If your firm performs audits or other engagements, your old quality-control playbook is officially retired. SQMS is what replaced it.
The profession rebuilt how firms manage quality, and the deadline has already passed. Firms must build and run a new quality management system, and the deadline has already passed. This is not a tweak to the old rules. It is a different way of thinking about quality standards, and it reaches far more firms than just the big ones.
This guide breaks down what the standard is, what changed, and what your firm needs to have in place.
SQMS stands for Statement on Quality Management Standards, issued by the AICPA.
The headline document is SQMS No. 1, "A Firm's System of Quality Management." It lays out how a firm designs, implements, and operates that system over its accounting and auditing practice. The Auditing Standards Board and the Accounting and Review Services Committee issued the new standards together, so they reach reviews, compilations, and attestation work. In short, it is the new rulebook for how your firm proves its work is done right.
The name changed for a reason, and that reason is the whole point.
For decades, firms followed control standards. The new guidance replaces that regime entirely.
The new standard supersedes the Statements on Quality Control Standards, the old SQCS rules most practitioners grew up on. The move from "control" to "management" is more than a word swap. The old control model was a set of rules you wrote once and left on a shelf. The new quality management standard asks you to actively run a living system, spot the risks specific to your firm, and respond to them, the kind of rigor that already shapes strong audit quality.
Control was static. Management is ongoing, and that difference shapes everything else.
At the heart of it sits a simple three-step engine.
First, you establish quality objectives, the outcomes your system needs to achieve. Second, you identify and assess quality risks, the things that could stop you from reaching those objectives. Third, you design and implement responses to those quality risks. This risk-based approach is what makes the rules bend to each firm: a two-partner shop and a 200-person practice face different risks, so they build different responses. The standard setters stopped handing out one-size-fits-all rules.
Objectives, risks, responses. Everything in your quality management system hangs off those three words.
The standard sorts the whole thing into eight connected components.
They are governance and leadership, the firm's risk assessment process, relevant ethical requirements, acceptance and continuance of clients, engagement performance, resources, information and communication, and a monitoring and remediation process. Each component gets its own objectives and its own assessed risks. The pieces are not silos: leadership feeds resources, resources feed engagement performance, and monitoring loops back to fix what is not working. Together they form the entire system your firm operates.
Eight parts, one system, all pointed at the same goal of consistent quality.
The first statement is the foundation, but it does not travel alone.
The second statement covers engagement quality reviews, the independent look at certain jobs before the report goes out. Alongside it sits SAS 146, which handles quality at the individual job level, plus a parallel standard for accounting and review services. The first statement builds the firm-wide system, while the others handle quality on specific engagements. Think of the firm-wide standard as the whole machine and that review as a check on one moving part.
One firm-level system, supported by standards that reach down into each engagement.
This is the part that surprises smaller practices: it reaches well beyond the big firms.
Any firm performing engagements under AICPA professional standards needs one. That sweeps in firms doing audit, review, and compilation work, whether you carry two hundred staff or two. If your firm issues a single audit report or a review, you are in scope, much like the judgment-heavy audit work smaller firms already navigate. The size of your system scales to the size and complexity of your practice, but the requirement itself does not bend.
Small firm or large, if you sign reports under those rules, they apply to you.
The calendar on this one matters, so write it down.
Firms were required to have their quality management system designed and implemented by December 15, 2025. That deadline has passed, which means compliance is no longer optional, it is the baseline now. A second deadline trips people up: the firm has to evaluate that system within one year after it takes effect. So designing the system was step one, and proving it works is the step many firms are working through right now.
Designed by the deadline, evaluated within the year after. Both dates count.
A QM system is only as strong as the work behind it.
Building one means documenting your quality objectives, mapping your risks, writing the policies and procedures that respond to them, and standing up monitoring that proves ongoing compliance and catches problems early. For a lean firm, that is a heavy lift on top of busy season, and it is exactly where an offshore partner earns its keep. At Madras Accountancy, we support US firms with the audit and assurance work and quality processes that sit underneath the new standard, from workpaper standards to monitoring support, the same disciplined quality processes we bring to every engagement. If this is still sitting on your to-do list, reach out.
What does SQMS stand for? It is the AICPA framework that governs how a firm runs quality across reviews and other work.
What is SQMS No. 1? SQMS No. 1, "A Firm's System of Quality Management," is the core standard issued by the AICPA. It requires a firm to design, run, and operate a risk-based quality management system over its accounting and auditing practice.
When did the standard take effect? Firms had to put their system in place by the December 2025 deadline. They must then evaluate it within one year after that date, so the work continues into 2026.
What is the difference between quality control and quality management? It was a static checklist of rules. Quality management is an active, risk-based system: you set quality objectives, assess your quality risks, and design responses, then monitor whether they work.
Who has to comply? Any CPA firm that performs engagements under AICPA professional standards, including reviews, compilations, and attestation work. It applies whether the firm is large or a sole practitioner, scaled to its size and complexity.
What are the components of a system of quality management? It sets out eight: governance and leadership, the risk assessment process, ethical requirements, acceptance and continuance, engagement performance, resources, information and communication, and monitoring and remediation.
What is the difference between SQMS 1 and SQMS 2? SQMS No. 1 covers the firm-wide system. The companion standard covers engagement-level reviews of certain jobs before the report is issued.
How does a firm put the standard in place? You set quality objectives, identify and assess your risks, then build responses through documented procedures and monitoring. Many firms lean on outside support to build and document the system.
Single-entry vs double-entry bookkeeping made simple: how each accounting system works, the key differences, and which one your small business needs.
%2075-100%20(12).png)
CPA vs EA (enrolled agent) vs tax attorney: how each tax professional differs, who can represent you to the IRS, and which fits your tax needs.
%2075-100%20(9).png)
Learn how tax professionals should respond to a data breach, report theft to the IRS and states, notify clients, meet FTC rules, and prevent future attacks.
