In this article
- As at 20 October 2026, SQC 1 still applies. ICAI deferred SQM 1 and SQM 2 on 31 March 2026 "until further announcement".
- Organise the manual around the six SQC 1 elements, plus a section on files and records.
- Write what the firm actually does, with names and months. Ten to twenty true pages are enough for a small firm.
- The manual points to one-page SOPs, checklists and a written maker-checker-partner review rule.
- Inspect completed files on a cycle of no more than three years, at least one per engagement partner, and record what changed.
A quality control manual for CA firm offices is often a thick file bought at a seminar, signed once and never opened again. That kind of manual fails the first time a peer reviewer or a new partner reads it. This guide is for partners and senior staff of small and mid-sized firms. It shows what the standard asks for today, gives you a section-by-section outline, and explains how SOPs, reviews and file rules turn the manual from paper into the way your office really works.
The test for every line is simple: is it true, and can someone check it?
Which standard your quality control manual for CA firm follows
As at 20 October 2026, the standard is SQC 1, "Quality Control for Firms that Perform Audits and Reviews of Historical Financial Information, and Other Assurance and Related Services Engagements".
- ICAI issued SQM 1 (Quality Management) and SQM 2 (Engagement Quality Reviews) on 14 October 2024. They were to become mandatory from 1 April 2026.
- On 31 March 2026, ICAI deferred their mandatory date "until further announcement". SQC 1 continues to apply until then.
So build your manual on SQC 1 now, and keep an eye on icai.org for the switch. A manual that is short and organised by topic is easy to rework when SQM 1 does arrive.
Does it apply to your firm?
SQC 1 says it applies to all firms, and it is written for audits, reviews, other assurance and related services work. If your firm signs statutory audits, tax audits or certificates, it applies to that work. If your office only does accounting, return filing and compliance, SQC 1 is still a good model for running the office, though not a requirement for that work. SQC 1 also says the policies should match the firm's size and way of working. A three-partner firm does not need a big firm's manual.
The manual, section by section
SQC 1 says a firm's system should have policies and procedures for six elements, and that they should be documented and communicated to the firm's people. The peer review Form 1 asks its general-control questions in the same order. Use that order, and add one section on records.
| Section | What to write (short) | Evidence it is used |
|---|---|---|
| 1. Leadership | Who is the quality partner; that partners agreed the manual; that fees and deadlines do not override quality | Signed partner approval; yearly quality meeting minutes |
| 2. Ethics and independence | Who handles independence questions; how threats are checked; yearly written confirmations | Signed declarations each year |
| 3. Acceptance and continuance | Checks before taking or continuing a client: integrity, competence, time, independence; who approves | A signed one-page form in each file |
| 4. People | Hiring, assigning teams, training, evaluation | Appointment letters, training and CPE records |
| 5. Engagement performance | Planning, supervision, review, consultation, differences of opinion, which jobs get an engagement quality control review | File index, review sign-offs, consultation notes |
| 6. Monitoring | Yearly inspection: who, which files, how findings change the system | Inspection note and action list |
| 7. Files and records | File assembly, retention, access, changes after closing, backups | Closed files, access settings, backup log |
SQC 1 asks for a written confirmation of independence at least once a year from everyone who must be independent. That one sheet, signed every April, is often the first thing a reviewer asks to see.
From manual to SOPs
The manual says what the firm does to protect quality. SOPs say how each job is done. Keep the manual short by pointing to them: "Each recurring service follows its SOP and checklist, stored in Office SOPs."
A small office SOP is one page per service, with the same eight headings every time:
- Purpose: one line on what the job achieves.
- Trigger: what starts it.
- Inputs: what you need before you start.
- Steps: 8 to 15 numbered actions, each starting with a verb.
- Output: what exists when it is done.
- Who checks: the review rule.
- Where saved: folder and file names.
- Common mistakes: taken from review notes and the error log.
Running the Firm: Systems & Quality is 14 short lessons: a work register, allocation and handover, a year calendar, SOPs and checklists, maker-checker review, error logs, working papers, quality standards and going paperless.
Let the person who does the job most often write the first draft while doing it. A senior corrects it, the partner approves the "who checks" line, and a different person then does the job once from the SOP and marks where they got stuck. Start with your three most frequent services, by number of jobs, not by fee. A blank one-page SOP template and a filled example come with the Running the Firm course kit.
Review before work goes out: maker, checker, partner
The engagement performance section of your manual should state your review rule in plain words. A rule that works in small offices has three levels:
| Level | Who | What it means |
|---|---|---|
| Self-check | The person who prepared it | The maker's part of the checklist, before sending for review |
| Checker review | A senior who did not prepare it | The checker's part of the checklist and written review notes |
| Partner review | The partner | Only for items on the written partner list |
The partner list is short and written down: anything the CA signs, notice replies, large changes from last period, new clients, and anything the checker is unsure about. The checker is never the maker. Nothing goes out until the register says "Ready to file".
