QC 1000: A Firm’s System of Quality Control

A certified public accounting (CPA) firm’s reputation is built on the quality and reliability of its work. To guide these practices, the American Institute of Certified Public Accountants (AICPA) established a framework through its Statement on Quality Management Standards (SQMS). This standard supersedes previous quality control standards, shifting from a policies-based “quality control” model to a more proactive and scalable risk-based “quality management” approach. The primary objective is to provide the firm with reasonable assurance that its personnel comply with professional standards and that reports issued by the firm are appropriate for the circumstances.

Applicability of the Standard

The requirements to establish a system of quality management apply to firms with an “accounting and auditing practice.” This term covers attest services where a practitioner issues a report on subject matter that is the responsibility of another party. A firm must design and implement a quality management system if it performs audits, reviews, compilations, or other attestation engagements. CPA firms with an accounting and auditing practice must have their new system designed and implemented by December 15, 2025.

Engagements performed under Statements on Auditing Standards (SAS), Statements on Standards for Accounting and Review Services (SSARS), and Statements on Standards for Attestation Engagements (SSAEs) fall under this umbrella. For example, a financial statement audit, a review of quarterly financial information, or an examination of a company’s internal control would trigger the requirement.

Conversely, a CPA firm that exclusively provides services outside this scope, such as tax preparation or consulting, is not required to have a system of quality management under these standards. While these firms must still adhere to other professional standards, such as the AICPA Code of Professional Conduct, the specific framework of SQMS is not mandated for their practice.

The Eight Components of a Quality Management System

A system of quality management is built upon eight interrelated components that provide a structure for a firm’s policies and procedures. These components are designed to be scalable, allowing firms of different sizes and complexities to tailor their systems appropriately. The system’s effectiveness depends on the thoughtful implementation of policies within each of these areas.

Governance and Leadership

The firm’s leadership must assume ultimate responsibility for the quality management system. This “tone at the top” is fundamental to embedding a culture of quality throughout the firm. It requires that the firm’s strategic decisions and operational priorities reflect a commitment to performing high-quality work, ensuring that commercial pressures do not override the quality of services performed.

The Firm’s Risk Assessment Process

Firms must establish a process to identify and assess quality risks. This proactive approach requires the firm to understand the conditions, events, and circumstances that could adversely affect the achievement of quality objectives. The firm then designs and implements responses to address these identified quality risks.

Relevant Ethical Requirements

Firms must establish policies to provide reasonable assurance that personnel maintain independence, integrity, and objectivity. Independence is an important part of the attest function, and procedures must be in place to identify and manage threats to it. These policies help ensure that personnel are free from conflicts of interest that could impair their judgment.

Acceptance and Continuance of Client Relationships and Specific Engagements

This component requires firms to establish policies for deciding whether to accept a new client or continue serving an existing one. The goal is to minimize the risk of associating with a client whose management lacks integrity. It also involves evaluating whether the firm has the necessary competence, resources, and time to perform the engagement in accordance with professional standards.

Engagement Performance

Engagement performance policies are designed to ensure that work performed meets applicable professional standards, regulatory requirements, and the firm’s own standards of quality. This involves proper planning, supervision, and review at all stages of the engagement and promotes consistency across all of the firm’s engagements.

Resources

The quality of a firm’s work depends on having appropriate resources. This component encompasses policies and procedures related to human, technological, and intellectual resources. Policies should be designed to ensure that the firm has a sufficient number of individuals with the necessary competence and commitment to ethical principles, as well as the technological and intellectual tools needed to perform high-quality engagements.

Information and Communication

Firms must establish a system for capturing, sharing, and retaining relevant and reliable information. Effective communication is essential for the proper functioning of the quality management system. This includes communicating responsibilities to personnel and sharing information with external parties when appropriate, ensuring a consistent understanding of quality expectations.

Monitoring and Remediation Process

The final component requires the firm to have a process for monitoring its quality management system. This involves an ongoing evaluation of the design and effectiveness of the other seven components. The objective is to provide the firm with reasonable assurance that its policies and procedures are operating effectively. This process includes identifying deficiencies and implementing timely and effective remedial actions.

Documenting the Quality Management System

A firm is required to formalize its quality management policies and procedures in writing. This documentation serves as the official manual for how the firm maintains quality, and it must address all eight components of quality management. The process of documentation forces a firm to think critically about its processes and how each policy contributes to the overall objective of quality. The level of detail will vary depending on the firm’s size and the nature of its practice.

Effective communication of these documented policies to all personnel is also required. The firm must ensure that every individual in the accounting and auditing practice understands the system and their responsibilities within it. This is often accomplished through training sessions and by requiring personnel to acknowledge they have read the quality management document. The document should be a living resource, updated as needed for changes in professional standards or the firm’s practice.

The Peer Review Process

After a firm has designed and implemented its system of quality management, it must undergo an external assessment known as a peer review. This process is an independent check on a firm’s quality management system, conducted by another qualified CPA firm and is required every three years. Under the new standards, the peer review process will evolve to assess these new systems. For peer review years ending after December 15, 2025, firms that perform audits or examinations under the Statements on Standards for Attestation Engagements (SSAEs) will be subject to peer reviews of their system of quality management. The goal of the review is to determine whether the firm’s system is suitably designed and being complied with to provide reasonable assurance that engagements are performed in line with professional standards. The outcome of a peer review is a report that is issued to the firm and, in many cases, is made publicly available.