Engagement quality reviews: What auditors should know

Firms with A&A practices should pay particular attention to the new standard on engagement quality reviews (EQRs) as they implement the new suite of quality management (QM) standards that are effective Dec. 15, 2025.

The new standard specific to EQRs is Statement on Quality Management Standards (SQMS) No. 2, Engagement Quality Reviews.

What’s changed?

What used to be called engagement quality control reviews are referred to simply as engagement quality reviews under the new QM standards.

Consistent with the QM standards’ requirements for risk assessment, EQRs are discussed in the context of a response to a quality risk. However, the requirements relating to EQRs are substantially the same.

What is an EQR?

An EQR is a process designed to provide an objective evaluation of the significant judgments made by the engagement team and the conclusions reached thereon, completed on or before the date the report is issued, in formulating the report.

For which engagements do EQRs have to be performed?

The recently issued QM standards require firms to determine the engagements for which an EQR is an appropriate response to a quality risk (that is, a risk that would result in the engagement not being performed in accordance with professional standards or the report being inappropriate).

The firm is required to establish criteria to determine when an EQR is required in accordance with its policies and procedures.

What are the criteria?

The following are examples of criteria the firm might use:

• The identification of unusual circumstances or risks in an engagement or class of engagements as predetermined by the firm, for example:
  • Audits in which a going concern issue was identified but the report was not modified;
  • A compilation with disclosures when the firm has only been doing compilations without disclosures;
  • A review (or other engagement) for an entity with issues that the firm rarely encounters (for example, joint ventures); or
  • Engagements in which a new accounting standard is being implemented.
• An engagement for which the undue influence threat may exist (for example, an engagement that represents over 10% of the firm’s audit and accounting practice).
• A high-risk engagement, as defined by the firm, using the same criteria used for acceptance and continuance.
• An engagement in an industry in which the firm’s practice is limited and the firm’s personnel have little or no experience.
• An engagement for which the familiarity threat may exist.
• An engagement for an entity operating in a highly specialized or regulated industry, including financial institutions, employee benefit plans, and audits in accordance with government auditing standards.
• An engagement for a new client or the first engagement for a new partner to the firm.

Your peer reviewer might ask the firm to explain how an EQR works and then might ask to see an EQR performed by the firm. If the answer is “we have never performed one,” this might mean your firm’s acceptance and continuance policies are so strong that the need for one never occurs. However, it’s (much) more likely to mean that your firm’s criteria are too restrictive.

The firm documents these criteria in its QM documentation.

What are some common misconceptions?

“We have a second-partner review on all jobs.” — An EQR is not a second-partner review. One difference is that the EQR reviewer does not need to be another partner. An EQR reviewer can be a qualified practitioner and might be:

• A manager or partner in the firm who has expertise in the specific area being reviewed.
• A CPA outside the firm who has expertise in the area.

However, the EQR reviewer cannot be a member of the engagement team.

“We perform an EQR on all jobs.” — Another difference between EQRs and other reviews is that, unlike “a second partner review,” there are separate requirements for the performance of an EQR. Paragraph 25 of SQMS No. 2 lists specific procedures to be performed for an EQR.

If a firm truly is performing an EQR on all jobs, the firm may wish to revisit its assessment of when an EQR is an appropriate response to a quality risk. For some engagements, firms may decide to have reviews performed — beyond those performed on every engagement — that do not include all the procedures required for an EQR. The criteria for these additional reviews would also be documented in the firm’s quality management documents.

“What’s important is that the review is performed, not who performs it.” — Peer reviewers commonly see the following working papers all signed as complete by the same individual (the standards require that this be three individuals):

• In-Charge Checklist;
• Technical Reviewers Checklist; and
• EQCR Checklist.

Practical considerations

Usually, whether an engagement meets the firm’s criteria for performing an EQR is determined no later than the planning process, so that the timeline of the completion of the engagement is correct. SMQS No. 2 requires that the EQR be performed at appropriate points in time during the engagements. In other words, it should not be a rushed process at the end of an engagement.

An EQR adds additional billable hours to the engagement. In addition, many small firms will need to seek outside assistance. Accordingly, it is helpful to determine in advance if an EQR is expected to be performed, so that the firm can bid the job correctly. If it is not bid correctly, the risk exists of rushing through “to make budget.”

Documentation and training

All firms, as they complete their QM documentation, should take the time to document these procedures properly for their firm.

Additionally, every firm should have an annual firmwide training to preview and provide guidance on the firm’s QM documentation to ensure all team members understand the procedures and can honestly sign that they have read and understand the contents.

— Ahava Goldman, CPA, is associate director–Audit & Attest Standards at AICPA & CIMA, together as the Association of International Certified Professional Accountants. Mark F. Wille, CPA, is a director with JLK Rosenberger Certified Public Accountants. To comment on this article, contact Jeff Drew at Jeff.Drew@aicpa-cima.com.

LEARNING RESOURCES

Understanding and Implementing the New Quality Management Standards

Enhance your understanding of risk assessment and quality management to implement effective quality management systems for your firm’s A&A practice.

CPE SELF-STUDY

Webcast four-part series (attend one or more)

New Quality Management Standards: Resources — Expectations for Firms and Engagement Partners

In a thriving quality management system for your firm’s A&A practice, your resources need to be allocated properly. Get valuable actionable insights.

New Quality Management Standards: What’s New for Firms’ Monitoring and Remediation Processes

Statement on Quality Management Standards No. 1 requires firms to perform enhanced monitoring and remediation activities. Start now by learning what you need to know to comply with the new standards.

New Quality Management Standards: Bringing It All Together — Exploring All Components of a Quality Management System

The newly issued Statement on Quality Management Standards No. 1 requires firms to design, implement, and operate a new quality control system by Dec. 15, 2025.

New Quality Management Standards: A Practical Approach to Risk Assessment and Response

Learn about SQMS No. 1 and understand the new risk-based approach to quality management, with an emphasis on creating processes tailored to your firm’s needs for its A&A practice.

For more information and helpful QM resources, visit aicpa-cima.com/auditqm.