SAS 146 is the AICPA Auditing Standards Board’s new standard on quality management for an audit of financial statements, and it takes effect for audits of financial statements for periods beginning on or after December 15, 2025. It replaces the older AU-C section 220 framework with a risk-based approach that puts the engagement partner squarely in charge of quality on each audit. The standard applies to audits conducted under generally accepted auditing standards, meaning non-issuer engagements rather than public company audits overseen by the PCAOB. It works alongside SQMS No. 1, the firm-level quality management standard firms were required to implement by the same date.1AICPA & CIMA. A Journey to Quality Management
What Changed from AU-C Section 220
The previous standard, codified as AU-C section 220 within SAS No. 122, took a policies-and-procedures approach. Firms built checklists and followed them. SAS 146 scraps that model. The engagement partner now actively identifies quality risks specific to each engagement and decides whether the firm’s existing policies are enough or whether additional responses are needed at the engagement level.2AICPA & CIMA. Codification of Statements on Auditing Standards – Search
That shift changes daily practice. Instead of confirming that boxes were checked, the partner has to think through what could go wrong on this particular engagement and design responses accordingly. The standard also strengthens requirements around professional skepticism, documentation of the partner’s involvement, and two-way communication between the engagement team and the firm’s quality management system. Under the old standard, information mostly flowed down from the firm to the team. Now the team is expected to feed information back to the firm about issues encountered during the engagement, so the firm’s overall system can improve over time.
What the Engagement Partner Must Do
The engagement partner bears overall responsibility for managing and achieving quality on the audit. SAS 146 frames this as active leadership throughout the engagement’s lifecycle rather than a passive sign-off role. The partner must create an environment that emphasizes the firm’s culture of quality and sets clear expectations for how team members should behave, particularly around challenging management assertions and flagging concerns without fear of pushback.3AICPA & CIMA. AICPA Statement on Auditing Standards No. 146
The partner’s duties fall into three categories under the standard. First, implement the firm’s responses to quality risks that apply to the specific engagement, using information communicated by the firm. Second, evaluate whether the engagement’s nature and circumstances call for additional responses beyond the firm’s standard policies. Third, communicate information from the engagement back to the firm when the firm’s policies require it, feeding the broader quality management system. That last piece is new and often overlooked during implementation. A partner who discovers an unusual fraud risk on a client, for example, needs to report that up so the firm can assess whether its system addresses similar risks on other engagements.
Accountability runs through all of this. The partner must be sufficiently involved to demonstrate that they directed the engagement strategy, stayed informed about significant matters, and made key decisions rather than delegating them entirely to managers or seniors. Documentation of that involvement is critical. Firms that treat partner sign-off as a formality are exactly the ones likely to run into trouble during peer review.
The partner is also responsible for ensuring every team member understands and complies with relevant ethical requirements, including independence. If anyone on the team identifies a potential threat, it must be reported through the firm’s channels so the partner can evaluate whether existing safeguards reduce the risk to an acceptable level or whether the firm needs to withdraw.
Professional Skepticism Requirements
SAS 146 gives professional skepticism more prominence than the previous standard did. The engagement partner is expected to exercise skepticism personally and create conditions where the rest of the team does the same. The standard acknowledges that skepticism can be undermined by cognitive biases, time pressure, and team dynamics where junior staff defer too readily to client management’s explanations.
Application guidance in the standard describes common impediments to skepticism and specific actions the team can take to counteract them. This is where the partner’s tone-setting matters most. A team that sees the partner accepting management’s assertions at face value will mirror that behavior. A team that sees the partner probing unusual transactions will do the same. The partner’s daily conduct effectively becomes a quality management control in itself.3AICPA & CIMA. AICPA Statement on Auditing Standards No. 146
Client Acceptance and Continuance
Before any audit work begins, the engagement partner must determine that the firm’s policies on client acceptance and continuance have been followed and that the conclusions reached are appropriate. This is more than a procedural formality. Acceptance is where the firm evaluates management integrity, assesses whether it has the competence and resources to handle the engagement, and identifies risks that could make the engagement untenable.
Evaluating management integrity involves looking at the client’s history with previous auditors, past regulatory investigations, and any financial restatements or disputes over accounting treatment. When succeeding a predecessor auditor, the incoming firm should make specific inquiries about matters bearing on management integrity, disagreements over accounting principles or procedures, and any communications to audit committees about fraud or illegal acts.4Public Company Accounting Oversight Board. Communications Between Predecessor and Successor Auditors Before making those inquiries, the firm must get the prospective client’s permission and ask the client to authorize the predecessor to respond fully. A client that refuses that authorization is waving a red flag worth taking seriously.
The competence assessment is equally important. If the client operates in a specialized industry involving complex financial instruments, unusual regulatory requirements, or technical accounting the firm has not handled before, declining is the right call. SAS 146’s documentation requirements make it harder to talk a firm into work it cannot do well, because the partner must document the basis for the acceptance or continuance decision. Continuance decisions deserve the same rigor, because changes in a client’s business model, ownership structure, or management can introduce risks the firm was not exposed to when the relationship started.
Assigning Resources to the Engagement
The engagement partner must determine that sufficient and appropriate resources are assigned and available in a timely manner. SAS 146 frames resources across three categories: human resources (the audit team, specialists, and external experts), technological resources (audit software, data analytics tools, and secure information storage), and intellectual resources (methodologies, audit programs, and industry-specific guidance).
