SQMS 1, SQMS 2 and SAS 146: Quality Management for Small CPA Firms

The AICPA's quality management standards replaced the old quality control standards (SQCS No. 8, QC section 10). The core idea is simple: the firm identifies what could go wrong with the quality of its accounting and auditing work, puts responses in place, checks whether they work, and fixes what does not.

This guide covers the three standards that matter most for a firm with a nonissuer audit, review and compilation practice: SQMS No. 1, SQMS No. 2 and SAS No. 146. It paraphrases the standards, which are in AICPA Professional Standards.

The three standards at a glance

There are conforming changes for other engagement types too, including SSARS No. 26 for reviews and compilations and SSAE No. 23 for attestation engagements.

Effective dates

• SQMS No. 1: systems of quality management must be designed and implemented by December 15, 2025. The firm's first evaluation of the system is required within one year after that date.
• SQMS No. 2: effective for audits and reviews of financial statements for periods beginning on or after December 15, 2025, and for other engagements in the firm's accounting and auditing practice beginning on or after that date.
• SAS No. 146: effective for audits of financial statements for periods beginning on or after December 15, 2025.

For a calendar-year client, that means 2026 year-end audits are the first full cycle performed under SAS 146 and SQMS 2. Peer review standards have also been updated to align with the quality management standards.

SQMS 1: the eight components

SQMS No. 1 organizes the system into eight components:

1. The firm's risk assessment process
2. Governance and leadership
3. Relevant ethical requirements, including independence
4. Acceptance and continuance of client relationships and specific engagements
5. Engagement performance
6. Resources, including human, technological and intellectual resources and service providers
7. Information and communication
8. The monitoring and remediation process

The standard sets quality objectives for each component. The firm adds objectives where needed, identifies quality risks that could prevent those objectives from being achieved, and designs and implements responses to those risks. Some responses are specified by the standard; most are designed by the firm.

Scalability

SQMS No. 1 is designed to scale. A three-partner firm that performs a dozen audits does not need the governance structure of a national firm. What matters is that the system is tailored to the firm's nature and circumstances and the engagements it performs. A purchased template can be a starting point, but the system has to be tailored to the firm's own circumstances.

The firm's risk assessment process

The risk assessment process is the biggest change from the old quality control model. Instead of following a fixed list of policies, the firm must:

1. Establish quality objectives, starting with those in the standard.
2. Identify and assess quality risks, considering conditions, events, circumstances, actions or inactions that could adversely affect achievement of the objectives. The firm considers its own nature and circumstances (size, structure, staffing, use of technology, reliance on service providers) and the nature of its engagements (industries, regulated entities, governmental work, ERISA plans).
3. Design and implement responses that address the assessed quality risks.
4. Update the objectives, risks and responses when circumstances change.

Example for a small firm

Suppose a firm has one partner with governmental audit experience who signs all single audits. Quality risks might include loss of that partner, insufficient Yellow Book CPE for staff, and lack of an independent reviewer for complex compliance issues. In this illustration, responses might include cross-training a second partner, tracking CPE by staff member, and arranging an external pre-issuance review for single audits.

Document the risk and its response together. A short table that links each quality risk to the response, the owner and how the firm monitors it can be easier to maintain than a long narrative.

Resources, including technology

The resources component covers people, technology and intellectual resources such as methodology and templates. It also covers service providers, for example an outside firm that performs monitoring or engagement quality reviews, or a vendor whose software the firm uses on engagements.

For technological resources, the firm should address how it decides to use a tool, how it determines that the tool is appropriate for its intended use, and how staff are trained to use it. This applies to audit software, data analytics tools and AI tools. Our guide to AI in auditing covers this in more detail.

Monitoring and remediation

Monitoring is how the firm finds out whether its system works. SQMS No. 1 requires the firm to design and perform monitoring activities that provide relevant, reliable and timely information about the system.

Key elements:

• Inspection of completed engagements, selected so that each engagement partner's work is inspected on a cyclical basis. The firm decides the cycle based on its risk assessment.
• Objectivity: the people performing monitoring must not have performed the engagement or the engagement quality review being inspected. A small firm may use an outside reviewer for this reason.
• Other information sources, including peer review results, regulatory inspections, complaints and allegations.
• Evaluation of findings to decide whether they are deficiencies.
• Root cause analysis of deficiencies, with the nature, timing and extent of the analysis based on the severity of the deficiency.
• Remedial actions that respond to the root cause, and follow-up on whether they worked.

The annual evaluation

The individual or individuals assigned ultimate responsibility and accountability for the system must evaluate it at least annually and conclude whether the system provides the firm with reasonable assurance that its objectives are being achieved. The possible conclusions are that the system provides reasonable assurance; that it does, except for matters with a severe but not pervasive effect; or that it does not. The evaluation and its basis must be documented.

SQMS 2: engagement quality reviews

An engagement quality review (EQR) is an objective evaluation of the significant judgments made by the engagement team and the conclusions reached, performed before the report is released.

