News & Insights

NEW REQUIREMENT: Annual Practice Questionnaire for Peer Review

During the week of June 1, 2026, the AICPA will launch a new questionnaire for all enrolled A&A firms (initial notifications will be sent over a one-week period, so if you do not see your notification right away, there is no need for concern). It will be short and simple, where you can tell the AICPA the emerging areas you may be performing in or considering, including engagement types and industries, so they can enhance quality and deliver resources that help your firm perform and thrive. The questionnaire will take fewer than 10 minutes to complete, so your daily schedule shouldn’t be interrupted.

The questionnaire is required, so all firms must complete it. For more information, see the AICPA’s FAQ or check out the My Resources tab after logging in to PRIMA. Please keep an eye out for future AICPA communications, including Facebook and LinkedIn posts, and more!

What Type of Peer Review do You Need?

We all agree the changing dynamics of business and regulatory environments has brought us to uncharted territories, including the need for new services for our clients. A common question CPA firms ask AICPA Peer Review staff is what happens if a firm is engaged to perform an audit after its engagement review has been completed. If your firm normally performs engagements that would require an engagement review and your firm performs an engagement that would require it to have a system review, such as an audit or an examination engagement under the Statements on Standards for Attestation Engagements (SSAEs), you should contact your administering entity as soon as possible to understand when your next Peer Review would be due. You might be required to have a ‘step-up’ review outside of your normal three-year cycle which includes a review of your firm’s system of quality management.

See Peer Reviews: System Review vs. Engagement Review for a resource on what type of Peer Review your firm should undergo based on the types of engagements your firm performs.

Refer to Are You Ready for Your Peer Review? for further information. The first webcast will be held on May 21!

Are You Looking to Become a Peer Reviewer?

Now is the perfect time to become a peer reviewer. With approximately 15,000 firms participating in the AICPA Peer Review Program, the demand for your skills in this key area has never been higher!

To initially qualify as a team captain on a system review or as a review captain on an engagement review, you must (in this order):

• Complete the online peer reviewer curriculum “Becoming an AICPA Peer Review Team or Review Captain.” This online peer reviewer curriculum is a series of self-study on-demand modules. While the modules must be taken sequentially, they do not all have to be taken in one sitting.
• Complete the “Becoming an AICPA Peer Review Team or Review Captain: Case Study Application.” These three-day series of live webcasts feature realistic case studies that encompass the most important elements of a system review, as well as several case studies pertaining to an engagement review.

Join the peer review community today and gain valuable knowledge, expertise, and exposure, while enhancing the quality of accounting and auditing services, upholding the integrity of our profession, and protecting the public interest!

Quality Management Standards

Now that we are past the date of implementation of the Quality Management Standards, firms’ focus should be shifting to maintaining and improving their systems of quality management. SQMS No. 1 requires firms to actively monitor their system and remediate identified deficiencies to continuously improve their system. Also on the horizon, the practitioner ultimately responsible for the system is required to evaluate the firm’s system of quality management, concluding whether it provides the firm with reasonable assurance that the objectives of the system of quality management are being achieved. This evaluation is required annually and within one year of implementation.

The AICPA has developed several resources to assist firms in each step of this journey. The quality management area of its website contains resources addressing both pre- and post-implementation requirements.

Additionally, the AICPA has developed a new suite of webcasts focusing on the post-implementation period. These expert-led webcasts will be broadcast throughout 2026. A webcast on QM peer review readiness will be announced in Q2.

• Quality Management: My System is Set Up – Now What?
• Quality Management: Performing a Root Cause Analysis
• Quality Management: Engagement Quality Reviews

GAO Publishes Q&A on Quality Management

Since the U.S. Government Accountability Office (GAO) issued its highly anticipated 2024 revision of Government Auditing Standards, also referred to as generally accepted government auditing standards (GAGAS) or the Yellow Book, auditors and audit organizations that use the Yellow Book have requested additional guidance about establishing and maintaining a system of quality management. In December 2025, the GAO released Frequently Asked Questions: Establishing and Maintaining a System of Quality Management to answer these frequently asked questions.

This guidance is intended to help an audit organization in its deliberations about designing, implementing, and operating a system of quality management for engagements conducted in accordance with the Yellow Book. It contains three sections:

• Section I: The Quality Management Risk Assessment Process
• Section II: The Quality Management Monitoring and Remediation Process
• Section III: Engagement Quality Reviews

This practice aid is considered GAGAS interpretive guidance in accordance with paragraph 2.06 of the Yellow Book which states: “Auditors should consider applicable GAO issued GAGAS interpretive guidance in conducting and reporting on GAGAS engagements.”

