphs 44 and 45 then require the person with operational responsibility for the process to:
- evaluate whether the remedial actions are appropriately designed to address the deficiencies and root causes, and determine that they have been implemented;
- evaluate whether actions for previously identified deficiencies are effective; and
- if they are not designed, implemented or effective, take action to modify them until they are.
Remediation can mean adding or changing objectives, risks or responses (A187). Document the action, owner, due date and follow-up on effectiveness. Inspecting the next engagement of the same type is stronger evidence than a statement that training was held.
Findings about a particular engagement
Paragraph 46 addresses the case where findings show required procedures were omitted or the report issued may be inappropriate. The firm takes appropriate action to comply with professional standards and legal and regulatory requirements and, when the report is considered inappropriate, considers the implications, including whether to obtain legal advice. For audits, AU-C 585, Consideration of Omitted Procedures After the Report Release Date, applies (A189). The firm still evaluates the finding for a system-level deficiency.
Communication
Paragraph 47 requires the person with operational responsibility for monitoring and remediation to communicate on a timely basis to the individuals with ultimate and operational responsibility for the system: the monitoring activities performed, the identified deficiencies with severity and pervasiveness, and the remedial actions. Paragraph 48 requires the firm to communicate the same matters to engagement teams and others with activities in the system so they can act promptly. It can be ongoing or periodic and is the basis for the annual evaluation (A190). SAS 146 closes the loop at the engagement level by requiring the engagement partner to understand the information from the firm's monitoring and remediation process and determine its effect on the audit. See SAS 146 at the engagement level.
Paragraph 59d requires documentation of the monitoring evidence, findings, deficiencies and root causes, remedial actions with the evaluation of their design and implementation, and the communications. Retention must be long enough for the firm and its peer reviewer to monitor the system (paragraph 61).
Frequently asked questions
How often must each partner be inspected?
The standard requires at least one completed engagement per engagement partner on a cyclical basis the firm determines. It does not set a number of years. Three years for partners who perform audits and five for others appear only as examples.
Can the managing partner inspect their own engagement?
The standard does not preclude it, but it identifies the self-review threat and says self-inspection may be less effective. An outside inspector or a partner who did not work on the engagement provides stronger evidence.
Sources
- AICPA, Statement on Quality Management Standards No. 1, A Firm's System of Quality Management (June 2022), paragraphs 36 to 48, 59 and 61 and application material A148 to A190
- AICPA, Statement on Auditing Standards No. 146, Quality Management for an Engagement Conducted in Accordance With Generally Accepted Auditing Standards (June 2022), paragraph 39
CORAA prepares ready-to-review audit files for US CPA firms from QuickBooks books; you review and sign. See /us.
Part of CORAA University · Quality management and practice: related guides, calculators and templates.
AU-C references are to AICPA Professional Standards, paraphrased here; read the standard itself before relying on a requirement. This page is guidance, not professional advice. Report an error