Resources to implement the QM standard
The AICPA offers a comprehensive practice aid to help firms implement the new quality management standard by the 2025 deadline.
Implementing the new standard on quality management (QM) by the Dec. 15, 2025, deadline may seem daunting, but the AICPA has developed resources and tools to get started, including a recently revised practice aid.
A mapping document from extant SQCS to SQMS No. 1 bridges the changes in requirements from your extant system of quality control. The audit and accounting practice aid, Establishing and Maintaining a System of Quality Management for a CPA Firm’s Accounting and Auditing Practice, includes a detailed look at the requirements of the standard and provides application guidance.
The AICPA Auditing Standards Board (ASB) issued its new standard on QM, Statements on Quality Management Standards (SQMS) No. 1, A Firm’s System of Quality Management, in June 2022. SQMS No. 1 introduces a risk-based approach that provides a scalable methodology to quality for all firms, from sole practitioners to large multinational firms.
The introduction of a risk-based approach compels each firm to tailor its system of quality management to its particular circumstances by performing a risk assessment and to implement a customized system of quality management by the effective date of Dec. 15, 2025. The standard also requires an evaluation of the QM system to be performed within one year following the firm’s implementation of its system.
The effective date was set to allow firms ample time to design and implement a more tailored system of QM in compliance with the new standard. Now that date is fast approaching.
GETTING STARTED
The new standard requires each firm to design, implement, and operate a system of QM that is customized for the nature and circumstances of the firm’s specific accounting and auditing practice.
The first steps start with laying the foundation by:
- Obtaining an understanding of the new standard and the requirements, and
- Developing an implementation plan.
THE RISK ASSESSMENT PROCESS AND THE PRACTICE AID
The most significant change in the new QM standard is the introduction of a risk-based approach and the required risk assessment. The risk assessment process is necessary for firms to identify and address risks specific to their respective practices.
The risk-based approach comprises three distinct steps:
- Establishing quality objectives (the desired outcomes relating to the components of the system of quality management to be achieved by the firm);
- Identifying and assessing quality risks (a risk that has a reasonable possibility of occurring and, individually or in combination with other risks, adversely affecting the achievement of one or more quality objectives); and
- Designing and implementing responses (policies or procedures designed and implemented by the firm to address one or more quality risks).
To comply with the new standard, tailor your quality responses based on the quality risks associated with the conditions, events, circumstances, actions, or inactions that relate to the nature and circumstances specific to your firm and its engagements.
To better assist with developing a quality management system that is appropriate for the size and nature of your practice, the practice aid includes considerations for both small- and medium-sided firms and for sole practitioners.
Firms are required to establish quality objectives for each of the following components:
- Governance and leadership;
- Relevant ethical requirements;
- Acceptance and continuance of client relationships and specific engagements;
- Engagement performance;
- Resources; and
- Information and communication.
The practice aid contains a helpful documentation template for the firm’s risk assessment process and includes each of the quality objectives that a firm is required to establish for the components shown above. The resources also includes a library of potential risks and responses related to each required quality objective.
The scalability of the QM standard lies in the ability to identify the risks and responses that are appropriate for the nature and circumstances of your specific practice. Not all quality risks in the library necessarily apply to every firm, and the quality risks and responses in the library can be, and should be, tailored to suit your circumstances. (See the illustration “Required and Suggested Quality Responses: Governance and Leadership.”)
The practice aid also provides a a completed example of the Governance and Leadership component which includes quality risks and linked responses to those quality risks. These examples illustrate the documentation of establishing quality objectives, evaluating quality risks, and designing the firm’s responses to those quality risks.
Your firm may identify other risks, may evaluate the likelihood and impact of those risks differently, and may choose other responses. However, the examples are helpful to provide a starting point or initiate further brainstorming.
Risk assessment is iterative, and, as such, you will likely need to revisit your practice’s identified and assessed quality risks throughout and after implementation. You may need to modify the responses or create additional policies and procedures that are not listed. The practice aid also walks through these considerations.
DOCUMENTATION
Most firms will have policies and procedures in place to address their quality risks; however, those policies and procedures may not be formalized, or fully documented, and likely would not have been mapped to identified and assessed quality risks.
Documentation of the risk assessment process should describe the process (that is, what you did to identify and assess the quality risks). To assist with preparing your firm’s documentation, use the example risk assessment documentation template and make this document your own by tailoring and including appropriate risks and responses based on the facts and circumstances of your practice.
The template does not represent a complete QM system; for example, it does not address monitoring and remediation, but it can provide a basis for documenting the risk assessment process as well as the quality responses.
MOVING TOWARD FULL COMPLIANCE
Once your firm is done preparing the initial design for its QM system, you can continue using the practice aid to begin the process of monitoring that system.
Firms do not have to apply the risk assessment process to monitoring and remediation. However, in evaluating and concluding on your QM system, you do need to consider whether the monitoring and remediation process achieves the objectives of providing relevant, reliable, and timely information about the system of quality management and whether it enables the firm to respond appropriately and timely to identified deficiencies.
The practice aid presents suggested policies and procedures for the monitoring and remediation process.
The template does not represent a complete QM system; for example, it does not address the broad requirements (for example, the assignment of responsibilities under QM section 10), but it can provide a basis for documenting the risk assessment process, including the required quality objectives and your firm’s identified risks and responses to those risks.
About the author
Patricia Bottomly is a finance consultant specializing in complex accounting, auditing, and reporting matters, a former AICPA Auditing Standards Board member, and a former partner in BDO USA’s professional practice. To comment on this article or to suggest an idea for another article, contact Jeff Drew at Jeff.Drew@aicpa-cima.com.
LEARNING RESOURCES
New Quality Management Standards Webinar Series
Gain a thorough understanding of risk assessment and quality management to create effective quality management systems for your firm’s A&A practice.
WEBCAST
New Quality Management Standards: Bringing It All Together
The newly issued Statement on Quality Management Standards No. 1 requires firms to design, implement, and operate a new system of quality management by Dec. 15, 2025. Start now by learning what you need to know to be in compliance with the new standards and pass your peer review.
WEBCAST
Understanding and Implementing the New Quality Management Standards
Enhancing your understanding of risk assessment and quality management can help you implement effective quality management systems for your firm’s A&A practice.
CPE SELF-STUDY
For more information or to make a purchase, go to aicpa-cima.com/cpe-learning or call 888-777-7077.
AICPA & CIMA MEMBER RESOURCES
Articles
“A&A Focus recap: A&A Risk, Notfor- Profit Update, SQMS, and ERC,” JofA, April 15, 2024
JofA coverage page for the new quality management standard Website