AICPA’s Enhancing Audit Quality Initiative Update

The AICPA’s Enhancing Audit Quality Initiative continues to work to provide practitioners additional information, resources, and discussions on its Areas of Focus. From resources to articles, webcasts to conferences and State Society presentations, the AICPA is committed to continuing to provide support for these areas as the year begins.

The 2026 Areas of Focus, identified through its data-driven process and collaboration with senior committees, include risk assessment, quality management, technology-enabled auditing, single audits, and emerging attestation engagements.

The 2025 Enhancing Audit Quality Highlights Report is now available to download. The 2025 areas of focus reflect both persistent challenges and evolving risks observed in practice monitoring activities and through engagement with practitioners. Download the report to read about the AICPA’s progress.

More information is available on the EAQ website, including links to each of the focus areas, related accounting, auditing, and assurance resources, and previous annual highlights reports.

Recent AICPA Reviewer Alert Article on Single Audits

Peer reviewers have been asking with increasing frequency how to handle single audit engagements where the Uniform Guidance report was issued before the final 2025 OMB Compliance Supplement was released. The February 2026 Reviewer Alert addresses those situations and provides potential implications, peer review perspectives, and other resources that may assist you in your upcoming peer review.

GAQC Resources and Tools for Auditors

The AICPA Governmental Audit Quality Center (GAQC) has developed resources that can assist you in performing engagements under Government Auditing Standards and single audits. As a public service, the GAQC periodically leaves certain resources open to the public. These resources include, but are not limited to:

• OMB Compliance Supplement Resource Center
• GAQC Alerts
• Single Audit Resources
• Governmental Illustrative Auditor’s Reports

We encourage you to regularly check the GAQC Resources page for any new resources and share with your clients, where appropriate, to enhance audit quality within the profession.

Not-for-Profit Illustrative Auditor’s Report

Designed to support auditors working with nonprofit organizations, the Not-for-Profit Illustrative Auditor’s Report provides a practical example of an independent auditor’s report tailored to common not-for-profit financial statement engagements. This downloadable resource is intended to assist practitioners by illustrating reporting considerations and presentation in a clear, nonprofit-focused context, helping auditors align their reports with professional standards while addressing issues unique to the NFP sector. It serves as a helpful reference when drafting or reviewing audit reports for not-for-profit financial statements.

SOC reports have become a widely recognized signal of trust for service organizations that handle customer data. As the growing market of SOC technology vendors promises faster and cheaper reports, some SOC examiners warn that emphasizing speed can encourage shortcuts, reduce professional skepticism, and ultimately undermine confidence in the reports themselves.

While software platforms can now help collect evidence and manage workflows, some vendor marketing – dominated by claims of “compliance” in days or even hours – can set unrealistic expectations and shift the market toward commoditized, high-volume reporting.

In these cases, firms may be placing excessive reliance on these tools and failing to comply with applicable professional standards and peer reviewers will be looking for SOC 2® engagements that may not be tailored to their clients, responsive to associated risks, or supported by sufficient appropriate evidence.

Check out this Journal of Accountancy article to learn more about these SOC report challenges.

Engagement Partner Involvement in SOC Engagements

Recent peer review feedback has highlighted instances where engagement partners were not sufficiently involved throughout the System and Organization Controls (SOC) engagement process. This lack of involvement raises concerns about meeting attestation and quality management standards. Ensuring that engagement partners fulfill their responsibilities from planning through report issuance, is critical for complying with standards, maintaining independence, and reducing risk or potential report issues.

SOC examinations are attestation engagements that provide report users with valuable information to assess and address risks associated with outsourcing services. Governed by the Statements on Standards for Attestation Engagements (SSAE), specifically AT-C sections 105, 205, and 320, these standards outline foundational requirements for SOC engagements, including the responsibilities of the practitioner (i.e., the CPA), quality management standards, and engagement performance. AT-C section 105, Concepts Common to All Attestation Engagements, discusses the engagement partner’s role in managing and achieving quality throughout the engagement:

.56 Prior to dating the practitioner’s report, the engagement partner should determine that the engagement partner has taken overall responsibility for managing and achieving quality on the attestation engagement. In doing so, the engagement partner should determine that

a. The engagement partner’s involvement has been sufficient and appropriate throughout the attestation engagement such that the engagement partner has the basis for determining that the significant judgments made and the conclusions reached are appropriate given the nature and circumstances of the engagement.

b. The nature and circumstances of the attestation engagement, any changes thereto, and the firm’s related policies or procedures have been taken into account in complying with the requirements of this section.

