By Anthony J. Mancuso

In Brief

Fine Tuning the Self-Regulatory Process

In response to the issuance of new quality control standards and the maturity of the program itself, the AICPA Peer Review Board issued new standards to update the Standards for Performing and Reporting on Peer Reviews.

The new standards--

* redefine an accounting and auditing practice for purposes of peer reviews.

* require a risk-based approach in planning and performing peer reviews similar to that used on audits.

* eliminate the restriction on team captains serving in that capacity on more than two successive reviews.

* prohibit individuals from serving as reviewers if their ability to practice accounting has been limited or restricted by a regulatory, monitoring, or enforcing body.

* revise the form of an adverse report on off-site reviews.

* require a letter of response to be reviewed by a team captain or reviewer prior to submission to administrators.

* require each member of a committee that has responsibility for acceptance of reviews to be associated with a firm that has received an unqualified report on its most recently completed peer review.

* provide for various actions that may be taken as a result of deficient performance by reviewers.

The effective date of the new standards has been changed from that indicated in the exposure draft and is now effective for all peer review years beginning on or after January 1, 1997.

The AICPA Peer Review Board (board) issued new standards, updating the Standards for Performing and Reporting on Peer Reviews, as a result of the Statements on Quality Control Standards Nos. 2 and 3, issued in May 1996. The board revised the standards because it believed changes were appropriate now that the program has been in effect for many years and firms have undergone their second triennial review.

When Did It All Begin?

It all started in 1979 when the AICPA instituted a voluntary practice monitoring program as part of a new Division for CPA Firms, that was designed to distinguish member firms and provide the public with information about how member firms were complying with professional standards. The first statement on quality control standards was issued by the Quality Control Standards Committee in that year. At approximately the same time, the Auditing Standards Board issued SAS No. 25, The Relationship of Generally Accepted Auditing Standards to Quality Control Standards. That statement pointed out that generally accepted auditing standards and quality control standards are related.

The experience gained from this process showed that independent reviews of firms' procedures were an effective way to identify substandard practices as well as to assist firms in improving the quality of their work.

As part of strengthening the AICPA's self-regulatory effort, AICPA Council recommended the adoption of a mandatory practice monitoring program for all firms in its Plan to Restructure Professional Standards (the Anderson Report.) In 1988, a majority of the members of the AICPA voted for the adoption of the plan as a condition for AICPA membership for firms that did not belong to a voluntary program. In 1989, the first standards for performing and reporting on quality reviews were issued by the Quality Review Executive Committee. The program, originally named Quality Review, was later changed to Peer Review in 1995 when the quality review program and PCPS peer review programs were combined.

The first quality control standards identified nine elements of quality control a firm should consider in designing a quality control system. Statement of Quality Control Standards (SQCS) No. 2, System of Quality Control for a CPA Firm's Accounting and Auditing Practice, condensed and replaced the nine elements of a quality control system with five elements of quality control, and redefined a firm's accounting and auditing practice to include all audit, attest, and accounting and review services for which professional standards have been established by the Auditing Standards Board or the Accounting and Review Services Committee under Rules 201 and 202 of the AICPA Code of Professional Conduct.

SQCS No. 2 provides that "a CPA firm shall have a system of quality control for its accounting and auditing practice and describes the elements of quality control and other matters essential to the effective implementation and maintenance of the system." Further, SQCS No. 2 provides "that the nature, extent, and formality of a firm's quality control policies and procedures depend on a number of factors, such as its size, number of offices, the degree of authority allowed its personnel and officers, the knowledge and experience of its personnel, the nature and complexity of its practice, and appropriate cost-benefit consideration."

Under the new standards, a firm should establish a system of quality control addressing policies and procedures related to each of the following five elements of quality control:

* Independence, integrity, and objectivity

* Personnel management

* Acceptance and continuance of clients and engagements

* Engagement performance

* Monitoring

A nonauthoritative Guide for Establishing and Maintaining a System of Quality Control for a CPA Firm's Accounting and Auditing Practice, was issued by the AICPA Joint Task Force on Quality Control Standards to present its recommendations on the application of quality control standards.

SQCS No. 3, Monitoring of a CPA Firm's Accounting and Auditing Practice was issued simultaneous with SQCS No. 2. Because the inspection element had posed significant implementation problems for small firms and consumed large amounts of agenda time of practice-monitoring committees, SQCS No. 2 changes the focus from the element "inspection" to that of "monitoring" with inspection but one way to achieve the monitoring objective.

How Have Peer Review Standards Changed?

The new standards make some significant changes.

Definition of an Accounting and Auditing Practice. An accounting and auditing practice for purposes of peer review has been redefined as all engagements covered by Statements on Auditing Standards (SAS), Statements on Accounting and Review Services (SSARS), Statement on Standards for Attestation Engagements (SSAE), Financial Forecasts and Projections, attest services on financial information when the firm audits, reviews, or compiles the historical financial statements of a client, and standards for financial and compliance audits contained in Government Auditing Standards (the Yellow Book) issued by the U. S. General Accounting Office (GAO).

As a result of this new definition, any firm that performs any type of engagement covered by AICPA statements on auditing standards requires an on-site peer review. For example, if the only kind of engagements performed by a firm are engagements under SAS No. 75, Engagements to Apply Agreed-Upon Procedures to Specific Elements, Accounts, or Items of a Financial Statement, the firm would be required to have an on-site review. Under the previous standard, such firms were eligible to have an off-site review. In effect, the new standards limit off-site reviews to firms performing only compilations and reviews.

After the exposure draft was issued, the board deliberated further on the definition of accounting and auditing under the peer review process and concluded all attest engagements, not just those for forecasts and projections, should be subject to an on-site review. The decision to broaden the new definition was deferred, however, because it would have required due process and reexposure of a new draft to all AICPA members. The definition of accounting and auditing for on-site reviews will certainly be altered when the board makes its next change to peer review standards.

Requires a Risk-Based Approach. The standards require a peer review be planned and performed on a risk-based approach in a manner similar to that used in the performance of audits of financial statements. The risk-based approach focuses on a firm's higher risk engagements such as banks, lending institutions, employee benefit plans, etc.

The new standards define peer review risk as the risk that a review team "fails to identify significant weaknesses in the reviewed firm's system of quality control for its accounting and auditing practice, its compliance with that system, or both; issues an inappropriate opinion on the reviewed firm's system of quality control for its accounting and auditing practice, its compliance with that system, or both; or reaches an inappropriate decision about the findings to be included in or excluded from the letter of comments, or about whether to issue a letter of comments.

Peer review risk consists of two parts--inherent and control risk and detection risk. Inherent and control risk is the risk that an engagement will fail to comply with professional standards and the reviewed firm's quality control system will not prevent such failure. Detection risk is the risk that the review team will fail to detect the design or compliance deficiencies in the reviewed firm's quality control system that either result in the firm having less than reasonable assurance of conforming with professional standards or constitute conditions whereby there is more than a remote possibility that the firm will not conform with professional standards on accounting and auditing engagements.

Inherent and control risk relate to the reviewed firm's accounting and auditing practice and its quality control system and are assessed by the review team in planning the review. Based on that assessment, the review team determines the offices and engagements to be selected for review to reduce peer review risk to an acceptable low level. The lower the inherent and control risk, the higher the detection risk that can be tolerated and vice versa.

As part of the emphasis on a risk-based approach to engagements, the board eliminated numerical guidance for determining engagement scope. Previous guidelines indicated the scope should represent five to 10 percent of the accounting and auditing hours of the reviewed firm. Since the process of engagement selection is not subject to definitive criteria, the board did not want to legislate a percentage for engagement selection to allow the team captain to make an adequate selection of the engagements. Under the new methodology, adequate consideration is to be given to key areas. If the team captain believes the selection of engagements causes the creation of an inappropriate scope of the firm's accounting and auditing practice, the team captain must justify a more limited scope in a summary review memorandum detailing why the selection would be adequate for the review. Under such circumstances, a team captain is encouraged to consult with the state CPA society administering the review about the selection of engagements for review.

Eliminates Restriction Against Performing Two Successive Reviews. In an attempt to "level the playing field," the board lifted the restriction prohibiting team captains from serving in that capacity on more than two successive reviews of the same firm. The difficulty with the old standards was that larger firms were able to maintain the reviewed firm as a client after two successive reviews by replacing the team captain with another qualified firm member. Smaller firms and sole practitioners conducting reviews were forced to give up the reviewed firm as a client after performing two consecutive peer reviews because of the inability to shift the peer review to another qualified firm member.

An alternative approach considered by the board was to limit the number of consecutive reviews an entire firm could conduct, as was the case with individual reviewers. The board rejected that concept and proposed eliminating the two-time team captain limitation. Consequently, concurrent with the effective date of the new standard, there is no further restriction on the number of consecutive reviews a firm or individual can perform.

The new rule parallels current business practice, which places the continuity of an engagement by a team captain (reviewer) in the hands of the client (the reviewed firm). The presumption is that as long as the team captain or reviewer services the client in a manner acceptable to the client and performs peer reviews in accordance with promulgated standards, that individual can retain the client.

