Written by Nicole Cradic, CPA
This article first appeared in the Pennsylvania CPA Journal - Spring 2023 and is reprinted with permission. Copyright © 2023 by the Pennsylvania Institute of CPAs. All rights reserved.
The PICPA’s Accounting & Auditing Steering Committee (A&A Committee) has been monitoring the Auditing Standards Board’s deliberation and ultimate issuance of four quality management (QM) standards:
- Statement on Quality Management Standards (SQMS) No. 1, A Firm’s System of Quality Management.
- SQMS No. 2, Engagement Quality Reviews.
- Statement on Auditing Standards (SAS) No. 146, Quality Management for an Engagement Conducted in Accordance
with Generally Accepted Auditing Standards. - Statement on Standards for Accounting and Review Services (SSARS) No. 26, Quality Management for an Engagement Conducted in Accordance with Statements on Standards for Accounting and Review Services.
The QM standards were issued in June 2022. Admittedly, I often check the effective date of any new standard to determine its place on my to-do list. At a quick glance, a standard with an effective date in 2025 may not appear to be a priority item. However, my plea to you in writing this article is to make addressing these QM standards a priority. The implementation for the QM standards is lengthy: it requires a multiyear effort by those firms performing attest engagements in accordance with SAS, SSARS, or Statements on Standards for Attestation Engagements.
PICPA’s A&A Committee is planning to provide more information in a series of articles in upcoming journal publications, so I will use this article for a high-level overview of SQMS No. 1 and offer some suggestions for the implementation of the standards. Ultimately, the QM standards need to be implemented by Dec. 15, 2025, and an evaluation of the system of quality management must be performed by Dec. 15, 2026.
SQMS No. 1 introduces a risk-based approach to a firm’s system of quality management. I found it helpful to compare
the concepts to the risk-based audit approach. Just like we use the audit risk assessment to focus more audit effort on
riskier parts of an engagement, we now analyze our firm’s attest practices along similar thought processes. SQMS No. 1 segments a firm’s system of quality management into eight highly integrated components. I like to parallel them to the concept of audit areas. Even if your firm does not perform audits, you should recognize these key areas of engagement risk and vulnerability:
- The firm’s risk assessment process.
- Governance and leadership.
- Relevant ethical requirements.
- Acceptance and continuance of client relationships and specific engagements.
- Engagement performance.
- Resources (includes human resources).
- Information and communication.
- The monitoring and remediation
process.
For each component, firms need to establish quality objectives that can be taken right out of SQMS No. 1. Here are
a few examples:
- Governance and Leadership: Resource needs, including financial resources, are planned for, and resources
are obtained, allocated, or assigned in a manner that is consistent with the
firm’s commitment to quality. - Resources – Human Resources: Engagement team members, including an engagement partner, who have
appropriate competence and capabilities to consistently perform quality engagements, including being given
sufficient time, are assigned to each engagement. - Resources – Technological Resources: Appropriate technological resources are obtained or developed, implemented, maintained, and used to enable the operation of the firm’s system of quality management and the performance of engagements. Once the quality objectives are determined, firms can begin to assess the risk that those quality objectives will not be achieved due to quality risks. Quality risks are hazards with a reasonable possibility of occurring and affecting the achievement of a quality objective. Questions to ask in this process could be as follows:
- What circumstances would cause a firm to not achieve a quality objective?
- Is there a reasonable possibility of that circumstance occurring?
- What quality management procedures are currently in place to address this risk?
- Are those procedures sufficient?
- What else can be done to reduce the quality risk?
Firms will design and implement responses to reduce identified quality risks. I will discuss SQMS No. 2, SAS
No. 146, and SSARS No. 26 in an upcoming issue. Those standards focus on the qualifications of the engagement
quality reviewer (EQR), the performance of EQRs, the engagement partner’s responsibilities relating to the EQR, and
the quality of the engagement overall. In closing, I would like to offer some suggestions to help practitioners ready
their firms for the new QM standards:
- Determine a leader for the implementation process and assemble a team to assist. (Smaller firms may
need to seek a peer adviser/consultant to help progress and stay the course.) - Obtain a thorough understanding of the QM standards by reading the standards, attending professional
education, and consulting other resources. - Monitor the AICPA website for additional information and resources.
- Contact the provider of your current quality control materials to understand what resources will be available and when.
- Map out a detailed implementation timeline.
- The AICPA suggests performing the risk assessment process in 2023 and 2024.
- In 2025, you should document the new SQM, implement new processes, and determine how to monitor the SQM moving forward.
- In 2026, your attest practice should fully operate under the new SQM and the SQM should be tested by Dec. 15, 2026.
- Schedule time on team members’ calendars for periodic project meetings and implementation efforts.
- Consider tackling one QM component at a time.
- Consult with your peer reviewer on questions and provide updates.
- Embrace this undertaking as it will allow firms to challenge the status quo of attest practices and create a mindset of continuous improvement.