This means engagement partners should be actively participating in all phases of the engagement, including planning and risk assessment, reviewing significant judgements and conclusions reached during fieldwork, and ensuring team members have the appropriate competencies and capabilities to perform the engagement in accordance with professional standards.

Additionally, the engagement partner should have sufficient knowledge and subject matter expertise to take responsibility for the conclusions reached during the engagement (AT-C section 105, paragraph .40). Engagement quality control reviewers cannot assume this responsibility or sign the report as they serve as independent reviewers, not engagement partners. QM section 10A, A Firm’s System of Quality Control, sets forth the requirements for Engagement Quality Control Reviews.

QM section 10A paragraph .43 The Firm should establish policies and procedures designed to maintain the objectivity of the engagement quality control reviewer. Such policies and procedures should provide that although the engagement quality control reviewer is not a member of the engagement team, the engagement quality control reviewer should satisfy the independence requirements relating to the engagements reviewed. Accordingly, such policies and procedures should provide that the engagement quality control reviewer:

a. When applicable, is not selected by the engagement partner.

b. Does not otherwise participate in the performance of the engagement during the period of review.

c. Does not make decisions for the engagement team.

Engagement partner involvement isn’t optional – it’s essential. Properly documenting the engagement partner’s involvement at every stage from planning to report issuance is key to ensuring that professional standards are being met. By prioritizing accountability and expertise, firms can continue to uphold professional standards and deliver reliable SOC reports.

For authoritative guidance and additional SOC resources, please refer to:

• AICPA Attestation Standards: https://www.aicpa-cima.com/resources/download/aicpa-ssaes-currently-effective
• AICPA Ethics Library including the Code of Professional Conduct: https://pub.aicpa.org/codeofconduct/Ethics.aspx
• AICPA SQMS – currently effective: https://www.aicpa-cima.com/resources/download/aicpa-sqmss-currently-effective
• SOC Suite of Services: https://www.aicpa-cima.com/resources/landing/system-and-organization-controls-soc-suite-of-services

A&A Focus Broadcast Series Continues

The AICPA’s monthly, live A&A Focus broadcast continues to be a valuable resource for the latest information for your A&A practice and provides AICPA members up to 12 free CPE hours, annually.

Each month, AICPA staff and esteemed guest speakers highlight news and topics critical to accounting, auditing, and assurance practitioners. This is a great way to spend an hour getting the latest updates and discussion of areas of concern. The broadcast highlights member-only resources, and a monthly newsletter following the event provides additional curated information, analysis, and resources.

Topics range from broad accounting and auditing topics to narrow dives into topics such as revenue recognition, digital assets, not-for-profit areas, risk assessment, and quality management. Visit aicpa-cima.com/AAFocus for more information, to register, and gain access to non-CPE replays of past events and highlighted resources.

Attendance is free for AICPA members, and you only have to register for one event. Your single registration will grant you access to all events in the ongoing series.

Upcoming events:

• June 3, 2026
• July 8, 2026
• August 5, 2026
• September 2, 2026
• October 7, 2026

All events begin at 1pm ET.

Have You Heard About Ethics Staff Insights?

It’s a new nonauthoritative article series from AICPA Professional Ethics Division staff that provides clear, real-world guidance to help members apply the AICPA Code of Professional Conduct in emerging or tricky situations. The articles highlight key ethical issues, potential risks and threats and helpful safeguards.

Find Ethics Staff Insights on the landing page of the AICPA Online Ethics Library:

• AI through an ethics lens
• Business arrangements with SOC tool providers

While you’re there, check out other helpful content such as the Ethics Q&As and the Plain English Guide to Independence.

Act Now: Comment on PEEC’s Proposed Update to the “Attest Engagement Team” Definition

PEEC has issued a targeted ethics exposure draft to clarify the definition of “attest engagement team” in the Code of Professional Conduct. The goal is to achieve better consistency with other AICPA standards — without altering independence requirements.

The proposed definition excludes internal auditors, external specialists, referred-to auditors/practitioners, and routine clerical support, while still including the firm’s own team members and quality reviewers.

Comment deadline is June 1 — Review the draft and submit your comments today.