SHARPECPA

Sharpe CPA  /  For CPAs  /  Peer review

Peer review, without the dread.

Every firm that issues audit, review or compilation reports goes through it every three years. Which kind of review you get, how the review runs from scheduling to the acceptance letter, what the ratings mean, and a checklist for getting the firm ready — months ahead, not the week the reviewer calls.

The free tools are used at your own risk. They are provided as is, without warranty, and are not accounting, legal or tax advice. All of the work a CPA performs is subject to that person’s or firm’s judgment. Do your own research and verify that the checklist or protocol you are using is valid and up to date. Each tool is built from public sources — see the sources and the terms of use.

The two types

System review or engagement review.

Under the AICPA Standards for Performing and Reporting on Peer Reviews there are two types. Your highest level of service decides which one you must have.

System review

For firms that perform audits or other engagements under the SASs, Government Auditing Standards, or examinations under the SSAEs.

  • The reviewer evaluates the firm’s system of quality management — now under SQMS No. 1 — and whether the firm complies with it.
  • Tests a sample of engagements across the practice, weighted toward risk, including any must-select engagements.
  • Interviews the partners and staff, reads the firm’s QM documentation, monitoring and annual evaluation, and tests independence, CPE and acceptance procedures.
  • Opinion: reasonable assurance that the system is suitably designed and complied with.

Engagement review

For firms whose highest level of service is reviews, compilations, preparation engagements or SSAE reviews and agreed-upon procedures.

  • The reviewer looks at the engagements, not the firm’s system: the reports, the financial statements and the required documentation.
  • Performed off-site from copies the firm sends.
  • Opinion: limited assurance that the work was performed and reported in conformity with the standards in all material respects.
  • A firm may choose a system review instead.

Must-select engagements

If the firm performed any of these during the review year, the system review has to include at least one of each.

EngagementWhy it is singled out
Government Auditing Standards (Yellow Book), including single auditsExtra standards, Yellow Book CPE and independence rules, and federal compliance requirements.
Employee benefit plan audits (ERISA)The engagement type with the highest historical deficiency rate.
FDICIA audits of insured depository institutionsRegulatory reporting and internal control requirements.
Audits of carrying broker-dealersSpecialized regulatory requirements.
SOC 1 and SOC 2 examinationsRelied on by other auditors and by customers.

Confirm the current list in the standards before planning the review.

Which applies to you

Check what the firm did in the review year.

This reflects the AICPA program and the California Board of Accountancy rules as summarized on this page. Your state board and administering entity decide; confirm with them.

The process

From the due date to the acceptance letter.

Reviews run on a three-year cycle. The administering entity — CalCPA in California — assigns the due date, and the review year is the twelve months the reviewer looks at.

  1. Enroll and get a due dateA firm that starts performing engagements subject to peer review enrolls with the administering entity, which sets the review year-end and the due date.
  2. Choose a reviewerThe firm selects a qualified team captain (system review) or review captain (engagement review), or a reviewing firm or association. The reviewer must be independent of the firm and experienced in the industries and engagement types it will review.
  3. Schedule the reviewThe reviewer schedules it through the administering entity’s system ahead of the due date. Scheduling and administration rules were updated by Peer Review Standards Update No. 3 for system reviews scheduled on or after February 28, 2026.
  4. Planning and the engagement listThe firm provides a list of every engagement in the review year by type and industry, its QM documentation and the prior review. The reviewer assesses risk and selects engagements.
  5. FieldworkSystem review: QM documentation, interviews, independence, monitoring and the selected engagement files. Engagement review: the reports, statements and required documentation sent off-site.
  1. Findings and the closing meetingEach issue is written up on a Finding for Further Consideration (FFC). The firm responds on the form with what it will do about it.
  2. The reportA rating of pass, pass with deficiencies or fail. For a pass with deficiencies or fail the firm writes a letter of response describing the corrective actions.
  3. AcceptanceThe administering entity’s report acceptance body reviews the working papers, the report and the responses. It may require corrective actions or an implementation plan.
  4. Final letter of acceptanceIssued once any required actions are completed. In California the firm then reports the results to the CBA.
  5. RemediateFix the causes in the system, not only the selected files. The next reviewer will read this review first.

Find a reviewer

Current lists of peer reviewers.

