AICPA Peer Review Program

GUIDELINES FOR REVIEW OF QUALITY CONTROL POLICIES AND PROCEDURES

1
FOR FIRMS WITH TWO OR MORE PERSONNEL

Firm Prepared By Date

.01 This questionnaire should be completed by the reviewer when evaluating the design of and compliance with
the firm’s quality control policies and procedures. The questionnaire has been developed for firms with two or
more personnel.

.02 In evaluating the design of the firm’s quality control policies and procedures, the reviewer will consider
whether certain policies and procedures have been implemented by the firm. It is expected that a firm may
achieve the objectives detailed in this questionnaire without implementing all of these quality control policies and
procedures.

.03 In cases where a policy or procedure in this questionnaire has not been implemented by a firm, the reviewer
will assess whether compensating controls are present at the firm to mitigate any potential resultant risks.

Leadership Responsibilities for Quality Within the Firm (“Tone at

the Top”)
Evaluating the Design of the Firm’s Quality Control Policies and Procedures
Objective
Determine whether the firm’s policies and procedures relative to leadership responsibilities for quality within the firm
(“Tone at the Top”) are designed to promote an internal culture based on the recognition that quality is essential in
performing engagements.
Procedures
1. Assess the design of the firm’s quality control policies and procedures by obtaining and reviewing the
firm’s documented policies and procedures.
2. Document “no” answers in appendix A.

Did the firm’s docu-

mented QCPP include
Policies and Procedures
this policy during
peer review year?
Yes No2
A. Leadership Responsibilities for Quality Within the Firm (“Tone at the Top”)
The firm should document its policies and procedures and communicate them to the
firm’s personnel (QC sec. 10 par. .18)

1 The term personnel is defined in QC section 10, A Firm’s System of Quality Control (AICPA, Professional Standards) as all individuals who
perform professional services for which the firm is responsible, whether or not they are CPAs (including leased and per diem employees who de-
vote at least 25 percent of their time at the reviewed firm in performing audits, reviews, compilations, or attestation engagements, or those profes-
sionals who have the partner-level or manager-level responsibility for the overall supervision or review of such engagements).
2
Document disposition of “no” answers in appendix A.
1
 Did the firm’s docu-
mented QCPP include
Policies and Procedures
this policy during
peer review year?
Yes No2
1. The firm must document all of its quality control policies and procedures and keep
that documentation up to date.
2. New hires are required to acknowledge receipt of the firm’s quality control docu-
ment in writing.
3. At least annually, firm personnel receive training on the firm’s quality control pol-
icies and procedures.
The firm should establish policies and procedures designed to promote an internal
culture based on recognition that quality is essential in performing engagements.
Such policies and procedures should require the firm’s leadership (managing part-
ner or board of managing partners, CEO, or equivalent) to assume ultimate respon-
sibility for the firm’s system of quality control. (QC sec. 10 par. 19)
4. The firm’s leadership promotes an internal culture based on recognition that quali-
ty is essential in performing engagements.
5. At least annually, firm leadership explicitly communicates the importance of qual-
ity to firm personnel.
6. The firm’s management assumes ultimate responsibility for the firm’s system of
quality control.
7. The firm assigns management responsibilities so that commercial considerations
do not override the quality of work performed.
The firm should establish policies and procedures designed to provide it with rea-
sonable assurance that any person or persons assigned operational responsibility for
the firm’s system of quality control by the firm’s leadership has sufficient and ap-
propriate experience and ability, and the necessary authority, to assume that respon-
sibility. (QC sec. 10 par. 20)
8. The firm assigns operational responsibility for its system of quality control to per-
sonnel who have sufficient and appropriate experience and ability to identify and
understand quality control issues and to develop appropriate policies and proce-
dures, as well as the necessary authority to implement those policies and proce-
dures.

Evaluating the Firm’s Compliance with Quality Control Policies and Procedures
Objective
Determine whether the firm’s policies and procedures relative to leadership responsibilities for quality within the firm
(“Tone at the Top”) are being complied with to promote an internal culture based on the recognition that quality is
essential in performing engagements.
Procedures
1. After evaluating the design of the firm’s system of quality control, develop a plan for the nature and extent of
compliance testing. The number and type of tests should be based upon the reviewer’s assessment of peer re-
view risk.

2
 2. If any of the firm’s policies were not complied with during the peer review year, those should be documented
in appendix A.

Did the firm com-

ply with this poli-
cy during peer
review year?
Policy # Description of procedures performed to test compliance and results Yes No

Conclusion

Yes No
Are the firm’s policies and procedures relative to leadership responsibilities
for quality within the firm (the “Tone at the Top”) designed and being com-
plied with to promote an internal culture based on the recognition that quali-
ty is essential in performing engagements?

3
Relevant Ethical Requirements
Evaluating the Design of the Firm’s Quality Control Policies and Procedures
Objective
Determine whether the firm’s policies and procedures relative to relevant ethical requirements are designed to provide
it with reasonable assurance that the firm and its personnel comply with relevant ethical requirements.
Procedures
1. Assess the design of the firm’s quality control policies and procedures by obtaining and reviewing the
firm’s documented policies and procedures.
2. Document “no” answers in appendix A.

Did the firm’s docu-

mented QCPP include
Policies and Procedures
this policy during peer
review year?
Yes No3
B. Relevant Ethical Requirements
The firm should establish policies and procedures designed to provide it with rea-
sonable assurance that the firm and its personnel comply with relevant ethical re-
quirements. (QC sec. 10 par. 21)
1. The firm documents and communicates its policies and procedures for relevant
ethical requirements to its personnel.
2. The firm maintains access to current guidance materials regarding the applicable
independence, integrity, and objectivity requirements.
3. The firm has assigned an individual with responsibility for providing guidance,
answering questions, monitoring compliance, and resolving matters with respect
to independence, integrity, and objectivity.
4. The firm ensures the independence of the firm as required by the AICPA, state
CPA societies, state boards of accountancy, state statute, the SEC, and other reg-
ulatory bodies, if applicable.
5. The firm informs its personnel of the types of financial or other relationships that
may impair independence and that may be prohibited.

6. Engagement partners must provide the firm with relevant information about cli-
ent engagements, including scope of services, to enable the firm to evaluate the
overall effect, if any, on independence requirements.
7. The firm provides its personnel with the list of clients and any related entities and
informs them on a timely basis as to any changes in the firm’s clients and any re-
lated entities to which independence policies apply.

