1.01 The objectives of a system of quality control are to provide a CPA firm with reasonable assurance¹ that the firm and its personnel comply with professional standards and applicable regulatory and legal requirements, and that the firm or engagement partners issue reports that are appropriate in the circumstances. QC section 10, A Firm’s System of Quality Control (AICPA, Professional Standards), addresses a CPA firm’s responsibilities for its system of quality control for its accounting and auditing practice. That section is to be read in conjunction with the AICPA Code of Professional Conduct and other relevant ethical requirements.

1.02 A system of quality control consists of policies designed to achieve the objectives of the system and the procedures necessary to implement and monitor compliance with those policies. The nature, extent, and formality of a firm’s quality control policies and procedures will depend on various factors such as the firm’s size; the number and operating characteristics of its offices; the degree of authority allowed to, and the knowledge and experience possessed by, firm personnel; and the nature and complexity of the firm’s practice.

Communication of Quality Control Policies and Procedures

1.03 The firm should communicate its quality control policies and procedures to its personnel. Most firms will find it appropriate to communicate their policies and procedures in writing and distribute them, or make them available electronically, to all professional personnel. Effective communication includes the following:

•     A description of quality control policies and procedures and the objectives they are designed to achieve

•     The message that each individual has a personal responsibility for quality

•     A requirement for each individual to be familiar with and to comply with these policies and procedures

Effective communication also includes procedures for personnel to communicate their views or concerns on quality control matters to the firm’s management.

Elements of a System of Quality Control

1.04 A firm must establish and maintain a system of quality control. The firm’s system of quality control should include policies and procedures that address each of the following elements of quality control identified in paragraph .17 of QC section 10:

•     Leadership responsibilities for quality within the firm (the “tone at the top”)

•     Relevant ethical requirements

•     Acceptance and continuance of client relationships and specific engagements

•     Human resources

•     Engagement performance

•     Monitoring

1.05 The elements of quality control are interrelated. For example, a firm continually assesses client relationships to comply with relevant ethical requirements, including independence, integrity, and objectivity, and policies and procedures related to the acceptance and continuance of client relationships and specific engagements. Similarly, the human resources element of quality control encompasses criteria related to professional development, hiring, advancement, and assignment of firm personnel to engagements, all of which affect policies and procedures related to engagement performance. In addition, policies and procedures related to the monitoring element of quality control enable a firm to evaluate whether its policies and procedures for each of the other five elements of quality control are suitably designed and effectively applied.

1.06 Policies and procedures established by the firm related to each element are designed to achieve reasonable assurance with respect to the purpose of that element. Deficiencies in policies and procedures for an element may result in not achieving reasonable assurance with respect to the purpose of that element; however, the system of quality control, as a whole, may still be effective in providing the firm with reasonable assurance that the firm and its personnel comply with professional standards and applicable regulatory and legal requirements and that the firm or engagement partners issue reports that are appropriate in the circumstances.

1.07 If a firm merges, acquires, sells, or otherwise changes a portion of its practice, the surviving firm evaluates and, as necessary, revises, implements, and maintains firm-wide quality control policies and procedures that are appropriate for the changed circumstances.

Leadership Responsibilities for Quality Within the Firm (the “Tone at the Top”)

1.08 The purpose of the leadership responsibilities element of a system of quality control is to promote an internal culture based on the recognition that quality is essential in performing engagements. The firm should establish and maintain the following policies and procedures to achieve this purpose:

•     Require the firm’s leadership (managing partner, board of managing partners, CEO, or equivalent) to assume ultimate responsibility for the firm’s system of quality control.

•     Provide the firm with reasonable assurance that personnel assigned operational responsibility for the firm’s quality control system have sufficient and appropriate experience and ability to identify and understand quality control issues and develop appropriate policies and procedures, as well as the necessary authority to implement those policies and procedures.

