Quality Management Standards (SQMS): What Clients Should Know

The new quality management standards for CPA firms are a set of requirements issued by the AICPA and the PCAOB that overhaul how accounting firms design, operate, and monitor the systems that govern the quality of their audit and assurance work. The AICPA’s Statement on Quality Management Standards No. 1 (SQMS No. 1) became effective December 15, 2025, replacing the prior quality control framework that had been in place since 2006. For public company auditors, the PCAOB’s parallel standard, QC 1000, takes effect December 15, 2026. Together, these standards represent the most significant structural change to audit quality oversight in nearly two decades.

Why Quality Management Standards Matter to Clients

Most clients hire an auditor and reasonably assume someone is minding the quality of the work. The prior framework, Statements on Quality Control Standards No. 8 (SQCS No. 8), required firms to document policies and procedures across six elements: leadership, independence, acceptance and continuance, human resources, engagement performance, and monitoring. That framework worked largely on the assumption that if the right policies were written down and followed, quality would result.

The problem was structural. A policies-first approach can become box-checking. Firms might maintain thick quality control manuals that look rigorous but fail to connect documented procedures to the actual risks their specific practice creates. For clients, that gap matters. A firm auditing complex real estate partnerships and a firm that reviews small business financial statements face entirely different quality risks, yet both could pass a quality control inspection under the old regime with the same boilerplate manual.

SQMS No. 1 changes the logic. Instead of starting with policies, firms must start with risks. The standard requires each firm to conduct a documented risk assessment, identify where audit quality could break down given the firm’s specific clients, services, and structure, and then design responses proportional to those risks. Quality management replaces quality control as both the terminology and the philosophy.

The Shift From Quality Control to Quality Management

The language change from “control” to “management” is intentional. Quality control implies a compliance posture: follow the rules, check the box. Quality management implies an operating posture: continuously assess, act, and improve. SQMS No. 1 introduces ongoing monitoring and remediation as a required, integrated component, not an afterthought. Firms must evaluate their systems at least annually, identify deficiencies, and implement corrective actions in a documented cycle.

For clients, this shift has real implications. A firm operating under a genuine quality management system is better positioned to catch engagement-level problems before they affect a report, to identify patterns across engagements that signal systemic risk, and to respond to changes in practice areas or personnel rather than waiting for the next inspection.

The Eight Components of SQMS No. 1

The AICPA’s SQMS No. 1 organizes a firm’s quality management system into eight integrated components. Two components, the risk assessment process and information and communication, are new components that did not exist in the prior standard. The remaining six components carried over from the prior framework but are now redesigned to operate within the risk-based architecture, with monitoring and remediation significantly expanded into a continuous process.

1. Risk Assessment Process

This is the foundation. Firms must establish quality objectives tied to each component, identify and assess the risks that could prevent meeting those objectives, and design responses proportionate to those risks. Risk assessment must be performed before designing the rest of the system, and the output must be documented.

2. Governance and Leadership

Firm leadership must create an environment that supports audit quality. This includes assigning ultimate responsibility for the quality management system to a specific individual, typically the managing partner or CEO, referred to in the standard as the “ultimate responsible individual” (URI).

3. Relevant Ethical Requirements

Firms must identify and respond to threats to compliance with independence, objectivity, and confidentiality requirements. The standard requires this to be connected to the risk assessment, not managed in isolation.

4. Acceptance and Continuance of Client Relationships and Engagements

Policies for accepting new clients and retaining existing ones must be risk-informed, documented, and calibrated to the firm’s capacity to perform quality work.

5. Engagement Performance

Standards for how engagements are planned, executed, supervised, and reviewed must be tied to the risks identified at the firm level and adapted for engagement-specific circumstances.

6. Resources

Firms must evaluate whether they have the human resources, technology, and intellectual resources to perform quality work across their practice. This component now explicitly includes technology resources, a nod to the expanding role of audit software and data analytics.

7. Information and Communication

This is a new component under SQMS No. 1. Firms must establish processes for capturing, creating, and sharing information that supports the quality management system, including information flowing between engagement teams and firm leadership.

8. Monitoring and Remediation Process

Firms must continuously monitor whether the quality management system is operating effectively, identify deficiencies, determine their root causes, and implement remediation. The monitoring cycle is ongoing, not periodic, and firms must evaluate the entire system within one year of implementation and annually thereafter.

SQMS No. 2: Engagement Quality Reviews

Alongside SQMS No. 1, the AICPA issued SQMS No. 2, which governs engagement quality reviews. Also effective December 15, 2025, SQMS No. 2 replaces the concept of the “engagement quality control review” with a more structured and independently governed process.

Under the prior standard, engagement quality reviews existed but lacked uniformity in scope, documentation, and reviewer eligibility. SQMS No. 2 tightens all three. Key requirements include:

• Reviewer appointment. The engagement quality reviewer must be appointed before the engagement report is issued, with documented eligibility criteria.
• Scope of the review. The reviewer evaluates significant judgments made by the engagement team, assesses whether appropriate consultations occurred, and reviews the engagement partner’s involvement. The reviewer does not reperform audit procedures or conduct a post-issuance review.
• Documentation. Firms must document the nature, timing, and extent of engagement quality review procedures performed.

For clients, a rigorous engagement quality review is an independent check that stands between the engagement team and the final report. SQMS No. 2 makes that check more consistent and better documented.