3
Document disposition of “no” answers in appendix A.
4
 Did the firm’s docu-
mented QCPP include
Policies and Procedures
this policy during peer
review year?
Yes No3

8. The firm obtains written confirmation, upon hire and on an annual basis, of com-
pliance with its policies and procedures on independence from all personnel re-
quired to be independent by relevant requirements. (If “no,” the firm may not be
in compliance with QC section 10, which requires written confirmation, at least
annually.)
9. If the firm accepts an engagement where it acts as principal auditor or accountant
and another firm of CPAs is engaged to perform segments of the engagement,
written confirmations are obtained regarding the other firm’s independence with
respect to audit engagements and either written or oral confirmations obtained for
review or attestation engagements.

10. The firm accumulates and communicates relevant information to appropriate per-
sonnel so that the firm and its personnel can readily determine whether they satis-
fy independence requirements; the firm can maintain and update information
relating to independence; and the firm can take appropriate action regarding iden-
tified threats to independence that are not at an acceptable level.
11. If the firm identifies circumstances or relationships that create threats to inde-
pendence, the firm evaluates those threats and takes appropriate action to elimi-
nate them or reduce them to an acceptable level by applying safeguards; or, if
considered appropriate, withdraws from the engagement when withdrawal is pos-
sible under applicable law or regulation.

12. The firm evaluates other possible threats to independence and objectivity, includ-
ing the familiarity threat that may be created by using the same senior personnel
on an audit or attest engagement over a long period of time. When a familiarity
threat is identified, the firm takes appropriate actions to eliminate those threats or
reduce them to an acceptable level by applying safeguards.
13. If the firm identifies circumstances for which documentation of the resolution of
independence, integrity, and objectivity questions is required, such documentation
is retained for a specified period of time.
14. The firm has established criteria for determining when it is necessary to consult
with individuals outside the firm on independence, integrity, or objectivity con-
cerns.

15. The firm designates responsibility to appropriate personnel for periodically re-
viewing unpaid fees from clients to ascertain whether any outstanding amounts
may impair the firm’s independence.
16. If the firm provides nonattest services to accounting and auditing clients, the firm
must meet all the requirements of Ethics Interpretation No. 101-3 for all such cli-
ents.
17. If the firm becomes a member of a network [ET sec. 92 par. .22], the firm will

5
 Did the firm’s docu-
mented QCPP include
Policies and Procedures
this policy during peer
review year?
Yes No3
i. meet all of the requirements of Ethics Interpretation No. 101-17.
ii. monitor its independence with respect to financial statement audits, re-
views, and other attest engagements performed by other members of the
network.
The firm should establish policies and procedures designed to provide it with rea-
sonable assurance that it is notified of breaches of independence requirements and
to enable it to take appropriate actions to resolve such situations. (QC sec. 10 par.
24)
18. Personnel must promptly notify the firm of independence breaches of which they
become aware and the firm must take appropriate actions to resolve such situa-
tions.
19. The firm promptly communicates identified breaches of independence policies
and procedures to
a. the engagement partner who, with the firm, must address the breach and
communicate actions taken to resolve the matter to the firm.
b. other relevant personnel in the firm and, when appropriate, the network and
those subject to the independence requirements, who must take appropriate
action to resolve the matter and communicate those actions to the firm.

Evaluating the Firm’s Compliance with Quality Control Policies and Procedures
Objective
Determine whether the firm’s policies and procedures relative to relevant ethical requirements are being complied
with to provide it with reasonable assurance that the firm and its personnel comply with relevant ethical requirements.
Procedures
1. After evaluating the design of the firm’s system of quality control, develop a plan for the nature and extent of
compliance testing. The number and type of tests should be based upon the reviewer’s assessment of peer re-
view risk.
2. If any of the firm’s policies were not complied with during the peer review year, those should be documented
in appendix A.

Did the firm com-

ply with this poli-
cy during peer
review year?
Policy # Description of procedures performed to test compliance and results Yes No

6
 Did the firm com-
ply with this poli-
cy during peer
review year?
Policy # Description of procedures performed to test compliance and results Yes No

Conclusion

Yes No
Are the firm’s policies and procedures relative to relevant ethical require-
ments designed and being complied with to provide it with reasonable assur-
ance that the firm and its personnel comply with relevant ethical
requirements?

7
Acceptance and Continuance of Client Relationships and Specific
Engagements
Evaluating the Design of the Firm’s Quality Control Policies and Procedures
Objective
Determine whether the firm’s policies and procedures relative to Acceptance and Continuance of Client Relationships
and Specific Engagements are designed to provide the firm with reasonable assurance that it will undertake or contin-
ue relationships and engagements only when the firm
 is competent to perform the engagement and has the capabilities, including time and resources, to do so;
 can comply with legal and relevant ethical requirements; and
 has considered the integrity of the client and does not have information that would lead it to conclude that the
client lacks integrity.
Procedures
1. Assess the design of the firm’s quality control policies and procedures by obtaining and reviewing the
firm’s documented policies and procedures.
2. Document “no” answers in appendix A.

Did the firm’s documented QCPP

include this policy during peer re-
Policies and Procedures
view year?
Yes No4
C. Acceptance and Continuance of Client Relationships and Specific
Engagements
The firm should establish policies and procedures for the acceptance
and continuance of client relationships and specific engagements, de-
signed to provide the firm with reasonable assurance that it will un-
dertake or continue relationships and engagements only when the firm
is competent to perform the engagement and has the capabilities, in-
cluding time and resources, to do so; can comply with legal and rele-
vant ethical requirements; and has considered the integrity of the
client and does not have information that would lead it to conclude
that the client lacks integrity. (QC sec. 10 par. .27)
1. The firm documents and communicates its policies and procedures
to personnel for accepting prospective clients and the continuance
of current clients and specific engagements.

2. The firm will only undertake or continue relationships and engage-

ments where it has considered the integrity of the client, is compe-
tent to perform the engagement, and can comply with the legal and
ethical requirements.

