A peer review audit for a CPA firm is an external quality check in which an independent reviewer examines the firm’s attest work and the quality management system behind it to confirm both meet AICPA professional standards. Any CPA firm that issues reports on audits, reviews, examinations, or certain compilations must go through one every three years, and most state boards of accountancy make it a condition of keeping the firm’s license to practice.
Which Firms Have to Get One
The trigger is simple. If your firm issues reports on attest engagements, you need a peer review. Attest engagements include audits, reviews of financial statements, examinations of prospective financial information, and compilations where the firm reports a lack of independence. Firm size doesn’t matter. A sole practitioner who performs one audit a year has the same obligation as a regional firm with dozens of partners.
Firms that stick to tax preparation, consulting, bookkeeping, or financial statement preparation services that don’t include a report generally fall outside the requirement. The line comes down to whether your firm issues a report that users rely on for assurance about financial information.
When to Enroll and How Often
A firm that begins performing attest services should enroll in the AICPA Peer Review Program by the report date of its first engagement, not months afterward. The AICPA’s guidance is clear that enrollment is expected by the time the firm issues its first attest report.1American Institute of Certified Public Accountants. Questions and Answers About the AICPA Peer Review Program Enrollment usually goes through a state CPA society that acts as the administering entity for the AICPA program. After that, reviews recur on a three-year cycle.
Missing enrollment or blowing the schedule has real consequences. A firm that doesn’t cooperate with the process can be terminated from the program, which typically triggers an investigation by the state regulator.2American Institute of Certified Public Accountants. PRSU No. 3 – Modernizing Peer Review Administration Requirements In practice that often means losing the ability to perform attest services or having the firm’s license suspended.
System Review or Engagement Review
Which of the two review types you get depends on the highest level of service your firm provides.
System Review
A system review is the more comprehensive of the two. It looks at the firm’s whole quality management system: the policies, procedures, leadership structure, and monitoring processes behind all of the firm’s attest work, not just individual engagement files. Any firm that performs audits or examinations must have a system review.3American Institute of Certified Public Accountants. AICPA Standards for Performing and Reporting on Peer Reviews
The reviewer picks a sample of engagements that covers the firm’s range of practice: different industries, different engagement partners, and higher-risk work. Some engagement types are “must-select” and are pulled into the sample automatically if the firm performs them. These include employee benefit plan audits, audits performed under government auditing standards, and other categories where the public interest is high.4AICPA & CIMA. Training for Reviews of Certain Must-Select Engagements The reviewer also interviews partners and staff to test whether documented policies match what people actually do.
Engagement Review
An engagement review is narrower. The reviewer examines selected engagement files, the accountant’s reports, and supporting documentation to determine whether the work product conforms to professional standards. It doesn’t evaluate the firm’s overall quality management system.
This type is available to firms whose highest level of service is a review of financial statements or a compilation under the Statements on Standards for Accounting and Review Services. If your firm doesn’t perform audits or examinations, an engagement review is all you need.
What the Reviewer Actually Does
The reviewed firm picks its own peer reviewer, but not freely. The reviewer must be independent of the firm and must have relevant experience in the industries and technical areas the firm serves. For a system review, the team captain must be a partner-level individual at an enrolled, peer-reviewed firm. The administering entity vets the reviewer’s qualifications before work begins.
The two sides then agree on scope: which engagements will be examined, the period covered (usually aligned with the firm’s fiscal year), and the fieldwork logistics.
In fieldwork the reviewer digs into the selected engagement files, working papers, financial statements, and reports to check them against applicable professional standards. For system reviews, that also means interviews with partners and staff about the firm’s quality management policies. Those interviews often reveal whether documented procedures are actually being followed or are sitting untouched in a binder.
Any departures from professional standards get documented as exceptions. Before the report is finalized, the reviewer holds an exit conference with firm management to walk through preliminary findings and give the firm a chance to add documentation or context.