PCAOB QC 1000: The Public Company Counterpart

For registered public accounting firms that audit public companies, the PCAOB adopted its own parallel standard, QC 1000, on May 13, 2024. The SEC approved QC 1000 in September 2024. The standard was originally set to take effect December 15, 2025, but the PCAOB postponed the effective date to December 15, 2026 after firms reported implementation challenges.

QC 1000 follows the same eight-component architecture as SQMS No. 1 and introduces two significant public-company-specific requirements. First, firms must classify significant quality control failures as “major QC deficiencies” and report them to the PCAOB. Second, firms must annually evaluate the effectiveness of their quality control system and certify the results. Early adoption of QC 1000 is permitted for firms that are ready.

The one-year delay does not reduce the urgency. Firms with dual AICPA and PCAOB practices have been running two overlapping implementation efforts, and the postponement creates a window to align the two systems before the PCAOB deadline arrives.

What These Standards Mean for Clients Choosing a CPA Firm

From a client’s perspective, SQMS No. 1 and No. 2 are signals worth understanding, even if the standards are directed at firms rather than clients. A firm that has genuinely implemented quality management, rather than simply updated its policy manual, should be able to demonstrate:

• A documented risk assessment that reflects the firm’s actual client base and service mix, not generic boilerplate.
• Clear leadership accountability for audit quality, with a named individual responsible for the system.
• Active monitoring of engagement performance, with documented remediation when problems are identified.
• Structured engagement quality reviews for high-risk engagements.

Clients evaluating audit firms, or reviewing their existing relationship, can ask these questions directly. Quality management is no longer an internal matter that firms keep behind closed doors. It is a structured, documented, assessable system that firms are now required to maintain.

For clients working with Modus on audit and assurance engagements, the SQMS framework aligns with how Modus approaches quality by design. Source-linked workpapers, structured review workflows, and documented monitoring processes are part of the operating model, not add-ons after the fact. The Modus approach to audit reflects the same principles SQMS No. 1 now requires of the profession at large: start with risk, build responses that fit the engagement, and monitor continuously.

How Firms Are Implementing the New Standards

Implementation of SQMS No. 1 is not a document project. Firms that approached it as a rewrite of the quality control manual have found the standard does not accommodate that approach. The risk assessment must precede documentation, which means firms must first identify what risks actually exist in their practice before they can write appropriate policies.

The AICPA released an updated QM practice aid in 2025, along with a second practice aid focused specifically on monitoring, several new implementation tools, and a series of online learning modules to support firms through the transition. The practical aid is available through the AICPA and CIMA resources library.

Larger firms have stood up dedicated implementation teams and used the standard as an opportunity to modernize quality infrastructure. Smaller firms have found the scalability of the risk-based approach to their advantage, allowing right-sized responses to risks that are proportionate to the scale of their practice. The December 15, 2025, deadline has passed, meaning SQMS No. 1 is now live for AICPA-member firms performing audit, review, attestation, and compilation engagements.

Related reading: Private Equity Is Buying CPA Firms: What It Means for Clients

Frequently Asked Questions

What are the new quality management standards for CPA firms?

The new quality management standards are SQMS No. 1 and SQMS No. 2, issued by the AICPA and effective December 15, 2025. SQMS No. 1 replaced the prior quality control framework (SQCS No. 8) with an eight-component, risk-based system of quality management. SQMS No. 2 governs engagement quality reviews and replaced the prior engagement quality control review requirements.

What is the difference between SQMS No. 1 and the old SQCS No. 8?

SQCS No. 8 was a policy-first framework: firms documented procedures across six quality control elements and demonstrated compliance with those procedures. SQMS No. 1 is a risk-first framework: firms must identify specific quality risks in their practice, design responses calibrated to those risks, and monitor the system continuously. Documentation of the underlying risk assessment was not required under SQCS No. 8. The number of components also expanded from six to eight, adding an explicit risk assessment process and an information and communication component.

Does SQMS No. 1 apply to all CPA firms?

SQMS No. 1 applies to any CPA firm that performs engagements under Statements on Auditing Standards (SASs), Statements on Standards for Attestation Engagements (SSAEs), or Statements on Standards for Accounting and Review Services (SSARSs). This includes firms that perform audits, reviews, compilations, and agreed-upon procedures. Firms that do not perform any of these services are not covered, but virtually any firm with an audit or assurance practice is subject to the standard.

What is PCAOB QC 1000 and when does it take effect?

PCAOB QC 1000, titled “A Firm’s System of Quality Control,” is the PCAOB’s counterpart to SQMS No. 1. It applies to registered public accounting firms that audit public companies. The PCAOB adopted QC 1000 in May 2024 and the SEC approved it in September 2024. The effective date was postponed from December 15, 2025, to December 15, 2026, due to implementation challenges reported by registered firms. Early adoption is permitted.

What is an engagement quality review under SQMS No. 2?

An engagement quality review is an objective evaluation of significant judgments made by the engagement team on certain high-risk engagements, performed by a qualified reviewer who is independent of the engagement team. Under SQMS No. 2, the reviewer must be appointed before the report is issued, must evaluate whether significant judgments were appropriate and properly supported, and must document the procedures performed. The reviewer does not re-perform audit work; the review is a second-partner check on the quality of key judgments.

What should clients ask their CPA firm about quality management?

Clients can ask whether the firm has completed implementation of SQMS No. 1 and what the risk assessment revealed about the firm’s quality risks. They can also ask how engagement quality reviews are structured for their type of engagement, who holds ultimate responsibility for the firm’s quality management system, and how deficiencies identified during monitoring are tracked and resolved. These are legitimate, specific questions that a firm operating a genuine quality management system should be able to answer.