SQMS No. 1 Monitoring: Checklists vs Software vs AI Agents

By Jude Lee · · Comparison

Two accountants reviewing an engagement quality checklist on a monitor in a CPA firm conference room

The part of quality management that turns into an operations problem

Per the AICPA, Statement on Quality Management Standards No. 1 (A Firm’s System of Quality Management) replaces the old quality-control framework with a risk-based one: you set quality objectives, identify quality risks, design responses, and then monitor and remediate. Firms that audit issuers have a parallel regime in the PCAOB’s QC 1000, and state boards of accountancy may add their own overlay.

Writing the policy manual is a one-time project. Monitoring is a recurring operational burden, and it looks nothing like tax prep:

Every one of those is a data-retrieval and cross-referencing job across practice management, your document management system, HR records, and time entry. That is exactly the shape of work AI agents handle well — and exactly the shape of work that partners currently do at 9pm in November.

8
Components of a QM system described in SQMS No. 1
AICPA
Dec 15, 2025
Date by which SQMS No. 1 systems were to be designed and implemented
AICPA

What “automation” means here, honestly

Automation in accounting spans three different things, and conflating them is why firms buy the wrong tool. Rule-based automation moves data and fires reminders when a condition is met — reliable, cheap, dumb. Off-the-shelf AI features are models embedded in software you already pay for, operating only on data inside that vendor’s walls. AI agents are models given tools and permission to carry out a multi-step task: look something up, compare it to a standard, open the next document, assemble a result, and stop for a human.

For QM monitoring, the deciding question is whether the evidence you need lives in one system. If it does, the vendor’s own reporting will beat anything you build. If it’s scattered across four systems plus a shared drive — the normal case — the agentic approach starts to earn its keep. We’ve laid out the general decision framework in rules vs AI agents vs neither.

Two builds, and the option you may already own

Checklists, Excel, and AICPA practice aids

Works when: one person can genuinely hold the full engagement inventory in their head. As a rule of thumb drawn from firm structure rather than any study, that usually means a narrow engagement mix and a monitoring sample small enough to work through in a sitting. The AICPA publishes quality management practice aids and implementation resources; for many small firms, those plus a disciplined annual sample are a complete, defensible answer.

Breaks when: the sample grows, staff turn over, or the evidence lives in five places. Manual monitoring tends to validate the engagements someone remembered, not the ones that are risky.

Cost: mostly partner and manager hours during the worst weeks of the year.

An AI agent over your own firm systems

Works when: evidence is scattered, you want continuous rather than annual monitoring, and you’re willing to invest in setup and governance.

Breaks when: your source data is inconsistent (engagement names that don’t match between systems, EQR evidence stored as a scanned signature page in a folder nobody standardized). Garbage retrieval produces confident garbage conclusions.

Cost: build and maintenance, plus the review time you still owe — because a human still signs.

The third option is the one you may already be paying for: QM and monitoring modules inside practice-management suites and peer-review-prep tools. If your practice management system already holds acceptance forms, independence confirmations, and engagement milestones, turning on its reporting is faster, cheaper, and more auditable than any custom build. Check what you own before you shop.

How the agentic version actually gets built

The mechanism is less exotic than it sounds. You expose your systems to an AI assistant through MCP — the Model Context Protocol, an open standard for giving an assistant governed, scoped access to data and tools. Vendors increasingly ship MCP servers; where none exists, you build a small custom one over your practice-management API and document store. The practical trade-offs are covered in practice-management APIs vs MCP servers.

Then you write a skill — a packaged, versioned instruction set that teaches the assistant to run your monitoring procedure the same way every time. Not “check the engagement,” but: pull the engagement record; confirm acceptance date precedes the first time entry; confirm an independence confirmation exists for every person with time charged; confirm EQR documentation is dated before report release; flag any missing or out-of-sequence item with the file path as citation.

That read-only boundary isn’t squeamishness; it’s the whole design principle. A quality management system that lives only in a partner’s memory isn’t a system, it’s a hope — but a system that lets software close its own findings isn’t a system either.

In quality management, the agent’s job is evidence. The judgment, the severity call, and the signature stay with a human who can defend them in peer review.

A worked example you can price yourself

Say your annual monitoring covers 40 engagements, and assembling the evidence for each takes a manager 45 minutes of hunting before any evaluation happens. That’s 30 hours of pure retrieval. Multiply by your blended manager cost — use your real number, not a vendor’s — and that’s the cost of the retrieval layer alone.

An agent doesn’t eliminate that cost; it shifts it. Assume retrieval drops substantially but review doesn’t disappear, then add build and maintenance. The honest output is a formula, not a headline: (hours saved on retrieval × blended rate) − (build + annual maintenance) = net, plus whatever you believe a clean peer review and fewer late EQRs are worth. If the retrieval number is small because you’re a six-person firm, the arithmetic will tell you to keep the spreadsheet. Let it.

Agents displace retrieval, not judgment

Firms that market this as the end of the reviewer are overselling. SQMS No. 1 is built on professional judgment: setting quality objectives for your firm, assessing your risks, deciding whether a deficiency is severe and pervasive. None of that is retrieval. What agents displace is the clerical layer underneath — finding, matching, and cross-referencing — which is also the layer that currently eats the time of people qualified to exercise judgment.

The realistic risk to a CPA’s role isn’t replacement; it’s that firms automate the sign-off instead of the search. That’s why monitoring belongs behind explicit review gates rather than autopilot.

What large firms do, and why copying them is a trap

The largest firms run internal quality platforms stitched into their audit and engagement-management software, with dedicated quality teams and in-house engineering. The capability you can borrow is the pattern — continuous monitoring, standardized evidence, exception dashboards — not the stack. A ten-person firm replicating a Big Four QM platform will spend more on the system than the risk it mitigates.

  1. Confirm the requirement before the tooling

    Read SQMS No. 1 against your actual engagement mix, using AICPA implementation resources. Many firms discover their monitoring obligation is narrower than they feared.

  2. Inventory where evidence already lives

    List each monitoring item and the system of record. If most of it sits in one platform, the answer is probably that platform’s reporting module.

  3. Standardize naming and storage first

    Agents fail on inconsistent file naming far more often than on reasoning. Fix this regardless of what you buy — it pays off across every workflow you later automate.

  4. Pilot on five engagements, read-only

    Run the agent and a manager over the same five files. Compare findings. Count false positives and missed items — that’s your accuracy baseline, not a vendor’s.

  5. Decide with your own numbers

    Hours saved on retrieval versus build and maintenance. If it’s close, don’t build.

Not sure where to start?

Get a free automation audit: we map your bookkeeping, month-end close, client onboarding, document collection, and AP/AR — and show you what's worth automating before you spend a dollar.

Get a free automation audit

Related guides