Preparing for peer review under the new Quality Management Standards

Navigate audit quality changes with key insights and strategies

Audit peer reviews are a cornerstone of maintaining quality and compliance within the profession. These reviews ensure firms adhere to professional standards and foster continuous improvement and accountability.

While they’ve always been a foundational part of ensuring audit quality, the significance of these reviews will only grow with the introduction of the new Statements on Quality Management Standards (SQMS).

The new standards are effective December 15, 2025, and they will bring substantial changes, emphasizing a risk-based approach and expanding the components of quality management.

Despite the importance of these new standards, our discussions with firm leaders indicate many are unprepared, believing there’s plenty of time to prepare before they take effect.

In this report, we’ll discuss why procrastination poses a significant risk and why the comprehensive nature of the new requirements demands early and thorough preparation. If firms do not start preparing now, they will likely be overwhelmed and scrambling to comply by the effective date.

Understanding the new SQMS

The new SQMS will introduce substantial changes to how CPA firms manage and ensure quality in their accounting, auditing, and attestation practices.

The new SQMS and related standards are:

• SQMS No. 1, A Firm’s System of Quality Management
• SQMS No. 2, Engagement Quality Reviews
• SQMS No. 3, Amendments to QM Sections 10, A Firm’s System of Quality Management, and 20, Engagement Quality Reviews
• Statement on Auditing Standards (SAS) No. 146, Quality Management for an Engagement Conducted in Accordance with Generally Accepted Auditing Standards
• Statement on Standards for Accounting and Review Services (SSARS) No. 26, Quality Management for an Engagement Conducted in Accordance with Statements on Standards for Accounting and Review Services
• Statement on Standards for Attestation Engagements (SSAE) No. 23, Amendments to the Attestation Standards for Consistency With the Issuance of AICPA Standards on Quality Management

These new standards, designed to enhance the overall quality of audits and engagements performed per the SSARSs and SSAEs, emphasize a more structured and comprehensive approach to quality management. The remainder of this report primarily addresses audit engagements.

The goal is to create a more robust and adaptable system that can address the complexities of modern audit environments. The primary changes include a shift toward a risk-based approach to quality management and the creation of a scalable system that firms can tailor to their operations and the types of audits they conduct, whether they’re a solo practitioner or large national firm.

Crucial components of a system of quality management

Under the new standards, quality management comprises eight components — six of which align with the existing quality control elements:

1. Risk assessment process
2. Governance and leadership
3. Relevant ethical requirements
4. Acceptance and continuance of client relationships and specific engagements
5. Engagement performance
6. Resources
7. Information and continuation
8. Monitoring and remediation process

One of the most notable changes in the new standards is adopting a risk-based approach to quality management. Firms are now required to identify and assess risks that may impact the quality of their audits, which involves thoroughly analyzing potential risks and developing tailored procedures to address them.

Current challenges and delays

Conversations with firm leaders across the country show that many firms are delaying their preparations for the new SQMS. Despite the evident importance of these upcoming changes, there is a pervasive sense of complacency. Leaders acknowledge the need for compliance but believe there is still ample time to prepare.

This perspective underestimates the effort required to identify and mitigate risks, design new policies and procedures, and ensure effective implementation.

While competing priorities and resource constraints are always a factor in these decisions, there are significant consequences of delayed preparation:

• Risk of peer review deficiencies. Firms that delay preparations are at a higher risk of non-compliance with the QM standards by the 2025 deadline, which can result in peer review deficiencies.
• Operational disruptions. Rushing to meet the standards at the last minute can disrupt daily operations. The extensive changes required may not be implemented smoothly, affecting the quality and efficiency of audit practices.
• Reputational damage. Failure to comply with the new standards can damage a firm’s reputation, undermining client trust and potentially leading to the loss of business.
• Financial consequences. Non-compliance and operational inefficiencies can translate into financial losses, both from unbillable time due to inefficiencies and the potential loss of clients.
• Stress and pressure on staff. Last-minute preparations can place significant stress and pressure on staff, leading to burnout and a decline in overall morale.

In light of these observations and implications, we encourage firms to prioritize preparation for the new standards. Early and proactive engagement ensures a smoother transition, maintaining compliance and upholding the quality and integrity of your audit practice.

Preparing for SQMS: A risk-based approach

Adopting a risk-based method is vital to an effective quality management system under the new standards. This approach allows firms to proactively identify and address potential issues that could impact the quality of their audits.