3. Before accepting or continuing a client relationship, the firm must

a. Evaluate the nature of the services to be provided and the integ-
rity of the client, including the following:

4
Document disposition of “no” answers in appendix A.
8
 Did the firm’s documented QCPP
include this policy during peer re-
Policies and Procedures
view year?
Yes No4

i. The nature and purpose of the services to be provided to

the client and management’s understanding thereof
ii. The identity of the client’s principal owners, key manage-
ment, related parties, and those charged with governance
iii. The nature of the client’s operations, including its business
practices, from sources such as annual reports, interim fi-
nancial statements, reports to and from regulators, income
tax returns, and credit reports
iv. Information obtained from third parties (bankers, factors,
attorneys, credit services, and others who have business re-
lationships with the entity), where appropriate based on the
size and nature of the client
v. Information concerning the attitude of the client’s principal
owners, key management, and those charged with govern-
ance toward such matters as aggressive interpretation of
accounting standards and internal control over financial
reporting
vi. Communications with the predecessor accountant or audi-
tor when required by professional standards. Such com-
munications should include inquiries regarding the nature
of any disagreements and other events, the reasons for the
change and whether evidence of “opinion shopping” ex-
ists.
vii. Background checks of the business, its officers, and so on
b. Documents an assessment of the firm’s competence, capabili-
ties and resources to undertake the engagement, including
whether

i. firm personnel have knowledge of relevant industries or

subject matters or the ability to effectively gain the neces-
sary knowledge;
ii. firm personnel have experience with relevant regulatory or
reporting requirements or the ability to effectively gain the
necessary competencies;
iii. the firm has sufficient personnel with the necessary com-
petence and capabilities;
iv. specialists are available, if needed;
v. individuals meeting the criteria and eligibility require-
ments to perform an engagement quality control review are
available, when applicable; and
vi. the firm is able to complete the engagement within the re-
porting deadline.

9
 Did the firm’s documented QCPP
include this policy during peer re-
Policies and Procedures
view year?
Yes No4
c. Documents an assessment of the risks associated with the en-
gagement, including whether

i. the prospective client operates in a highly specialized or

regulated industry;
ii. there may be substantial doubt about the entity’s ability to
continue as a going concern;
iii. the entity is in the development stage;
iv. the engagement will require an inordinate amount of time
to complete relative to the available resources of the firm;
v. the engagement would be with significant client or other
client for which the firm’s objectivity or the appearance of
independence may be impaired; and
vi. additional firm and individual licenses may be needed for
states other than where the firm’s main office is domiciled
or for states other than where an individual primarily prac-
tices.
4. When issues have been identified relative to Ethics Interpretation
102-2, “Conflicts of Interest,” and the firm decides to accept or con-
tinue the client relationship or a specific engagement, the firm doc-
uments how the issues were resolved.
5. The firm designates individuals to evaluate and make recommenda-
tions as to whether a client or specific engagement should be ac-
cepted or continued.
a. The designated individuals will
i. Evaluate all the information obtained about the client or
engagement and make a recommendation about whether
the client or engagement should be accepted or continued.

ii. Document the decision and have an individual at an appro-

priate level approve the decision.
The firm should establish policies and procedures on continuing an
engagement and the client relationship that address the circumstances
when the firm obtains information that would have caused it to decline
the engagement had that information been available earlier. (QC sec.
10 par. .30)
6. The firm specifies conditions that require evaluation of an existing
client or engagement, obtaining relevant information to determine
whether the relationship should be continued, and establishing a
specific time period to make and document that evaluation.

10
 Did the firm’s documented QCPP
include this policy during peer re-
Policies and Procedures
view year?
Yes No4
a. The conditions include the following:

i. Significant changes in the client, such as a major change in

senior client personnel, ownership, advisors, nature of its
business, or its financial stability
ii. Changes in the nature or scope of the engagement, includ-
ing requests for additional services
iii. Changes in the composition of the firm, such as the loss of
and inability to replace key personnel who are particularly
knowledgeable about a specialized industry
iv. The decision to discontinue services to clients in a particu-
lar industry
v. The existence of conditions that would have caused the firm
to reject the client or engagement had such conditions exist-
ed at the time of the initial acceptance
vi. The client’s delinquency in paying fees
vii. The client has ignored prior recommendations, such as those
that address deficiencies in internal control
7. The firm establishes procedures for withdrawal from an engage-
ment or from both the engagement and the client relationship.
8. If the firm considers discontinuing any audit and accounting client
relationships but decides to continue, the factors considered in de-
termining that the relationship should be continued are documented.

Evaluating the Firm’s Compliance with Quality Control Policies and Procedures
Objective
Determine whether the firm’s policies and procedures relative to Acceptance and Continuance of Client Relationships
and Specific Engagements are being complied with to provide the firm with reasonable assurance that it will under-
take or continue relationships and engagements only when the firm
 is competent to perform the engagement and has the capabilities, including time and resources, to do so;
 can comply with legal and relevant ethical requirements; and
 has considered the integrity of the client and does not have information that would lead it to conclude that the
client lacks integrity.
Procedures
1. After evaluating the design of the firm’s system of quality control, develop a plan for the nature and extent of
compliance testing. The number and type of tests should be based upon the reviewer’s assessment of peer re-
view risk.
2. If any of the firm’s policies were not complied with during the peer review year, those should be documented
in appendix A.

11
 Did the firm com-
ply with this poli-
cy during peer
review year?
Policy # Description of procedures performed to test compliance and results Yes No

Conclusion

Yes No
Are the firm’s policies and procedures relative to acceptance and continu-
ance of client relationships and specific engagements designed and being
complied with to provide the firm with reasonable assurance that it will un-
dertake or continue relationships and engagements only when the firm
 is competent to perform the engagement and has the capabilities,
including time and resources, to do so;
 can comply with legal and relevant ethical requirements; and
 has considered the integrity of the client and does not have infor-
mation that would lead it to conclude that the client lacks integrity.

12
Human Resources
Evaluating the Design of the Firm’s Quality Control Policies and Procedures
Objective
Determine whether the firm’s policies and procedures relative to human resources are designed to provide the firm
with reasonable assurance that it has sufficient personnel with the competence, capabilities, and commitment to ethi-
cal principles necessary to
 perform engagements in accordance with professional standards and applicable legal and regulatory re-
quirements, and
 enable the firm to issue reports that are appropriate in the circumstances.
Procedures
1. Assess the design of the firm’s quality control policies and procedures by obtaining and reviewing the
firm’s documented policies and procedures.
2. Document “no” answers in appendix A.

