Johnson Global partners with leadership of public accounting firms, driving change to achieve the highest level of audit quality. Led by former PCAOB staff, JGA professionals are passionate and practical in their support to firms in their audit quality journey. We accelerate the opportunities to improve quality through policies, practices, and controls throughout the firm. This innovative approach harnesses technology to transform audit quality. Our team is designed to maintain a close pulse on regulatory environments around the world and incorporates solutions which navigates those standards. JGA is committed to helping the profession in amplifying quality worldwide.
In September 2022, we wrote an article discussing the struggle that firms were experiencing at that time in remediating Quality Control (QC) criticisms as it relates to their Engagement Quality Review (EQR) process. This struggle seemingly continues today, as, so far in 2025, the PCAOB has publicly re-released previously issued inspection reports for 32 registered firms, and in 19 of those reports, EQR was a QC criticism that was released to the public as these firms had failed to satisfactorily remediate their EQR QC criticism¹. This means that firms continue to struggle to identify and effectively implement remedial actions to the satisfaction of the PCAOB that demonstrate that they have successfully remediated their non-compliance with AS 1220, Engagement Quality Review . So why are firms still failing to remediate this QC criticism? As we stated previously, having worked with engagement teams and looking at the nuanced and sometimes detailed nature of some of the PCAOB Part I findings, attributing the audit issue to a deficient EQR review can sometimes feel like the regulator is being overly exigent. In fact, in its adopting release to the EQR standard , the Board stated that it “…has been sensitive to commenters' concerns and agrees that the EQR should not become, in effect, a second audit.” This is a difficult concept for EQRs to balance though, as engagement teams often ask us, “As EQR am I required to review every test of design and operating effectiveness for internal controls related to every significant risk? Which substantive workpapers in significant risk audit areas should I review and to what level of detail?” Though not explicitly required in AS 1220, implicitly by the very nature of the EQR attribution, the PCAOB is inherently creating an expectation of a detailed EQR review. After all, AS 1220.09 does require the EQR to “review documentation.” When the PCAOB evaluates a firm’s Rule 4009 remediation response, they pay particular attention to recurring deficiencies. If the same deficiency is long-standing or occurs in subsequent reports, remediation efforts undertaken must be incremental in each remediation submission so as to address the recurring deficiency. Said otherwise, a firm cannot deliver the same training year after year and expect it to drive change; it must change its approach to remediate the recurring deficiencies. We have numerous clients telling us that this is the second or third inspection report that includes an EQR QC criticism. They often ask us, “This time, what can we do that is incremental that we haven’t already done?” Remediation Considerations The new quality control standards (QC 1000, ISQM 1 and SQMS1) require firms to perform root cause analyses for audit deficiencies. In doing so, firms should identify the real root cause behind why EQRs are failing to identify audit deficiencies and then design specific remedial actions to address these root causes. So, remedial action should be in response to the actual root cause of the EQR deficiency – i.e., what is the ultimate root cause of EQR’s not identifying the Part I deficiencies at the time of their review? The following are typical actions that we see firms undertake: a. Training as an Action For many firms, they start out the remedial process by providing training to audit professionals that specifically address the requirements of AS 1220. Some firms attempt this by sourcing online training from the marketplace. If this is the first time your firm has received a Part II EQR criticism, then this action might be effective. However, training designed to remediate quality control deficiencies must be specific to the facts and circumstances of your issue(s). Oftentimes though, when the EQR criticism is long-standing or repetitive, training alone is not sufficient. Key takeaway : Consider developing more robust training that specifically addresses nuances of firm findings and walk through examples of EQR reviews. b. EQR Sign-off Checklist as