Engagement quality reviews under SQMS No. 2

Which engagements need an engagement quality review, who can be the reviewer, cooling-off for former engagement partners, and what the EQR covers and documents.

4 min read · CORAA Team
Lesson 11 of 13 · 0 of 13 complete
In this lesson you will
  • Determine which engagements require an EQR under QM 10.35f
  • Apply the eligibility criteria for engagement quality reviewers in QM 20.18-.20
  • Perform the EQR procedures in QM 20.25
  • Document the EQR under QM 20.30

Which engagements need one

SQMS No. 1 requires the firm to establish policies or procedures that address engagement quality reviews under SQMS No. 2 and require an EQR for (QM 10.35f):

  • audits or other engagements for which an EQR is required by law or regulation; and
  • audits or other engagements for which the firm determines an EQR is an appropriate response to one or more quality risks.

There is no automatic category beyond law or regulation. The firm's criteria come from its risk assessment. The application material suggests conditions such as high complexity or judgment, significant estimation uncertainty, going concern doubt, recurring inspection findings, unremediated significant deficiencies, a material restatement, a new client that disagreed with its prior auditor, emerging industries, entities with public interest characteristics such as certain banks, insurers and pension funds, and governmental organizations.

SQMS No. 2 is effective for audits or reviews of financial statements for periods beginning on or after December 15, 2025, and for other engagements beginning on or after that date (QM 20.11).

Who can be the reviewer

An engagement quality reviewer is a partner, other individual in the firm, or an external individual appointed by the firm (QM 20.13). Firm policies must require that the reviewer (QM 20.18):

  • is not a member of the engagement team;
  • has the competence and capabilities, including sufficient time, and appropriate authority;
  • complies with relevant ethical requirements, including those on threats to objectivity and independence; and
  • complies with any law or regulation on eligibility.

Policies must also address threats to objectivity when someone becomes the reviewer after serving as engagement partner (QM 20.19). SQMS No. 2 does not set a fixed cooling-off period; the application material says a firm may set one and that a suitable length depends on facts and circumstances, and that firms may consider cooling-off for individuals other than the engagement partner (QM 20.A16-.A17). Assistants to the reviewer must also be outside the engagement team and competent (QM 20.20). If eligibility becomes impaired, the reviewer notifies the firm and declines or discontinues the review (QM 20.23).

What the reviewer does

QM 20.25 requires the reviewer to:

a. read information from the engagement team about the engagement and entity, and from the firm about monitoring and identified deficiencies relevant to significant judgments; b. discuss significant matters and significant judgments with the engagement partner and team; c. review selected documentation on significant judgments and evaluate the basis, including skepticism, whether documentation supports the conclusions, and whether the conclusions are appropriate; d. evaluate the basis for the partner's determination that independence requirements were fulfilled; e. evaluate whether appropriate consultation took place; f. for GAAS audits, evaluate the basis for the partner's determination that the partner's involvement was sufficient and appropriate; and g. review the financial statements and report.

The reviewer performs procedures at appropriate points during the engagement, not only at the end (QM 20.24a). The engagement partner may not release the report until notified that the EQR is complete (QM 20.24b). Unresolved concerns go to the appropriate person in the firm, and the EQR cannot be completed (QM 20.26).

Documentation

QM 20.30 requires the reviewer's names and assistants, the documentation reviewed, the basis for the completion determination, the notifications given and the completion date, sufficient for an experienced practitioner with no connection to the engagement to understand the work. It is included with the engagement documentation (QM 20.29). Use the EQR eligibility and performance checklist and the EQR guide.

Worked example

Fenwick Osei CPAs: setting EQR criteria and picking a reviewer

Fenwick Osei CPAs' risk assessment identifies three engagement-level quality risks for which it designs EQR as a response:

  1. Audits of entities with substantial doubt about going concern.
  2. Single audits with total federal awards expended over $10 million.
  3. Audits of financial institutions with assets over $500 million.

No law or regulation in its client base requires an EQR, so these three criteria define the population. For 2026: 4 going concern audits, 3 large single audits and 2 financial institutions; one entity meets two criteria, so 8 engagements need an EQR.

Reviewer selection for Coastline Credit Union's audit (criterion 3):

  • Candidate A: audit partner who was Coastline's engagement partner through the 2024 audit, now off the engagement. The firm's policy bars a former engagement partner from serving as reviewer for the two audits after rotating off. The 2026 audit is the second of those two (2025 and 2026). Not eligible until the 2027 audit.
  • Candidate B: partner from another office with 8 credit union audits and no involvement with Coastline. Has 40 hours available in February and March 2027. Eligible.

B is appointed. B meets the team at planning to discuss the allowance for credit losses, again after fieldwork, and reviews the final statements and report. The partner releases the report on March 20, 2027 after B's completion notice dated March 18, 2027.

Self-check

Answer each question before you open the answer.

  1. Does SQMS No. 1 require an EQR for every audit of a governmental entity?

    Show answer

    No. It requires an EQR when law or regulation requires one or when the firm determines it is an appropriate response to quality risks. Governmental organizations are listed only as an example the firm may consider.

  2. Does SQMS No. 2 set a fixed cooling-off period before a former engagement partner can become the reviewer?

    Show answer

    No. Firm policies must address the objectivity threat (QM 20.19), and the application material says a firm may set a cooling-off period whose length depends on the facts and circumstances.

  3. Can the engagement partner release the report before the EQR is complete?

    Show answer

    No. Firm policies must preclude release until the reviewer notifies the partner that the review is complete (QM 20.24b), and SAS 146 paragraph 36d says the same at engagement level.

Sources

Back to the syllabus

Standards are paraphrased from the primary sources listed above; read the source before relying on a requirement. This lesson is training material, not professional advice. Report an error

For US CPA firms

Join the CORAA waitlist

CORAA AI drafts audit working papers from your client’s QuickBooks books and does the first pass: lead schedules, tie-out, memos, draft notes and letters. CORAA Network reviewers clear every finding. Your firm reviews and signs.

  • First audit free, so you can judge the quality on a real file
  • Flat fee by entity size; messy books included
  • We work only with CPA firms, never their clients
See how it works →

* required