1.09 Establishing and maintaining the following policies and procedures assists firms in recognizing that the firm’s business strategy is subject to the overarching requirement for the firm to achieve the objectives of the system of quality control in all the engagements that the firm performs:

•     Assign management responsibilities so that commercial considerations do not override the quality of the work performed.

•     Design policies and procedures addressing performance evaluation, compensation, and advancement (including incentive systems) with regard to personnel to demonstrate the firm’s overarching commitment to the objectives of the system of quality control.

•     Devote sufficient and appropriate resources for the development, communication, and support of its quality control policies and procedures.

Relevant Ethical Requirements

1.10 The purpose of the relevant ethical requirements element of a system of quality control is to provide the firm with reasonable assurance that the firm and its personnel comply with relevant ethical requirements when discharging professional responsibilities. Relevant ethical requirements include independence, integrity, and objectivity. Establishing and maintaining policies such as the following assist the firm in obtaining this assurance:

•     Require that personnel adhere to relevant ethical requirements such as those in regulations, interpretations, and rules of the AICPA, state CPA societies, state boards of accountancy, state statutes, the U.S. Government Accountability Office, and any other applicable regulators.

•     Establish procedures to communicate independence requirements to firm personnel and, where applicable, others subject to them.

•     Establish procedures to identify and evaluate possible threats to independence and objectivity, including the familiarity threat that may be created by using the same senior personnel on an audit or attest engagement over a long period of time, and to take appropriate action to eliminate those threats or reduce them to an acceptable level by applying safeguards.

•     Require that the firm withdraw from the engagement if effective safeguards to reduce threats to independence to an acceptable level cannot be applied.

•     Require written confirmation, at least annually, of compliance with the firm’s policies and procedures on independence from all firm personnel required to be independent by relevant requirements.

•     Establish procedures for confirming the independence of another firm or firm personnel in associated member firms who perform part of the engagement. This would apply to national firm personnel, foreign firm personnel, and foreign-associated firms.²

•     Require the rotation of personnel for audit or attest engagements where regulatory or other authorities require such rotation after a specified period.

Acceptance and Continuance of Client Relationships and Specific Engagements

1.11 The purpose of the quality control element that addresses acceptance and continuance of client relationships and specific engagements is to establish criteria for deciding whether to accept or continue a client relationship and whether to perform a specific engagement for a client. A firm’s client acceptance and continuance policies represent a key element in mitigating litigation and business risk. Accordingly, it is important that a firm be aware that the integrity and reputation of a client’s management could reflect the reliability of the client’s accounting records and financial representations and, therefore, affect the firm’s reputation or involvement in litigation. A firm’s policies and procedures related to the acceptance and continuance of client relationships and specific engagements should provide the firm with reasonable assurance that it will undertake or continue relationships and engagements only where it

•     is competent to perform the engagement and has the capabilities, including the time and resources, to do so;

•     can comply with legal and relevant ethical requirements;

•     has considered the client’s integrity and does not have information that would lead it to conclude that the client lacks integrity; and

•     has reached an understanding with the client regarding the services to be performed.

1.12 This assurance should be obtained before accepting an engagement with a new client, when deciding whether to continue an existing engagement, and when considering acceptance of a new engagement with an existing client. Establishing and maintaining policies such as the following assist the firm in obtaining this assurance:

•     Evaluate factors that have a bearing on management’s integrity and consider the risk associated with providing professional services in particular circumstances.³

•     Evaluate whether the engagement can be completed with professional competence; undertake only those engagements for which the firm has the capabilities, resources, and professional competence to complete; and evaluate, at the end of specific periods or upon occurrence of certain events, whether the relationship should be continued.

•     Obtain an understanding, preferably in writing, with the client regarding the services to be performed.

•     Establish procedures on continuing an engagement and the client relationship, including procedures for dealing with information that would have caused the firm to decline an engagement if the information had been available earlier.

•     Require documentation of how issues relating to acceptance or continuance of client relationships and specific engagements were resolved.