an Action Another common remedial action is for firms to make enhancements to their methodology, including their EQR sign-off checklist . Most firms subscribe to audit software programs already which have a basic EQR checklist that calls out the requirements under AS 1220. Modification to the EQR checklist and/or creation of addendums that specifically focus on the issues or concerns can be a meaningful improvement and can add rigor to the review process. Key takeaway : Firms should determine whether they need to modify their EQR sign-off checklist and/or create addendums to include specific bullets and questions addressing firm audit deficiencies, specifically calling it out to the EQR’s attention. c. EQR mentoring/coaching program as an Action Many firms have already implemented the previous two actions, and they may continue to see deficiencies in the QC criticism. The PCAOB is expecting firms to do more to ensure quality audits. As we have worked with firms on remediation, we recommend firms consider an EQR mentoring/coaching program . When designed and implemented properly – and timely – we believe this action to be important to a successful remediation of QC deficiencies around the EQR function. Key takeaway : Consider designing and implementing an EQR coaching or mentoring program, paying close attention to key elements important for effective remediation criteria. Other Considerations Given that global audit regulators have raised the bar in expectations on recurring findings – specifically on the EQR process – we cannot stress enough the importance of beginning the remediation process early . Engage the PCAOB in a dialogue immediately once your 12-month remediation period begins, to discuss the planned remedial actions and get feedback on the sufficiency of those actions. Pay particular attention to understanding what is considered timely implementation. Do not underestimate the amount of time it will take to fully implement remedial actions. Key takeaway : Engage the PCAOB early in the remediation process to seek feedback on the sufficiency of the remedial actions (perhaps even before the final report has been issued). EQR as last line of defense Another important point is that EQRs are essentially the last line of defense with regard to audit quality. Said differently, audit quality starts with the audit engagement team and the firm’s entire QC system (training, methodology, tools, etc.) that enables and supports audit engagement teams to perform quality audits. Firms must also consider the remedial actions that also address the PCAOB’s Part I audit deficiency(ies). The EQR QC criticism, while linked to its own standard, is really just the review of the audit work performed under all the other audit standards (e.g., AS 2501, AS 1301, etc.). It is a collective effort, and the EQR as well as the entire engagement team should be considered when remediating all QC criticisms identified in firm inspection reports. It may feel like a never-ending story and perhaps regulators are being overly rigorous, but the reality is this issue is not going away, so firms need to consider what incremental actions they can take to truly ensure EQRs perform quality reviews. ¹Part I of a PCAOB inspection report contains audit deficiencies; this part is made public when the report is initially published. Part II contains the firm’s QC criticism(s); and this part is not initially released to the public. The firm has one year from the date the report is published to remediate the QC criticism(s). If the remediation is satisfactory to the Board, then Part II is kept private. However, if the firm fails to satisfactorily remediate the QC criticism, the QC criticism in Part II is then released to the public. At Johnson Global Advisory , we support firms in selecting, implementing, and optimizing these tools to meet their unique needs. For more insights, visit our blog or contact us to learn how we can help your firm AmplifyQuality®.