The Three Possible Ratings
After the exit conference, the reviewer issues a formal report with one of three ratings.
- Pass. The firm’s quality management system, or the selected engagements in an engagement review, conforms to professional standards. This is an unmodified report and the best outcome.
- Pass with deficiencies. The reviewer found departures from professional standards that were more than minor but didn’t fundamentally undermine the reliability of the firm’s reports. Specific problems have to be addressed, but the system isn’t broken.
- Fail. The quality management system has serious, pervasive deficiencies, or the engagements reviewed showed significant departures from standards. The rating signals the firm may not be reliably producing work that meets professional standards.
The report goes to the administering entity’s peer review committee, which reviews the findings and the firm’s response before formally accepting the report or requiring further action.
What Happens After a Deficiency or Failure
A firm that receives a pass with deficiencies or a fail has to submit a formal letter of response to the peer review committee with a specific remediation plan. Depending on what the reviewer found, corrective actions commonly include:
- Targeted continuing education for partners or staff in the areas where deficiencies were found
- Updates to quality management policies and procedures to close the gaps identified during the review
- Pre-issuance review of future high-risk engagements before reports are released
- An accelerated follow-up peer review before the normal three-year cycle to confirm corrective actions are working
The committee monitors the firm’s progress. Firms that don’t follow through on promised corrective actions risk termination from the program and the regulatory fallout that follows.2American Institute of Certified Public Accountants. PRSU No. 3 – Modernizing Peer Review Administration Requirements
The Quality Management Shift Peer Reviewers Are Now Checking
Firms undergoing peer review in 2026 face a significant change. The AICPA required all firms to establish a system of quality management under the new Quality Management standards, primarily QM Section 10, A Firm’s System of Quality Management, by December 15, 2025. Firms should be operating under their new system in 2026.5AICPA & CIMA. Readying Your New System of Quality Management for Peer Review
The older quality control framework focused on whether firms had documented policies and whether those policies were followed. The new approach is more proactive: firms must identify and assess risks to engagement quality, then design responses tailored to those risks. Peer reviewers in 2026 and beyond will be evaluating whether the quality management system reflects that risk-based approach rather than just checking boxes on a policy manual. A firm that hasn’t updated its documentation from the old standards will see the gap surface quickly during a system review.
Who Can See the Results
Peer review reports are not confidential. The AICPA makes accepted peer review documents available to the public through its website, and state boards of accountancy may publish results independently.6AICPA. AICPA Peer Review Program The public file includes the rating, the peer reviewer’s report, and the firm’s letter of response if one was required.
One practical limit is worth knowing. The AICPA’s public file displays results for firms that are members of certain AICPA practice sections, such as the Private Companies Practice Section, the Employee Benefit Plan Audit Quality Center, and the Governmental Audit Quality Center, plus firms that have voluntarily asked to make their results public. Not every enrolled firm’s results appear automatically. Clients, regulators, and other stakeholders who want to verify a specific firm’s peer review status can also check with the state board of accountancy, which may maintain its own records.
Cost and Time to Budget
Peer review costs come from two sources: the administrative fee charged by the administering entity, usually the state CPA society, and the reviewer’s professional fees for performing the review. Administrative fees vary by state and are often scaled to the number of professionals at the firm, typically running from a few hundred dollars for a small firm to a couple of thousand for a larger one. These are generally billed once every three years, in the year of the review.
Reviewer fees depend on the type and complexity of the review. An engagement review for a small firm is the least expensive. A system review with must-select engagements, especially government or employee benefit plan audits, costs more because of the additional expertise and time involved.
Start to finish, from scheduling through final acceptance by the peer review committee, the process typically runs several months. Firms that keep their engagement files and quality management documentation current year-round spend far less time scrambling than firms that try to pull everything together at the last minute. A good internal inspection program, run every year rather than only in the review year, catches problems before a reviewer does and shows the reviewer that the firm actively monitors its own work.