Did the firm’s documented QCPP

include this policy during peer re-
Policies and Procedures
view year?
Yes No5
D. Human Resources
The firm should establish policies and procedures designed to provide
it with reasonable assurance that it has sufficient personnel with the
competence, capabilities, and commitment to ethical principles neces-
sary to perform engagements in accordance with professional stand-
ards and applicable legal and regulatory requirements and enable the
firm to issue reports that are appropriate in the circumstances. (QC
sec. 10 par. .31)
1. The firm has an individual or individuals responsible for the firm’s
hiring and human resources management, including evaluation of
personnel needs, establishment of hiring objectives, and providing
final approval.
2. The firm has criteria for determining which individuals will be in-
volved in the interviewing and hiring process.
3. The firm establishes hiring criteria that addresses the following:
i. Attributes, achievements, and experiences desired in entry-
level and experienced personnel to enable them to perform
competently within the firm
ii. How the firm evaluates personal characteristics such as
integrity, competence, and motivation of new hires

5
Document disposition of “no” answers in appendix A.
13
 Did the firm’s documented QCPP
include this policy during peer re-
Policies and Procedures
view year?
Yes No5

iii. Any additional information the firm requires for experi-

enced hires, such as background checks and inquiries about
any outstanding regulatory actions
4. The firm has an orientation and training policy for new hires.
5. The firm encourages personnel to pass the Uniform CPA Examina-
tion and to participate in other professional development activities,
such as taking graduate-level courses, becoming members of pro-
fessional organizations, serving on professional committees, and
writing for professional publications.
6. The firm has an individual or individuals responsible for the firm’s
CPE and professional development activities, including maintaining
CPE records and course materials for personnel.
7. The firm provides CPE to personnel in subjects that are relevant to
their responsibilities.
8. The firm establishes CPE requirements for personnel. Under these
requirements,
a. all personnel must participate in CPE and professional devel-
opment activities that support their performance of the engage-
ments they are assigned and are appropriate when considering
their role in the firm.
b. If an individual signs opinions on or manages must-select en-
gagements, the individual must have a minimum of eight hours
of CPE specific to the must-select industry or area every three
years (or within the firm’s or individual’s CPE period covering
a three-year period).
c. All personnel must take at least two hours of ethics CPE every
24 months.
9. All personnel must comply with the professional education require-
ments of the board(s) of accountancy in state(s) where they are li-
censed, the AICPA (if applicable), the state CPA society (if
applicable), and Government Auditing Standards—the Yellow Book
(if applicable).
10. When the firm accepts an audit in an industry that the firm’s per-
sonnel have not audited in the preceding five years, the firm re-
quires all senior members of the engagement team to take industry-
specific CPE before planning procedures are performed.
11. The firm informs personnel of changes in accounting and auditing
standards, independence, integrity, and objectivity requirements and
the firm’s technical policies and procedures with respect to them
(for example, by distributing technical pronouncements and holding
training courses on recent changes and areas noted by the firm as
needing improvement).

14
 Did the firm’s documented QCPP
include this policy during peer re-
Policies and Procedures
view year?
Yes No5
The firm’s policies and procedures should provide that personnel se-
lected for advancement have the qualifications necessary for fulfill-
ment of the responsibilities that they will be called on to assume. (QC
sec. 10 par. .32)
12. The firm designs procedures addressing personnel performance
evaluation, compensation, and advancement to demonstrate the
firm’s overarching commitment to quality.
13. The firm has different levels of responsibility within the firm (for
example, partner, manager, and senior).
14. The firm establishes, documents, communicates and assures adher-
ence to evaluation and advancement criteria for personnel at all lev-
els.
15. The firm establishes compensation and advancement criteria for
partners and senior-level staff that addresses the following:
a. Feedback based on monitoring results, peer reviews, and regu-
latory inspections
b. Appropriate identification of significant and emerging account-
ing and auditing issues
c. Appropriate consultation with firm experts when challenging
issues arise
16. The firm designates an individual with responsibility for
a. making advancement and termination decisions, including
identifying responsibilities and requirements for evaluation at
each level and deciding who will prepare evaluations.
b. developing the evaluation form for each professional classifica-
tion, including partners.
17. The firm designates responsibility for periodically evaluating the
performance of personnel and advising them of their progress in the
firm.
18. At least annually, the firm summarizes and reviews with personnel
the evaluation of their performance, including an assessment of
their knowledge, skills and abilities (competencies), and progress
with the firm, that includes a discussion regarding performance, fu-
ture objectives of the firm and the individual, assignment prefer-
ences, and career opportunities.

15
 Did the firm’s documented QCPP
include this policy during peer re-
Policies and Procedures
view year?
Yes No5
The firm should assign responsibility for each engagement to an en-
gagement partner and should establish policies and procedures requir-
ing that the identity and role of the engagement partner are
communicated to management and those charged with governance;
the engagement partner has the appropriate competence, capabilities,
and authority to perform the role; and the responsibilities of the en-
gagement partner are clearly defined and communicated to that indi-
vidual. (QC sec. 10 par. .33)
19. The identity and role of the engagement partner must be communi-
cated to management and those charged with governance.
20. The firm specifies the knowledge, skills, and abilities (competen-
cies) that the practitioner in charge of the firm’s accounting, audit-
ing, or attestation engagements (the partner or other person who is
responsible for supervising those types of engagements and signing
or authorizing someone to sign the accountant’s report on such en-
gagements) should possess to fulfill his or her engagement respon-
sibilities.
a. Such competencies for the practitioner-in-charge include the
following:
i. An understanding of the role of the firm’s system of quali-
ty control and the AICPA Code of Professional Conduct
ii. An understanding of the performance, supervision, and
reporting aspects of the engagement
iii. An understanding of the applicable accounting, auditing,
or attestation professional standards, including those
standards directly related to the industry in which a client
operates
iv. An understanding of the industry in which a client oper-
ates, including the industry’s organization and operating
characteristics, to identify the areas of high or unusual risk
associated with an engagement, and to evaluate the reason-
ableness of industry-specific estimates
v. Skills that indicate sound professional judgment
vi. An understanding of how organizations are dependent on
or enabled by information technologies, and the manner in
which information systems are used to record and maintain
financial information
21. The firm periodically evaluates all personnel, including owners, who
sign reports on behalf of the firm to assess whether they possess the
knowledge, skills, and abilities (competencies) necessary to enable
them to be qualified to perform the firm’s accounting, auditing, or at-
testation engagements (for example, by means of counseling, peer
evaluation or self-appraisal).

