Quality control for a CPA firm is the internal system of policies and procedures that gives the firm reasonable assurance its people follow professional standards and that every report or opinion it issues fits the client’s circumstances. As of December 15, 2025, the AICPA replaced its older rules-based framework with a risk-based quality management system, and the PCAOB will follow with its own risk-based standard on December 15, 2026. In practice, that means a firm can no longer satisfy its obligations by running down a fixed checklist. It has to identify the specific risks that threaten the quality of its work, design responses, and keep checking whether those responses are holding up.
Which Rulebook Applies to Your Firm
Two bodies set the standards, and which one governs depends on the clients the firm serves.
The American Institute of Certified Public Accountants (AICPA) writes the standards for firms that audit privately held companies, nonprofits, and government entities. Every AICPA member firm must comply, and the AICPA’s peer review program enforces the requirements.
The Public Company Accounting Oversight Board (PCAOB) governs firms that audit publicly traded companies. Registered firms must adopt a quality control system that provides reasonable assurance of compliance with PCAOB auditing standards.1Public Company Accounting Oversight Board. AS 1110 – Relationship of Auditing Standards to Quality Control Standards
Many larger firms answer to both at once because their client list mixes public and private companies.
The AICPA Framework in Force Now
The AICPA’s Statements on Quality Management Standards (SQMS No. 1, No. 2, and No. 3) took effect on December 15, 2025.2AICPA & CIMA. A Journey to Quality Management Instead of maintaining a fixed set of six quality control elements, a firm now operates a risk-based system built around eight interconnected components. The firm identifies quality objectives, assesses what could go wrong, designs responses, and monitors whether those responses are working.
SQMS No. 1 lays out the eight components:
- Risk assessment process. The engine of the system: identify quality objectives, assess quality risks, design responses.
- Governance and leadership. Senior partners set the culture and assign operational responsibility for the system to a specific individual.
- Relevant ethical requirements. Policies covering independence, integrity, objectivity, and confidentiality.
- Acceptance and continuance of client relationships. Deciding whether the firm can serve a client competently and ethically before taking the work.
- Engagement performance. Planning, supervision, consultation, and review of the work.
- Resources. Staffing, technology, and intellectual resources matched to the firm’s practice.
- Information and communication. Quality-related information moving to the right people inside and outside the firm.
- Monitoring and remediation. Ongoing evaluation of the other components, with corrective action when something fails.
SQMS No. 2 sets the standard for engagement quality reviews, which require a second partner to independently evaluate certain engagements before the report goes out. SQMS No. 3 makes conforming amendments to the first two. Together they form the complete framework for non-public-company work.
What Changes for PCAOB-Registered Firms in 2026
The PCAOB currently operates under interim quality control standards it adopted in 2003 from the AICPA’s older framework.3Public Company Accounting Oversight Board. Quality Control Standards Those interim standards organize quality control around five elements: independence, integrity, and objectivity; personnel management; acceptance and continuance of clients; engagement performance; and monitoring.4Public Company Accounting Oversight Board. QC Section 20 – System of Quality Control for a CPA Firm’s Accounting and Auditing Practice
That changes on December 15, 2026, when QC 1000 takes effect.5Public Company Accounting Oversight Board. QC 1000, A Firm’s System of Quality Control Under QC 1000, a firm must establish quality objectives, identify and assess quality risks each year, design responses, and maintain a monitoring and remediation process. The firm must also evaluate the effectiveness of its system annually as of September 30 and report on that evaluation. Firms that undergo annual PCAOB inspections must add an external quality control function that gives the system an independent check.
Once QC 1000 is in force, both regimes will share the same risk-based philosophy, which simplifies life for firms that work on both sides of the line.
What the System Has to Cover
Whichever framework applies, certain functions appear in every quality control system.
Leadership and the Tone at the Top
Managing partners set the culture. In practice, that means naming a specific partner with operational responsibility for the quality management system, budgeting time for technical consultation on complex engagements, and structuring compensation so partners are not rewarded for cutting corners to boost billable hours.
On the tax side, Circular 230 gives this concept real teeth. The person with principal authority over a firm’s tax practice can be personally disciplined for failing to maintain adequate compliance procedures if practitioners at the firm engage in a pattern of noncompliance.6eCFR. 31 CFR 10.36 – Procedures to Ensure Compliance
Independence and Ethics
Independence is the single highest-risk area for assurance work. If the firm or its people hold a financial interest in an audit client, the engagement is compromised. The system must track every financial relationship between the firm’s people and its clients, including investments, loans, and family ties that could create conflicts. Personnel typically sign annual affirmations that they hold no prohibited relationships.
The firm also has to monitor compliance with the AICPA’s Code of Professional Conduct, which sets rules on confidentiality, objectivity, and professional competence. Tax work carries its own ethical requirements under Circular 230, including due diligence standards and restrictions on taking unreasonable positions on returns.7Internal Revenue Service. Office of Professional Responsibility and Circular 230
Client Acceptance and Continuance
Not every client is worth having. Before taking on a new engagement or renewing an existing one, the firm has to evaluate whether it has the technical competence to do the work, whether the client’s management has integrity issues that create unacceptable risk, and whether it can meet independence requirements. Practical capacity matters too: enough staff with the right expertise, and a realistic shot at meeting the deadline. If any of that fails, the right answer is to decline.
