- Determine which engagements require an EQR under QM 10.35f
- Apply the eligibility criteria for engagement quality reviewers in QM 20.18-.20
- Perform the EQR procedures in QM 20.25
- Document the EQR under QM 20.30
Which engagements need one
SQMS No. 1 requires the firm to establish policies or procedures that address engagement quality reviews under SQMS No. 2 and require an EQR for (QM 10.35f):
- audits or other engagements for which an EQR is required by law or regulation; and
- audits or other engagements for which the firm determines an EQR is an appropriate response to one or more quality risks.
There is no automatic category beyond law or regulation. The firm's criteria come from its risk assessment. The application material suggests conditions such as high complexity or judgment, significant estimation uncertainty, going concern doubt, recurring inspection findings, unremediated significant deficiencies, a material restatement, a new client that disagreed with its prior auditor, emerging industries, entities with public interest characteristics such as certain banks, insurers and pension funds, and governmental organizations.
SQMS No. 2 is effective for audits or reviews of financial statements for periods beginning on or after December 15, 2025, and for other engagements beginning on or after that date (QM 20.11).
Who can be the reviewer
An engagement quality reviewer is a partner, other individual in the firm, or an external individual appointed by the firm (QM 20.13). Firm policies must require that the reviewer (QM 20.18):
- is not a member of the engagement team;
- has the competence and capabilities, including sufficient time, and appropriate authority;
- complies with relevant ethical requirements, including those on threats to objectivity and independence; and
- complies with any law or regulation on eligibility.
Policies must also address threats to objectivity when someone becomes the reviewer after serving as engagement partner (QM 20.19). SQMS No. 2 does not set a fixed cooling-off period; the application material says a firm may set one and that a suitable length depends on facts and circumstances, and that firms may consider cooling-off for individuals other than the engagement partner (QM 20.A16-.A17). Assistants to the reviewer must also be outside the engagement team and competent (QM 20.20). If eligibility becomes impaired, the reviewer notifies the firm and declines or discontinues the review (QM 20.23).
What the reviewer does
QM 20.25 requires the reviewer to:
a. read information from the engagement team about the engagement and entity, and from the firm about monitoring and identified deficiencies relevant to significant judgments; b. discuss significant matters and significant judgments with the engagement partner and team; c. review selected documentation on significant judgments and evaluate the basis, including skepticism, whether documentation supports the conclusions, and whether the conclusions are appropriate; d. evaluate the basis for the partner's determination that independence requirements were fulfilled; e. evaluate whether appropriate consultation took place; f. for GAAS audits, evaluate the basis for the partner's determination that the partner's involvement was sufficient and appropriate; and g. review the financial statements and report.
The reviewer performs procedures at appropriate points during the engagement, not only at the end (QM 20.24a). The engagement partner may not release the report until notified that the EQR is complete (QM 20.24b). Unresolved concerns go to the appropriate person in the firm, and the EQR cannot be completed (QM 20.26).
Documentation
QM 20.30 requires the reviewer's names and assistants, the documentation reviewed, the basis for the completion determination, the notifications given and the completion date, sufficient for an experienced practitioner with no connection to the engagement to understand the work. It is included with the engagement documentation (QM 20.29). Use the EQR eligibility and performance checklist and the EQR guide.
Fenwick Osei CPAs: setting EQR criteria and picking a reviewer
Fenwick Osei CPAs' risk assessment identifies three engagement-level quality risks for which it designs EQR as a response:
- Audits of entities with substantial doubt about going concern.
- Single audits with total federal awards expended over $10 million.
- Audits of financial institutions with assets over $500 million.
No law or regulation in its client base requires an EQR, so these three criteria define the population. For 2026: 4 going concern audits, 3 large single audits and 2 financial institutions; one entity meets two criteria, so 8 engagements need an EQR.
Reviewer selection for Coastline Credit Union's audit (criterion 3):
- Candidate A: audit partner who was Coastline's engagement partner through the 2024 audit, now off the engagement. The firm's policy bars a former engagement partner from serving as reviewer for the two audits after rotating off. The 2026 audit is the second of those two (2025 and 2026). Not eligible until the 2027 audit.
- Candidate B: partner from another office with 8 credit union audits and no involvement with Coastline. Has 40 hours available in February and March 2027. Eligible.
B is appointed. B meets the team at planning to discuss the allowance for credit losses, again after fieldwork, and reviews the final statements and report. The partner releases the report on March 20, 2027 after B's completion notice dated March 18, 2027.
Self-check
Answer each question before you open the answer.
Does SQMS No. 1 require an EQR for every audit of a governmental entity?
Show answer
No. It requires an EQR when law or regulation requires one or when the firm determines it is an appropriate response to quality risks. Governmental organizations are listed only as an example the firm may consider.
Does SQMS No. 2 set a fixed cooling-off period before a former engagement partner can become the reviewer?
Show answer
No. Firm policies must address the objectivity threat (QM 20.19), and the application material says a firm may set a cooling-off period whose length depends on the facts and circumstances.
Can the engagement partner release the report before the EQR is complete?
Show answer
No. Firm policies must preclude release until the reviewer notifies the partner that the review is complete (QM 20.24b), and SAS 146 paragraph 36d says the same at engagement level.
Use it on the file
- GuideEngagement Quality Review Guide: SQMS 2 and AU-C 220 for Small CPA Firms
- TemplateEQR Eligibility and Performance Checklist (SQMS No. 2)
- TemplateEngagement Quality Review Checklist (SQMS 2)
- TemplateEngagement Quality Review Documentation Memo (SQMS No. 2)
Sources
- AICPA, SQMS No. 2, Engagement Quality Reviews (QM sec. 20)
- AICPA, SQMS No. 1, A Firm’s System of Quality Management (QM sec. 10)
Standards are paraphrased from the primary sources listed above; read the source before relying on a requirement. This lesson is training material, not professional advice. Report an error