Audit organizations performing engagements under Government Auditing Standards have new guidance to help them navigate the quality management requirements introduced in the 2024 Yellow Book.
Since releasing the updated Yellow Book in February 2024, the Government Accountability Office (GAO) has received numerous questions about how audit organizations should establish, maintain, and evaluate their systems of quality management. In response, the GAO published Frequently Asked Questions: Establishing and Maintaining a System of Quality Management.
The FAQ focuses on three important areas: the quality management risk assessment process, monitoring and remediation, and engagement quality reviews. For organizations conducting Yellow Book engagements, the guidance provides useful clarification as they continue implementing and maintaining their quality management systems.
Understanding the Quality Management Risk Assessment Process
One of the GAO’s key messages is that quality management is not a one-time exercise.
The risk assessment process is intended to be iterative and should be reviewed at least annually. Audit organizations should also revisit the process when deficiencies are identified or when changes occur in the organization, its engagements, or the environment in which it operates.
Under the 2024 Yellow Book, the quality management risk assessment process includes three core steps:
- Establish quality objectives.
- Identify and assess quality risks.
- Design and implement responses to those quality risks.
The GAO FAQ addresses eleven questions related to this process, including the six quality management components established by the 2024 Yellow Book and the effects of changes introduced in the updated standards.
Quality Management Should Be Tailored to the Organization
An important theme throughout the guidance is that quality management systems should reflect the actual circumstances of the audit organization.
Rather than simply copying policies, templates, or risk assessments from another organization, auditors should evaluate their own engagement types, staffing, resources, risks, and organizational characteristics.
Templates can provide a useful starting point, but the resulting quality management system should be tailored to the organization’s specific risks and operating environment.
Organizations Subject to Both GAO and AICPA Standards
Some audit organizations are subject to both the Yellow Book and the AICPA Statements on Quality Management Standards.
The GAO FAQ indicates that these organizations may be able to establish one system of quality management instead of maintaining two separate systems, provided the system also addresses the additional requirements imposed by the Yellow Book.
This approach may help reduce duplication while still meeting all applicable professional standards.
Monitoring and Remediation Remain Critical
Designing and implementing a quality management system is only the beginning. Audit organizations must also determine whether the system continues to function as intended.
The monitoring and remediation process is designed to provide reasonable assurance to audit organization leadership that:
- Quality management policies and procedures are appropriately designed and operating effectively.
- Auditors are fulfilling their responsibilities under professional standards and applicable laws and regulations.
- Engagements are being performed and reported in accordance with relevant standards and requirements.
The GAO FAQ includes seven questions addressing monitoring and remediation.
Among the topics discussed are additional requirements introduced by the 2024 Yellow Book and the relationship between monitoring activities and the organization’s quality risk assessment process.
How Risk Assessment and Monitoring Work Together
Risk assessment and monitoring should not operate independently.
Information identified through monitoring can reveal deficiencies or new risks that require the organization to reconsider its quality objectives, quality risks, or responses.
For example, if monitoring identifies a recurring engagement documentation issue, the organization may need to determine why the problem is occurring and whether existing policies, training, supervision, or review procedures adequately address the risk.
This ongoing feedback process helps keep the quality management system relevant as the organization changes.
Engagement Quality Reviews Under the Yellow Book
The GAO FAQ also addresses engagement quality reviews, commonly referred to as EQRs.
An engagement quality review is an objective evaluation of significant judgments made by the engagement team and the conclusions reached. The review must be performed by an individual who is not a member of the engagement team and must be completed before the audit report is released.
The Yellow Book does not require an EQR for every engagement.
Instead, the audit organization must evaluate whether performing an EQR is an appropriate response to one or more identified quality risks.
This makes the EQR decision part of the broader quality management risk assessment process rather than an automatic requirement for every Yellow Book engagement.
Important Quality Management Deadlines
Audit organizations subject to the Yellow Book were required to have their systems of quality management designed and implemented by December 15, 2025.
However, implementation is not the final step.
The system must continue to be maintained, monitored, and updated as necessary. In addition, the initial evaluation of the system of quality management must be completed by December 15, 2026.
That evaluation must be performed by the senior-level official assigned ultimate responsibility and accountability for the system of quality management.
With that deadline approaching, organizations should ensure they have processes in place to evaluate whether their system is functioning effectively and whether identified deficiencies have been appropriately addressed.
Practical Steps for Audit Organizations
Audit organizations conducting Yellow Book engagements should consider using the GAO FAQ as part of their ongoing quality management process.
Key areas to review include:
- Whether quality objectives and risks remain appropriate.
- Whether responses are tailored to the organization’s actual circumstances.
- Whether monitoring procedures are identifying deficiencies effectively.
- Whether identified deficiencies are being remediated in a timely manner.
- Whether an engagement quality review is appropriate for certain engagements.
- Whether the organization is prepared for the required December 15, 2026 system evaluation.
- Whether organizations subject to both GAO and AICPA standards can appropriately integrate their requirements into one quality management system.
Final Thoughts
The GAO’s new FAQ reinforces an important principle of the 2024 Yellow Book: an effective system of quality management must evolve with the audit organization.
Designing the system was only the first step. Risk assessment, monitoring, remediation, and periodic evaluation are ongoing responsibilities that help ensure policies and procedures continue to support quality engagements.
Audit organizations performing Yellow Book engagements should review the GAO guidance carefully, assess whether their existing systems remain responsive to current risks, and prepare for the December 15, 2026 evaluation requirement.
A thoughtful, tailored approach to quality management can help organizations strengthen audit quality, identify problems earlier, and maintain compliance with Government Auditing Standards.
