How to monitor a firm’s system of quality management

Many small firms and sole practitioners are unclear about how exactly to fulfill the monitoring and remediation requirements in Statement on Quality Management Standards (SQMS) No. 1, A Firm’s System of Quality Management (QM sec. 10).

Practitioners understand how to identify quality objectives and quality risks. They know how to design quality responses. But they are uncertain about monitoring the firm’s system of QM that they were required to design and implement by Dec. 15, 2025.

They wonder how often a response will be tested? Will the firm review every item or select a sample? What does “evidence” of monitoring look like in a sole-practitioner or small-firm environment? And how much documentation is enough?

The best way to understand monitoring is to view it through a familiar lens. Even if a firm does not regularly perform controls-based assurance engagements, most CPAs understand the concept of testing controls in an external audit.

In an audit, the client asserts it has a control. If the control is considered an identified control under AU-C section 315, an auditor evaluates whether the control is suitably designed and determines whether it was properly implemented. If the auditor relies on controls to alter the nature and extent of substantive testing, they would perform procedures to determine whether the control operated effectively during the period.

Monitoring under SQMS No. 1 follows the same logic. The firm has designed a quality response to address a quality risk. Monitoring means to determine whether that response was appropriately designed, placed into operation, and functioning as intended.

Paragraph .36 of QM sec. 10 requires the firm to establish a monitoring process designed to provide relevant, reliable, and timely information about the design, implementation, and operation of the system of quality management.

Further, paragraphs .37 and .38 make clear that monitoring activities should be planned and performed to detect deficiencies. The nature, timing, and extent of those activities should be driven by the firm’s quality risks, prior monitoring results (including past peer review results), changes in the system, and other relevant internal and external information.

This is important for small firms because the standard does not require every response to be monitored the same way, at the same frequency, or with the same depth. Monitoring, like the QM system itself, is meant to be risk-based and scalable, not a one-size-fits-all boilerplate approach.

The monitoring process begins with the quality response

Practitioners who are unsure about where to start their monitoring procedures could use the same three steps they used to build the system: the objective, the risk, and its response.

For example:

• Quality objective: Assurance personnel maintain the appropriate and sufficient CPE required by firm policy, professional standards, licensing requirements, and assigned engagement responsibilities.
• Quality risk: Personnel may not complete required CPE on a timely basis, or the firm may not identify gaps before engagement assignments are made.
• Quality response: The firm maintains a centralized CPE tracking process and performs periodic compliance reviews.

A functioning quality response is a safety net for the firm. It is also the target of the firm’s monitoring procedures.

Does the quality response (that is, the control) operate as intended? It is the same question a practitioner would ask when considering an entity’s control. The concept is foundational for CPAs, even for those not performing audit engagements.

The nature, timing, and extent of monitoring procedures

The nature of monitoring procedures refers to the procedure itself. Common procedures include:

• Inspection of documents or logs.
• Inquiry of responsible personnel.
• Observation of a process being performed.
• Reperformance of a control or review step.
• Inspection of completed or in-process engagements.

Paragraph .A149 of QM sec. 10 states that a firm’s monitoring activities may comprise a combination of ongoing monitoring activities and periodic monitoring activities. Ongoing monitoring activities are generally routine activities built into the firm’s processes and performed on a real-time basis. Periodic monitoring activities are conducted at certain intervals by the firm.

For a small firm, this is a helpful distinction.

Not all monitoring happens at year-end. For example, checking CPE status before staffing a specialized engagement is an ongoing monitoring activity. Reviewing the full CPE tracker quarterly is a periodic monitoring activity.

The timing of monitoring will reflect the risk. Higher-risk areas, or those where failure may result in a more severe negative outcome, may warrant monthly, quarterly, or real-time monitoring. For areas deemed lower risk, an annual review may be sufficient.

To illustrate the variety of potential timing and frequency, consider that a firm might monitor CPE compliance quarterly, with closer attention near year-end or licensing deadlines. They might review new client acceptance and independence either after each new client is accepted or on a quarterly basis, and they might review templates and reports at least annually and again when standards change. Finally, the firm may perform engagement inspections on a cyclical basis, as required by QM sec. 10, or more frequently, consistent with the firm’s inspection approach and risk profile.

The AICPA practice aid The Monitoring and Remediation Process for a Firm’s System of Quality Management emphasizes that the nature, timing, and extent of a firm’s monitoring procedures will reflect firm-specific factors such as the system’s design, the nature of the firm’s practice, changes in the system, and the results of prior monitoring or external inspections.

The extent of monitoring procedures is a matter of professional judgment. Is it prudent to test just a handful of results? Is the risk high enough to warrant testing all instances? For small firms, the answer is often simpler than expected. Many sole practitioners and small organizations default out of simplicity to testing 100% of populations.

For example, if a sole practitioner has three long-term clients, two clients newly retained in the current year, and the firm uses an off-the-shelf methodology and working paper templates, it is often easier and more persuasive to review all items than to design a formal sample.

Sampling may become more prudent as populations grow and efficiency becomes valuable. In firms with a larger number of clients, and dozens of professionals, sampling may be appropriate. But even then, the sample is risk-based, not arbitrary. The firm will document why the items selected address the particular quality risk, for example, potential increased risks of first-year clients, clients in specialized industries, or when considering personnel assigned to regulated engagements.

