The annual evaluation of the system and network requirements

In this lesson you will

Perform the annual evaluation and reach one of the three conclusions in QM 10.55
Identify the actions required when the conclusion is not an unqualified one
Apply QM 10.49-.53 when the firm belongs to a network
List the documentation QM 10.59 requires

The annual evaluation

The individual or individuals with ultimate responsibility and accountability evaluate the system on behalf of the firm, as of a point in time, at least annually (QM 10.54). The first evaluation is due within one year following December 15, 2025 (QM 10.14). Based on it, they conclude one of three things (QM 10.55):

a. the system provides the firm with reasonable assurance that its objectives are being achieved; b. except for matters related to identified deficiencies that have a severe but not pervasive effect, the system provides that reasonable assurance; or c. the system does not provide that reasonable assurance.

The inputs are the monitoring results: deficiencies, their severity and pervasiveness, root causes, and whether remediation was designed, implemented and effective by the evaluation date. Deficiencies that are not severe, or that have been remediated, can support conclusion (a).

When the conclusion is (b) or (c)

The firm must take prompt and appropriate action and communicate to engagement teams and others assigned activities in the system to the extent relevant, and to external parties under the firm's external communication policies (QM 10.56). The leaders' periodic performance evaluations take the system evaluation into account (QM 10.57).

The annual evaluation guide and the annual evaluation checklist walk through a first-year evaluation.

Documentation

The firm documents its system sufficiently to support understanding by personnel, consistent implementation of responses, and evidence of operation to support the evaluation (QM 10.58). QM 10.59 requires documentation of:

the individuals with ultimate and operational responsibility;
the quality objectives and quality risks;
a description of the responses and how they address the risks;
for monitoring and remediation: evidence of monitoring activities, the evaluation of findings, deficiencies and root causes, remedial actions and their evaluation, and communications; and
the QM 10.55 conclusion and its basis.

Retention must be long enough for the firm and its peer reviewer to monitor the system, or longer if law or regulation requires (QM 10.61).

Networks

When the firm belongs to a network, it must understand the network requirements, the network services it chooses to use and its own responsibilities for implementing them (QM 10.49). The firm remains responsible for its system and may not let network requirements contravene SQMS No. 1. Based on that understanding, it determines how network requirements and services fit into its system and whether they need to be adapted or supplemented (QM 10.50).

If the network monitors the firm's system, the firm determines the effect on its own monitoring, its responsibilities and obtains the results timely (QM 10.51). The firm also understands the network's monitoring across network firms and, at least annually, obtains the overall results, communicates them as appropriate and considers their effect (QM 10.52). If the firm finds a deficiency in a network requirement or service, it tells the network and remediates the effect on its own system (QM 10.53). The network and service providers guide covers associations and alliances.

Common implementation problems

Evaluation performed by the quality partner instead of the individual with ultimate responsibility.
Conclusion with no basis documented.
Network methodology adopted wholesale with no evaluation of fit.
No evidence the firm obtained the network's monitoring results.

Worked example

Prescott Ridge CPAs: the first annual evaluation

Prescott Ridge CPAs sets November 30, 2026 as its evaluation date. The monitoring partner reports to the managing partner:

Deficiency	Severity	Pervasive?	Remediated by November 30?
Going concern practice aid gap (found in 3 of 10 inspected audits)	Not severe	Yes, all audits	Yes, aid revised in July; 4 audits tested since, no recurrence
Annual independence confirmations not obtained from 6 contract staff	Not severe	No	Yes, obtained in September
Single audit practice: major program determinations not reviewed by a qualified manager on 2 of 3 audits; one used the wrong Type A threshold	Severe	No, limited to the single audit practice	Partly: training done, but no new single audits completed to test

Evaluation: the first two deficiencies are not severe and have been remediated. The third is severe, because it could lead to an inappropriate compliance report, but it is confined to one practice area. Remediation is designed but not yet shown to be effective.

Conclusion under QM 10.55b: except for matters related to the single audit deficiency, which has a severe but not pervasive effect, the system provides reasonable assurance. Actions under QM 10.56 and .57: an engagement quality review on every single audit for the next cycle, communication to the single audit teams, and a note in the managing partner's performance evaluation. The conclusion and its basis are documented under QM 10.59e.

Self-check

Answer each question before you open the answer.

Who performs the annual evaluation, and how often?
Show answer
The individual or individuals assigned ultimate responsibility and accountability for the system, on behalf of the firm, as of a point in time, at least annually (QM 10.54).
What are the three possible conclusions?
Show answer
Reasonable assurance; reasonable assurance except for deficiencies with a severe but not pervasive effect; or no reasonable assurance (QM 10.55).
Can a firm in a network rely on network requirements without evaluating them?
Show answer
No. QM 10.50 requires the firm to determine how they fit its system and whether they need to be adapted or supplemented, and the firm remains responsible for its system (QM 10.49).

Sources

Back to the syllabus

Standards are paraphrased from the primary sources listed above; read the source before relying on a requirement. This lesson is training material, not professional advice. Report an error