16
 Did the firm’s documented QCPP
include this policy during peer re-
Policies and Procedures
view year?
Yes No5
22. When an engagement is found to be materially non-conforming af-
ter report issuance (for example, through firm monitoring, peer re-
view or regulatory inspection), the firm either (a) requires the
engagement partner to take relevant CPE and requires EQCR on the
engagement partner’s future engagements in that industry or area,
(b) prohibits the engagement partner from performing future en-
gagements in that industry or area, or (c) dismisses the engagement
partner.
The firm should establish policies and procedures to assign appropri-
ate personnel with the necessary competence and capabilities to per-
form engagements in accordance with professional standards and
applicable legal and regulatory requirements and enable the firm to
issue reports that are appropriate in the circumstances. (QC sec. 10
par. .34)
23. The firm ensures personnel assigned to engagements have the degree of
technical training and proficiency required in the circumstances consid-
ering the nature and extent of supervision to be provided.
a. To meet that objective, the firm:
i. designates a responsible party for the assignment of per-
sonnel to engagements.

ii. considers each of the following factors to determine how

personnel are assigned to engagements: engagement size
and complexity; specialized experience or expertise re-
quired; personnel availability and involvement of supervi-
sory personnel; timing of the work to be performed;
continuity and rotation of personnel; opportunities for on-
the-job training; previous knowledge; skills and abilities
[competencies] gained through other experience; and situa-
tions where independence or objectivity concerns exist.

iii. documents its review of the competence and capabilities of

each engagement team, including the factors listed in QC
section 10 par. .A11, and the engagement partner approves
the composition of the engagement team before any proce-
dures are performed.
24. The firm assures that individuals are maintaining the appropriate li-
censes to perform the engagements they are assigned, including for
states other than where the individual primarily practices public ac-
counting.
25. When the firm accepts an audit in an industry that the firm’s per-
sonnel have not audited in the preceding five years, the firm engag-
es a suitably qualified external person to assist with the
performance of an audit as a member of the engagement team.

17
Evaluating the Firm’s Compliance with Quality Control Policies and Procedures
Objective
Determine whether the firm’s policies and procedures relative to human resources are being complied with to provide
the firm with reasonable assurance that it has sufficient personnel with the competence, capabilities, and commitment
to ethical principles necessary to
 perform engagements in accordance with professional standards and applicable legal and regulatory re-
quirements, and
 enable the firm to issue reports that are appropriate in the circumstances.
Procedures
1. After evaluating the design of the firm’s system of quality control, develop a plan for the nature and extent of
compliance testing. The number and type of tests should be based upon the reviewer’s assessment of peer re-
view risk.
2. If any of the firm’s policies were not complied with during the peer review year, those should be documented
in appendix A.

Did the firm com-

ply with this poli-
cy during peer
review year?
Policy # Description of procedures performed to test compliance and results Yes No

Conclusion

Yes No
Are the firm’s policies and procedures relative to human resources designed
and being complied with to provide the firm with reasonable assurance that it
has sufficient personnel with the competence, capabilities, and commitment
to ethical principles necessary to
 perform engagements in accordance with professional standards and
applicable legal and regulatory requirements, and
 enable the firm to issue reports that are appropriate in the circum-
18
 Yes No
stances.

19
Engagement Performance
Evaluating the Design of the Firm’s Quality Control Policies and Procedures
Objective
Determine whether the firm’s policies and procedures relative to engagement performance are designed to provide the
firm with reasonable assurance of performing and reporting in conformity with applicable professional standards.
Procedures
1. Assess the design of the firm’s quality control policies and procedures by obtaining and reviewing the
firm’s documented policies and procedures.
2. Document “no” answers in appendix A.

Did the firm’s documented QCPP

include this policy during peer re-
Policies and Procedures
view year?
Yes No6
E. Engagement Performance
The firm should establish policies and procedures designed to provide it
with reasonable assurance that engagements are consistently per-
formed in accordance with professional standards and applicable legal
and regulatory requirements and that the firm issues reports that are
appropriate in the circumstances. (QC sec. 10 par. .35)
1. If the firm develops its own quality control materials (QCM) (for ex-
ample, an audit and accounting manual, standardized forms, check-
lists, templates, practice aids, tools, questionnaires and the like) to
assist with engagement performance, the firm has established policies
and procedures for
i. developing materials that are reliable and suitable for the
firm’s practice.
ii. maintaining the reliability and suitability of the materials
through updates and revisions.
2. If the firm uses third-party QCM (for example, an audit and ac-
counting manual, standardized forms, checklists, templates, practice
aids, tools, questionnaires, and the like) to assist with engagement
performance, the firm has established policies and procedures for
i. identifying and adopting materials that are reliable, modi-
fying as necessary to make them suitable for the firm’s
practice.
ii. maintaining the reliability and suitability of the materials
through updates and revisions.
3. Written programs tailored to each specific engagement are required
to be used on all engagements. The programs must be reviewed and
approved by someone with appropriate authority.

6
Document disposition of “no” answers in appendix A.
20
 Did the firm’s documented QCPP
include this policy during peer re-
Policies and Procedures
view year?
Yes No6
4. To promote consistency, working papers must adhere to certain
form and content requirements, such as including purchased prac-
tice aids, as well as standardized forms, checklists, and question-
naires, that are to be used in engagement performance evaluations.
5. Each engagement is required to be supervised by suitably experi-
enced engagement team members.
a. Engagement supervision includes the following:
i. Tracking the progress of the engagement;
ii. Considering the competence and capabilities of individual
members of the engagement team, whether they have suf-
ficient time to carry out their work, whether they under-
stand their instructions, and whether the work is being
carried out in accordance with the planned approach to the
engagement;
iii. Addressing significant findings and issues arising during
the engagement, considering their significance, and modi-
fying the planned approach appropriately; and
iv. Identifying matters for consultation or consideration by
more experienced engagement team members during the
engagement.

7. The firm assigns responsibility for review of all reports, financial

statements, and working papers to a reviewer who is senior (when
possible) to the preparer. All reviewers must have appropriate expe-
rience, competence, and responsibility. The extent of engagement
reviews is required to be documented.
a. That review is designed to obtain reasonable assurance of the
following:
i. The work has been performed in accordance with profes-
sional standards and applicable legal and regulatory re-
quirements.
ii. Significant findings and issues have been raised for further
consideration.
iii. Appropriate consultations have taken place and the result-
ing conclusions have been documented and implemented.
iv. The nature, timing, and extent of the work performed is
appropriate and without need for revision.
v. The work performed supports the conclusions reached and
is appropriately documented.
vi. The evidence obtained is sufficient and appropriate to sup-
port the report.

