Waiting for peer review cycles puts firms at risk under SQMS 1

Many firms still treat SQMS 1 as a documentation exercise, assuming implementation can wait until peer review is on the calendar. Firms with reviews scheduled for 2027 or 2028 often act like they have time before monitoring, remediation and annual evaluation become urgent.

The American Institute of CPAs (AICPA) new peer review checklists make this expectation clear. The focus extends beyond the existence of documentation, but whether firms can demonstrate a functioning, evidence-backed system of quality management. That's the real shift in SQMS 1: from maintaining a static quality control manual to proving an active process.

Under the old quality control standards, many firms treated the manual as something you updated periodically and revisited around peer review. SQMS 1 changes that. Firms are now expected to run an ongoing, risk-based system that keeps pace with changes in personnel, engagements, technology, and regulatory expectations. Under SQMS 1, quality management is an active process, not a binder on a shelf.

In practice, firms must be able to show how they:

1. Identify quality objectives
2. Assess risks against those objectives
3. Design and implement responses
4. Use monitoring and remediation findings to inform the annual evaluation

The real deadline is the annual evaluation

Most firms prepared for the Dec. 15, 2025, implementation deadline. Fewer are taking the annual evaluation as seriously; due within one year of implementation and every year after. A firm cannot credibly conclude its system operated effectively if monitoring didn't happen during the first period. Monitoring should have started as soon as the system was set up, not compressed into the last few months before evaluation.

A firm that waits until late 2026 to begin inspections, review responses, or evaluate findings may not have enough runway to identify deficiencies, perform root cause analysis, implement remediation, and confirm the remediation actually worked before the evaluation is due. The annual evaluation requirement forces firms to operationalize their systems far earlier than most currently expect.

Peer review will reflect SQMS 1’s new requirements

Peer review hasn't changed structurally, but what reviewers are looking for has. Historically, many firms viewed peer review as focused on engagement file inspection and confirming that quality control documentation existed.

The new checklists guide reviewers to assess whether firms identified quality objectives, assessed risks, implemented responses, monitored the system, found deficiencies and remediated them. It's no longer enough that policies exist on paper. Reviewers will look for evidence that the system operated all year, gathered through documentation and inquiries of firm personnel.

A transformed approach to Quality Management Standards

Traceability and documentation matter more than ever

SQMS 1 expects a clear, logical chain of evidence: quality objectives drive risk identification, risks drive responses, and monitoring findings drive remediation. That's a real problem for firms relying on generic templates or disconnected spreadsheets, where the connection between one step and the next lives in someone's head rather than in the record.

Many firms used the AICPA practice aid to link risks to responses. The next step is operationalizing those responses and tying them to monitoring activity that actually gets performed. The principle is simple: If you say you do it, you need to actually do it, and it needs to reflect the real nature, size and complexity of your practice.

Monitoring and remediation are the highest-risk area

Monitoring was already a common source of peer review deficiencies under the old standards. SQMS 1 raises the bar significantly: Firms must identify findings, evaluate severity and pervasiveness, investigate root causes, implement corrective action, and confirm the action actually resolved the issue.

The old approach was built around periodic compliance inspections. The new model is built around continuous improvement and systematic remediation. Many firms still underestimate how much operational activity this requires. Monitoring can't be deferred to year-end. Reviewers are being instructed to look for evidence it actually happened during the year.

Culture is set at the top

Reviewers are also being instructed to interview staff, not just partners, about their understanding of the firm's quality management processes. They may ask whether personnel were informed of policy changes, received training, understand consultation procedures, and believe the firm's culture emphasizes quality over profitability or deadline pressure.

That repositions SQMS 1 from a partner-level compliance exercise into an organization-wide operating expectation. Firms that built out QM documentation centrally but never pushed it down to staff will feel that gap the moment a reviewer starts asking questions.

"The days of putting quality control documents on a shelf for three years until your peer reviewer calls are over. Your SQM policies and procedures must be a living, breathing, and evergreen system." — Julie Burkenstock, partner, Audit-PCAOB, Weaver

Delay doesn’t buy you time

The standards don't tie implementation urgency to peer review timing. The annual evaluation requirement applies in 2026, and every year after, regardless of when peer review occurs. A firm whose peer review isn't until 2028 will still need to demonstrate evidence of:

1. Initial design and implementation of the risk assessment at the implementation date
2. Monitoring activities performed since then
3. Updates to risk assessments
4. Remediation procedures
5. Annual evaluations
6. Communication of quality management changes to staff

Delaying implementation only increases operational pressure later and raises the odds that evidence of the system operating won't exist when it's needed. The Peer Review Board is still deliberating what responsibility a reviewer has to determine whether a firm complied with SQMS 1 deadlines, and what happens if a reviewer determines a firm simply waited until its review year to implement.

The bottom line

The peer review checklists leave little ambiguity: Reviewers are evaluating operational effectiveness, not just the existence of documentation. Firms that begin operationalizing their systems now will have time to refine monitoring, catch deficiencies, remediate, and strengthen their annual evaluation before review pressure intensifies. Firms that keep waiting will find out too late that SQMS 1 readiness needed to start long before the reviewer ever showed up.

Prepare now, before peer review pressure arrives

Explore AICPA quality management and peer review resources

See how QMCore helps firms operationalize SQMS 1