Right-size your quality management documentation for SQMS No. 1

Statement on Quality Management Standards No. 1, A Firm’s System of Quality Management, becomes effective on Dec. 15, 2025, and the required documentation surrounding that system’s design, implementation, and operation is a critical, required step for compliance with the standard. SQMS No. 1 requires firms to do more than create a static document and file it away. It proposes a living QM system that is designed, implemented, operated, and evaluated on an ongoing basis.

The documentation you keep is not busywork — it contains the critical information that gives the firm, and its personnel, a shared understanding of the system, supports consistent application of responses, memorializes ongoing monitoring and finding-based remediation, and provides evidence of and support for the annual evaluation of whether the system is achieving its objective. In short, documentation is how your system becomes, and remains, visible, teachable, and always improving.

SQMS No. 1 was crafted to be risk‑based and scalable. That means your documentation should reflect the reality of your practice. This reality includes your firm’s service mix, size, complexity, and quality risks. A firm with several partners performing a mix of assurance and related services will naturally need more structured, role‑based documentation than a sole practitioner who performs only preparation engagements. But both must be able to demonstrate, through documentation, how their system achieves reasonable assurance that engagements comply with professional standards and that issued reports are appropriate in accordance with the overall objective of SQMS No. 1.

A firm’s documentation may be a library of memos and spreadsheets, or it may be compiled and managed by a dedicated software package. SQMS No. 1 does not prescribe the format of a firm’s documentation but addresses its sufficiency. Generally, SQMS No. 1 requires a firm to design its documentation to illustrate who is responsible for what; the firm’s quality objectives; what risks exist and what responses to those risks are in place and being performed; how the firm monitors and remediates issues; and the conclusion of the firm’s annual evaluation of the system’s effectiveness and related support.

Let’s look at the broad requirements, what a firm should be including in its documentation, and how a firm might appropriately scale that documentation:

Documenting responsibilities under SQMS No. 1

The firm is required to identify and document who holds (a) ultimate responsibility and accountability for the system of QM and (b) operational responsibility for day‑to‑day design, implementation, operation, and monitoring. Larger firms may assign these responsibilities to separate individuals, and some singular responsibilities may even be shared among several firm members. For sole practitioners, the owner holds all responsibilities. Regardless of how a firm assigns responsibility, ultimate responsibility belongs to the firm’s managing partner, or equivalent.

In addition to documenting the firm member assigned the responsibilities identified in SQMS No. 1, the firm should consider including additional details, when applicable, such as:

• How the firm evaluates the objectivity and competence of the individuals assigned.
• Relevant reporting lines, decision rights, and escalation paths.
• How coordination works within the firm and who breaks ties.

For sole practitioners, a single‑page memo naming the owner as both ultimately and operationally responsible would likely satisfy this requirement and could be made more comprehensive by memorializing the partner’s consideration and responses to potential concerns such as independence and bias.

Documenting objectives, risks, and responses under SQMS No. 1

Documenting the firm’s risk assessment process is critical to the design, implementation, and ongoing effectiveness of the system of QM. For each objective required by the standard’s components — six of the eight components contain required objectives — clearly document the specific risks that exist in the practice and the concrete responses in place to address them.

Consider including a description of the frequency (e.g., quarterly acceptance review), criteria (e.g., competence measures and independence safeguards), and response owners. This discussion is best presented in a version‑controlled manner and is updated when conditions change — new services, new software, personnel shifts, or external developments. Some firms maintain a short narrative for context followed by a table. The key is traceability: Anyone should be able to see how a response addresses a defined risk tied to a required objective.

Beyond establishing and documenting the details of responses, firms will want to show the responses have been implemented. For each response, keep evidence fit for purpose: policies and procedures, templates, checklists, training agendas and attendance, workflow configurations/screenshots, or sample outputs from tools.

To support that responses are functioning, maintain contemporaneous records that the response happened on schedule and met its criteria. For example, retain acceptance or continuance evaluations, memorialized independence inquiries, engagement quality risk assessments, supervision and review notes, and technology access control logs. If a response is automated in software, retain configuration snapshots and change logs. Again, traceability is critical. Maintain a clear story from risk to response to evidence that the response worked as intended.

Documenting monitoring activities, findings, and root-cause analysis under SQMS No. 1

The monitoring process provides evidence that the firm’s system of QM continues to operate over time. A firm’s documentation will detail what was inspected or monitored, the procedures performed, when the monitoring took place, who performed the monitoring, and the results of the monitoring procedures. Note that firms benefit from identifying successes and strengths, along with any deviations or findings. For each finding or deficiency, documentation will include an evaluation of pervasiveness and severity, a root-cause analysis, and any factors supporting any judgments made. Returning once again to traceability, firms will tie each finding back to the affected quality objectives and risk responses in place.

If and when deficiencies are identified, the firm will design and implement remedial actions, and those details are documented. The firm’s record likely will include the remediation owner, the intended effect, due dates, milestones, and measures of success. Documentation may also include evidence of implementation, for example policy updates, retraining, or workflow changes, and a post‑implementation evaluation confirming whether the action addressed the root cause and is operating as designed. If a remedial action is only partially effective, the firm’s documentation might identify what remains and whether additional actions are planned. Firms may have to revisit the foundational documentation of the system of QM when changes to responses are implemented.