21
 Did the firm’s documented QCPP
include this policy during peer re-
Policies and Procedures
view year?
Yes No6
vii. The objectives of the engagement procedures have been
achieved.
viii. The engagement team completed the assembly of final
engagement files on time.
8. The firm requires that a partner of the firm ultimately be responsible
for each engagement (certain standards may require partner respon-
sibility).
9. If the firm practices in a must-select industry or area, a partner is
designated with firm-wide responsibility for the quality of the
firm’s practice in that area. That partner must take annual CPE in
the must-select industry or area.
10. The firm establishes documented procedures to follow when the
firm uses other offices or correspondents for audit or accounting
engagements.
a. Those procedures address the following:
i. The form in which instructions are given to other offices or
correspondents, and
ii. The extent to which their work is reviewed.
11. The firm maintains the appropriate firm license(s), including states
other than where its main office is domiciled.
a. In all states where the firm practices, the firm
i. is licensed under the same name(s) under which it practices;
ii. must obtain license(s) which are effective before any re-
ports are issued in the state;
iii. considers variations in licensing bodies’ rules and regula-
tions and how they impact the firm’s need to be licensed in
that state; and
iv. addresses any restrictions on practice imposed by the li-
censing bodies.
The firm should establish policies and procedures designed to provide
it with reasonable assurance that consultation takes place on difficult
or contentious issues; sufficient resources are available to enable ap-
propriate consultation to take place; the nature and scope of such con-
sultations are documented and are agreed upon by both the individual
seeking consultation and the individual consulted; and the conclu-
sions resulting from consultations are documented, understood by
both the individual seeking consultation and the individual consulted,
and implemented (QC sec. 10 par. .37)

12. The firm informs personnel of its consultation policies and proce-
dures.

22
 Did the firm’s documented QCPP
include this policy during peer re-
Policies and Procedures
view year?
Yes No6

13. The firm identifies circumstances, including specialized situations,

when firm personnel are expected to consult.
a. Those circumstances include the following:
i. Application of newly issued technical pronouncements
ii. Industries with special accounting, auditing, or reporting
requirements
iii. Emerging practice problems
iv. Choices among alternative generally accepted accounting
principles upon initial adoption or when an accounting
change is made
v. Reissuance of a report, consideration of omitted proce-
dures after a report has been issued, or subsequent discov-
ery of facts that existed at the time a report was issued
vi. Filing requirements of regulatory agencies
14. The firm has established criteria which require consultation with
outside parties.
15. The firm requires the person ultimately responsible for the engage-
ment to determine the need to consult.
a. That determination is based on the following:
i. The materiality of the matter
ii. The experience of senior engagement personnel in a par-
ticular industry or functional area
iii. Whether generally accepted accounting principles or gen-
erally accepted auditing standards in the functional area
are as follows:
(a) Based on authoritative pronouncements that are sub-
ject to varying interpretations
(b) Based on varied interpretations of prevailing practice
(c) Developed
(d) Under active consideration by an authoritative body
(e) Not previously interpreted by the firm (for example, in
connection with another engagement)
16. The firm designates individuals within and outside the firm as con-
sultants in certain areas.
17. The firm resolves differences of opinion between engagement per-
sonnel and specialists before report issuance.

23
 Did the firm’s documented QCPP
include this policy during peer re-
Policies and Procedures
view year?
Yes No6
18. The firm maintains or provides its personnel access to adequate and
current reference materials, including materials related to its clients.
a. Those materials include the most current versions of the fol-
lowing:
i. AICPA Professional Standards
ii. AICPA A&A guides relevant to all industries in which the
firm practices
iii. FASB pronouncements
iv. Any other pronouncements relevant to the firm’s practice
(for example, SEC pronouncements, GASB pronounce-
ments, Government Auditing Standards (the “Yellow
Book”), and other government audit guides relevant to the
firm’s practice)
19. The firm requires documentation of consultations.
a. That required documentation includes the following:
i. All relevant facts and circumstances
ii. References to professional literature used in the determina-
tion
iii. Conclusions reached, and how they were implemented
iv. Signatures of engagement partner and consultant
v. Reference to the engagement working papers
The firm should establish criteria against which all engagements cov-
ered by this section should be evaluated to determine whether an en-
gagement quality control review should be performed. (QC sec. 10 par.
.38)
20. The firm establishes criteria for determining whether an engage-
ment quality control review is required to be performed prior to the
release of the report. Those criteria are designed to be appropriate
for the firm’s practice, are communicated to personnel, and reflect
consideration of the nature of the firm’s practice, the nature of cer-
tain engagements, unusual circumstances or risk, and whether laws
or regulations require an engagement quality control review.
21. The criteria established by the firm require an engagement quality
control review to be performed for the following:
a. An engagement for an entity operating in a highly specialized
or regulated industry, including financial institutions, govern-
mental entities and employee benefit plans
b. An engagement in an industry where the firm’s practice is lim-
ited and the firm’s personnel have little or no experience

24
 Did the firm’s documented QCPP
include this policy during peer re-
Policies and Procedures
view year?
Yes No6
c. An engagement that represents over 10 percent of the firm’s
A&A practice
The firm should establish policies and procedures setting out the na-
ture, timing, and extent of an engagement quality control review. Such
policies and procedures should require that the engagement quality
control review be completed before the report is released. (QC sec. 10
par. .40)
22. When an engagement meets the criteria for an engagement quality
control review,
a. The engagement partner should not select the engagement qual-
ity control reviewer, when practicable.
b. The engagement quality control reviewer must have sufficient
technical expertise, experience and objectivity. If the review-
er’s objectivity becomes impaired, the reviewer must be re-
placed.
c. The engagement quality control reviewer meets the independ-
ence requirements relating to the engagements reviewed, even
though the reviewer does not otherwise participate in the per-
formance of the engagement during the period of review.
d. The engagement partner remains responsible for the engage-
ment and its performance, and the engagement quality control
reviewer does not make decisions for the engagement team.
e. The engagement partner may consult the engagement quality
control reviewer at any stage during the engagement, with the
understanding that the engagement quality control reviewer’s
objectivity may be impaired if the nature and extent of consul-
tations becomes significant.
f. The engagement quality control review may be conducted at
various stages throughout the engagement.
g. The engagement quality control review includes a discussion
with the engagement partner about significant findings and is-
sues.
h. The engagement quality control review is completed before the
report is released.
i. The engagement quality control review is documented. This in-
cludes an assertion that the reviewer is not aware of any unre-
solved matters that would cause the reviewer to believe that the
significant judgments the engagement team made and the con-
clusions it reached were not appropriate.
j. Before reports are released, matters that would cause the re-
viewer to question the engagement team’s judgments and con-
clusions are resolved.

