What Is a Peer Review Audit for CPA Firms?

A peer review audit for a CPA firm is an outside quality check that any firm issuing audits, reviews, or other attest reports must undergo every three years to keep performing that work. An independent reviewer, usually another CPA firm, examines a sample of the firm’s engagement files and, in most cases, the quality management system behind them, then rates the firm against professional standards set by the American Institute of Certified Public Accountants (AICPA). Most state boards of accountancy treat a current peer review as a condition of licensure for attest practice, which makes the process effectively mandatory for any firm that signs reports.

Which Firms Have to Get One

The trigger is simple: if your firm issues reports on attest engagements, you need a peer review. Attest work includes audits, reviews of financial statements, examinations of prospective financial information, and compilations where the firm reports a lack of independence. Firm size doesn’t matter. A sole practitioner with one audit a year has the same obligation as a regional firm with dozens of partners.

Firms that only prepare taxes, do bookkeeping, consult, or prepare financial statements without issuing a report generally fall outside the requirement. The dividing line is whether the firm issues a report that users rely on for assurance.

A firm beginning attest work should enroll in the AICPA Peer Review Program by the report date of its first engagement, not months later.¹ Enrollment typically goes through a state CPA society acting as the administering entity. From there, the firm is on a recurring three-year cycle.

Missing enrollment or failing to complete a review on schedule has real consequences. A firm that doesn’t cooperate with the process can be terminated from the program, which usually prompts an investigation by the state regulator and can mean losing the ability to perform attest services.²

System Review or Engagement Review

Which type of review you need depends on the highest level of service your firm provides.

System Review

A system review is the broader of the two. It evaluates the firm’s entire quality management system, including policies, procedures, leadership structure, and monitoring, along with a sample of engagements that covers the firm’s range of practice. Any firm that performs audits or examinations needs a system review.³

The reviewer’s sample is designed to capture different industries, different engagement partners, and higher-risk work. Certain categories, called “must-select” engagements, are automatically included when the firm performs them. These typically include employee benefit plan audits and audits performed under government auditing standards, where the public interest is particularly high.⁴ The reviewer also interviews partners and staff to test whether documented policies match actual practice.

Engagement Review

An engagement review is narrower. The reviewer examines selected engagement files (financial statements, the accountant’s report, and supporting documentation) to decide whether the work conforms to professional standards. It does not evaluate the firm’s overall quality management system.

This type is available to firms whose highest level of service is a review of financial statements or a compilation under the Statements on Standards for Accounting and Review Services. If your firm doesn’t perform audits or examinations, an engagement review is what applies.

What the Reviewer Actually Does

The reviewed firm selects its own peer reviewer, but the choice has limits. The reviewer must be independent and must have relevant experience in the industries and technical areas the firm serves. For a system review, the team captain must be a partner-level individual at an enrolled, peer-reviewed firm. The administering entity vets the reviewer’s qualifications before the review proceeds.

Once the reviewer is approved, both sides agree on scope: which engagements will be examined, what period the review covers, and the logistics of fieldwork.

During fieldwork, the reviewer works through the selected engagement files, checking working papers, financial statements, and reports against the applicable standards. For system reviews, fieldwork also includes interviews with professional staff and partners about quality management policies. Those interviews often reveal whether written procedures are being followed or are sitting in a binder. Any departures from professional standards are documented as exceptions, and the reviewer holds an exit conference with firm management to discuss preliminary findings before drafting the final report. The firm can provide additional documentation or context during that window.

The Three Possible Ratings

After fieldwork, the reviewer issues a formal report with one of three ratings.

Pass. The firm’s quality management system (or, for an engagement review, the engagements examined) conforms to professional standards. This is the best outcome, an unmodified report.
Pass with deficiencies. The reviewer found departures from professional standards that were more than minor but didn’t fundamentally undermine the reliability of the firm’s reports. Specific problems need fixing, but the overall system isn’t broken.
Fail. The quality management system has serious, pervasive deficiencies, or the engagements reviewed showed significant departures from professional standards.

The report goes to the administering entity’s peer review committee for acceptance. The committee reviews the findings and the firm’s response before formally accepting the report or requiring further action.

