SQMS 1 and QC 1000: Practical Tips on Meeting the New Firm Quality Assurance Standards 

The U.S. audit profession is entering a new era of quality assurance. Two standards—SQMS 1 from the AICPA and QC 1000 from the PCAOB—are reshaping how accounting firms must manage quality. These frameworks require firms to take a risk-based, firm-specific approach to quality management that goes beyond the traditional checklist model. 

In a recent webinar, Rohit Kundu, Sales Director at Caseware, and Brian Yujuico, Vice President at CPAClub, offered practical implementation tips on how firms can approach compliance for the new standards and the tools and expertise that can reduce the burden. 

Understanding the standards: Same mission, different names 

One of the first challenges firms face is understanding the regulations. SQMS 1 and QC 1000 are two different standards, issued by different governing bodies, CPAClub’s Yujuico noted, but they share a common purpose: to ensure a firm’s system of quality management is effective, adaptable and provides reasonable assurance that the firm and its personnel comply with relevant standards and regulations. 

“Even though the standards are from different governing bodies, they have many similarities” he said. “However, the objective of both is to design, implement and operate an effective system of quality management or control.” 

The emphasis on reasonable assurance is key. It’s a concept familiar to auditors, but the two new standards apply it at the firm level, requiring firms to demonstrate their quality systems are robust enough to consistently meet professional and regulatory obligations. 

Risk assessment and response 

At the heart of both SQMS 1 and QC 1000 is a structured, four-step approach to managing quality through risk assessment. Firms must: 

1. Establish quality objectives – the desired outcomes tied to key components like governance, ethics and engagement performance. 

2. Identify and assess quality risks – what could prevent the firm from achieving those objectives. 

3. Design and implement responses – policies and procedures that mitigate those risks. 

4. Modify as needed – ensuring the system evolves over time with changes in the firm and regulatory landscape. 

This is not a one-time setup, Yujuico explained. It’s an iterative, ongoing process that demands strategic thinking, firm-specific customization and regular evaluation. 

These standards force firms to think deeply about their internal controls and how they align with the realities of their practice, size, services, and people. 

Examples of how the standards work 

To illustrate the practical application of the standards, Yujuico ran through several examples for SQMS 1 and QC 1000. The standards have eight components, and within each component the standards specify certain quality objectives. Here are two that stood out: 

1. Component: Governance and Leadership 

• Quality Objective: Leadership demonstrates a commitment to quality through its actions and behaviors. 

• Quality Risk: Professionals in leadership positions prioritize economic gain over quality through their actions and behaviors. “This could be read as leadership wanting to bring in revenue over everything else,” Yujuico explained. “Even if it means possibly overworking staff, which may lead to lower quality.” 

• Response to Quality Risk: Policies are in place to prohibit placing economic gain over quality. Leadership is evaluated annually, and standardized evaluations prioritize quality over financial and operational metrics. 

2. Component: Acceptance and Continuance of Client Engagements 

• Quality Objective: The financial and operational priorities of the firm do not lead to inappropriate judgments about whether to accept or continue a client relationship or specific engagement. 

• Quality Risk: An Engagement Partner makes inappropriate judgments about whether to accept or continue a client relationship or specific engagement based on financial and operational priorities. 

• Response to Quality Risk: Policies are in place to prohibit a firm from accepting or continuing a client relationship based on inappropriate financial and operational priorities. A newly developed standardized acceptance and continuance form is now completed, and all engagements requiring an Engagement Quality Reviewer (EQR) must also have EQR sign-off on the form prior to commencement of the engagement. 

“In this example, this firm felt the need to develop a new standardized acceptance and continuance form… and take it a step further,” Yujuico said. “They wanted additional approval by an EQR.” 

The cost of manual compliance 

A critical takeaway from the webinar was the cost, both in time and money, of attempting to implement SQMS 1 and QC 1000 manually. 

“In some cases, we’ve estimated at the high-end 500+ hours,” Yujuico said. “And this isn’t something you can hand off to the intern or new staff. It really needs to be someone at the partner, director, maybe to a lesser extent, the manager level.” This means pulling people away from client-facing, revenue-generating work. 

That opportunity cost adds up quickly. Trying to build out a firm-wide quality system in spreadsheets or Word documents can become overwhelming, especially when you factor in reviews, approvals and version control. 

“Time is money,” Kundu said. “You’re meeting your compliance, but those are non-billable hours you’re stacking up.” 

Resources and technology 

The good news? There’s plenty of support available, Yujuico noted. 

The AICPA and PCAOB have both published detailed practice aids, templates, and checklists. CPAClub offers a free downloadable implementation guide with real-world examples and planning tools tailored to firms of all sizes. 

But many firms are turning to technology to get ahead of the complexity. Caseware SQM is a cloud-based platform that automates large parts of the process with: 

• Rich library of quality objectives and sample risks  

• Built-in workflows for risk assessment and response 

• Monitoring and remediation tools 

• Support for both SQMS 1 and QC 1000 

“We’ve already read the 700+ pages of the standard for you,” Kundu said. “It’s all built in. It’s very intuitive, cloud-based technology. You just tailor it to your firm’s profile and the system does the heavy lifting.” 

The clock is ticking 

The window for implementing the new quality management standards is rapidly closing. The deadline for designing, implementing and operating a system of quality management for SQMS 1 and QC 1000 is December 15, 2025. Many firms have already completed their transition and those still in progress are now racing against the clock.  

Drawing on lessons learned from firms already down the implementation path, Yujuico shared practical guidance to help others avoid missteps and accelerate their progress: 

• Plan in phases: Don’t try to do it all at once. Tackle one component (e.g., ethics, leadership, engagement performance) at a time. 

• Make it usable: Ensure policies and procedures are practical for staff in the field, not buried in a dense 700-page manual. 

• Don’t hesitate to bring in help: Whether through a consultant or co-sourcing arrangement, having experienced support can save significant time and stress. 

Looking ahead: A smarter path to compliance 

SQMS 1 and QC 1000 aren’t just about checking a box. They represent a broader opportunity to enhance your firm’s quality culture, reduce risk and improve the consistency of audit engagements. 

With the right combination of guidance, tools, and technology, firms can not only meet these new standards but also build a stronger, more resilient practice. 

“These standards present challenges,” Yujuico said. “But they can also provide a valuable opportunity to enhance your firm’s quality management processes and engagements.” 

To learn more about how you can prepare for the new quality assurance standards, book a demo today.