Steps to assess and respond to risks

SQMS No. 1 calls for firms to do the following to implement a risk-based approach:

1. Establish quality objectives. The standard details quality objectives, but the firm can add more if deemed appropriate.
2. Identify and assess quality risks. The second step is to systematically identify risks that could affect the quality of audits. Doing so involves considering factors such as the nature of the firm’s clients, the complexity of audit engagements, and any changes in the regulatory environment. Once identified, the firm must assess risks to determine their potential impact and likelihood. This assessment helps prioritize which risks require the most attention and resources.
3. Design and implement responses to address quality risks. The standard specifies some responses, but most are left to the firm based on its unique situation. It’s crucial to take a thoughtful and honest look at the firm’s structure, financial incentives, areas of competence, services, and client base. Ensure that you can meet your quality objectives.

Designing policies and procedures

After identifying and assessing risks and developing responses, the next step is to design policies and procedures that effectively detail how the firm will put risk responses into action.

1. Develop tailored policies. Create specific policies from the responses that address each identified risk. These policies should be clear, practical, and aligned with the firm’s overall quality management strategy.
2. Establish procedures. Develop detailed procedures that outline how the firm will implement the policies in practice. Procedures should designate responsible parties for each task.
3. Training and education. Ensure all staff members receive adequate training on the new policies and procedures. This training should be ongoing to address any updates or changes in the risk landscape.

The American Institute of Certified Public Accountants (AICPA) created practice aids to help practitioners prepare for their new quality management systems. The practice aid Establishing and Maintaining a System of Quality Management for a CPA Firm’s Accounting and Auditing Practice is available in two versions — one for sole practitioners and another for small-to-medium-sized firms —  and is free for AICPA members.

PPC’s Guide to Quality Control (GQC) contains a practice aid to assist firms in identifying risks and working through the new risk assessment requirement for quality management. In addition, GQC  provides illustrative policies and procedures documents that correspond to the identified risks and responses.

Designing policies and procedures is only the beginning. The true effectiveness of a risk-based approach lies in continuous monitoring and ongoing follow-up. Regularly monitor the implementation of policies and procedures to ensure they function as intended.

When monitoring reveals deficiencies or areas for improvement, firms must take prompt action to remediate these issues. This remediation might involve additional training, revising procedures, or reallocating resources.

Resource management under SQMS

The new standards significantly broaden the definition of resources to reflect the evolving nature of audit practices. Under the new standard, resources encompass not only human resources but also technological and intellectual resources.

• Human resources. Recruiting, developing, and retaining human resources is fundamental to maintaining the quality of audits. The new standards emphasize ensuring staff are adequately trained, experienced, and supervised. Firms should establish clear performance evaluation processes that allow less experienced staff to learn and continuously improve to maintain high audit quality standards.
• Technological resources. These include software, tools, and other technologies that support the quality management system and engagement performance. With advances in artificial intelligence and data analytics, technological resources are becoming increasingly integral to the audit. Firms must ensure these technologies are integrated into their audit workflows and train staff to use them effectively.
• Intellectual resources. A firm’s methodologies, subject-matter-specific guides, accounting guides, other information sources used in performing the engagement, and written policies and procedures fall under this category.

The new standards also address resources provided by service providers or networks. These would include, among other things, specialized technical support, outsourcing audit tasks to a service provider, or outsourcing monitoring activities. This comprehensive view ensures firms consider and effectively manage all aspects contributing to audit quality.

Impacts on M&A, private equity, and alternative structures

In recent years, the volume of mergers, acquisitions, and private equity in accounting firms has grown dramatically.

Peer review readiness is a crucial part of mergers and acquisitions (M&A) and private equity deals. The quality and compliance of a firm’s audit practices can impact the success of these transactions. Firms well-prepared for peer reviews are considered more reliable, stable, and attractive to potential buyers and investors.

Firms that have not adequately prepared may face several challenges:

• Deal viability. Peer review findings can impact the viability of M&A and private equity deals. Negative findings or non-compliance issues can deter potential investors or buyers, leading to deal cancellations or renegotiations.
• Valuation. A firm’s readiness for peer review affects its valuation. The value of firms with strong compliance and high audit quality will likely be higher than those with significant deficiencies or risks.
• Due diligence. During the due diligence process, the other party scrutinizes peer review results to assess the quality of a firm’s audit practices. Positive results facilitate smoother transactions, while negative findings lead to extended negotiations or additional remediation requirements.

