Making the most of the quality management standards (SQMS 1) changes

With the Dec. 15, 2025, effective date for the new SQMS No. 1 quality management standard quickly approaching, audit and assurance firms are deep into preparation.

But let's reframe the narrative on risk assessment. The new quality management standard is a firm-wide opportunity to build a framework that actively strengthens how your practice delivers quality engagements to your clients. With the right approach, SQMS No. 1 can become your firm’s next strategic advantage.

A mindset shift worth making

SQMS1 requires a fundamental change for all firms. Instead of relying on reactive quality control systems, firms are now expected to adopt a proactive, risk-based approach to quality management. This change to firm processes is structural in nature.

Think of it as a shift from the expectation of “quality by tradition” to “quality by design.” Firms are now expected to define what quality means in the context of their unique operations and demonstrate how they achieve it.

The standard introduces eight components of a system of quality management (SOQM) a firm must establish, including two that form the foundation of the operational change: risk assessment and monitoring & remediation. These activities are not one-time events—they’re ones that firms must engage regularly, thoughtfully and transparently.

If your firm performs audit, attestation or review engagements under AICPA standards—SQMS 1 applies to you.

Quality management systems start with people

Every successful system starts with the right people in the right roles. SQMS 1 requires firms to assign responsibility across four defined roles:

• The ultimate responsible individual (URI), typically the managing partner or CEO, oversees the entire system.
• The operational responsible individual (ORI) manages the system day-to-day supported by other individuals in operational roles:
• • The monitoring & remediation lead ensures issues are tracked, addressed, and learned from.
  • The independence oversight role, while optional, helps preserve objectivity and accountability.

In smaller firms, these roles can be combined, but they must be clearly defined and documented. In SQMS 1, accountability lands on who does the work and who ensures the work gets done correctly.

Building the roadmap: A structured SQMS 1 implementation plan

A structured, step-by-step plan turns this large change into an achievable milestone. With the new standard going into effect in a few short months, firm leaders need a plan to act now. It’s best if you think about moving to the new standard in a phased journey versus trying to do everything at once. Here is a framework to help guide your firm as you shift your quality management approach to align with SQMS 1.

• Phase 1: Start by assigning the core roles.
• Phase 2: Choose your implementation method while considering your operational scale, whether it’s using spreadsheets and Word docs, an add-on to your current system or a purpose-built solution like QM Core, a CPA.com preferred partner. It’s important that you consider how your firm can manage your system on an ongoing basis, especially since a spreadsheet may not be a scalable solution for a SQMS 1- compliant quality management system.
• Phase 3: Assemble your risk assessment team. Make sure they understand the firm’s structure, services and existing processes, policies and procedures. Keep in mind that your SOQM will go across your firm from HR to operations to IT to the audit and assurance department. You’ll need to engage people that understand these areas. This phase is about identifying the people that best understand your firm and the quality risks it faces. They will be a multi-disciplinary team led by individuals who understand risk.
• Phase 4: Start your risk assessment process by digging into the risk identification and documentation. Identify your responses and the potential gaps you need to close. This is the heart of SQMS 1.
• Phase 5: It is important as part of your implementation that you finalize your system which includes preparing for ongoing monitoring.

Each phase builds on the one before it, ultimately helping you meet your implementation timeline. The phasing of the steps is important to avoid rework and delay the overall process.

Where it all comes together: The risk assessment

The risk assessment serves as a foundation for SQMS 1. The process is about identifying what could go wrong while deeply understanding how your firm operates, where vulnerabilities lie, and what structures exist to mitigate those vulnerabilities.

Start with a clear definition of what quality means for your firm. Then, map that definition to your day-to-day operations, answering questions like: