If you've downloaded the AICPA SQMS Risk Assessment template, you've already taken an important first step.
The template provides a solid starting point for documenting your firm's quality objectives, identifying quality risks, and referencing suggested responses. However, it's important to understand what the template is - and what it isn't.
Many firms expect the template to guide them through the entire risk assessment process. In reality, it serves as a framework. The work of tailoring the documentation to your firm still remains.
The template is organized around your firm's quality management components.
Within each component, it includes:
One important thing to note is that the template does not include the actual policies and procedures. It only references them.
To locate the recommended responses, you'll need to pull them from the AICPA Quality Management Practice Aid Supplement: Library of Potential Quality Objectives, Potential Risks, and Potential Responses.
Once you've reviewed the template, the real work begins.
Not every suggested risk will apply equally to every firm.
As you work through the template, consider:
This becomes the foundation of your firm's documented risk assessment.
Each risk references suggested responses found in the AICPA Practice Aid Library.
Those responses need to be:
Over time, this becomes one of the more time-consuming parts of the documentation process because you're constantly moving between multiple documents.
One mistake I frequently see is treating policies and procedures as the finish line.
They're only one part of the system.
During 2026, SQMS No. 1 requires your firm to demonstrate those policies are actually being performed and your system is being “monitored”.
As you're documenting each policy or procedure, ask yourself:
Thinking through monitoring now will save significant time later.
Many firms (and peer reviewers) ultimately use the PPC Quality Management policies and procedures as a result of their risk assessment process.
If that's your plan, remember that the AICPA template and the PPC policies and procedures do not align one-for-one.
That means you'll likely spend additional time:
Plan for this early to eliminate a significant amount of duplicate work.
After working through this process with several firms, I realized that most time was not being spent evaluating risk.
It was being spent:
To eliminate much of that administrative work, I developed a Risk Assessment Matrix that builds on the AICPA framework.
Unlike the original template, the matrix uses formula-based linking throughout, tracing objectives, risks, policies, and monitoring activities as you document your firm's system of quality management.
| Feature | AICPA Template | Risk Assessment Matrix |
|---|---|---|
| Quality Objectives | ✓ | ✓ |
| Example Risks | ✓ | ✓ (reconciled with PPC where applicable) |
| Response References | ✓ | ✓ |
| Pre-Formatted Policies & Procedures | – | ✓ |
| Reconciliation with PPC Documentation | – | ✓ |
| Formula-Based Cross Referencing | – | ✓ |
| Suggested Monitoring Activities | – | ✓ |
| Suggested Evidence for Monitoring | – | ✓ |
| Distribution-Ready Documentation | – | ✓ |
The risk assessment is one of the foundational elements of SQMS No. 1, but it's only one component of a complete system of quality management.
While documenting quality objectives, risks, and responses is a significant milestone, firms also need to implement those responses, monitor whether they're operating effectively, perform annual evaluations, and continually update the system as the firm evolves.
For most firms, the challenge isn't completing the risk assessment itself. It's bringing all of those pieces together into a practical, maintainable system.
The AICPA Risk Assessment template is an excellent starting point, but it's only one piece of the documentation process.
Completing a meaningful risk assessment requires tailoring objectives and risks to your firm, documenting policies and procedures that reflect how your firm actually operates, and thinking ahead to how those procedures will eventually be monitored.
The earlier those pieces are considered together, the smoother implementation becomes.
If you're looking to reduce the administrative work involved in building and reconciling the documentation, I developed a Risk Assessment Matrix specifically to streamline that process while preserving the flexibility to tailor everything to your firm's unique system of quality management. It's available as part of the SQMS Toolkit, or I can provide it individually if this is the step of the implementation you are stuck on. Book a consultation with me and let's chat!
Learn more about SQMS No. 1 SupportIf you're building your firm's entire system of quality management, the risk assessment is only the beginning.
The full SQMS Toolkit expands beyond the risk matrix to include implementation guidance, policy and procedure documentation, monitoring resources, suggested evidence, annual evaluation tools, and other materials designed to help firms build and maintain their complete system of quality management.
Learn more about SQMS No. 1 SupportBook a short call if you're deciding how to approach your firm's documentation, or want to see the Risk Assessment Matrix and the rest of the SQMS Toolkit.