Building SQMS No. 1 into your firm

For many CPA firms, implementing SQMS No. 1 begins with building the foundation: documenting quality objectives, identifying quality risks and designing responses. But the system of quality management does not end once the initial framework is in place.

The real long-term success of SQMS No. 1 depends on the monitoring and remediation that happens next.

Under the standard, firms must be able to demonstrate that their system of quality management is not only designed appropriately, but that it also operates effectively over time. Monitoring is the mechanism that allows firms to gather evidence, evaluate results, identify deficiencies and continuously improve. Putting this into practice can feel complex. The good news is that firms can take a structured, practical approach. Below are five actions that can help build a monitoring process that is scalable and sustainable.

Recognize that your system will evolve

One of the biggest mindset shifts under SQMS No. 1 is recognizing that the system of quality management is dynamic. The risk assessment and responses firms documented are a starting point.

Firms should expect quality risks to evolve as business models change, client profiles shift, staffing fluctuates or new technology is adopted. Monitoring is how the firm ensures that responses remain appropriate and effective as circumstances change.

Importantly, SQMS No. 1 does not require perfection. It does mandate firms to surface deficiencies early, evaluate them honestly, and remediate them effectively. Ongoing evaluations are designed to reveal issues — not to prove that none exist.

Define your monitoring population

A common pitfall is launching review procedures without clearly defining the monitoring population — the universe of responses, controls and engagement files that could affect the achievement of quality objectives.

Defining that population at the outset allows firms to focus attention on higher-risk areas, newly implemented responses and processes where timing is critical for remediation.

Firms may also prioritize newly implemented or modified responses, as well as responses where timing matters and deficiencies need to be identified early enough for remediation.

Align testing to your firm’s scale

Once your population is identified, firms must determine how responses will be tested. SQMS No. 1 requires firms to evaluate the design, implementation and operation of responses — not simply confirm that documentation exists.

A practical starting point is walkthrough testing, which helps determine whether controls are operating, how owns them, and what evidence supports their operation. This will look different for each firm, depending on its size and structure.

For example, a weekly client acceptance discussion in a large firm may produce formal minutes and action trackers. However, in a small firm, the evidence may appear in engagement acceptance documentation. The key is consistency, clarity and repeatability — whatever process the firm adopts must be capable of being monitored effectively.

Turn findings into improvements

SQMS No. 1 requires firms to evaluate whether findings represent deficiencies, perform root cause analysis and remediate issues on a timely basis. The ultimate purpose is improvement: strengthening quality responses, closing gaps and preventing recurrence.

However, oversight can also surface positive practices worth scaling across the organization. Consistent communication of outcomes — to leadership, engagement teams and those responsible for responses — reinforces accountability and supports a culture where monitoring is viewed as an opportunity rather than a burden.

Many firms begin assessments with spreadsheets, shared folders or internal documentation tools. That may be sufficient initially, but monitoring under SQMS No. 1 is ongoing, evidence-heavy and interconnected. Firms must be able to track oversight activities, assign responsibility, document findings, manage remediation and connect deficiencies back to the underlying response, risk and quality objective.

Technology can play a critical role in making the process sustainable, especially as systems mature beyond year one.

Embed oversight into daily operations

Successful SQMS implementation isn’t about building a perfect system immediately - it will evolve over time through iteration.

The more firms integrate monitoring and remediation into normal operations — rather than as an annual exercise — the stronger the outcomes for the system of quality management overall.

Done well, it is an opportunity to strengthen engagement quality, manage risk more proactively and build trust with stakeholders over the long term.

Monitoring and remediation don’t have to be overwhelming.

QMCore supports firms by centralizing oversight activities, linking findings back to risks and objectives, and tracking remediation through completion. See how QMCore can help make your risk monitoring more sustainable over time.

Simplify your quality management

 
About the author
Kilian Doyle is responsible for consulting on the development and management of RegTech solutions. A CPA, Kilian was a Director in EisnerAmper Ireland’s Advisory department and worked with clients closely in executing projects, change management programmes and advising on complex financial transactions and regulatory requirements.