When is an EQR required?

SQMS No. 1 requires the firm to establish policies that require an EQR for engagements where one is required by law or regulation, and for engagements where the firm determines that an EQR is an appropriate response to assessed quality risks. A firm might, for example, choose to require an EQR for all single audits, all ERISA audits, first-year audits of complex entities, or any engagement with a going concern issue.

Who can be the reviewer?

SQMS No. 2 requires the firm to set eligibility criteria. The reviewer must have the competence, capabilities and time to perform the review, and must be objective and independent. The reviewer can be a partner or other qualified person in the firm, or an external individual.

The standard also requires the firm's policies to address threats to objectivity created when an individual who previously served as the engagement partner is appointed as the engagement quality reviewer. The firm's policy should set out how it handles that situation, including whether a cooling-off period applies.

What does the reviewer do?

The reviewer reads and understands the engagement, discusses significant matters and judgments with the engagement partner, reviews selected documentation, evaluates the basis for significant judgments and the conclusions reached, and reviews the financial statements and report. The reviewer does not reperform the audit. The report cannot be released until the reviewer notifies the engagement partner that the review is complete.

Documentation

The firm documents the EQR in the engagement file, including the procedures performed and that the review was completed before the report was released.

SAS 146: the engagement partner's role

SAS No. 146 sets out the engagement partner's responsibilities for quality at the engagement level. Its main themes:

• Overall responsibility. The engagement partner takes overall responsibility for managing and achieving quality on the audit, including through being sufficiently and appropriately involved throughout.
• Direction, supervision and review. The partner is responsible for the nature, timing and extent of direction and supervision of the team and the review of their work. The partner can assign procedures and tasks to others but remains responsible.
• Review of key documentation. The engagement partner reviews documentation of significant matters and significant judgments, including those relating to difficult or contentious matters, and other matters the partner considers relevant, on or before the report date.
• Ethics and independence. The partner is responsible for being satisfied that relevant ethical requirements, including independence, have been fulfilled.
• Acceptance and continuance. The partner determines that the firm's policies on acceptance and continuance were followed.
• Resources. The partner determines that sufficient and appropriate resources, including technology, are assigned or made available on a timely basis.
• Professional skepticism. The standard emphasizes the partner's role in creating an environment where the team exercises skepticism.

A practical point: the engagement partner's review needs to be evident in the file, with dates that show it happened on or before the date of the auditor's report, as SAS 146 requires. AU-C 230 requires documentation of who reviewed the work and when.

Implementation tips for small firms

• Start from the AICPA practice aids and tailor them. Delete risks that do not apply and add ones that do.
• Keep it in one place. A single quality management document with linked policies, risk tables and evidence is easier to maintain and to show a peer reviewer.
• Assign owners. Each response should have a named owner and a way to show it operated.
• Use your monitoring. Inspection findings should change the methodology, templates or training, not just the inspected file.
• Calendar the annual evaluation, and document it even when the conclusion is that the system works.

Frequently asked questions

Does SQMS 1 apply to a firm that only does compilations?

SQMS No. 1 applies to firms that perform engagements under AICPA professional standards in their accounting and auditing practice, which includes engagements under the SSARS. The system is scaled to the engagements the firm performs, so a compilation-only firm will have a much simpler system than a firm with audits.

Is an engagement quality review required for every audit?

An EQR is not required for every audit. It is required where law or regulation requires one and where the firm's own policies, based on its quality risk assessment, call for one.

What happened to AU-C 220?

AU-C 220 remains the section number but was revised by SAS No. 146. It now addresses quality management for an engagement conducted under GAAS, replacing the earlier quality control requirements for audits.

Can an outside firm perform our monitoring?

Yes. A small firm can use an outside reviewer for engagement inspections, which helps meet the objectivity requirement. The firm remains responsible for its system and must evaluate the service provider's work.

Sources

• AICPA, Statement on Quality Management Standards No. 1 (SQMS No. 1), A Firm's System of Quality Management (effective December 15, 2025; first evaluation within one year)
• AICPA, SQMS No. 2, Engagement Quality Reviews (periods beginning on or after December 15, 2025)
• AICPA, SAS No. 146, Quality Management for an Engagement Conducted in Accordance With GAAS (AU-C 220, as revised; periods beginning on or after December 15, 2025)
• AICPA, SSARS No. 26 and SSAE No. 23, conforming quality management standards for SSARS and SSAE engagements
• AICPA, AU-C Section 230, Audit Documentation; AICPA Peer Review Standards
• Supersedes AICPA SQCS No. 8, QC Section 10, A Firm's System of Quality Control

CORAA prepares ready-to-review audit files for US CPA firms from QuickBooks books; you review and sign. See /us.

AU-C references are to AICPA Professional Standards, paraphrased here; read the standard itself before relying on a requirement. This page is guidance, not professional advice. Report an error