Documenting internal, and appropriate external, communication under SQMS No. 1

Required communication of information about a firm’s system of QM supports the system’s effective operation, and it’s important to document that communication. Documenting these communications will include how the information was communicated (policy issuance, training, reminders, etc.) and who received what, when, and how (firm intranet, email, meetings, etc.). For small practices, minutes of periodic touch‑base meetings and archived emails likely suffice.

If a firm makes external communications about its system of QM, for example, in response to client or regulator requests, those communications should be memorialized and include the information shared, who authorized it, and how the firm ensured confidentiality was respected and the determination that the content was accurate and appropriate for disclosure.

Communication evidence supports both operation of the firm’s system of QM but also its culture, through learning and improvement.

Documenting the annual evaluation of the system and formal conclusion under SQMS No. 1

Annually, the individual with ultimate responsibility is required to evaluate the firm’s system of QM and conclude whether the system provides the firm with reasonable assurance that the system’s objectives are being achieved. The evaluation considers many factors, including monitoring results and remedial actions and status, all of which have been documented over the period under evaluation. The firm’s documentation culminates in a signed conclusion memorandum that states the conclusion and explains the basis for that conclusion.

Retention of documentation

In accordance with SQMS No. 1, the firm will establish a policy regarding the period for the retention of its documentation. The retention period should be sufficient to enable the firm and its peer reviewer to monitor the design, implementation, and operation of the firm’s system of QM or the period required by GAAS, or any law or regulation. Retention policies should be practical, for example, long enough to show trends across evaluation cycles but not so long as to create unnecessary clutter.

What does scaling look like?

The requirements of what a firm’s documentation captures do not change by firm size. However, the scale and formality of documentation may. Consider this comparison of a smaller firm and a sole practitioner and the way each firm prepared documentation.

Practical tips to keep documentation ‘right‑sized’

• Anchor every document to a purpose: understanding, implementation, or evaluation. If the document does not serve one of these, consider whether it belongs in the QM file.
• Create short, standardized documentation over long narratives that are hard to maintain. Consider checklists, one‑page memos, or annotated screenshots.
• Use a simple change log to track modifications to the system and results of remediation procedures. Record what changed, why, who approved it, and the effective date.
• Set reminders for recurring activities that generate evidence (acceptance reviews, training, and monitoring). This calendar can serve as additional evidence of the operation of the system.
• When a response is automated, capture configuration snapshots after significant updates and keep a brief note on testing/validation performed.
• For small firms, run brief root-cause sessions after each monitoring cycle. A simple “five whys” worksheet is often enough to reveal systemic fixes. For sole practitioners, keep a list and refer to it regularly.
• Cross‑reference relentlessly. Link objectives to risks to responses. Link findings to remedial actions to validation. Reviewers should be able to follow the thread in minutes.
• When appropriate, document what is not applicable and why, for example, when independence confirmations are not completed for preparation engagements. This memorializes thoughtful consideration and scaling and not omission or oversight.
• Consider documentation a tool. A new partner or a peer reviewer should be able to clearly understand your judgments and support using the file alone, easing reviews.

Final thoughts

SQMS No. 1 does not ask for, nor require, tomes of documentation. SQMS No. 1 asks for clarity and evidence. If a firm’s documentation shows who is responsible, what tailored risks its faces, what the responses are and their effectiveness, how the firm monitors and improves, and how the conclusion reached during the firm’s annual evaluation was decided and supported, the firm will have met the spirit and letter of the standard. Scale to your practice, keep documentation current, and make it easy for a knowledgeable outsider to follow.

— Dave Arman, CPA, MBA, is senior manager–Audit Quality at the Association of International Certified Professional Accountants. To comment on this article or to suggest an idea for another article, contact Jeff Drew at Jeff.Drew@aicpa-cima.com.

---

FIRM RESOURCES

The AICPA has two practice aids, Establishing and Maintaining a System of Quality Management for a CPA Firm’s Accounting and Auditing Practice (2025 update) and The Monitoring and Remediation Process for a Firm’s System of Quality Management, that provide guidance for designing and implementing your firm’s system of quality management and consistently improving that system, respectively, and to supplement the information presented in the recently revised general SQMS No. 1 practice aid.

QM learning online — live!

The AICPA has one remaining online, live learning opportunity about QM as well as past sessions, archived, for additional learning. All QM Conversations programs will be archived and are paired with a companion Ask About QM session. The archived, on-demand recordings are available with AICPA membership. 

• Tuesday, Nov. 4, 3–5 p.m. ET: QM Conversations: “Peer Review”

Other valuable resources and archived replays are detailed on the AICPA webpage A Journey to Quality Management. Watch for more QM webcasts in 2026.

QMCore

AICPA subsidiary CPA.com has partnered with FinReg to develop QMCore, a comprehensive quality management solution that provides an intuitive and dynamic platform, enabling firms to collectively manage their system of quality management. Learn more on the QMCore webpage.