25
 Did the firm’s documented QCPP
include this policy during peer re-
Policies and Procedures
view year?
Yes No6
The firm should establish policies and procedures for addressing and
resolving differences of opinion within the engagement team; with
those consulted; and, when applicable, between the engagement part-
ner and the engagement quality control reviewer (QC sec. 10 par. .46)
23. The firm resolves differences of professional judgment within an
engagement team. (See AU-C section 220, Quality Control for an
Engagement Conducted in Accordance With Generally Accepted Au-
diting Standards [AICPA, Professional Standards].)
a. In reaching resolutions, the firm
i. assigns responsibility for resolving such matters.

ii. allows assistants to document their disagreement with the

conclusion reached and disassociate themselves from the
resolution of the matter.
iii. requires conclusions reached to be appropriately docu-
mented.
iv. requires that the matter be resolved before the report is
released.
The firm should establish policies and procedures for engagement
teams to complete the assembly of final engagement files on a timely
basis after the engagement reports have been released. (QC sec. 10
par. .49)
24. The firm complies with professional standards, laws or regulation that
prescribe time limits by which the assembly of final engagement files
must be completed. When no such time limits are prescribed, the firm
establishes time limits that reflect the need to complete the assembly
of final engagement files on a timely basis.
The firm should establish policies and procedures designed to main-
tain the confidentiality, safe custody, integrity, accessibility, and re-
trievability of engagement documentation.(QC sec. 10 par. .50)
25. The firm must maintain confidentiality, safe custody, integrity, acces-
sibility, and retrievability of engagement documentation.
The firm should establish policies and procedures for the retention of
engagement documentation for a period sufficient to meet the needs of
the firm, professional standards, laws, and regulations. (QC sec. 10
par. .51)
26. The firm retains engagement documentation for a period of time,
sufficient to meet the needs of the firm, professional standards, and
laws and regulations.

26
Evaluating the Firm’s Compliance with Quality Control Policies and Procedures
Objective
Determine whether the firm’s policies and procedures relative to engagement performance are being complied with to
provide the firm with reasonable assurance of performing and reporting in conformity with applicable professional
standards.
Procedures
1. After evaluating the design of the firm’s system of quality control, develop a plan for the nature and extent of
compliance testing. The number and type of tests should be based upon the reviewer’s assessment of peer re-
view risk.
2. If any of the firm’s policies were not complied with during the peer review year, those should be documented
in appendix A.

Did the firm com-

ply with this poli-
cy during peer
review year?
Policy # Description of procedures performed to test compliance and results Yes No

Conclusion

Yes No
Are the firm’s policies and procedures relative to engagement performance
designed and being complied with to provide the firm with reasonable assur-
ance of performing and reporting in conformity with applicable professional
standards?

27
Monitoring
Evaluating the Design of the Firm’s Quality Control Policies and Procedures
Objective
Determine whether the firm’s policies and procedures relative to monitoring are relevant, adequate, and operating
effectively.
Procedures
1. Assess the design of the firm’s quality control policies and procedures by obtaining and reviewing the
firm’s documented policies and procedures.
2. Document “no” answers in appendix A.

Did the firm’s documented QCPP

include this policy during peer re-
Policies and Procedures
view year?
Yes No7
F. Monitoring
The firm should establish a monitoring process designed to provide it
with reasonable assurance that the policies and procedures relating to
the system of quality control are relevant, adequate, and operating ef-
fectively. (QC sec. 10 par. .52)
1. The firm communicates its monitoring policies and procedures to
firm personnel.
2. The firm performs ongoing consideration and evaluation of the sys-
tem of quality control, including inspection or a period review of
engagement documentation, reports, and clients’ financial state-
ments for a selection of completed engagements.
a. At least annually, the firm
i. identifies new developments in professional standards and
legal and regulatory requirements and how they are re-
flected in the firm’s policies and procedures;
ii. interviews firm personnel and assesses their understanding
of the firm’s quality control policies and procedures and
implementation thereof;
iii. reviews selected administrative and personnel records per-
taining to the quality control elements;
iv. reviews written confirmations of compliance with policies
and procedures on independence;
v. evaluates training programs to determine whether they
achieve their objectives;

vi. reviews summaries of CPE records to track each of its per-

sonnel’s compliance with the requirements of the AICPA
and other regulatory bodies;

7
Document disposition of “no” answers in appendix A.
28
 Did the firm’s documented QCPP
include this policy during peer re-
Policies and Procedures
view year?
Yes No7
vii. considers whether the firm’s professional development
programs should be revised based on the results of the
firm’s inspection or peer review;
viii. solicits information from firm personnel regarding effec-
tiveness of the firm’s training programs;
ix. reviews engagement documentation, reports, and clients’
financial statements;
x. assesses the appropriateness of the firm’s guidance materi-
als and any practice aids to assure they are updated for new
professional pronouncements and are reliable and suitable
for the firm’s practice;
xi. reviews decisions related to acceptance and continuance of
client relationships and specific engagements;
xii. determines corrective actions to be taken and improve-
ments to be made in the system, including providing feed-
back into the firm’s policies and procedures relating to
education and training;
xiii. communicates to appropriate firm personnel of weaknesses
identified in the system, in the level of understanding of
the system, or compliance with the system; and
xiv. follows up with appropriate firm personnel so that neces-
sary modifications are promptly made to the quality con-
trol policies and procedures.
b. Through the procedures performed, the firm evaluates
i. adherence to professional standards and applicable legal
and regulatory requirements.
ii. whether the system of quality control has been appropri-
ately designed and effectively implemented.
iii. whether the firm’s quality control policies and procedures
have been operating effectively so that reports that are is-
sued by the firm are appropriate in the circumstances.
3. The firm assigns responsibility for the firm’s process to a partner or
partners or other persons with sufficient and appropriate experience
and authority in the firm to assume that responsibility.
4. The firm establishes criteria to assure that individuals responsible
for the inspection and other monitoring procedures have sufficient
experience and authority to assume that responsibility.
a. The firm assures that those responsible for conducting monitor-
ing procedures,

29
 Did the firm’s documented QCPP
include this policy during peer re-
Policies and Procedures
view year?
Yes No7
i. have sufficient training, experience and competence to
execute their responsibilities;
ii. have no history of limitations or restrictions on their ability
to practice public accounting; and

iii. have not acted as engagement partner on one or more ma-

terially non-conforming engagements that were uncovered
through peer review, monitoring, or regulatory inspection.
5. The firm performs timely inspections;8 post-issuance reviews of en-
gagement working papers, reports, and clients’ financial statements
for selected engagements; or both, to evaluate the firm’s compli-
ance with its policies and procedures as part of its monitoring pro-
cess.
In evaluating the firm’s compliance with its policies and proce-
dures,
a. The firm assigns responsibility for performing the inspections
or post-issuance reviews to a partner or manager-level individ-
ual not associated with the engagement.
b. The firm’s inspections or post-issuance reviews include the fol-
lowing:
i. Establishing an approach and timetable for performing the
inspection or post-issuance review procedures and deter-
mining the forms and checklists to be used and the extent
of documentation required
ii. Performing appropriate tests of compliance with the firm’s
policies and procedures on a sample basis

iii. Reviewing correspondence and documentation, as well as

interviewing personnel, to determine the firm’s compliance
with its policies and procedures regarding leadership respon-
sibilities for quality within the firm, relevant ethical require-
ments (including independence, integrity, and objectivity),
acceptance and continuance of client relationships and specif-
ic engagements, human resources, engagement performance,
and monitoring
iv. Reviewing a cross section of engagements considering the
following criteria:
(a) All partners and managers with significant accounting
and auditing responsibilities

