Peer review and the quality management standards

• Distinguish system reviews from engagement reviews and which firms need each
• Identify the peer review ratings and what they signal
• State when the QM-related peer review revisions apply
• Prepare the firm’s quality management documentation for a system review

Why peer review and quality management meet

Almost every firm that performs accounting or auditing work is required to have a peer review. Firms enrolled in the AICPA Peer Review Program are reviewed once every three years, with the review covering a one-year period of the firm's accounting and auditing practice. State boards build on this: many make peer review a condition of license renewal. For firms performing GAGAS engagements, Government Auditing Standards separately require an external peer review at least once every three years.

The peer review evaluates the firm's quality system against the standards in force. From the quality management effective date, that means the SQMS No. 1 system.

System and engagement reviews

• System review. Required for firms that perform engagements under the SASs or Government Auditing Standards, or examinations under the SSAEs. The reviewer evaluates the design of and compliance with the firm's system, and inspects a selection of engagements.
• Engagement review. For firms whose highest level of service is reviews, compilations and other engagements not requiring a system review. The reviewer evaluates selected engagements against professional standards.

Ratings

Peer review reports carry one of three ratings: pass, pass with deficiencies or fail. In a system review, a pass means the system was suitably designed and complied with to provide reasonable assurance of performing and reporting in conformity with professional standards in all material respects. Pass with deficiencies means that assurance is lacking in one or more areas. Fail means the system is not suitably designed or not complied with. Firms receiving deficiencies respond with corrective actions that the administering entity may require and monitor. See peer review ratings and corrective actions.

The QM revisions to peer review

The AICPA Peer Review Board approved Peer Review Standards Update No. 2 (PRSU No. 2) in November 2024. Its QM-related provisions are effective for peer reviews with peer review years ending on or after December 31, 2025. The update aligns terminology with the QM standards and adjusts requirements to address the risk-based approach. In practice, the first reviews of SQMS No. 1 systems cover firm years ending December 31, 2025 or later.

What the reviewer will look at

A system reviewer evaluating an SQMS No. 1 system will expect to see:

• the assigned responsibilities and evidence of time and authority;
• the firm's quality objectives, quality risks and the reasons for their assessments;
• responses mapped to risks;
• monitoring activities, findings, deficiencies, root cause analyses and remedial actions;
• the annual evaluation and conclusion with its basis; and
• engagement files that show the responses operating.

Documentation retention must be long enough for the firm and its peer reviewer to monitor the system (QM 10.61).

Using peer review in your system

Peer review results are "information from external inspections," which QM 10.38f requires the firm to consider in monitoring. A matter for further consideration or a finding in a peer review should flow into the firm's deficiency evaluation and root cause analysis like an internal inspection finding.

Common problems

• Treating peer review as the firm's monitoring process.
• No crosswalk from prior QC policies to the new QM documentation.
• Peer review corrective actions completed but never tested for effectiveness.

Use the peer review readiness checklist and the guide to peer review under the QM standards.

Halverson & Ng CPAs: timing and readiness for the next review