A firm takes on an SEC issuer without checking workload, skips the EQR to hit a deadline, and files an opinion the PCAOB vacates. Three quality failures, all testable.
HIGH-FREQUENCY: AICPA Statement on Quality Management Standards No. 1 replaced the older SQCS framework. Every firm performing audits, reviews, compilations, or attestations must design, implement, and operate a system of quality management (SQM). The system is risk-based: the firm identifies quality risks, designs responses, and monitors whether those responses work.
SQMS No. 1 organizes the SQM around eight components:
- Governance and leadership. Tone at the top, accountability for quality, partner compensation tied to quality, not realization.
- Ethical requirements. Independence policies, rotation, conflict screening, breach reporting.
- Acceptance and continuance. Client screening, integrity, capacity, risk evaluation before signing the engagement letter.
- Engagement performance. Direction, supervision, review, consultation, EQRs, documentation.
- Resources. Human, technological, and intellectual resources, including capacity planning.
- Information and communication. Timely quality-related information inside the firm and to external parties.
- Monitoring and remediation. Ongoing assessment of the SQM; deficiencies must be root-caused and remediated.
Common mistakes
- Confusing SQMS No. 1 components with old SQCS elements. SQMS No. 1 has eight risk-based components, not five fixed elements. "Five elements" is a trap distractor.
- Thinking the EQR re-performs procedures. The reviewer evaluates judgments and report appropriateness, not retesting balances.
- Conflating peer review and PCAOB inspection. Peer review = AICPA, every three years, non-issuer engagements. PCAOB inspection = issuer audits, every three years (annually if more than 100 issuers). A firm with both practices is subject to both.
Bottom line
- SQMS No. 1 requires a risk-based system of quality management built on eight components, evaluated at least annually
- Every firm performing audits, reviews, compilations, or attestations must operate an SQM; the form scales with size, but the requirement does not
- An EQR is required for higher-risk engagements and every SEC-issuer audit, must be independent, and must finish before report release
- AU-C 220 puts engagement-level quality on the partner: leadership, ethical requirements, accept/continue, HR, engagement performance, monitoring
Exam shortcut
Identify scope first. Firm-wide → SQMS No. 1, eight components, annual evaluation. Engagement-level → AU-C 220, six controls, partner accountability. Second-look → SQMS No. 2 / PCAOB AS 1220, EQR independence, complete before release. External oversight → peer review for non-issuers (every three years), PCAOB inspection for issuers (every three years, or annually if more than 100 issuers). "Publicly traded" or "SEC issuer" → PCAOB.
The full lesson (about 1,882 words, 13 min read) adds 2 worked examples, all 6 common mistakes, a self-check, free in the app.
Learning objectives
- I.G1
Browse all free CPA AUD lessons or jump into free CPA AUD practice questions.