How should a firm review and sign off a client's books before they go out — the second-pair-of-eyes step over a preparer's work?

What is the reviewer accountable for that the preparer is not?

The preparer owns the work: entries, reconciliations, support and the first call on each judgment. The reviewer owns one question: can this work, and the conclusions in it, be released? The AICPA's Statement on Quality Management Standards (SQMS) No. 2 frames its engagement quality review the same way, as an objective evaluation of the significant judgments made by the engagement team and the conclusions reached. SQMS No. 2 adds that the review does not change the engagement partner's responsibilities, and that the reviewer is not required to obtain evidence to support the conclusion on the engagement.

Two limits follow. The reviewer does not re-perform the work: a second preparation pass doubles the cost and repeats the preparer's blind spots instead of testing them. Nor does the reviewer make the fixes. SQMS No. 2 warns against a reviewer who is, or may be perceived to be, making decisions on behalf of the engagement team, so every finding goes back to the preparer as a review point.

SQMS No. 1 applies to a firm's accounting and auditing practice: audit, attestation, review, compilation and other services for which the AICPA's Auditing Standards Board or Accounting and Review Services Committee has promulgated standards. The latter issues the Statements on Standards for Accounting and Review Services (SSARS, codified as AR-C sections), including AR-C 70 on preparing financial statements. AR-C 70 calls merely assisting in preparing financial statements a bookkeeping service not subject to that section; for general bookkeeping files, adopt these standards as a model. If a client engages your CPA firm to prepare its financial statements, AR-C 70 applies; see the path table below.

How do you set review depth for a client, period and preparer?

SQMS No. 2 scales review to the file: where the team made fewer significant judgments, the reviewer's procedures would likely be less extensive. The depth factors in SQMS No. 2 include the complexity of the engagement, the nature and size of the entity, and concerns raised about the quality of the engagement team's work. SQMS No. 1 adds, as examples of conditions that may lead a firm to require an engagement quality review, engagements on which issues have been encountered and entities in emerging industries or for which the firm has no previous experience.

Turn those factors into a written depth rule:

Record the depth chosen, and why, before review starts, so the sign-off can be read against it.

What does the reviewer examine?

The reviewer works through five classes of evidence and judgment:

• Control balances. Bank, card, loan, payroll and tax-agency balances agree to statements or notices from outside the business.
• Unusual or unsupported items. Large, round, manual, late or suspense entries have a document or an explanation.
• Treatment decisions. Each judgment, such as expensing or capitalizing and which period an item belongs to, has a stated basis that supports the conclusion.
• Movement against prior periods. Balances and margins that moved against last month or last year have an explanation that fits the client.
• Completeness of supporting work. Reconciliations, schedules and client queries are finished, not parked.

SQMS No. 1 says a review of work may include considering whether significant matters have been raised for further consideration and whether the work performed supports the conclusions reached and is appropriately documented. SQMS No. 2 has the reviewer evaluate the basis for making significant judgments, and notes that a self-review threat may be created when the reviewer was previously involved with them. Each class tests a conclusion already reached, which its author is worst placed to test. Line-item checklists for bookkeeping, the general ledger, prepared statements and bank reconciliations are separate questions.

How are review points raised, cleared and held back from release?

Run every point through the same steps:

1. The reviewer logs the point in the client file, one issue per point, stating what raised it and what would clear it.
2. The preparer, as owner, corrects the entry or supplies the support and records what they did.
3. The reviewer checks the response against the clearance requirement and either marks the point cleared, with evidence attached, or reopens it.
4. A disagreement goes to a named senior person, who decides and records the conclusion. If the senior person decides against the reviewer, the log records the reviewer's concern, the decision, who made it and why, and that person signs the release for that point. An engagement quality review allows no such override.
5. Name who releases each client's output. That person plays the engagement partner's part in the SQMS No. 2 control, and it is not the preparer acting alone. They release only against the reviewer's recorded sign-off showing no open points. In a one-person practice, release only after the self-review sign-off is recorded.

SQMS No. 2 requires policies under which the engagement partner is precluded from releasing the report until the reviewer gives notice that the review is complete, and completion includes resolving matters the reviewer raised. Under SQMS No. 2 the reviewer takes concerns to the engagement partner first and, if they are not resolved to the reviewer's satisfaction, tells the appropriate individuals in the firm that the review cannot be completed. Releasing with points open "to fix later" lets the client act on figures the firm has not accepted, and the fix then lands in a period that has already gone out.

What does a review-point record look like?

Each record carries six fields, shown with an invented example:

Intuit's help page "Review clients' books in QuickBooks Online Accountant" (updated 8/7/2026) says that you can create your own tasks under each tab, and that the Wrap-up tab lets you prepare reports, send the reports package and close the books. The page places Books review in Intuit Accountant Suite, where the client list's Books review column shows which tasks are finished or open. If you use it, log each open point as a task and use Wrap-up only when that column shows none open.

What does sign-off assert, and who may give it?

Put in writing who may sign off which clients. SQMS No. 2 requires the firm's eligibility criteria to include four conditions:

• The reviewer is not a member of the engagement team.
• The reviewer has the competence and capabilities, including sufficient time, and the appropriate authority to perform the review.
• The reviewer complies with relevant ethical requirements, including those addressing threats to objectivity and independence.
• The reviewer complies with any law or regulation relevant to eligibility.

A self-review cannot meet the first condition. For an internal check on bookkeeping output, the firm may allow it as a recorded exception under the self-review controls below. Where firm policy requires an engagement quality review, self-review is not available; SQMS No. 2 lets a smaller firm or sole practitioner with no eligible reviewer use an outside one.