Human resources is where most engagements run into trouble. An understaffed engagement almost always leads to rushed work, inadequate testing, and missed deadlines. The partner needs to assess not just headcount but whether the team members assigned have the right experience and competencies for the engagement’s complexity. If the audit requires IT systems testing or complex valuation work, the partner must determine whether internal specialists or outside experts need to be brought in and ensure they are available when the work needs to happen.
Technological resources matter more now than they did under the old standard, given how heavily modern audits rely on data analytics and electronic workpapers. The partner should verify that the tools being used are functional, current, and appropriate for the engagement. Intellectual resources are less tangible but just as important. An audit team working in an unfamiliar industry without the right methodology will produce lower-quality work regardless of headcount.
Direction, Supervision, and Review
SAS 146 requires the engagement partner to take responsibility for directing, supervising, and reviewing the work of the engagement team. Direction means giving team members clear instructions about their responsibilities, the objectives of the procedures they are performing, and the nature and timing of the work. Supervision means monitoring progress, addressing issues as they arise, and adjusting the approach when conditions change. Review means examining evidence and conclusions to determine whether they adequately support the audit opinion.
One area the standard emphasizes more than its predecessor is the timing of reviews. Rather than treating review as a single event at the end of fieldwork, SAS 146 expects documentation to be reviewed at appropriate points throughout the engagement. Catching a problem in week two of fieldwork is fundamentally different from catching it when the team is assembling the final file. Early review lets the partner redirect the team’s efforts, request additional evidence, or escalate an issue before it becomes a crisis that threatens the report date.
When review uncovers deficiencies, the partner must ensure that additional procedures are performed to resolve the issues before the report is issued. If the engagement team cannot obtain sufficient appropriate evidence on a particular matter, that fact needs to be reflected in the audit opinion rather than glossed over.
Consultation and Resolving Disagreements
The engagement partner must determine that team members have performed appropriate consultations on difficult or contentious matters. The partner needs to be aware of which issues warranted consultation, whether the right people were consulted, and whether the conclusions were properly implemented in the audit.
Differences of opinion within the team or between the team and its consultants must be resolved before the report is issued, and the conclusions reached must be documented. This guards against situations where a senior team member overrides a valid concern raised by someone more junior. If a staff auditor identifies an issue with revenue recognition and the manager disagrees, the resolution should be documented rather than decided by seniority alone. The partner is ultimately responsible for ensuring these differences do not result in an inappropriate audit opinion.
How SAS 146 Connects to SQMS No. 1
SAS 146 does not operate in isolation. It is the engagement-level counterpart to SQMS No. 1, which establishes the firm-wide system of quality management. The firm builds its quality management system under SQMS No. 1 by identifying quality risks and designing responses. SAS 146 then requires the engagement partner to implement those firm-level responses on each individual audit and decide whether additional engagement-specific responses are needed.1AICPA & CIMA. A Journey to Quality Management
The monitoring and remediation component creates an ongoing feedback loop. The engagement partner must understand the firm’s monitoring and remediation process, determine whether findings from it are relevant to the current engagement, and take appropriate action. If the firm’s internal inspections found recurring deficiencies in audit sampling across multiple engagements, the partner on a new engagement needs to factor that into the supervision and review plan. Going the other direction, the partner must remain alert throughout the engagement for information relevant to the firm’s monitoring process and communicate it back. Firms are required to evaluate their quality management system within one year of completing implementation, or by December 15, 2026, and annually after that.1AICPA & CIMA. A Journey to Quality Management
What Small Firms Should Know
A common concern about SAS 146 is whether sole practitioners and small firms can realistically comply. The standard was designed to be less prescriptive and more scalable than AU-C section 220, precisely because it uses a risk-based approach rather than a checklist. A sole practitioner performing straightforward audits of small businesses will have fewer and less complex quality risks to identify and respond to than a regional firm auditing clients across multiple industries.
The key at a small firm is specificity. Under the old framework, many firms relied on boilerplate practice aids that produced generic quality control documents. SAS 146 expects the risk assessment to reflect the firm’s actual practice. That means thinking about what can realistically go wrong given the firm’s client base, staffing, and areas of expertise, then designing responses that address those specific risks. The trap to avoid is importing a large-firm template and filling in the blanks, which produces documentation that does not match reality and will not hold up under peer review.
Consequences of Noncompliance
Because SAS 146 applies to non-issuer audits under GAAS, the primary enforcement mechanism is the peer review process administered through state CPA societies and the AICPA. A firm that fails to comply may receive a deficient peer review report, which can trigger remedial actions, additional monitoring, or referral to the relevant state board of accountancy. State boards have authority to impose disciplinary actions including fines, suspension, or license revocation for CPAs and firms that violate professional standards.5North Carolina State Board of Certified Public Accountant Examiners. Enforcement
For auditors who also perform work on SEC registrants or broker-dealers, PCAOB inspection findings can compound the consequences. The SEC has imposed sanctions ranging from censures to permanent bars from practice for audit quality failures, including deficiencies in engagement partner supervision.6U.S. Securities and Exchange Commission. SEC Charges Accounting Firm With Audit Failures Those enforcement actions arise under PCAOB standards rather than GAAS, but a firm with quality management failures on its non-issuer engagements is unlikely to be performing better on its issuer work. Quality management problems tend to be systemic.