8 Paragraphs .A72–.A73 of QC section 10 provides guidance for inspection and monitoring procedures for small firms with a limited number of
persons with sufficient and appropriate experience to effectively monitor compliance.
30
 Did the firm’s documented QCPP
include this policy during peer re-
Policies and Procedures
view year?
Yes No7
(b) The industries served by the firm, with at least one
engagement selected from each specialized or regulat-
ed industry (including financial institutions, govern-
mental entities and employee benefit plans)
(c) The size of the firm, number and geographical loca-
tion of offices, and the degree of authority
(d) Significant client engagements
(e) First-year engagements
(f) Level of service performed (that is, audit, review,
compilation, and attestation engagements)
(g) Engagements for which there have been complaints or
allegations from firm personnel, clients, or other third
parties that the work performed by the firm failed to
comply with professional standards, regulatory re-
quirements, or the firm’s system of quality control
(h) Engagements in which there were significant disa-
greements between the quality review partner and the
engagement partner
v. Assuring the completeness of the engagement population
upon which the inspection and peer review samples are
based.
The firm should establish policies and procedures to address cases
when the results of the monitoring procedures indicate that a report
may be inappropriate or that procedures were omitted during the per-
formance of the engagement. (QC sec. 10 par. .57)
6. If an engagement is found to be materially non-conforming after re-
port issuance (for example, through firm monitoring, peer review or
regulatory inspection), the firm assures that the requirements of pro-
fessional standards to perform additional procedures and/or to con-
sider recalling and reissuing the report were met and such
considerations were documented.
The firm should communicate, at least annually, the results of the
monitoring of its system of quality control to engagement partners and
other appropriate individuals within the firm, including the firm’s
leadership. (QC sec. 10 par. .58)
7. The firm summarizes and communicates at least annually to rele-
vant engagement partners and other appropriate individuals with the
firm, including the firm’s leadership, the monitoring process results,
and any recommended changes to the firm’s policies and proce-
dures.

31
 Did the firm’s documented QCPP
include this policy during peer re-
Policies and Procedures
view year?
Yes No7
8. The firm documents the evidence of the operation of each quality
control system element (through its summary monitoring report,
electronic databases, manual notes, checklists, and forms).
a. That documentation addresses
i. a description of the monitoring procedures performed to
review and test compliance with firm quality control poli-
cies and procedures relating to all of the elements of quali-
ty control.
ii. review of the firm’s professional library and practice aids
to determine that they were appropriate and up-to-date.

iii. interviews of a sample of personnel regarding the effec-

tiveness of the firm’s professional development programs.
iv. the deficiencies identified through the monitoring proce-
dures and an assessment of the significance of those defi-
ciencies.
v. recommended corrective actions that are designed to pre-
vent the recurrence of the deficiency. For each deficiency,
one or more of the following must be recommended:
(a) Taking appropriate remedial action in relation to an
individual engagement or member of personnel
(b) The communication of the findings to those responsi-
ble for training and professional development
(c) Changes to the quality control policies and procedures
(d) Disciplinary action against those who fail to comply
with the policies and procedures of the firm, especially
those who do so repeatedly
9. The firm takes specific corrective actions or steps based upon the
results of the monitoring process, and follows up on such planned
corrective actions to assure compliance with its policies and proce-
dures.
The firm should establish policies and procedures designed to provide
it with reasonable assurance that it deals appropriately with com-
plaints and allegations that the work performed by the firm fails to
comply with professional standards and applicable legal and regulato-
ry requirements and allegations of noncompliance with the firm’s sys-
tem of quality control (QC sec. 10 par. .60)
10. The firm stresses the importance of obtaining feedback on its sys-
tem of quality control from its personnel and actively pursues such
feedback.

32
 Did the firm’s documented QCPP
include this policy during peer re-
Policies and Procedures
view year?
Yes No7
11. The managing partner informs personnel that they may raise any
concerns about noncompliance with professional standards, regula-
tory and legal requirements, or the firm’s system of quality control
with any partner without fear of reprisals.

12. When complaints and allegations arise, the firm assigns a partner
who is not otherwise involved in the engagement, or a suitably
qualified external person or another firm, to investigate complaints
and allegations and the responses to them. The firm documents the
complaints and allegations and the responses to them.

Evaluating the Firm’s Compliance with Quality Control Policies and Procedures
Objective
Determine whether the firm’s policies and procedures relative to monitoring are relevant, adequate, and operating
effectively.
Procedures
1. After evaluating the design of the firm’s system of quality control, develop a plan for the nature and extent of
compliance testing. The number and type of tests should be based upon the reviewer’s assessment of peer re-
view risk.
2. If any of the firm’s policies were not complied with during the peer review year, those should be documented
in appendix A.

Did the firm com-

ply with this poli-
cy during peer
review year?
Policy # Description of procedures performed to test compliance and results Yes No

33
Conclusion

Yes No
Are the firm’s policies and procedures relative to monitoring designed and
being complied with to provide the firm with reasonable assurance that they
are relevant, adequate, and operating effectively?

34
 APPENDIX A

Disposition of “No” Answers

Objective
Wherever a “no” answer was noted, determine whether the firm has implemented compensating controls which miti-
gate the risk associated with the absence of or lack of compliance with the policy or procedure.
Procedures
1. Document all “no” answers from the checklist in the matrix below.
2. Determine, through discussion with the firm, whether any compensating controls exist which would mitigate
the risk presented by the “no” answer.
3. Perform tests to confirm that the control was implemented and being complied with during the peer review
year.
4. Conclude on whether the risk presented by the “no” answer was mitigated by compensating controls. If not,
document on an MFC.

Nature of “No” Answer Disposition

Policy # Design Compliance Description of compensating controls Risk mitigated MFC
(if any), including procedures per- by compensat-
formed to evaluate design and com- ing controls
pliance

35