Over the summer and fall of last year, firms were busy developing, finalizing, and implementing systems of quality management (QM) to meet the Dec. 15, 2025, implementation date of AICPA’s Statements on Quality Management Standards. This meant that on top of already heavy workloads and hectic schedules, firms performing engagements under Statements on Auditing Standards, Statements on Standards for Accounting and Review Services, and Statements on Standards for Attestation Engagements had to:
During the design process, firms focused on identifying, assessing, and responding to risk across the QM components. These risk responses formed the bones of the firm’s documented QM policies and procedures. Now, with the heavy lifting of QM system design in the rearview mirror, the real challenge for firms is making their systems work for them by connecting their policies to their daily actions. However, for many firms, design documentation may include loosely defined policies that make it challenging to understand the policy’s purpose or how to apply it in practice.
After a decade of serving as a technical reviewer for the Peer Review Alliance (an administrator of the AICPA’s Peer Review Program), I’ve noticed that having a well-functioning system— one that consistently produces engagements in accordance with professional standards—has less to do with memorizing standard terminology or drafting a QM document that consists of broadly stated policies. Instead, it has far more to do with whether firm personnel understand why these policies exist and if they can articulate how their firm lives them out in practice.
In the past year, I had the opportunity to interact with leaders from firms of varying sizes across six states to discuss how their firms translate policy into practice. Based on those discussions, here are several commonly identified risks in three QM components and strategies for responding to them.
One of firm leadership’s most critical roles is securing the resources necessary to perform engagements in accordance with professional standards. With that in mind, a firm’s QM documentation may include the following as one of its quality risks and responses:
| Quality Risk | Risk Response (Policy) |
| The firm doesn’t realistically assess the availability of resources (e.g., time, appropriately capable personnel, etc.) or ensure allocation of such resources. | The firm considers and provides sufficient and appropriate time and personnel for each engagement. |
While this policy may “sound” great, the question it fails to answer is, “What does this look like in real life?”
When discussing this concept with practitioners, I wanted to know more about how firms plan to approach the next three, six, or 12 months of engagements. Regardless of firm size, most practitioners described a process of laying out upcoming engagements, estimating time requirements, hammering out preliminary scheduling, and determining personnel availability (including their own).
Believe it or not, this planning exercise is risk response in action. Making the effort to improve the quality of that planning directly impacts the effectiveness of the QM system.
By moving beyond simple scheduling considerations, firm leaders suggested the following methods to transform this process into an effective risk response:
Responsibility and accountability are foundational QM concepts. In particular, the concept of supervision and review of engagements are critical elements of standards. Therefore, a firm’s QM documentation may include the following as one of its quality risks and responses:
| Quality Risk | Risk Response (Policy) |
| The nature, timing, and extent of engagement team direction, supervision, and review are inadequate for the circumstances, leading to insufficient support for work performed on attestation engagements. | The engagement team documents an assignment and supervision plan. Firm methodology requires review of specific segments of engagements by the engagement partner. |
While a supervision plan and review assignments are important steps, it’s the depth and quality of both that matter.
Of course, this may mean something different to everyone on the team. That’s why it’s critical to develop a collective understanding of the expectations for, and characteristics of, good supervision and review in varying circumstances to ensure firm personnel are effectively living out supervision and review policies.
In my discussions with practitioners, several strategies for effective supervision and review for accounting and audit engagements emerged:
Attending relevant continuing professional education (CPE) is key to ensuring a firm develops its most significant resource—its people. However, this is only one piece of the puzzle. Firms must also find ways of ensuring the lessons learned make it into practice. With this in mind, a firm’s QM risk assessment documentation may include the following as one of its quality risks and responses:
| Quality Risk | Risk Response (Policy) |
| The firm’s personnel don’t apply knowledge regarding professional standards gained during CPE courses at the engagement level. | The firm identifies pertinent CPE content and incorporates it into relevant client engagements. |
While CPE is easier than ever to find and attend, the real challenge for firms is incorporating that learning into engagements. Notably, it can be difficult to home in on relevant course content and make sure learnings and standards flow through to relevant engagements.
In discussing with firms how they plan to tackle this challenge, firm leaders cited:
Much of the above may seem intuitive, but many of these steps often get overlooked. That’s why as firms move out from under the design phase of QM and into the action phase, it’s essential for them to understand what their policies should look like in real-life practice. Firms that take time to intentionally consider and discuss what living out a policy really means will end up with more consistent and effective QM systems. Without this shared understanding and action, even the most well-documented QM system runs the risk of becoming little more than words on a page.
Heather Lindquist, CPA, is the Illinois CPA Society’s director of peer review and professional standards.
