A partner is three weeks from signing an opinion on a complex engagement. The standard requires an independent reviewer to challenge the toughest judgment calls before that opinion goes out the door. She starts running through names. The audit partner who touched the file is ineligible. The tax partner covering overflow work doesn’t have the audit depth. The reviewer who filled in last year is still inside a cooling off period tied to a consulting engagement with that same client. The list runs out fast, and it isn’t a scheduling problem. It is exactly the scenario SQMS No. 2 was written around.
The AICPA’s Statement on Quality Management Standards No. 2, Engagement Quality Reviews, applies to audits and reviews of financial statements for periods beginning on or after December 15, 2025. Firms that have already worked through an engagement under the new standards know the rulebook exists. Far fewer have reckoned with how much it narrows who is actually allowed to do the reviewing. As part of our Five Points series, here is what SQMS No. 2 covers, how it differs from the standards it keeps getting confused with, and why the hardest part of compliance is turning out to be finding the right person, not writing the policy.
SQMS No. 2 Governs the Reviewer, Not the Firm’s System
SQMS No. 2 sets the rules for who can serve as an engagement quality reviewer, how that person gets appointed, and how the review itself has to be performed. It sits at the engagement level, not the firm level, and it applies to every audit and review of financial statements for periods beginning on or after December 15, 2025. If an opinion went out this year under the new standards, a reviewer meeting this bar already stood behind it, whether the firm fully appreciated the requirements or not.
It Is Not SQMS No. 1, and It Is Not QC 1000
The confusion starts because three standards sound like they are describing the same thing. SQMS No. 1 is the firm’s overall system of quality management, the framework that decides which engagements carry enough risk to need an independent review in the first place. SQMS No. 2 picks up where that decision ends. It is not about the firm’s system, it is about the person doing the reviewing and the review itself. QC 1000 is a different standard entirely, the PCAOB’s parallel requirement for issuer audits. SQMS No. 2 lives on the AICPA side, built for private company and other non-issuer work.
The Eligibility Bar Is Higher Than a Job Title
A reviewer under SQMS No. 2 needs authority, technical competence, enough time to actually do the work, and objectivity, along with a documented process for what happens when any of that gets compromised. The role itself is not a second audit. A reviewer does not rerun procedures or inspect the file after the opinion is already signed. The better comparison is a co-pilot who has full standing to challenge a call before the plane leaves the gate, not a second doctor reviewing the chart after the surgery is done. That means evaluating the significant judgments, the ethics questions, and how involved the engagement partner really was, early enough in the engagement to still change the outcome.
The Same Handful of Partners Keep Running Into the Same Wall
That eligibility bar is exactly what shrinks the pool so quickly. Competence, capability, objectivity, no conflicts, no cooling off issues. At a firm with a handful of audit partners, most of them are already touching the client in some way, or do not have the bandwidth to add a rigorous review on top of their own book of business. This is not a hypothetical stress test. It is the scenario opening this article, and it is playing out at firms of every size right now, often on the exact engagements where a strong review matters most.
The Standard Already Points to the Fix
SQMS No. 2 anticipates this problem directly. It explicitly permits firms to bring in external individuals to serve as the reviewer, or to support one, when internal resources with the right qualifications and time are not available. That flexibility is not a workaround or a lesser path to compliance. It is built into the standard on purpose, because the AICPA understood that not every firm has a bench deep enough to staff this role across a growing list of engagements requiring it.
Conclusion
Writing a policy that says the firm will perform engagement quality reviews was never the hard part. Finding someone eligible to actually perform one, engagement after engagement, without running into the same conflicts and time constraints, is where firms are getting stuck.
Three things are worth checking now.
- Whether your firm’s current reviewer roster can realistically cover the engagements requiring a review this year without conflicts or cooling off issues
- Whether time and bandwidth, not just qualifications, were factored into who was assigned
- Whether the firm has a plan for the engagement where every internal name on the list turns out to be ineligible
CPAClub provides qualified, independent engagement quality reviewers to firms that need coverage beyond their internal bench. If your firm is weighing whether the reviewer on your next engagement truly meets the bar SQMS No. 2 sets, let’s talk.
