At CPAClub, we spend a lot of time helping firms navigate quality management. Through implementation projects, ongoing monitoring engagements, webinars, and conversations with firm leaders, we see firsthand where the standards are clear, where the practical challenges begin, and which questions keep coming up.

Increasingly, those questions start from the same place. Your firm designed and documented a system of quality management. You mapped quality objectives, identified quality risks, built responses, and got your system in place. That was implementation. Now comes the harder part, and potentially the more valuable one.

Monitoring and remediation is where your quality management system moves from something you designed to something that actually helps you run a better A&A practice. It requires your firm to continually evaluate whether the system is working, identify where it is falling short, understand why, and make meaningful improvements.

Approached as a compliance exercise, monitoring can become another set of checklists, inspections, and documentation requirements. Approached with the right mindset, it can be transformative. It creates an ongoing feedback loop that helps firms identify recurring problems earlier, improve consistency, strengthen accountability, allocate resources more effectively, and ultimately operate a more effective and efficient A&A practice.

And that brings a new set of questions. What should we monitor? How often? Who should do it? What evidence do we need? When does a finding become a deficiency? How do we determine root cause? And how do we know whether remediation actually worked?

Navigating Quality Management Monitoring was created to answer those questions. Inside, we address the questions we hear most from firms navigating monitoring and remediation, combining clear answers with practical examples and insights drawn from the work our team does with firms every day.

Throughout this Navigator Guide, you’ll also find From the Helm, our practical perspective on what the standards mean when you actually have to put them into practice.

The end goal is not better monitoring. It is a better firm.

01

Getting Started with Monitoring

Getting Started with Monitoring · Question 1

We’ve implemented our system of quality management. What comes next?

Start by focusing on three things.

• Operate the system. Your policies and procedures need to move from documentation into practice. Make sure the responses you designed are actually being performed consistently and that the people responsible for them understand their roles.

• Build the evidence. Monitoring depends on evidence. Decide what needs to be retained, where it will live, who is responsible for capturing it, and how it will be organized. The goal is to create evidence as the system operates, not reconstruct it months later.

• Plan for monitoring. Decide who will perform your monitoring activities, what they will evaluate, and when they will happen. Consider the competence, capacity, and objectivity needed for the work, and whether those resources exist internally or need to come from outside the firm.

Implementation gave you the framework. Now you need to operate it, evidence it, and begin testing whether it works.

Getting Started with Monitoring · Question 2

How is monitoring under SQMS No. 1 different from the old approach?

Under the previous quality control standards, monitoring often centered on periodic inspection of completed engagements. Select some files, inspect them for compliance with professional standards and firm policies, document the results, and address what you found.

SQMS No. 1 takes a broader, more proactive approach. The focus is no longer simply on inspecting engagements. It is on evaluating whether the firm’s entire system of quality management is working as intended. Four changes are especially important.

• The lens is the system. Engagement inspections still matter, but they are only one source of information. Monitoring should help the firm evaluate whether its quality objectives, quality risks, and responses remain appropriate and whether the system is operating effectively.

• Monitoring is risk-based. The nature, timing, and extent of monitoring activities should respond to the firm’s quality risks and other relevant information. Monitoring should be designed around your firm’s system, not a generic checklist applied the same way every year.

• Findings have to go somewhere. Information identified through monitoring must be evaluated to determine whether deficiencies exist. When deficiencies are identified, the firm needs to understand their root causes, remediate them, and evaluate whether those remedial actions are effective.

• The work supports an annual evaluation. At least annually, the individual assigned ultimate responsibility and accountability for the system evaluates it and reaches a conclusion about whether the system is achieving its objectives. The monitoring performed throughout the year provides critical evidence for that evaluation.

Getting Started with Monitoring · Question 3

What should an effective monitoring program accomplish?

An effective monitoring program does more than identify problems. It provides the information your firm needs to evaluate whether its system of quality management is working and to take action when it is not.

At its core, the monitoring and remediation process should accomplish four things.

• Inform. Produce relevant, reliable, and timely information about the design, implementation, and operation of the system of quality management.

• Evaluate. Assess findings individually and in the aggregate to determine whether deficiencies exist and, when they do, evaluate their severity and pervasiveness.

• Remediate. Respond to identified deficiencies on a timely basis, with remedial actions designed to address their root causes.

• Communicate. Get monitoring results, identified deficiencies, and remedial actions to the people responsible for the system and others who need the information to perform their roles.

How a firm accomplishes these objectives will vary. Monitoring is scalable by design. A sole practitioner and a 200-person firm will not perform the same activities or devote the same resources to monitoring, but both need a process capable of producing the information necessary to evaluate and improve their systems.

Getting Started with Monitoring · Question 4

What does the monitoring and remediation process actually look like?

Monitoring is not a single activity. It is a process that turns information about your QM system into action.

02

Roles & Responsibilities

Roles & Responsibilities · Question 1

Who is responsible for monitoring and remediation?

Monitoring and remediation is a firm responsibility, but specific roles need to be clearly assigned.

• Ultimate responsibility and accountability. The individual assigned ultimate responsibility and accountability for the system of quality management is responsible for the system as a whole, including evaluating it at least annually and reaching the required conclusion about its effectiveness.

• Operational responsibility. The individual assigned operational responsibility for the system is responsible for overseeing its day-to-day operation, including making sure monitoring and remediation activities are planned, performed, evaluated, and communicated.

• Those performing monitoring activities. The people actually performing monitoring activities need the competence and capabilities, including sufficient time, to perform the work effectively. Their objectivity also needs to be considered based on the nature of the activity they are performing.

The exact structure will look different from firm to firm. In a larger firm, these responsibilities may be spread among several people or teams. In a smaller firm, one person may wear multiple hats, which makes thoughtful planning around competence, capacity, and objectivity particularly important.

What matters is that responsibilities are clear, the right people are performing the work, and the monitoring function has enough authority and support to do its job.

Roles & Responsibilities · Question 2

What’s the difference between operating a control and monitoring it?

This is one of the most important distinctions in quality management.

A firm can design a strong control and perform it consistently, but neither of those things tells you whether the control is actually working as intended. That is the role of monitoring. Think of it in three stages.