AU-C section 220, Quality Management for an Engagement Conducted in Accordance With Generally Accepted Auditing Standards, is the engagement-level half of the AICPA's quality management framework. It comes from SAS No. 146 (issued in 2022), which replaced the old AU-C 220 on quality control for an engagement. The firm-level half is SQMS No. 1, A Firm's System of Quality Management, with SQMS No. 2 covering engagement quality reviews.
SAS 146 is effective for engagements conducted under GAAS for periods beginning on or after December 15, 2025. For a calendar-year client, that means the 2026 audit. The SAS also applies to auditors in government audit organizations that perform financial audits under GAAS, even though SQMS does not apply to those organizations.
This page paraphrases the standard; the authoritative text is AU-C 220 in AICPA Professional Standards. Paragraph numbers below are those of SAS 146 and are given where they help a reader find the text.
What is the objective of AU-C 220?
The auditor's objective is to manage quality at the engagement level to obtain reasonable assurance that quality has been achieved, so that the auditor has fulfilled the auditor's responsibilities and conducted the audit in accordance with professional standards and applicable legal and regulatory requirements, and that the auditor's report is appropriate in the circumstances (paragraph 11).
The engagement team, led by the engagement partner, works within the firm's system of quality management. It implements the firm's responses to quality risks that apply to the engagement, decides whether the circumstances call for responses beyond the firm's, and passes back to the firm information the firm's policies require (paragraph 4).
What changed from the old AU-C 220?
The old section talked about quality control. SAS 146 talks about quality management and is written around the firm's own system of quality management. The changes that matter in daily work:
- Partner accountability is explicit. The engagement partner remains ultimately responsible and accountable for compliance. The partner may seek help, but some responsibilities are written so that the partner must fulfill them personally, and others use the phrase "take responsibility for", which allows assignment to suitably skilled members of the team (paragraph 9).
- Sufficient and appropriate involvement. The partner must be involved throughout the audit so that the partner has a basis for deciding whether the significant judgments and conclusions are appropriate (paragraph 13).
- Scalability. The standard says it applies to the nature and circumstances of each audit. When an audit is carried out entirely by the partner, some requirements that depend on other team members do not apply (paragraph 8).
- Technology and resources. The application material recognizes technological and intellectual resources and warns that careless use can increase overreliance on information and create ethics risks such as confidentiality (paragraphs A63 and A68).
- Bias and skepticism. The standard ties skepticism to quality and describes conscious and unconscious bias and steps to counter it (paragraphs 7, A35 and A36).
The engagement partner's overall responsibility
The partner takes overall responsibility for managing and achieving quality on the engagement. This includes setting the tone for the engagement team. The partner takes responsibility for clear, consistent and effective action that reflects the firm's commitment to quality, including emphasizing (paragraph 14):
- that every team member contributes to quality
- the importance of professional ethics, values and attitudes
- open and robust communication, including the ability to raise concerns without fear of reprisal
- the importance of professional skepticism throughout
If the partner assigns work to others, the partner still directs and supervises them and reviews their work (paragraph 15). For a small firm where one person does the audit, that assignment question may not arise, but the partner-level responsibilities still apply to that person.
Ethics and independence
The partner must understand the relevant ethical requirements that apply to the engagement, make sure the team is aware of them and of the firm's related policies, remain alert for breaches through observation and inquiry, and evaluate and address threats if they arise (paragraphs 16 to 20). "Relevant ethical requirements" means the AICPA Code of Professional Conduct together with any more restrictive rules of the state board of accountancy or regulators.
Before dating the report, the partner must take responsibility for determining whether the relevant ethical requirements, including independence, have been fulfilled (paragraph 21). In practice, this is the point where nonattest services, fee arrangements, and relationships that came up during the year get a final look, and the conclusion goes in the file.
Acceptance and continuance
The partner determines that the firm's policies for acceptance and continuance of client relationships and audit engagements were followed and that the conclusions are appropriate. The partner uses the information obtained in planning and performing the audit. If the team learns something that might have led the firm to decline the engagement had it been known earlier, the partner passes that information promptly to the firm so it can act (paragraphs 22 to 24). See AU-C 210 for the terms of engagement side.
Engagement resources
The partner must determine that sufficient and appropriate resources are assigned or made available in a timely manner, including competence, capabilities and enough time, and must act if they are not (paragraphs 25 to 27). The partner also takes responsibility for the resources being used appropriately (paragraph 28). Resources include people, technological resources and intellectual resources such as audit methodologies and implementation tools.
Practical resource questions include whether the team has the industry experience for the client, whether a needed specialist (IT, valuation, actuarial) is engaged early, and whether the timeline is realistic.
Direction, supervision and review
The partner takes responsibility for direction and supervision of the team and for review of its work. The nature, timing and extent must be planned and performed in line with the firm's policies, professional standards and legal requirements, and must respond to the nature of the engagement and the resources available (paragraphs 29 and 30).
