A quality control review for accounting firms is an external examination of whether your firm’s internal systems produce reliable, standards-compliant audit and attestation work. State licensing boards in 55 jurisdictions require it, the AICPA requires it for members, and firms performing government audits face an additional layer under Government Auditing Standards. A poor result can trigger mandatory remediation, loss of AICPA membership, license revocation, or federal debarment, so the process is worth understanding before the review team schedules its entry meeting.
Which Firms Are Subject to Review
If your firm issues audit reports, reviews financial statements, or performs attestation engagements, you almost certainly need a peer review. Nearly every firm performing accounting or auditing engagements is covered by the AICPA Peer Review Program, and state boards in the vast majority of jurisdictions have made participation a statutory condition of keeping a CPA license.1AICPA & CIMA. Final Version of New AICPA Peer Review Standards Update Now Available
Firms performing government audits under Government Auditing Standards, commonly called the Yellow Book, must undergo an external peer review at least once every three years.2Inspector General Network. FAQ Audit Peer Review The three-year cycle is a ceiling. Reviewing bodies can shorten the interval when a firm’s prior review turned up serious findings, and firms are expected to run their own internal monitoring in between. For PCAOB-registered firms, the new standard QC 1000, effective December 15, 2026, adds an annual evaluation of the firm’s quality control system reported on a new Form QC.3PCAOB. Quality Control
What Documentation to Have Ready
Preparing for a review means assembling an evidence package well before the reviewers arrive. Reviewers form impressions quickly, and a firm that cannot locate its own workpapers signals something about how it manages quality day to day. The core materials your firm needs to produce:
- Complete audit workpapers for the engagements selected, showing procedures performed, conclusions reached, and how complex issues were resolved.
- Written quality control policies covering independence, engagement acceptance, human resources, supervision, and monitoring.
- Continuing professional education records. For GAGAS work, each auditor must complete at least 80 hours every two years, with at least 24 hours in government-related subjects and no fewer than 20 hours in any single year.4Government Accountability Office. Government Auditing Standards: Guidance on GAGAS Requirements for Continuing Professional Education
- Internal monitoring reports from your own annual inspections of completed engagements, including how any problems were addressed.
- The prior peer review report and any corrective action letters, plus evidence you followed through on required improvements.
- A full engagement listing for the review period identifying the lead partner on each audit, so the review team can pull a representative sample.
How the Review Unfolds
The process begins with a planning phase. The review team studies your firm’s profile, selects the engagements it wants to examine, and schedules fieldwork. A formal entry meeting with firm leadership sets scope and timeline.
During fieldwork, reviewers test whether the work matches your written policies and professional standards, looking at planning, risk assessment, execution, and the final report. Expect interviews at multiple levels. A review team that only talks to partners gets a sanitized picture; talking to senior associates and staff auditors shows whether quality controls are genuinely embedded or exist only on paper.
Issues get discussed in real time as they surface. Sometimes what looks like a deficiency has a reasonable explanation that simply was not documented well. Fieldwork ends with an exit conference where the team presents preliminary findings, after which a formal report is drafted and your firm responds. The full cycle from initial scheduling to acceptance by the administering entity can stretch well beyond a few months, particularly when corrective actions are required before the review can be closed.
The Three Ratings
A peer review ends in one of three ratings.5AICPA & CIMA. Peer Review: A Vital Component in Audit Quality
A Pass means your quality control system is properly designed and the firm is following it. Pass with Deficiencies means the system works overall, but reviewers identified specific areas where the firm fell short of professional standards. These are not trivial oversights; they are serious enough to warrant formal documentation and corrective action. A Fail means the quality control system is either not adequately designed or not being followed to a degree that undermines the reliability of the firm’s work.
What Happens After a Deficiency or Fail Rating
A Pass with Deficiencies or Fail triggers a structured remediation process. Your firm must submit a letter of response detailing the corrective actions taken or planned, the timeline for completion, and the steps you will implement to prevent recurrence. On individual engagements, required actions can include performing omitted procedures, reissuing reports and financial statements, or notifying users to stop relying on a previously issued report.
Because peer review is tied to state board licensing, firms that cannot clear their deficiencies face more than embarrassment. Firms that fail remediation risk having their license revoked.5AICPA & CIMA. Peer Review: A Vital Component in Audit Quality Grounds for termination from the AICPA Peer Review Program include failing to correct deficiencies after consecutive non-pass reports, failing to correct deficiencies after repeated corrective actions on the same review, or findings so severe that the review committee concludes no amount of education or remedial action would be adequate. A firm facing termination receives formal notice and the right to a hearing before a panel, but reaching that point usually means the firm has already had multiple chances to fix things.
Firms performing federal audit work face additional exposure. Federal agencies have the authority to suspend or debar contractors and service providers whose work does not meet standards of responsibility and integrity. A debarment typically lasts three years and applies government-wide, meaning the firm loses access to all federal contracting, not just the agency that initiated the action. Debarment proceedings include written notice and a 30-day opportunity to respond, but even a suspension can be devastating to a firm that depends on government audit work.
The 2024 Yellow Book Shift to Quality Management
Firms performing government audits need to plan around a major change. The 2024 revision to Government Auditing Standards shifted the underlying framework from “quality control” to “quality management.”6U.S. GAO. Government Auditing Standards 2024 Revision The older approach treated quality as a compliance checklist. The new model puts leadership in charge of proactively managing quality through a risk-based process scaled to the firm’s size and complexity.
Firms were required to design and implement a compliant quality management system by December 15, 2025, and must complete their first evaluation of that system by December 15, 2026. Under the new framework, firms identify quality risks specific to their practice and design tailored responses rather than following a one-size-fits-all checklist. The standards are explicitly scalable, so a five-person local government audit shop is not expected to build the same apparatus as a national firm. Monitoring receives greater emphasis, with firms expected to proactively test whether their systems work rather than waiting for an external reviewer to find the gaps. The standards also introduce optional engagement quality reviews for individual GAGAS engagements.
Firms subject to both GAGAS and other quality management standards, such as those issued by the PCAOB, can operate a single integrated system rather than maintaining parallel structures. If your firm audits both public companies and government entities, that flexibility is designed to reduce the burden of satisfying overlapping requirements.7U.S. GAO. Yellow Book: Government Auditing Standards