With the effective date for SQMS 1 and QC 1000 fast approaching, firms of all sizes—especially small and sole practitioners—must take action to implement a system of quality management (SQM) that meets the new standards. The good news? You don’t have to start from scratch. Despite QC 1000’s implementation date deferral, the AICPA’s date hasn’t changed, and the international standards are already effective. It’s important to maintain momentum on the efforts toward implementation of all applicable standards for your firm. This article outlines 10 practical steps to help firms build their SQM. Each step includes actionable guidance and considerations for firms with limited resources, and ties into JGA’s broader thought leadership on quality management, risk assessment, and system evaluation. The 10 Steps to Build Your SQM Step 1: Establish a Project Team Form a team with the right mix of quality expertise and operational insight. For small firms, this may mean involving a manager who can grow into a leadership role or setting aside dedicated time as a sole practitioner. Recommended actions to consider: Identify internal champions with interest or experience in quality. Schedule recurring project meetings to maintain momentum. Join a peer group for support and shared learning. Step 2: Understanding and Awareness Document your firm’s business strategy, service offerings, and operational conditions. This step helps identify factors that may impact quality—such as remote work, new industries, or staff turnover. Recommended actions to consider: Conduct a strategy review with firm leadership. List recent changes in firm structure or engagement types. Use these insights to inform your risk assessment. Step 3: Assign Responsibilities Define who is accountable for the SQM. The new standards require clear delineation of ultimate and operational responsibility, including oversight of independence and monitoring. Recommended actions to consider: Assign roles based on existing responsibilities. Clarify delegation boundaries for managing partners. Document responsibilities in your quality manual. Step 4: Establish a Risk Assessment Function Design a process to identify and assess quality risks. This includes understanding conditions or events that could impact quality objectives. Recommended actions to consider: Create a risk assessment policy tailored to your firm. Use relatable examples to demystify risk factors. Leverage AICPA practice aids for structure and templates. Step 5: Perform the Initial Risk Assessment Conduct brainstorming sessions by component and document risks using the AICPA Risk Assessment Template. Include both formal and informal responses. Recommended actions to consider: Use the AICPA risk library to identify common risks. Tailor risks to your firm’s size and services. Include existing responses—even if informal—for evaluation. Step 6: Finalize the Gap Analysis Evaluate where your current responses fall short. This may include undocumented policies or areas where responses don’t fully address the risk. Recommended actions to consider: Identify gaps in governance, ethics, and technology. Determine which informal practices need formalization. Prioritize gaps based on risk severity and regulatory impact. Step 7: Implement Responses to Address the Gaps Develop policies and procedures to close gaps. Responses must be documented and operational. Recommended actions to consider: Draft policies that reflect your firm’s values and risks. Link procedures to specific quality objectives. Use existing documentation as a starting point. Step 8: Update Your Monitoring Process Move beyond peer review prep—monitoring should be continuous and system-wide. Recommended actions to consider: Assign monitoring responsibilities across the team. Incorporate testing of responses into internal inspections. Use dashboards or checklists to track progress. Step 9: Formalize Root Cause and Remediation Procedures Investigate deficiencies and document why they occurred. This step is essential for both system and engagement-level reviews. Recommended actions to consider: Conduct interviews to understand root causes. Use findings to improve policies and training. Apply remediation even if your firm only undergoes engagement reviews. Step 10: Initial Test of Design and Implementation Review documentation and walk through processes to ensure your system is operational and testable. Recommended actions to consider: Validate that each component is supported by evidence. Simulate a peer review to test your system. Confirm that objectives, risks, and responses align. Conclusion Implementing a system of quality management is not just a compliance exercise—it’s an opportunity to strengthen your firm’s foundation for audit quality, risk management, and long-term success. Whether you’re a sole practitioner or a small firm with a few partners, these 10 steps offer a scalable roadmap to meet the new standards. Ready to get started or need help refining your approach? Contact your JGA audit expert today to schedule a consultation and ensure your implementation is tailored to your firm’s needs. At Johnson Global Advisory , we support firms in selecting, implementing, and optimizing these tools to meet their unique needs. For more insights, visit our blog or contact us to learn how we can help your firm AmplifyQuality®.