The standard sets specific partner review points:
| When | What the partner does |
|---|---|
| During the audit, at appropriate points | Reviews audit documentation on significant matters, significant judgments including difficult or contentious matters, and anything else the partner judges relevant (paragraph 31) |
| On or before the date of the report | Determines, through review of documentation and discussion with the team, that sufficient appropriate evidence has been obtained to support the conclusions and the report (paragraph 32) |
| Before dating the report | Reviews the financial statements and the auditor's report, including any key audit matters, and related documentation (paragraph 33) |
| Before issuance | Reviews formal written communications to management, those charged with governance and regulators (paragraph 34) |
The application material describes what review of the team's work should consider, including whether work follows firm policies and standards, whether significant matters were raised, whether consultation took place and was implemented, whether the nature, timing and extent of work needs to change, whether the work supports the conclusions and is documented, and whether the evidence is sufficient and appropriate (paragraph A89). The partner also reviews the overall audit strategy and plan under AU-C 300, and AU-C 230 asks that the date and extent of review be documented.
Review evidence has to be in the file: the documentation requirements in AU-C 230 ask for who reviewed the work, when and to what extent.
Consultation and differences of opinion
The partner takes responsibility for the team consulting on difficult or contentious matters, on matters the firm's policies say require consultation, and on other matters the partner judges need it. The partner determines that the consultation was appropriate, that the conclusions are agreed with the party consulted, and that they were implemented (paragraph 35).
If differences of opinion arise within the team, with the engagement quality reviewer, or with those consulted, the team follows the firm's policies for resolving them. The partner must not date the report until differences of opinion are resolved (paragraphs 37 and 38).
Engagement quality review
SQMS No. 1 sets the criteria for which engagements need an engagement quality review, and SQMS No. 2 covers who can be the reviewer and how the review is done. When a review is required for an audit, the partner must (paragraph 36):
- determine that a reviewer has been appointed
- cooperate with the reviewer and tell the team to do the same
- discuss significant matters and judgments with the reviewer, including those arising from the review
- not release the report until the review is complete
The standard defines an engagement quality review as an objective evaluation of the significant judgments made by the team and the conclusions reached, performed by the reviewer and completed before the report is released. The partner must not release the report until the review is complete (paragraph 36d). The application material (A105) links this to the rule in AU-C 700 that the report is dated no earlier than when sufficient appropriate evidence has been obtained.
Which audits need an engagement quality review is set by SQMS No. 1 and the firm's own criteria, together with any legal or regulatory requirement.
Monitoring and remediation
The partner takes responsibility for understanding the information from the firm's monitoring and remediation process, deciding what it means for the engagement, and staying alert for information the firm's process could use (paragraph 39). The information comes from the firm's own monitoring process, which can include findings from internal inspections and external reviews such as peer review.
Taking overall responsibility, before the date of the report
Before dating the report, the partner must determine that the partner has taken overall responsibility for managing and achieving quality, that involvement was sufficient and appropriate throughout, and that the nature and circumstances of the audit, any changes, and the firm's policies were taken into account (paragraph 40). It works as a stand-back check at the end.
Documentation
AU-C 230 applies. SAS 146 adds that the file must include (paragraph 41):
- significant issues identified, relevant discussions and conclusions on relevant ethical requirements and independence, and on acceptance and continuance
- the nature and scope of consultations and their conclusions, and how they were implemented
- if the engagement is subject to an engagement quality review, that the review was completed before the report was released
Conforming amendments elsewhere
SAS 146 also made conforming changes to other AU-C sections that cross-refer to quality control, for example AU-C 200, 210, 230, 260, 300, 600, 620, 700 and 701. Those amendments apply to audits of periods beginning on or after December 15, 2025.
File checks on engagement-level quality
These are practice checks, not requirements of the standard. Gaps to look for:
- No evidence of partner review before the report date
- Independence conclusion not documented at report date
- Consultation on a hard issue held by phone with nothing in the file
- Engagement quality review required by firm policy but completed after the report was released
- File shows the firm's SQMS policies but not how the engagement team applied them
Related
- SQMS No. 1 quality management guide
- Peer review readiness checklist
- AU-C 230 audit documentation
- AU-C 300 planning
Sources
- AICPA, AU-C Section 220, Quality Management for an Engagement Conducted in Accordance With GAAS (SAS No. 146, effective for periods beginning on or after December 15, 2025)
- AICPA, SQMS No. 1, A Firm's System of Quality Management, and SQMS No. 2, Engagement Quality Reviews
- AICPA, AU-C Section 230, Audit Documentation; AU-C 300, Planning an Audit; AU-C 700, Forming an Opinion and Reporting on Financial Statements
- AICPA Code of Professional Conduct (relevant ethical requirements)
Part of CORAA University · Planning and risk assessment: related guides, calculators and templates.
AU-C references are to AICPA Professional Standards, paraphrased here; read the standard itself before relying on a requirement. This page is guidance, not professional advice. Report an error