Reviewer lists change every month as reviewers qualify, retire or lose eligibility, so this page does not keep a copy. These sources are kept current by the people who run the program — open them for today’s list.

AICPA Reviewer Search

The national, current list. Search by state, review type (system or engagement), industry and must-select experience such as Yellow Book, single audits or benefit plans.

Only individuals in enrolled firms whose own peer review was rated pass and accepted within the last three years and six months appear, so a listing is itself a quality screen.

Open the Reviewer Search

CalCPA Directory of Reviewers

California’s administering entity publishes a directory each year of reviewers who chose to be listed, with contact details, review types and industry codes.

It is a partial list. For a firm in California, CalCPA’s peer review staff can also help: peerreview@calcpa.org.

Open the 2026 directory (PDF)

If the link has moved, find the current year’s directory on CalCPA’s peer review pages at calcpa.org.

AICPA Peer Review Public File

Check any firm — including a reviewer’s own firm — for enrollment status and its last review date.

Reports and acceptance letters show for firms in PCPS, the EBPAQC or the GAQC, and for firms that made them public. Search by firm name, city or state.

Open the Public File

Questions to ask a reviewer

  • How many reviews of firms our size and in our industries have you done?
  • Are you qualified for our must-select engagements, or will you add a team member?
  • What was your own firm’s last peer review rating? (Check the Public File.)
  • Any relationship with our firm or clients that could impair independence?
  • How do you work — remote, on-site, timetable, the fee and what it covers?
  • Will you schedule it with enough time before our due date?

Ratings

How an issue climbs to a rating.

Not every “no” on a checklist reaches the report. The reviewer weighs the nature, cause, pattern and pervasiveness of what was found.

MatterA “no” answer on a peer review checklist, documented for further consideration.
FindingOne or more matters where the firm could fail to perform or report in conformity with the standards. Goes on an FFC.
DeficiencyFindings important enough to be reported. The report rating becomes pass with deficiencies.
Significant deficiencyDeficiencies so pervasive that there is no reasonable assurance of conformity. The rating is fail.
PassSystem review: the system of quality management is suitably designed and complied with. Engagement review: nothing came to the reviewer’s attention that the engagements were not performed and reported in conformity in all material respects.
Pass with deficienciesThe same conclusion, except for the deficiencies described in the report. A letter of response is required.
FailSignificant deficiencies: the system is not suitably designed or not complied with, or the engagements reviewed were not performed or reported in conformity. A letter of response is required, and state boards follow up.
What followsCorrective actions, an implementation plan for findings, possible follow-up reviews, and on a fail usually an accelerated next review. Repeated deficient reports draw board attention.

California

What the CBA requires.

  • Firms performing audit, review, other attest or compilation services must have a peer review from a CBA-recognized provider; CalCPA administers the AICPA program in California.
  • Firms whose highest level of service is preparation engagements under AR-C 70 are excepted from the California requirement.
  • A firm that completes its first accounting and auditing engagement must have a peer review accepted within 18 months of that date.
  • Results are reported on Form PR-1 with the license renewal, using the date the report was accepted, not the date it was performed. Every licensee files the form, even to say no review was required.
  • A substandard (fail) report must be sent to the CBA within 45 days of acceptance.

Rules change. Check 16 CCR Article 6 and the current PR-1 instructions before relying on these.

What reviewers find

The deficiencies that keep showing up.

AreaWhat goes wrong
Engagement lettersMissing, unsigned, or missing required language for the service and framework.
Risk assessmentGeneric risk assessments; no link between the assessed risks and the procedures; no understanding of controls.
IndependenceNonattest services without documented management skills, knowledge and experience, or self-review threats not evaluated.
ReportsWrong report form, missing paragraphs, legends or references to the framework; going concern not addressed.
DisclosuresRequired disclosures omitted, especially new standards (leases, credit losses, revenue) and related parties.
EstimatesAccepting management’s numbers without testing — see goodwill, intangibles and going concern.
Specialized engagementsSingle audit and benefit plan requirements missed; Yellow Book CPE short.
Quality managementSQMS No. 1 risk assessment not tailored to the firm; monitoring not performed; no annual evaluation.

Getting ready

A checklist for the months before.

Work through it as the review year closes. Progress stays in this browser; print it or export it for the firm’s file.

Sources

Where this comes from.

The standards and your administering entity control. This page summarizes them and is not a substitute for reading them.