Human Resources

1.13 The purpose of the human resources element of a system of quality control is to provide the firm with reasonable assurance that it has sufficient personnel with the capabilities, competence, and commitment to ethical principles necessary (a) to perform its engagements in accordance with professional standards and regulatory and legal requirements, and (b) to enable the firm to issue reports that are appropriate in the circumstances. Establishing and maintaining policies such as the following assist the firm in obtaining this assurance:

•     Recruit and hire personnel of integrity who possess the characteristics that enable them to perform competently.

•     Determine capabilities and competencies required for an engagement, especially for the engagement partner, based on the characteristics of the particular client, industry, and kind of service being performed. Specific competencies necessary for an engagement partner are discussed in paragraph .A27 of QC section 10.

•     Determine the capabilities and competencies possessed by personnel.

•     Assign the responsibility for each engagement to an engagement partner.

•     Assign personnel based on the knowledge, skills, and abilities required in the circumstances and the nature and extent of supervision needed.

•     Have personnel participate in general and industry-specific continuing professional education and professional development activities that enable them to accomplish assigned responsibilities and satisfy applicable continuing professional education requirements of the AICPA, state boards of accountancy, and other regulators.

•     Select for advancement only those individuals who have the qualifications necessary to fulfill the responsibilities they will be called on to assume.

Engagement Performance

1.14 The purpose of the engagement performance element of quality control is to provide the firm with reasonable assurance (a) that engagements are consistently performed in accordance with applicable professional standards and regulatory and legal requirements, and (b) that the firm or the engagement partner issues reports that are appropriate in the circumstances. Policies and procedures for engagement performance should address all phases of the design and execution of the engagement, including engagement performance, supervision responsibilities, and review responsibilities. Policies and procedures also should require that consultation takes place when appropriate. In addition, a policy should establish criteria against which all engagements are to be evaluated to determine whether an engagement quality control review should be performed.

1.15 Establishing and maintaining policies such as the following assist the firm in obtaining the assurance required relating to the engagement performance element of quality control:

•     Plan all engagements to meet professional, regulatory, and the firm’s requirements.

•     Perform work and issue reports and other communications that meet professional, regulatory, and the firm’s requirements.

•     Require that work performed by other team members be reviewed by qualified engagement team members, which may include the engagement partner, on a timely basis.

•     Require the engagement team to complete the assembly of final engagement files on a timely basis.

•     Establish procedures to maintain the confidentiality, safe custody, integrity, accessibility, and retrievability of engagement documentation.

•     Require the retention of engagement documentation for a period of time sufficient to meet the needs of the firm, professional standards, laws, and regulations.

•     Require that

—     consultation take place when appropriate (for example, when dealing with complex, unusual, unfamiliar, difficult, or contentious issues);

—     sufficient and appropriate resources be available to enable appropriate consultation to take place;

—     all the relevant facts known to the engagement team be provided to those consulted;

—     the nature, scope, and conclusions of such consultations be documented; and

—     the conclusions resulting from such consultations be implemented.

•     Require that

—     differences of opinion be dealt with and resolved;

—     conclusions reached are documented and implemented; and

—     the report not be released until the matter is resolved.

•     Require that

—     all engagements be evaluated against the criteria for determining whether an engagement quality control review should be performed;

—     an engagement quality control review be performed for all engagements that meet the criteria; and

—     the review be completed before the report is released.

•     Establish procedures addressing the nature, timing, extent, and documentation of the engagement quality control review.

•     Establish criteria for the eligibility of engagement quality control reviewers.

