Engagement Acceptance & Quality Management

Why this topic matters

Before any audit begins, the firm must decide whether to accept the client, agree the terms of the engagement in writing, and operate within its system of quality management. Auditing and Attestation (AUD) Area I tests these steps, and the 2026 blueprint updated its references to the new quality management standards — the Statements on Quality Management Standards (SQMS) Nos. 1 and 2 and Statement on Auditing Standards (SAS) No. 146 — effective December 15, 2025. For public company audits, the Public Company Accounting Oversight Board (PCAOB) quality control (QC) standard QC 1000 follows on January 1, 2027 (see below).

Quality management at the firm level — SQMS No. 1

SQMS No. 1 replaced the old quality control standards with a risk-based approach: the firm sets quality objectives, identifies and assesses quality risks, and designs responses. It has eight components:

Component	What it covers
Firm's risk assessment process	Setting quality objectives, identifying and assessing quality risks, designing responses
Governance and leadership	Tone at the top; ultimate responsibility with the firm's leadership
Relevant ethical requirements	Independence and other ethics requirements across the firm and network
Acceptance and continuance	Judgments about the client's integrity and the firm's ability to perform
Engagement performance	Direction, supervision, review, consultation, differences of opinion, engagement quality reviews
Resources	Human, technological, and intellectual resources, and service providers
Information and communication	Capturing and sharing information needed for the system to work
Monitoring and remediation process	Evaluating the system, finding deficiencies and their root causes, and fixing them

The firm's leadership must evaluate the system at least annually and conclude whether it provides reasonable assurance that its objectives are being achieved. Peer review is an external practice-monitoring program — not a component of the firm's system.

Engagement quality reviews — SQMS No. 2

• An engagement quality (EQ) review is required for audits of certain entities (when required by law or regulation) and for engagements the firm determines need one as a response to quality risks.
• The reviewer must be competent and objective and cannot be a member of the engagement team. A former engagement partner must observe a cooling-off period of two years before becoming the reviewer for that engagement.
• The review is performed at appropriate points during the engagement, and the report cannot be released until the reviewer notifies the engagement partner that the review is complete.

Quality management at the engagement level — SAS No. 146

The engagement partner takes overall responsibility for managing and achieving quality on the audit, including sufficient and appropriate involvement throughout, direction and supervision, and review of documentation — even when tasks are assigned to others.

Public company audits — PCAOB QC 1000

For audits of issuers (public companies) and broker-dealers registered with the Securities and Exchange Commission (SEC), the PCAOB adopted a new quality control standard, QC 1000, A Firm's System of Quality Control. It takes effect on December 15, 2026, and becomes eligible for testing on AUD from January 1, 2027.

QC 1000 uses the same risk-based approach and the same eight components as SQMS No. 1: the firm sets quality objectives, identifies and assesses quality risks, and designs quality responses. The main differences are in how the system is overseen and reported:

Feature	SQMS No. 1 (American Institute of Certified Public Accountants (AICPA) — nonissuers)	QC 1000 (PCAOB — issuers and broker-dealers)
Who is responsible	The firm's leadership has ultimate responsibility	The firm's principal executive officer has ultimate responsibility and accountability; named individuals hold operational responsibility for the system, for ethics and independence, and for monitoring and remediation
Annual evaluation	At least annually, on a date the firm chooses	Evaluated as of September 30 each year and reported to the PCAOB on Form QC by November 30, certified by the principal executive officer and the individual with operational responsibility for the system
Possible conclusions	The system provides reasonable assurance, or it does not	Reasonable assurance; reasonable assurance except for unremediated deficiencies that are not major; or no reasonable assurance (when an unremediated major QC deficiency exists)
Largest firms	No extra governance requirement	Firms that issued audit reports for more than 100 issuers in the prior year must have an external quality control function — at least one person independent of the firm, adding outside judgment to its oversight of quality

Like SQMS No. 1, QC 1000 requires monitoring at both the engagement and firm level, root cause analysis of deficiencies, and timely remediation. On September 9, 2026, the PCAOB adopted amendments to QC 1000 that still need SEC approval; under the AICPA's announcement, those amendments become testable in the first calendar quarter beginning six months after the SEC approves them.

Accepting and continuing clients

The firm considers:

• The integrity of management and those charged with governance.
• Whether the firm is competent and has the time and resources to perform the engagement.
• Whether the firm can comply with independence and other ethical requirements.
• Significant matters from the current or prior engagement.

Communicating with the predecessor auditor

Before acceptance (required)	After acceptance (recommended)
The successor initiates communication, after the prospective client gives permission for the predecessor to respond fully	Review the predecessor's audit documentation to help with opening balances and consistency
Inquire about: management integrity; disagreements with management about accounting or auditing; communications to those charged with governance about fraud, noncompliance, and internal control deficiencies; the predecessor's understanding of the reasons for the change	The predecessor may request a consent-and-acknowledgment letter from the client and a letter from the successor restricting use of the documentation

If the client refuses permission for the predecessor to respond, the successor should consider the implications — usually the engagement should be declined. If the predecessor gives a limited response, it must say so.

Preconditions for an audit

Before accepting, the auditor must determine that:

1. The financial reporting framework management uses is acceptable (for example, US Generally Accepted Accounting Principles (GAAP), International Financial Reporting Standards (IFRS), or a special purpose framework such as the tax basis).
2. Management acknowledges and understands its responsibility for:
   • preparing and fairly presenting the financial statements;
   • designing, implementing, and maintaining internal control relevant to their preparation;
   • providing the auditor with access to all relevant information, additional information requested, and unrestricted access to people within the entity.

If management imposes a scope limitation before acceptance that would lead to a disclaimer of opinion, the auditor should not accept the engagement (unless required by law).

The engagement letter

Agreed terms must be documented in writing — normally an engagement letter — and include:

• The objective and scope of the audit.
• The responsibilities of the auditor and of management.
• A statement that, because of inherent limitations, there is an unavoidable risk that some material misstatements may not be detected.
• The applicable financial reporting framework.
• The expected form and content of reports, and a statement that the report may differ from the expected form.

Optional items include fees and billing, arrangements with component auditors or specialists, and any restriction of the auditor's liability. Recurring audits may not need a new letter each year, but the auditor should assess whether terms need revising.

Changing the engagement

A client may ask to change an audit to a review or compilation before completion. Reasonable justification includes a change in circumstances affecting the need for the service or a misunderstanding about the service originally requested. A request driven by scope restrictions imposed by management, or by information that would lead to a modified report, is generally not reasonable. If the auditor agrees to change, the new report should not mention the original engagement or the procedures performed.

Opening balances in an initial audit

The auditor must obtain sufficient appropriate evidence that opening balances contain no material misstatements affecting the current period — for example, by reviewing the predecessor's documentation, testing current-period transactions, or performing specific procedures. If this is impossible, the auditor considers a qualified opinion or disclaimer.

How it is tested

• Identify the required contents of an engagement letter and the preconditions for an audit.
• Apply the successor–predecessor communication rules.
• Recognize SQMS No. 1 components and engagement quality review requirements.
• From January 1, 2027: distinguish QC 1000 (PCAOB, public company audits) from SQMS No. 1 — the annual evaluation reported on Form QC and the extra requirements for the largest firms.
• Decide whether a request to change the engagement is reasonable.