Introduction Auditing accounting estimates has long been one of the most judgment-intensive and inspection-prone areas of the audit. For smaller firms, the challenge is even greater due to limited resources and evolving regulatory expectations. At JGA , we’ve worked closely with firms navigating these complexities and have identified three critical areas where auditors can strengthen their approach and reduce risk. What’s Recurring and What’s New: Insights from PCAOB’s Latest Audit Focus The PCAOB’s recent Audit Focus¹ underscores persistent deficiencies in how auditors evaluate accounting estimates. Common issues include failure to identify significant assumptions, reliance on inquiry or simple recalculations, and inadequate testing beyond vouching to internal or external data. These recurring gaps continue to surface in inspections of smaller firms. What’s new is a sharper emphasis on critical accounting estimates—those with high uncertainty and material impact. Auditors are now expected to understand how management analyzes the sensitivity of assumptions to other likely outcomes and to incorporate that understanding into their evaluation of bias and reasonableness. Additionally, the PCAOB highlights good practices such as updating internal guidance, enhancing EQR partner reviews, and aligning audit programs with the standards. Key Takeaways and Our Recommended Action Items 1. Evaluate the Reasonableness of Significant Assumptions What the PCAOB said: The PCAOB continues to observe recurring deficiencies in how auditors evaluate significant assumptions used in accounting estimates. Common issues include failing to identify key assumptions, relying solely on inquiry or recalculations, and not assessing whether assumptions are consistent with external factors like market conditions or industry trends. Auditors are expected to evaluate assumptions both individually and in combination, and to consider management’s intent and ability to carry out specific actions when assumptions are forward-looking². JGA’s reaction: In our article “Like Making Concrete out of Jell-O”², we described the inherent difficulty of auditing estimates that are subjective, uncertain, and often based on future projections. We emphasized that auditors must go beyond surface-level validation and challenge management’s assumptions with rigor. In “An Update for Unprecedented Times”³, we noted that economic volatility has made assumption testing even more complex, requiring auditors to evaluate whether recurring assumptions still hold in today’s environment. JGA’s recommendation: Firms should implement structured assumption testing protocols that go beyond vouching. Use external data sources to validate assumptions and ensure that engagement teams document how each assumption was evaluated. Partner and EQR reviews should include a step to confirm that all significant assumptions were tested for reasonableness and consistency. 2. Develop Independent Expectations and Use Reliable Data What the PCAOB said: AS 2501 outlines three approaches to testing estimates, including developing an independent expectation. The PCAOB stresses that auditors must have a reasonable basis for their own assumptions and methods and must evaluate the relevance and reliability of third-party data. This is especially important when using unobservable inputs or when substituting auditor assumptions for those used by management². JGA’s reaction: We’ve consistently advocated independent modeling as a way to reduce bias and improve audit quality. In our earlier articles, we highlighted how auditors can use historical data, peer comparisons, and macroeconomic indicators to build independent expectations. In “An Update for Unprecedented Times”³, we emphasized that auditors must reassess models and assumptions that were previously considered reliable, especially in light of post-pandemic economic shifts. JGA’s recommendation: Firms should train engagement teams to build independent expectations using validated data sources. When using third-party data, document the evaluation of reliability per AS 1105. Consider integrating external audit methodology tools that support independent modeling and provide templates for documenting assumptions and methods. 3. Strengthen Audit Methodology and Engagement Oversight What the PCAOB said: The PCAOB highlights good practices from firms that have updated their internal guidance, audit programs, and review checklists. These updates include scoping exercises for identifying estimates subject to AS 2501, requiring EQR partners to review all significant inputs, and linking risk assessments to audit responses. These practices are especially important for smaller firms that may lack centralized oversight². JGA’s reaction: We’ve seen firsthand how firms that invest in methodology updates experience fewer inspection findings. In “Like Making Concrete out of Jell-O”², we discussed how subjective estimates—like goodwill impairments or startup valuations—require more than just technical compliance. In “An Update for Unprecedented Times”³, we noted that firms must adapt their methodologies to reflect new economic realities and ensure that recurring assumptions are still valid. JGA’s recommendation: Firms should revise their audit programs to include scoping for all types of estimates, not just those flagged as significant risks. Partner and EQR checklists should be updated to ensure comprehensive review of estimate testing. Risk assessment documentation should clearly link identified risks to specific audit responses, with traceable evidence. Conclusion Firms should assess their current audit programs and consider enhancements aligned with AS 2501. JGA offers tailored consultations to help firms implement best practices and prepare for inspections. Contact us today to schedule a review or download our latest audit quality resources. Auditing estimates doesn’t have to feel like “making concrete out of Jell-O.” With a disciplined approach to assumptions, independent analysis, and robust methodology, firms can deliver high-quality audits that stand up to regulatory scrutiny. JGA is here to help you lead with confidence. For more information, reach out to your JGA audit quality expert . Sources ¹PCAOB’s new publication Audit Focus- Auditing Accounting Estimates | PCAOB ²See our full article Auditing Estimates: Like Making Concrete out of Jell-O ³See our full article Auditing Estimates: An Update for Unprecedented Times