For engagements that need an engagement quality control review, Use a reviewer who meets SQC 1's competence, independence and eligibility requirements; where the firm has nobody suitable, a suitably qualified external person can do it. Small firms may contract an external reviewer, such as a partner of another firm. Write down which engagements get this review and who does it.
Files and records: the rules to write down
For audit work, the manual should point to SA 230 and SQC 1 rather than repeat them. In short:
- SA 230 says the final audit file should ordinarily be assembled within 60 days of the auditor's report date.
- After assembly, nothing is deleted before the end of the retention period. Any later addition records the reason, who made it and when.
- SQC 1 says audit documentation is ordinarily kept for no less than seven years from the date of the auditor's report.
For every service, a good closed folder holds five things: the client's source data, the working, review evidence, the client's approval, and the filed or signed copy. If a capable person who was not involved can open it and understand it in ten minutes, the file is good. The data safety side, such as access rights and backups, is covered in /learnings/dods/?utm_source=blog&utm_medium=article&utm_campaign=quality-control-manual-ca-firm.
Monitoring: the yearly inspection
Monitoring is the section most small firms skip. SQC 1 says completed engagements are inspected on a cycle that ordinarily spans no more than three years, covering at least one engagement of each engagement partner. Small firms and sole practitioners may use a suitably qualified external person or another firm for this.
Add the error log here too. Every mistake caught after work went out gets a line: what happened, why, and which SOP or checklist line changed. Over a year, the error log tells you where your system is weak.
A 30-day plan to write the manual
- Week 1: name the quality partner; list every service and mark which are assurance work; write section 1 with real names.
- Week 2: write sections 2 to 4; print the yearly independence declaration and the acceptance form.
- Week 3: write sections 5 to 7; write the partner list and the review rule; hand out three SOP drafts.
- Week 4: partners read, correct and sign; share with every staff member and keep a list of who received it; fix the date of the first yearly inspection.
Five rules for the manual itself: fit your size, write what you do, name people and months, put a version and date on it, and keep the old versions. If a policy starts today, write today's date. Never present a new policy as if it was followed all along.
If your firm will face peer review, the manual is the document the reviewer measures everything else against. Our guide on Peer Review for CA Firms: Applicability and Checklist explains who needs a certificate and when, and Peer Review Ready shows how a reviewer reads your manual against Form 1. For the wider office habits that make a manual stick, see 10 Things to Improve Your CA Office This Year.
A quality control manual for CA firm partners is worth writing only if it describes the real office. The register, calendar, SOPs, checklists and review notes that make it real are taught in Running the Firm: Systems & Quality. Begin with the free first lesson and draft section 1 tonight, with real names and real months.
Rules change: check the latest ICAI announcement before you act.
Questions people ask
Is a quality control manual mandatory for a CA firm?
SQC 1 says a firm's quality control policies and procedures should be documented and communicated to its personnel. It applies to firms performing audits, reviews and other assurance and related services. A written manual is the simplest way to show this, and the peer review Form 1 asks whether you have one.
Has SQM 1 replaced SQC 1?
Not yet. ICAI issued SQM 1 and SQM 2 on 14 October 2024 to apply from 1 April 2026, but on 31 March 2026 it deferred the mandatory date until further announcement. SQC 1 continues to apply. Check icai.org for any later announcement.
How long should a quality control manual be?
There is no set length. A small firm can cover the six SQC 1 elements in ten to twenty pages, as long as every line is true and names who does what and when. A long manual describing committees the firm does not have does more harm than good.
Who can do the engagement quality control review in a small firm?
Use a reviewer who meets SQC 1's competence, independence and eligibility requirements; where the firm has nobody suitable, SQC 1 allows a suitably qualified external person, such as a partner of another firm. Small firms and sole practitioners may contract an external person for this.
How long must audit working papers be kept?
SQC 1 says the retention period for audit engagement documentation is ordinarily no shorter than seven years from the date of the auditor's report, or the group auditor's report if later. SA 230 says the final audit file should ordinarily be assembled within 60 days of the report date.
Sources
- ICAI, SQC 1, paras 5, 6(d), 7, 8, 23, 72, 83, 90, 92
- ICAI, Issuance of SQM 1 and SQM 2 (14 October 2024)
- ICAI, Announcement on deferment of effective date of SQM 1 and SQM 2 (31 March 2026)
- ICAI, SA 230 Audit Documentation, paras 14 to 16 and A21
- ICAI, Code of Ethics, 13th edition (2026), Volume I: section 26 of the CA Act and Clause (12) at 2.14.1.12
- ICAI, Peer Review Form 1, Part B (general controls based on SQC 1)
Start with the free first lesson of Running the Firm: Systems & Quality. If peer review is coming, Peer Review Ready shows how a reviewer tests the manual. The Office plan puts both in front of your seniors too.
