AUD, Auditing and Attestation
Sources for Audit and Assurance Quality
Last reviewed
The standards and authorities behind PocketCPA's AUD lessons on Audit and Assurance Quality. The topic rests on AU-C 220.
About this topic
Good audits do not happen because everybody means well. Quality is built, and it is built at two levels at once.
Recent standards make quality management risk based. So a firm designs controls around the risks that threaten quality, rather than following a fixed checklist.
Key points
- A system of quality management (SQM) replaces the former quality control standards and requires a risk-based approach.
- The engagement partner is responsible for overall quality on the engagement, including direction, supervision, and review.
- An engagement quality review is required for audits of public companies and other engagements meeting specified criteria.
- SQMS 1 requires the firm to identify quality risks, design responses, and monitor whether they are operating effectively.
What the lessons cover
- Engagement-level quality
- The firm's system of quality management
- Reviews, monitoring, and remediation
- Which standard answers which question
- GAAS and PCAOB engagement quality, drawn apart
Authoritative references
Where these requirements sit in the literature. Every AU-C paragraph number was verified on 2026-08-16 against the AICPA free public compilation of currently effective AU-C sections. The PCAOB entries were quote-checked against primary text. Each entry names the standard, then breaks it out paragraph by paragraph.
- AU-C 220.13 carries the engagement partner's responsibility for managing and achieving quality, and with it involvement throughout the audit, determining relevant ethical requirements including independence were fulfilled, being satisfied acceptance and continuance procedures were followed, and communicating promptly to the firm information that would have caused it to decline.
- AU-C 220.36d carries the bar on releasing the report until a required engagement quality review is complete, and AU-C 220.41c requires the documentation to record that completion preceded release. AU-C 220.38c is the only bar on dating, and it runs until any differences of opinion are resolved, with AU-C 220.37 sending those to the firm's own policies. AU-C 220.40 separately requires the partner, prior to dating, to determine that they have taken overall responsibility for managing and achieving quality.
- SQMS No. 1 establishes the firm's system of quality management: quality objectives, assessed quality risks, designed responses, monitoring, remediation, reasonable assurance at a high but not absolute level, and the eight components listed in this lesson's second section.
- SQMS No. 2, compiled as QM section 20, governs the engagement quality review: its scope, the reviewer's required competence, capabilities, objectivity, time and authority, and the bar on being a team member or the engagement partner. .19 requires the firm's policies to address the threats to objectivity created by appointing a former engagement partner, and .A16 makes a cooling-off period an optional firm response rather than a GAAS requirement. .24b precludes the partner from releasing the report until notification is received. .26 requires the reviewer to notify the partner of concerns, and the firm if they are not resolved. .27 requires the reviewer, on determining the review is complete, to notify the partner. .A25 contemplates a review completed after the report date and requires the date to change only where additional procedures result. .A54 confirms that completion "includes resolving matters raised by the engagement quality reviewer", while allowing the review documentation to be finalized after release but before assembly of the final engagement file.
- AS 1201.03, .05 and .06 are the PCAOB supervision analogue.
- .03 makes the partner responsible for the engagement and therefore for supervising team members, including those outside the firm.
- .05 requires the auditor to inform, direct, and review, with review complete before the report release date.
- .06 carries the four factors setting the extent of supervision.
- AS 1220 is the PCAOB review standard.
- .01 requires the review, with concurring approval of issuance.
- .02 states the objective.
- .03 and .05 carry who may serve and the competence standard.
- .07 bars the reviewer from deciding for the team.
- .08 is the two-audits-preceding bar.
- .12 allows approval only if the reviewer is not aware of a significant engagement deficiency.
- .13 bars permission to use the report before approval.
- .19 through .21 carry documentation.
- AS 1215.14 and .15 anchor the PCAOB timeline.
- .14 makes the report release date the date the auditor grants permission to use the report, with seven-year retention from it.
- .15 requires all procedures and all partner and supervisor documentation reviews to be complete before that date, with assembly no more than 14 days after.
- AS 1215.08 and AS 1215.12 require documenting differences in professional judgment and their resolution.
- PCAOB QC 1000, effective 15 December 2026, carries four tested points.
- .05 is the reasonable-assurance objective.
- .18 through .21 carry quality objectives, with an annual risk assessment and responses.
- .28 requires the External Quality Control Function above 100 issuers.
- .77 and .79 carry the 30 September evaluation, reported on Form QC by 30 November.
- AICPA Code 1.200 carries the conceptual framework for independence. A close family member in a position of significant influence at an attest client creates a familiarity threat; the firm evaluates its significance and applies safeguards, possibly removing the partner.
How PocketCPA uses these sources
Every lesson is written in original words and cites the paragraph each rule comes from. No standard's text is reproduced. How lessons and questions are written and checked is set out in our methodology.