Internal sign-off asserts that the named reviewer examined the file at the recorded depth, evaluated the preparer's significant judgments and saw every point cleared, or recorded who decided any escalated point and why, so the file may be released. It does not assert that every transaction was checked, or that the whole file complies with firm policy. SQMS No. 2 describes even an engagement quality review as an evaluation of the significant judgments and the conclusions reached, not of whether the entire engagement complies with professional standards or the firm's policies or procedures. Sign-off asserts nothing to the client. A signature with no stated scope leaves nobody able to say later what was examined.

Which words must an internal review never borrow?

Review, compilation and audit are engagements defined by professional standards. SSARS define limited assurance, the basis for the conclusion in an accountant's review report, as a level of assurance less than the reasonable assurance obtained in an audit, and state that a compilation is not an assurance engagement. The AR-C foreword says the AICPA Code's Compliance With Standards Rule requires a member who performs compilation, review or other SSARS services to comply with SSARS.

The Uniform Accountancy Act (UAA), the model bill the AICPA and NASBA publish, lets only licensees and individuals with practice privileges issue a report on financial statements, or offer to render or render any attest or compilation service as the Act defines them. The UAA's exceptions include non-licensees preparing tax returns, giving management advisory services or preparing financial statements without issuing reports on them. The UAA also bars non-licensees from using language conventionally used by licensees in reports on financial statements or attest services, and has the state board issue safe harbor language non-licensees may use. The UAA preface notes that every American jurisdiction has an accountancy law; your state's law and board rules set your exact limits.

Nothing the client or a third party sees should say the books were reviewed, compiled or audited, or carry a signed statement that reads like a report. Settle which path you are on before choosing any wording:

In what order do review, release and period lock happen?

Keep this order:

1. The preparer finishes and records a completion check.
2. The reviewer records the depth, reviews and raises points.
3. Every point is cleared, or decided through escalation.
4. The reviewer signs off.
5. The period is locked in the software.
6. The output is released to the client.

Locking before step 3 forces corrections into a later period and leaves the review trail describing figures that no longer match the period reported. Locking at sign-off, before release, means the client receives exactly what was signed off. If something is found after release, reopen the lock only through the route in the next section. SQMS No. 2 lets a review's documentation be finalized after the report is released but before the final engagement file is assembled, provided the review was complete. The write-up may trail release up to a deadline the firm sets; the clearing of points may not. How to set the lock in your software is a separate question.

What if something turns up after the client has the work?

The route depends on when it is found:

Keep the original sign-off and add the correction beside it: SQMS No. 1 notes that the integrity of engagement documentation may be compromised if it is altered, supplemented or deleted without authorization.

What must the review leave on file?

SQMS No. 2 requires engagement quality review documentation sufficient to enable an experienced practitioner, having no previous connection with the engagement, to understand the procedures performed and the conclusions reached. SQMS No. 2 requires it to include the names of the reviewer and anyone who assisted, an identification of the documentation reviewed, the basis for the reviewer's determination, the required notifications, and the date the review was completed. For the internal gate, keep these records:

• The depth decision and its reasons
• What was examined, by class and by file
• The review-point log, each point with its clearance evidence
• Any escalation decision, with who made it and why
• The sign-off, naming the reviewer, the date, the depth and whether it was a self-review
• Any post-release correction, filed beside the original

Sort cleared points by cause each quarter and turn repeats into preparer instructions or standard work.

How do you run the gate with no second person?

Without a second person, use a disciplined self-review, an outside reviewer, or both; an engagement quality review needs the outside reviewer.

What makes self-review hold up?

SQMS No. 1 does not preclude an individual from monitoring their own compliance, but says such self-inspections may be less effective than compliance inspections by another qualified individual. The safeguards SQMS No. 1 lists against the self-review threat include requiring inspection checklists and requiring the passage of time after an engagement is completed before self-inspection. Those passages concern monitoring after the fact; at the release gate, review from a written list of the five classes, on a later day than you finished preparing, logging points as a reviewer would. Record on the sign-off that it was a self-review, so anyone reading the file later knows no second person looked.

When should an outside reviewer be used?

SQMS No. 2 notes that a smaller firm or sole practitioner may contract with, or obtain the services of, individuals external to the firm to perform the review, and SQMS No. 1 says a firm using a service provider remains responsible for its system of quality management. SQMS No. 1 also lists using an external provider when self-inspection proves ineffective or conditions change, for example by taking on clients in an industry not previously serviced. Send your deepest-review files out, with confidentiality and turnaround in the contract.

What changes when a lender or buyer will rely on the output, or the preparer is new or offshore?

Before sign-off, find out who will receive the output and for what. If a lender, insurer or buyer requires a compilation, review or audit, that is a standards-defined engagement that the UAA model reserves to licensees, who alone may offer or perform it, and an internal check cannot stand in for it. If they will accept bookkeeping output, apply the deepest review and consider an outside reviewer. The same wording limits apply to what they see; a report on the statements, rather than a non-attest transmittal, is licensee work.

For a new, offshore or first-time preparer, raise depth until their points fall away. SQMS No. 1 expects less experienced members' work to be directed, supervised and reviewed by suitably experienced members, and says that where a firm uses a service delivery center in the firm or in another network firm, its policies may specifically address the direction and supervision of those individuals and review of their work. An offshore provider outside the firm and its network is a service provider under SQMS No. 1; the firm stays responsible for its system of quality management, so set the task split and review expectations in the contract. Require a written basis for each judgment, review every judgment and all five classes in full rather than at summary level, and set which tasks the offshore team may do.