Monitoring

1.16 The purpose of the monitoring element of a system of quality control is to provide the firm and its engagement partners with reasonable assurance that the policies and procedures related to the system of quality control are relevant, adequate, operating effectively, and complied with in practice. Monitoring involves an ongoing consideration and evaluation of the appropriateness of the design, the effectiveness of the operation of a firm’s quality control system, and a firm’s compliance with its quality control policies and procedures. The purpose of monitoring compliance with quality control policies and procedures is to provide an evaluation of the following:

•     Adherence to professional standards and regulatory and legal requirements

•     Whether the quality control system has been appropriately designed and effectively implemented

•     Whether the firm’s quality control policies and procedures have been operating effectively so that reports issued by the firm are appropriate in the circumstances

1.17 Establishing and maintaining policies such as the following assist the firm in obtaining the assurance required relating to the monitoring element of quality control:

•     Assign responsibility for the monitoring process to a partner or partners or other persons with sufficient and appropriate experience and authority in the firm to assume that responsibility.

•     Assign performance of the monitoring process to competent individuals.

•     Require the performance of monitoring procedures that are sufficiently comprehensive to enable the firm to assess compliance with all applicable professional standards and the firm’s quality control policies and procedures. Monitoring procedures consist of the following:

—     Review of selected administrative and personnel records pertaining to the quality control elements.

—     Review of engagement documentation, reports, and clients' financial statements.

—     Summarization of the findings from the monitoring procedures, at least annually, and consideration of the systemic causes of findings that indicate that improvements are needed.

—     Determination of any corrective actions to be taken or improvements to be made with respect to the specific engagements reviewed or the firm's quality control policies and procedures.

—     Communication of the identified findings to appropriate firm management personnel.

—     Consideration of findings by appropriate firm management personnel who should also determine that any actions necessary, including necessary modifications to the quality control system, are taken on a timely basis.

—     Assessment of

•     the appropriateness of the firm’s guidance materials and any practice aids;

•     new developments in professional standards and regulatory and legal requirements and how they are reflected in the firm’s policies and procedures where appropriate;

•     compliance with policies and procedures on independence;

•     the effectiveness of continuing professional development, including training;

•     decisions related to acceptance and continuance of client relationships and specific engagements; and

•     firm personnel’s understanding of the firm’s quality control policies and procedures and implementation thereof.

•     Communicate at least annually, to relevant engagement partners and other appropriate personnel, deficiencies noted as a result of the monitoring process and recommendations for appropriate remedial action.

•     Communicate the results of the monitoring of its quality control system process to relevant firm personnel at least annually.

•     Establish procedures designed to provide the firm with reasonable assurance that it deals appropriately with the following:

—     Complaints and allegations that the work performed by the firm fails to comply with professional standards and regulatory and legal requirements.

—     Allegations of noncompliance with the firm’s system of quality control.

—     Deficiencies in the design or operation of the firm’s quality control policies and procedures, or noncompliance with the firm’s system of quality control by an individual or individuals, as identified during the investigations into complaints and allegations.

This includes establishing clearly defined channels for firm personnel to raise any concerns in a manner that enables them to come forward without fear of reprisal and documenting complaints and allegations and the responses to them.

•     Require appropriate documentation to provide evidence of the operation of each element of its system of quality control. The form and content of documentation evidencing the operation of each of the elements of the system of quality control is a matter of judgment and depends on a number of factors, including the following, for example:

—     The size of the firm and the number of offices.

—     The nature and complexity of the firm’s practice and organization.

•     Require retention of documentation providing evidence of the operation of the system of quality control for a period of time sufficient to permit those performing monitoring procedures and peer review to evaluate the firm’s compliance with its system of quality control, or for a longer period if required by law or regulation.

1.18 Some of the monitoring procedures discussed in the previous list may be accomplished through the performance of the following:

•     Engagement quality control review

•     Review of engagement documentation, reports, and clients’ financial statements for selected engagements after the report release date

•     Inspection⁴ procedures

Documentation of Quality Control Policies and Procedures

1.19 The firm should document each element of its system of quality control. The extent of the documentation will depend on the size, structure, and nature of the firm’s practice. Documentation may be as simple as a checklist of the firm’s policies and procedures or as extensive as practice manuals.