What Happens After a Deficiency or Failure

A firm that receives a pass with deficiencies or a fail must submit a formal letter of response outlining a remediation plan. Depending on the severity of the findings, corrective actions commonly include:

Targeted continuing education for partners or staff in the areas where deficiencies were found
Revised quality management documentation to close identified gaps
Pre-issuance review of future high-risk engagements by an independent reviewer before reports go out
An accelerated follow-up peer review ahead of the normal three-year cycle, in more serious cases, to confirm the fixes are working

The committee monitors progress. Firms that don’t follow through on promised actions risk termination from the program and the regulatory fallout that follows.²

One thing worth knowing: peer review reports aren’t confidential. Accepted documents are published through the AICPA for firms in certain practice sections, such as the Private Companies Practice Section, the Employee Benefit Plan Audit Quality Center, and the Governmental Audit Quality Center, as well as any firm that voluntarily requests publication.⁵ State boards may publish results independently. Not every enrolled firm’s results appear automatically, but clients and regulators can usually verify a firm’s status through the state board.

The 2026 Quality Management Shift

Firms being reviewed in 2026 face a significant change. The AICPA required all firms to establish a system of quality management under the new QM standards, principally QM Section 10, A Firm’s System of Quality Management, by December 15, 2025. Firms should be operating under that new system in 2026.⁶

The older framework asked whether firms had documented policies and whether those policies were followed. The new approach is risk-based: firms must identify and assess risks to engagement quality, then design responses tailored to those risks. Peer reviewers in 2026 and beyond will be checking whether a firm’s system reflects that risk-based thinking, not just whether a policy manual exists. A firm still working from pre-QM documentation will have that gap surface quickly in a system review.

How to Prepare

Firms that struggle in peer review almost always treat it as an event instead of a reflection of ongoing practice. A few areas matter more than others.

Internal Monitoring

Inspect your own engagement quality every year, not just in review years. A documented internal inspection program shows the reviewer that quality monitoring is actually happening, and it catches problems before someone else does. Cover a cross-section of partners, industries, and engagement types.

Quality Management Documentation

With the QM standards now in effect, your firm needs a written risk assessment, documented responses to identified quality risks, and evidence that monitoring is active.⁶ A quality control manual from five years ago won’t satisfy a reviewer in 2026.

Engagement File Organization

Every file the reviewer selects gets scrutinized for completeness. Common weak spots include missing documentation of risk assessment procedures, failure to document independence considerations when non-audit services are provided, and incomplete implementation of newer accounting standards like revenue recognition and lease accounting. The AICPA publishes peer review engagement checklists that help catch gaps before fieldwork begins.⁷

CPE and Staff Readiness

Reviewers check continuing professional education records, especially in accounting and auditing. Keep CPE records centrally rather than scattered among individual staff. Firms doing employee benefit plan audits or government audits need staff trained specifically in those standards.

Choosing the Reviewer

Pick a reviewer with experience in your firm’s industries and in firms of your size. Someone who regularly reviews small-firm construction audits will give more useful feedback on that work than a reviewer whose practice is large-firm financial institutions. Ask for references before committing.

Costs and Timing

Peer review costs come from two sources: an administrative fee charged by the administering entity (usually the state CPA society) and the reviewer’s professional fees. Administrative fees vary by state and are often scaled to the number of professionals at the firm, typically ranging from a few hundred dollars for a small firm to a couple thousand for a larger one, billed once per three-year cycle in the review year.

Reviewer fees depend on the type and complexity of the review. An engagement review for a small firm is the least expensive. A system review with must-select engagements, especially government or employee benefit plan audits, costs more because of the additional expertise and time involved.

The full process, from scheduling through final committee acceptance, usually takes several months. Firms that keep engagement files and quality management documentation current year-round spend far less time scrambling than those that try to assemble everything just before fieldwork.

1
American Institute of Certified Public Accountants. Questions and Answers About the AICPA Peer Review Program
2
American Institute of Certified Public Accountants. PRSU No. 3 – Modernizing Peer Review Administration Requirements
3
American Institute of Certified Public Accountants. AICPA Standards for Performing and Reporting on Peer Reviews
4
AICPA & CIMA. Training for Reviews of Certain Must-Select Engagements
5
AICPA. AICPA Peer Review Program
6
AICPA & CIMA. Readying Your New System of Quality Management for Peer Review
7
AICPA & CIMA. Search Results – Peer Review Engagement Checklists