Whether testing all occurrences or a representative sample, the goal is to obtain relevant, reliable, and timely information about whether the firm’s system of quality management is working.

Documenting monitoring procedures

Many firms, regardless of size, often worry that documentation must be overly detailed and lengthy, but it is not that cut and dried. In fact, the practice aid notes that documentation for sole practitioners is often not overly formal and will be significantly less comprehensive than in larger firms.

However, less formal does not mean no documentation or documentation without purpose. Many third-party practice aids, such as CPA.com’s QMCore, provide templates that aid in monitoring documentation.

At a minimum, a practical quality response monitoring workpaper will capture:

• The quality objective, quality risk, and quality response being tested.
• The monitoring procedure performed.
• The period covered and the frequency.
• The population and the extent tested (including why 100% review or sampling was appropriate).
• The results, including findings or exceptions.
• The firm’s conclusion on whether a deficiency exists.
• If a deficiency exists, the root cause or causes.
• The remedial action, responsible person, and due date.
• The firm’s follow-up conclusion on whether the remedial action was appropriately designed, implemented, and effective.
• Evidence of required communication to responsible individuals and affected personnel.

The practice aid specifically notes that monitoring and remediation documentation will include evidence of monitoring activities performed, an evaluation of findings, a list of identified deficiencies and related root causes, remedial actions taken, evaluation of the design and implementation of those actions, and documentation of required communications. (See “Final Peer Review Quality Management Checklists,” Audit & Assurance Resources, April 24, 2026.)

Note that QM sec. 10 requires the firm to establish a retention period for this documentation that is sufficient to enable the firm and its peer reviewer to evaluate the design, implementation, and operation of the system, unless a longer period is required by law or regulation.

Examples of small-firm monitor procedures under SQMS No. 1

The following examples show how a small firm can translate common quality responses into practical monitoring activities by identifying the procedure performed, the timing and extent of testing, and the type of documentation that may support the firm’s conclusion.

Example 1: Quarterly CPE compliance review

• Quality objective: Assurance personnel maintain the appropriate and sufficient CPE required by firm policy, professional standards, licensing requirements, and assigned engagement responsibilities.
• Quality risk: Personnel may not complete required CPE on a timely basis, or the firm may not identify gaps before engagement assignments are made.
• Quality response: The firm maintains a centralized CPE tracking process and performs periodic compliance reviews.

What’s part of the monitoring activity

Example 2: New client onboarding review

• Quality objective: New client relationships and specific engagements are accepted or continued only when the firm can comply with relevant ethical requirements, including independence, and has considered the integrity of the client and the firm’s competence and capacity to perform the engagement.
• Quality risk: Conflict checks, independence evaluations, or client acceptance approvals may be incomplete, undocumented, or performed after engagement work begins.
• Quality response: The firm uses a standardized client onboarding process that requires documented conflict checks, independence assessments, and client acceptance approval before engagement work begins.

What’s part of the monitoring activity

Example 3: Annual template and report update review

• Quality objective: Personnel use current and appropriate engagement letters, report templates, representation letters, practice aids, and other methodology resources that reflect applicable professional standards and the firm’s approved approach.
• Quality risk: Outdated templates or superseded methodology materials may remain in use, resulting in noncompliant engagement documentation or reporting.
• Quality response: The firm maintains a controlled library of approved templates and practice aids and performs a formal review at least annually and when standards, methodology, or methodology-provider resources change.

What’s part of the monitoring activity

Many practitioners experienced monitoring under the former quality control standards as a largely periodic, inspection-oriented process. QM sec. 10 reframes that responsibility as a broader monitoring and remediation process that is intended to be continuous. In fact, paragraph .A148 of QM sec. 10 emphasizes that the monitoring and remediation process is proactive and ongoing, supporting continual improvement in both engagement quality and the QM system as a whole.

Monitoring procedures themselves are not wildly different from the work practitioners already know. It is the firm applying the same disciplined thinking used in the field but focused on the firm’s own quality responses.

That is why the concept should feel familiar. The practitioner has identified its own risks and has designed its own responses. Monitoring procedures evaluate whether those responses are working.

— Dave Arman, CPA, MBA, is senior manager–Audit Quality at the AICPA. To comment on this article or to suggest an idea for another article, contact Jeff Drew at Jeff.Drew@aicpa-cima.com.

---

MEMBER RESOURCES

A&A Focus

May Webcast Segment on SQMS No. 1 and Post-implementation Monitoring

Website

A Journey to Quality Management

LEARNING RESOURCES

Quality Management: Performing a Root Cause Analysis

Explore how root cause analysis can help firms identify underlying issues, strengthen remediation efforts, and enhance the overall effectiveness of their QM system.

3 p.m.–5 p.m. ET, June 18, Aug. 20, Oct. 15, and Dec. 10

Webcast

Quality Management: My System Is Set Up — Now What?

The deadline for finalizing the design and the implementation of your firm’s system of quality management has passed. Review the remaining requirements of SQMS No. 1 and what’s in store for your system.

3 p.m.–5 p.m. ET, May 21, July 16, Sept. 17, and Nov. 19

Webcast