A firm risk assessment under SQMS No. 1 requires three connected pieces (paragraphs 24–27):
The framework is straightforward, but documenting it in a way that meets the requirements and is practical to maintain takes some thought. Below, I break down what the guidance actually requires, along with practical considerations for building your own matrix.
Using the AICPA’s risk assessment matrix? See my previous article for guidance specific to that template.
SQMS No. 1 prescribes quality objectives for each component (paragraphs 29–34). Paragraph A44 notes that firms are unlikely to need additional objectives.
For most firms, this step is straightforward: start with the prescribed objectives and evaluate their relevance to your firm’s circumstances.
The Excel-based risk matrix includes all prescribed quality objectives, with:
The result: A clear, traceable risk assessment that helps your firm demonstrate coverage of applicable quality objectives without building the connections from scratch.
SQMS No. 1 requires firms to identify and assess risks that could prevent achievement of their quality objectives (paragraph 26). This means considering the firm’s size, structure, leadership, resources, engagements, and other relevant circumstances.
Not every possible risk needs to be documented. A quality risk is one that has a reasonable possibility of occurring and adversely affecting achievement of one or more quality objectives.
The AICPA Quality Management Practice Aid and PPC materials provide extensive libraries of suggested risks. The challenge is determining which actually apply to your firm, rather than copying every example into your assessment.
I recommend reviewing risks with firm leadership to identify vulnerabilities, evaluate the suggested risks, and add any firm-specific risks.
Do risks have to be scored? No. SQMS No. 1 permits formal ratings or scores but does not require them (paragraph A50).
I’ve already done much of the groundwork. The matrix consolidates and organizes suggested quality risks, with pre-drafted language tailored to three firm structures:
Each version includes:
The result: Your firm can focus on evaluating its actual risks rather than spending hours building and organizing a risk library.
SQMS No. 1 requires firms to design and implement policies and procedures that address their assessed quality risks (paragraph 27). The responses should be based on, and responsive to, the reasons for those risk assessments.
Paragraph 59 also requires firms to document their responses and explain how they address the identified quality risks.
Many firms already have policies and procedures in place, whether developed internally or adapted from PPC or AICPA materials. The question is whether those responses appropriately address the firm’s actual risks.
If a policy or procedure doesn’t link to an identified risk, consider whether it’s separately required by the standard, addresses a risk you’ve overlooked, or simply reflects unnecessary legacy language.
The goal isn’t the longest policy manual. It’s a system of policies and procedures that addresses the risks your firm actually faces.
The matrix includes a dedicated responses tab, with:
The result: A clear connection between your firm’s quality risks and the policies designed to address them, without building the documentation from scratch.
Your risk assessment also lays the groundwork for monitoring. SQMS No. 1 requires firms to consider their risk assessments and responses when designing monitoring activities (paragraph 38).
The CCC Risk Matrix includes suggested monitoring references and supporting evidence for each policy and procedure. The full SQMS Toolkit builds on those references with corresponding monitoring templates and checklists.
A partner or peer reviewer should be able to follow the logic from beginning to end:
SQMS No. 1 allows firms to scale their risk assessment process and documentation to their size and complexity (paragraph A40).
Regardless of the format, the documentation should clearly connect the firm’s quality objectives, assessed risks, and responses.
The CCC Risk Assessment Matrix is designed to save firms the time of compiling, drafting, and organizing their risk assessments from scratch.
With pre-drafted risks and responses, built-in links between objectives, risks, and policies, and suggested monitoring references, your firm can focus on evaluating and tailoring the documentation rather than building the framework.
Explore the CCC Risk Assessment MatrixBook a complimentary 30-minute call if you're deciding how to approach your firm's documentation, or want to see the Risk Assessment Matrix and the rest of the SQMS Toolkit.
Prefer email? caroline@carolinecast.cpa
This article is intended for general educational purposes and reflects practical experience applying SQMS No. 1. It is not authoritative AICPA guidance or a substitute for reviewing the applicable professional standards and considering your firm's specific facts and circumstances.