Prohibits Service as a Reviewer Under Certain Conditions. The qualifications for service as a reviewer have been revised to prohibit an individual from serving as an on-site or off-site peer reviewer if his or her ability to practice accounting has in any way been limited or restricted by a regulatory, monitoring, or enforcing body.

Conforms Year-End Selection. Selection of engagements for on-site and off-site reviews were not consistent and created confusion for both reviewers and reviewed firms. The prior basis for selecting engagements for off-site reviews was to include in the population for the peer review year all reports on engagements issued by the firm during the year under review. On-site reviews included in the population for the peer review year were all engagements with fiscal years ending during the year under review. The new standard adopts the criterion used for on-site engagements for off-sites as well so that the date of the financial statements is the determining factor for inclusion.

Revises an Adverse Report. The new standard revises the report paragraph of an adverse report for an off-site peer review to report only on engagements reviewed. In previous standards, an adverse report contained language stating that, "Because of the significance of the matters... we believe (Firm Name) did not have reasonable assurance of conforming with professional standards in the conduct of its accounting practice." The implication was that the entire practice was not in conformity with standards. Since an off-site review is not a systems review of an accounting firm's practice, but a review of reports selected and submitted, the board altered the language to limit the adverse opinion to the reports submitted for review. The new language states "Because of the significance of the matters...we do not believe that the compilation and review reports submitted for review by (Firm Name) for the (year ended), conform with requirements of professional standards in all material respects."

Requires Review of Letters of Comments. A reviewed firm is now required to submit its letter of response to a team captain or reviewer for review and comment prior to submission of the document to the CPA state society administering the peer review. Previously, when a reviewed firm received a letter of comments, the firm would send its letter of response directly to the administrators together with a copy of the firm's report and letter of comments. In a large number of cases, the team captain or reviewer did not see the firm's response and was unable to determine if the reviewed firm properly responded to the deficiencies cited in the letter of comments. Revisions to letters of response were common, and disputes would arise because the firm was not clear on how to make the necessary improvements in its system of quality control or reporting practice. As a result, the board believed a review of the letter of response prior to submission of all documents to the administering entity would eliminate any misunderstanding between the team captain or reviewer and the firm.

Places Conditions on Report Acceptance Body. Each member of a state CPA society committee charged with the responsibility of considering the results of peer reviews must now be associated with a firm that has received an unqualified report on its most recently completed peer review.

Provides for Actions to Be Taken for Deficient Reviewer Performance. If a team captain or reviewer is deficient in his or her performance of a particular review, or if a pattern of deficiencies exist, various actions may now be required of him or her. A committee or report acceptance body evaluates the reviewer's performance on the peer review when the committee considers the peer review documents for acceptance. Based upon the situation, the committee or report acceptance body can consider the need to impose corrective or monitoring actions on the reviewer, such as requiring attendance at a reviewer's training course; performing committee oversight on the next review performed by the reviewer at the expense of the reviewer's firm; requiring completion of all outstanding peer reviews before the reviewer performs another review; or requiring preissuance review of the report, letter of comments, and working papers on future reviews of the reviewer.

Effective Date

The original effective date of the new standards in the exposure draft was for peer reviews commencing on or after January 1, 1997. It was initially established to coincide with the new Statements on Quality Control Standards that are effective on that date. The board decided to modify the effective date to all peer review years beginning on or after January 1, 1997. The change in the effective date was made to eliminate some of the transitional issues and provide time for the development of educational and guidance materials that will be needed for the implementation of the standards.

The change in the peer review exposure draft's original effective date does not affect the date for the establishment of the new quality control standards. The impact of implementing the two new standards causes a transitional effect for peer reviews conducted during the year 1997, which will be evaluated on a dual quality control system. Firms establishing quality control standards under SQCS Nos. 2 and 3 that have their peer review during 1997 fall into that transitional period. A portion of their system of quality control would be under the prior nine elements and the other portion under the new five elements. The review would be based upon the quality review standards in effect during each period. In an effort to minimize transitional problems, the board decided to maintain the old element titles when writing letters of comments, but adopting the new report format.

The change in implementation date impacts successive reviewer engagements, which under the original proposed standard would have allowed a team captain to serve in such capacity for more than two successive reviews of the same firm, effective for all peer reviews commencing on or after January 1, 1997. The change in the effective date, to all peer review years beginning on or after January 1, 1997, pushes a team captain's ability to perform successive reviews one year further down the road into 1998. *

Anthony J. Mancuso, CPA, is Director of Accounting Information Services with the NYSSCPA and a member of the AICPA Peer Review Board that issued the new standards.