Peer Review Requirements for CPA Firms

A peer review is a process where one CPA firm’s accounting and auditing services are examined by another CPA. This system serves as a mechanism for self-regulation within the public accounting profession, aiming to uphold high standards. The review is not an inspection but an educational and supportive process intended to enhance a firm’s performance and adherence to professional standards.

Determining the Peer Review Requirement

A CPA firm’s obligation to undergo a peer review is triggered by professional affiliations and the types of services offered. The most common requirement stems from membership in the American Institute of Certified Public Accountants (AICPA), which mandates that member firms participate in an approved practice-monitoring program. If any individual in a firm is an AICPA member, the entire firm falls under this requirement. For an initial peer review, a firm must enroll in a program by the date of its first eligible engagement, with the review due within 18 months of that engagement’s year-end.

State boards of accountancy are another source of this mandate, with most jurisdictions requiring a peer review for licensure and renewal, particularly for firms performing attest services like audits. Firms performing engagements under Government Auditing Standards, or the “Yellow Book,” must also undergo a peer review and make their results publicly available. A 2024 revision to these standards is effective for periods ending on or after December 15, 2025, though early implementation is permitted. To confirm specific obligations, a firm should consult its state board of accountancy for current regulations.

Types of Peer Reviews

The services a CPA firm provides dictate which of two main types of peer review it must undergo: a System Review or an Engagement Review. A System Review is required for firms that perform engagements under Statements on Auditing Standards (SASs), Statements on Standards for Attestation Engagements (SSAEs), or Government Auditing Standards. This review involves an in-depth study of the firm’s system of quality control to provide the basis for an opinion on that system over a specified one-year period.

An Engagement Review is for firms that provide services such as compilations and reviews under Statements on Standards for Accounting and Review Services (SSARS). This type of review focuses on assessing whether the firm’s financial statements and reports comply with applicable professional standards. The reviewer evaluates a selection of engagements to determine conformity, but does not evaluate the firm’s overall system of quality control.

Preparing for the Peer Review

A firm’s first step is to select a qualified peer reviewer through its administering entity, which is a state CPA society or the AICPA. These entities maintain lists of approved reviewers, and firms can use online portals like the AICPA’s Peer Review Integrated Management Application (PRIMA) to find one. The chosen reviewer must be independent and have experience in the industries and types of engagements the firm handles.

Once a reviewer is engaged, the firm must compile documentation, including its quality control (QC) document and a complete list of engagements for the review period. Other necessary items include documentation of independence for each engagement, CPE records for all professional staff, and evidence of licensing compliance.

Internally, the firm should designate a peer review captain to coordinate with the reviewer. This person is responsible for ensuring that all staff are aware of the upcoming review and that all engagement files are complete, organized, and accessible. This includes verifying that workpapers are properly signed off on and that all required documentation is present in each file.

The Peer Review Process

The peer review begins with the firm and reviewer agreeing on the one-year review period and the timing for fieldwork. Based on the firm’s practice, the reviewer develops a risk-based approach and selects a cross-section of engagements for detailed examination. The selection is designed to be representative of the firm’s practice, covering different industries and service levels.

For a System Review, the reviewer examines workpapers and reports for the selected engagements to assess compliance with professional standards and the firm’s QC policies. For an Engagement Review, the examination is limited to the final reports and related financial statements.

Fieldwork can be conducted on-site or remotely. The reviewer examines files, interviews personnel, and assesses the implementation of the quality control system. At the conclusion of the fieldwork, the reviewer holds an exit conference with the firm’s leadership to discuss any findings, deficiencies, or areas for improvement.

Navigating Post-Review Procedures

After the exit conference, the peer reviewer drafts a formal report with one of three ratings: pass, pass with deficiencies, or fail. A “pass” rating indicates the firm’s system of quality control is suitably designed and complied with, or that engagements conform to standards. A “pass with deficiencies” rating is issued when the review identifies significant issues that are not considered pervasively compromising. A “fail” rating signifies that the firm’s system has serious and pervasive problems.

The firm can review the draft report and compose a letter of response if deficiencies were noted, outlining planned corrective actions. The final report, the firm’s response, and a letter from the reviewer are submitted to the administering entity’s peer review committee for acceptance.

If the report is a “pass,” the process is complete upon acceptance. For reports of “pass with deficiencies” or “fail,” the committee requires the firm to complete remedial actions. These may include submitting a corrective action plan, undergoing follow-up reviews, or attending specific CPE courses. The firm must provide evidence of completing these actions by a specified deadline.