Staffing and Professional Development
Staff assigned to an engagement must have training and experience matched to its complexity. A first-year associate should not run a complicated revenue recognition analysis without supervision from someone who has done it before. The system needs policies for recruitment, training, performance evaluation, and advancement.
Continuing professional education keeps technical skills current. AICPA members must complete 120 hours of CPE every three-year reporting period.8AICPA & CIMA. AICPA Membership CPE Requirements Most state boards layer on their own annual requirements, so the firm needs a tracking system that keeps every professional current with both.
Engagement Performance
This is where quality holds or falls apart. Engagement performance policies govern planning, supervision, consultation, and review, with the engagement partner bearing final responsibility for the work and the appropriateness of the report.
Consultation on complex or unusual matters has to be mandatory, not optional. When a staff member hits a transaction they haven’t seen before, the system should route that question to an experienced partner or outside expert before the team lands on an answer. Work papers have to document the procedures performed, the evidence gathered, and the reasoning behind the conclusions. Vague or incomplete documentation is one of the most common deficiencies PCAOB inspectors flag, because if it is not in the work papers, it effectively did not happen.
Document Retention
Quality control does not end when the engagement wraps. For public company audits, the Sarbanes-Oxley Act directs auditors to retain all audit or review work papers for at least seven years.9U.S. Securities and Exchange Commission. Retention of Records Relevant to Audits and Reviews Destroying audit records before that period expires can trigger criminal penalties. State boards and professional standards generally set shorter periods for non-public work, though many firms apply the seven-year rule across the board as a practical safeguard.
How the Requirements Shift by Service Line
A single quality management system has to flex to different risks depending on the work.
Audit and Assurance
Independence controls are tightest here because third parties rely on the opinion. The system requires detailed documentation of every technical consultation, strict evidence-gathering standards, and an engagement quality review for higher-risk engagements under SQMS No. 2. Public company audits add PCAOB auditing standards on top of the AICPA framework.
Tax
Tax work introduces a different risk set. Due diligence standards require a documented basis for every position taken on a return. The firm has to ensure adherence to Circular 230, and the individual overseeing the tax practice carries personal exposure for failing to maintain adequate compliance procedures.6eCFR. 31 CFR 10.36 – Procedures to Ensure Compliance Staff training has to keep up with tax law changes, and the system has to address the risk of preparer penalties for unreasonable positions.
Consulting and Advisory
Advisory engagements often need specialized knowledge in cybersecurity, business valuation, or transaction structuring. The system has to confirm that assigned staff have documented expertise in the relevant field. Engagement letters defining the exact scope matter here because advisory work can expand in unpredictable ways and create liability the firm never agreed to take on. Conflicts of interest also need attention, especially when the firm advises on transactions involving entities it also audits.
How the System Gets Checked From Outside
Internal monitoring only goes so far. Both the AICPA and the PCAOB impose external review.
AICPA Peer Review
Firms that perform accounting or auditing work undergo peer review on a three-year cycle. An independent CPA firm examines the quality management system and a sample of completed engagements, then issues a report rated pass, pass with deficiencies, or fail. Anything short of a clean pass typically triggers corrective action and can affect the firm’s ability to retain certain clients or stay enrolled in AICPA practice-monitoring programs.
PCAOB Inspections
Registered firms face a tougher process. The PCAOB inspects firms that audit more than 100 public companies every year and inspects smaller registered firms at least once every three years.10Public Company Accounting Oversight Board. Basics of Inspections Inspectors review individual engagements and evaluate the firm’s quality control system as a whole.
When inspectors identify quality control defects, the firm has 12 months to fix them. If the firm does not address the criticisms to the Board’s satisfaction within that window, the deficiency findings become public.11Public Company Accounting Oversight Board. Remediation In serious cases, the PCAOB can impose sanctions ranging from censure to civil money penalties to temporary or permanent bars on individual practitioners.
What a Breakdown Costs
A weak system is not just a compliance problem. A missed audit procedure leads to a deficient inspection report, the deficiency becomes public, and the fallout spreads from clients to staff to insurers. At the extreme end, the PCAOB can revoke a firm’s registration, and state boards can suspend or revoke its license to practice.
For individuals, the consequences are personal. Auditors have been censured, fined tens of thousands of dollars, and barred from association with registered firms under PCAOB disciplinary proceedings for quality-related failures. Under Circular 230, the person overseeing a tax practice can be personally disciplined when the firm’s practitioners engage in a pattern of noncompliance, even if that person did not prepare the problematic returns.6eCFR. 31 CFR 10.36 – Procedures to Ensure Compliance That is why leadership’s tone at the top is treated as a rule rather than a slogan.