8 steps to build your firm’s quality management system on time

Firms that perform audits, reviews, or compilations have a little more than four months to implement the new risk-based quality management (QM) standards. The task may feel daunting, but Joe Lynch, CPA/CITP, managing director and shareholder at Johnson Global Advisory in Denver, believes it can be accomplished by the Dec. 15 deadline. (For more information, see “How to Implement the Risk-based Quality Management Standards,” JofA, Oct. 1, 2023.)

If your firm has not yet started designing a QM system to comply with the new Statement on Quality Management Standards (SQMS) No. 1, a firm’s current quality control (QC) practices can serve as a foundation, Lynch said. SQMS No. 1 is one of four new standards that retain and strengthen core elements from previous standards, including scalability (see “Quality Management Standards — Executive Summaries and Standards At a Glance”). The new standards require firms to replace their current QC systems with a risk-based QM system.   

“You have had a system of quality management since you started your firm, whether formal or informal,” Lynch said. “The most sustainable approach when you’re dealing with the rigor of the standards is [applying] the standard to what you’re doing now. You’ve already experienced pitfalls in your day-to-day business. Make those your risks because you have real-world experience with these.”  

He suggests eight steps to design your firm’s QM system:

1. Seek input from various leaders and teams. Get feedback and insights from firm leaders and teams, including senior leadership, lead audit partners, engagement partners, administrative assistants, human resources, and your firm’s IT department. These conversations should clarify your understanding of the business strategy, determine your firm’s audit types and QM needs, and reveal how teams and processes interconnect.

2. Delegate responsibilities. Insights from financial and nonfinancial teams make assigning responsibilities easier. The standard requires leads in four areas: ultimate responsibility, operational responsibility, monitoring remediation, and independence. 

Ultimate responsibility lies with the firm’s managing partner or equivalent. In firms with more than one partner, a separate audit partner may supervise the operational functions of the QM system. These two roles work closely together.

Two individuals with sufficient competence and capability are responsible for monitoring compliance with independence requirements and managing the monitoring and remediation process. These may or may not include the managing partner or audit partner.

For a sole practitioner, the individual partner holds all the titles and responsibilities.

3. Consider quality objectives. Effective QM systems meet desired outcomes, or quality objectives, that are centered on consistently delivering exceptional services and enhancing organizational efficiency.

“Our objectives have certain attributes, and those attributes oftentimes are used as what could go wrong with the risks,” Lynch explained.

Six of SQMS 1’s eight components include already required quality objectives and can be used as your firm’s launchpad. Quality objectives for governance and leadership include holding leaders responsible for quality and addressing the firm’s resource needs. Other objectives ensure staff members understand ethical requirements, engagement teams exercise appropriate professional judgments, and personnel are hired and trained appropriately.  

4. Establish a risk assessment process and perform an initial test. “Whether you’ve had pitfalls with hiring people in the past or brought on the wrong type of client, you put a process in place so you didn’t repeat your mistakes,” Lynch said. “That’s your risk and response right there, and tie it into the objective it fits into.”

A strong risk assessment process will dive into each objective to identify associated risks and help you design responses to those risks. Within the AICPA Practice Aid, Establishing and Maintaining a System of Quality Management for a CPA Firm’s Accounting and Audit Practice, is a library with more than 300 identified risks. While most will likely not apply to your firm, use them to prompt ideas and generate discussions. Tailor them to align with your firm.

“Your risks are unique to your firm,” Lynch said. “Other firms might have 20 offices in five different states and operate within 20 different industries. Their risk profile is much different than a two-partner firm performing some compilations in the construction industry.”

With the risk assessment process in place, conduct an assessment on each risk. The initial test provides an opportunity to hone the unique risks that apply to the types of services or audits performed within your sector.

5. Reframe your approach to gap analysis. The biggest mistake firms could make with their gap analysis is to only go surface level. A strong gap analysis deepens your understanding of business strategy and exposes weaknesses in your risk assessment.

“The best way to understand a process is to walk through it,” Lynch said. Sit down with other departments and walk through a transaction or the entire new hire process. “When you do walk through these processes and bring these people together, light bulbs start turning on. People really understand how important their day-to-day job is and how it really ties into business decisions.”

Identified gaps need formal, operational, and documented responses. Addressing these gaps by Dec. 15 are top priorities.

“Maybe you can fix [the gap] right away. If you can’t, maybe you have a temporary stopgap until you can get your bigger project in place, which might include a new system,” Lynch advised.

6. Prepare to monitor everything. From governance and leadership to human resources and technology, you are required to monitor every component of your QM system to assure your firm’s responses operate smoothly. (For more information, see “QM Standards: Overview Of The Monitoring and Remediation Process,” JofA, Sept. 28, 2023.) KPIs, such as tracking staff’s hours of continuing professional education or time spent on audits, help you track progress and improvements.

Collect all your findings and use them to identify the root causes of problems. (For more information, see “QM Standards: How to Perform a Root Cause Analysis,” JofA, Dec. 1, 2023.) Remediation requires a holistic understanding of the problem and how to prevent it from happening again.

Monitoring is ongoing and distinct from the one-year post-implementation evaluation.

7. Practice continuous improvement. QM systems require an element of flexibility. When gaps, failures, or changes to business strategy appear, ask your staff to seek solutions and implement workflow improvements. A QM system is meant to be iterative and continuously improved.

“A risk assessment process is not ‘set it and forget it,’” Lynch said. “When our business strategy changes, our risk changes. The continuous improvement aspect comes through the risk assessment, meaning it’s a process that’s ongoing.”

8. Review and enhance existing documentation. SQMS is prescriptive with reporting and documentation requirements.

As part of implementation, each component of your QM system needs to be documented. You’ll document evidence that supports your objectives, risks, and responses. These records enhance transparency, accountability, and reveal improvement areas.

How SQMS unlocks deeper firm insights

The work of creating a QM system brings benefits beyond compliance, such as clearer insights into how your firm uses resources, the value clients bring, and how clients are onboarded. Lynch said he has seen some firms apply the standards’ framework to their tax and advisory services because the formalized processes produce actionable insights and results.

“You just need to get started and read the standard,” Lynch said. “Once firms step back and really understand what the system of quality management is, they’ll realize they’re already doing it. This is how they started their firms.”

QM compliance is a journey to quality management — not a checkbox — and the Dec. 15, 2025, deadline is the final stop to get your firm’s QM system on track. — Jamie Roessner is a senior content writer at the Association of International Certified Professional Accountants. To comment on this article or to suggest an idea for another article, contact Jeff Drew at Jeff.Drew@aicpa-cima.com.

RESOURCE

JofA’s quality management coverage