From quality control to quality management: what changed and when

• State the effective dates of SQMS No. 1, SQMS No. 2 and SAS 146
• Explain how a risk-based quality management system differs from quality control
• List the eight components of a system of quality management
• Identify which firms and engagements SQMS No. 1 covers

Why the standards changed

For decades, US firms ran their quality systems under the Statements on Quality Control Standards, most recently SQCS No. 8 (QC section 10). That model told firms which policies to have: leadership, ethics, acceptance, human resources, engagement performance and monitoring. Firms often met it with a policy manual and an annual inspection, whether or not the policies addressed the firm's actual risks.

The AICPA's quality management standards, issued in June 2022 and based on the IAASB's ISQM 1 and ISQM 2, replace that with a risk-based approach. SQMS No. 1 supersedes SQCS No. 8. Instead of adopting a standard set of policies, the firm sets quality objectives, identifies the risks to achieving them and designs responses to those risks (QM 10.08 and .09). The system is meant to operate continually and iteratively, responding to changes in the firm and its engagements (QM 10.07).

The standards and their dates

• SQMS No. 1, A Firm's System of Quality Management (QM sec. 10). Systems must be designed and implemented by December 15, 2025, and the first evaluation of the system under paragraphs .54-.55 must be performed within one year following December 15, 2025 (QM 10.14).
• SQMS No. 2, Engagement Quality Reviews (QM sec. 20). Effective for audits or reviews of financial statements for periods beginning on or after December 15, 2025, and for other engagements beginning on or after that date (QM 20.11).
• SAS 146 (AU-C 220), Quality Management for an Engagement Conducted in Accordance With GAAS. Effective for engagements for periods beginning on or after December 15, 2025 (SAS 146, paragraph 10). SSARS No. 26 makes parallel changes for reviews and compilations, and AT-C 105 and AR-C 60 carry engagement-level quality management requirements for attestation, review and compilation engagements (QM 10.03).
• SQMS No. 3 made conforming amendments.

Who is covered

SQMS No. 1 applies to every firm that performs any engagement in its accounting and auditing practice: audits, attestation, reviews, compilations and other services under AICPA ASB or ARSC standards (QM 10.06 and .17). It also applies to audit and attestation engagements a firm performs under Government Auditing Standards, though not to government audit organizations (QM 10.05). Compliance is required by the Compliance With Standards Rule of the AICPA Code. Scalability is built in: a firm that only performs compilations will have a simpler, less formal system than a firm auditing specialized industries (QM 10.11).

The eight components

QM 10.07 lists the components the system addresses:

1. The firm's risk assessment process
2. Governance and leadership
3. Relevant ethical requirements
4. Acceptance and continuance of client relationships and specific engagements
5. Engagement performance
6. Resources
7. Information and communication
8. The monitoring and remediation process

The objective is reasonable assurance that the firm and its personnel fulfill their responsibilities under professional standards and legal and regulatory requirements, and that engagement reports are appropriate in the circumstances (QM 10.15). At least annually, the individual with ultimate responsibility evaluates the system and concludes whether it provides that assurance (QM 10.10). The SQMS No. 1 guide gives an overview of each component.

What firms got wrong in implementation

• Relabeling the old QC manual as a "quality management system" with no quality risks or link between risks and responses.
• Treating the eight components as eight separate binders instead of an interconnected system.
• No plan for the first evaluation, which falls due within one year of December 15, 2025.

The policy manual outline organizes documentation around the components.

Which rules apply to which engagement?