Proactively preparing for the new standards ensures compliance and strengthens the firm’s reputation and valuation in the eyes of potential investors and buyers.

Practical steps for implementation

Implementing the new standards can seem overwhelming — and it will be for firms that wait until the eleventh hour. Start preparing now by breaking down the SQMS implementation into manageable pieces.

• Determine who will manage the implementation process and perform detailed work.
• Perform a thorough review of SQMS No. 1 and review other relevant professional literature, if necessary. Assess the current state of your firm’s quality management system and identify gaps and areas that need improvement to meet the new requirements.
• Establish a timeline for implementation.
• Create detailed steps for the implementation plan that includes specific actions required for each component of the SQMS. Prioritize actions based on their impact and urgency. Focus first on areas that pose the highest audit quality and compliance risk.
• Begin work on the new risk assessment process requirement. Implement changes in phases to address the most critical areas first while gradually integrating the new standards into all aspects of the quality management system. This approach helps ensure a smooth transition.
• Develop the firm’s quality management policies and procedures based on the risk assessment process.
• Establish the enhanced quality management monitoring and remediation process.
• Communicate completion of the implementation project and train staff.
• Begin using the quality management system.
• Perform monitoring activities on the system and make modifications as necessary. Encourage staff feedback and questions. Create channels for two-way communication, such as town hall meetings, Q&A sessions, and suggestion boxes, to address concerns and gather input. Schedule regular reviews to monitor progress and adjust as needed. These reviews help promptly address issues to keep the implementation on track.

By breaking down the implementation process into manageable pieces, utilizing available resources, and thoroughly documenting all steps, firms can effectively prepare for the new standards and enhance their audits' overall quality and reliability.

Thomson Reuters: Your partner in creating a system of quality management

We offer a variety of resources and practice aids that can assist firms in preparing for and implementing the new standards.

Training and conference opportunities

Take advantage of our training and conference opportunities, where you can get valuable insights and practical guidance on complying with the new standards.

Specialized training and consulting from AuditWatch provide expert guidance on all aspects of auditing, including standards, methodology, and processes, with courses on Peer Review Remediation and Peer Review Insights. See the complete list of specialized training offerings and registration options to register.

The annual Thomson Reuters SYNERGY conference for tax, audit, and accounting professionals offers four days of interactive learning and more than 20 CPE credits. Included in the course offerings for 2024 are more than two dozen audit sessions, including guidance on the New Quality Management Standards. It’s a must-attend event to connect with peers, get exclusive professional insights, and stay on top of the latest technology.

Audit and accounting solutions

We offer a comprehensive suite of audit and accounting solutions designed to enhance audit quality and support compliance with the new standards. These solutions integrate data analytics and artificial intelligence to streamline audit processes, improve accuracy, and support effective risk management.

Guided Assurance (formerly Checkpoint Engage) provides guided audit-tracking technology and the tools you need to perform efficient and profitable audits that comply with professional standards and pass peer review.

Engagement Manager (formerly AdvanceFlow) offers the most extensive cloud-based audit engagement management with full trial balance capabilities, management for workpapers, financial statement reporting functionality, and more.

Thomson Reuters Confirmation is an online confirmation service that reduces the risk of fraud in the audit confirmation process and guarantees a response from a global network of validated responders.

PPC Audit Guides  are loaded with practical considerations, real-life examples, and time-saving audit checklists and practice aids to give firms the expertise they need to complete audit engagements with the assurance that you haven’t overlooked anything.

A companion offering to the PPC Guides, PPC’s Practice Aids are Microsoft Word and Excel versions of all the editable practice aids in a Guide. They work with leading paperless engagement software or with Word and Excel alone.

Thought leadership

We provide insights and best practices to help firms stay ahead of industry trends and regulatory changes.

The special report, “New quality management and peer review standards significantly impact firms,” provides an in-depth look at the new standards and practical tips for compliance.

Act now to prepare for peer reviews

As we approach the implementation date for the new quality management standards, proactive preparation is essential for maintaining quality and compliance in your audit practice.

Peer reviews have always been vital to maintaining audit quality, but their significance will increase under the new standards. Breaking down the implementation of the new standards into manageable pieces and taking advantage of available resources can ease the transition.

By taking proactive steps today, your firm can ensure a smooth transition, uphold the quality and integrity of your audits, and maintain client trust and confidence.