The July 2024 issue of the Audit & Accounting Alert highlighted the Statement on Quality Management Standards (SQMS) 1, A Firm’s System of Quality Management, and SQMS 2, Engagement Quality Reviews, newly released then by the AICPA. The practice aid provided at the time, Establishing and Maintaining a System of Quality Management for a CPA Firm’s Accounting and Auditing Practice, has now been updated.
As stated in SQMS 1, a system of quality management consists of the following eight components:
- The firm’s risk assessment process
- Governance and leadership
- Relevant ethical requirements
- Acceptance and continuance of client relationships and specific engagements
- Engagement performance.
- Resources
- Information and communication
- The monitoring and remediation process.
As stated in SQMS 1, a firm is “required to apply a risk-based approach in designing, implementing, and operating the components of the system of quality management in an interconnected and coordinated manner such that the firm proactively manages the quality of engagements performed by the firm.”
SQMS 2 covers “the appointment and eligibility of the engagement quality reviewer” and “the engagement quality reviewer’s responsibilities relating to the performance and documentation of an engagement quality review.”
The practice aid begins with a description of the eight components from SQMS 1. Then the risk assessment process is explained beginning with the need to “establish quality objectives; identify and assess quality risks; and design and implement responses to address the quality risks.”
Quality risks are those where “1) The risk has a reasonable possibility of occurring and 2) The risk has a reasonable possibility of , individually or in combination with other risks, adversely affecting the achievement of one or more quality objectives.”
An especially helpful section of the practice aid consists of a library with four tables with comprehensive entries of examples as follows:
Table 1 – Required Quality Objectives
Table 2 – Required Quality Objectives and Potential Quality Risks
Table 3 – Required and Suggested Quality Responses
Table 4 – Example of Evaluated Quality Risks and Linked Responses
Users are cautioned to customize the “risks and responses” in the practice aid to their own situation and not just copy them. Otherwise, they will not be in compliance and will likely be less “efficient and effective.”
As noted in the practice aid, “This practice aid does not address the quality control requirements of the Sarbanes-Oxley Act of 2002 (SOX), nor does it address the quality control requirements of PCAOB standards that must be followed by auditors of issuers. Auditors of issuers should follow these other standards and make changes to their firm’s quality control systems as necessary.”
